########## ########## ########## | COMPUTER SPIES
########## ########## ########## | by Mitchell Kapor
#### #### #### |
######## ######## ######## |BUILDING BLOCKS AS STUMBLING BLOCKS
######## ######## ######## | A Commentary on the 15th NCSC
#### #### #### | by Rebecca Mercuri
########## #### #### |
########## #### #### | THIS OLD DOS
=====================================================================
EFFector Online November 9, 1992 Issue 3.09
A Publication of the Electronic Frontier Foundation
ISSN 1062-9424
=====================================================================
Computer Spies
by Mitchell Kapor
Can a company lawfully eavesdrop on its employees' telephone calls? Not
if they have an expectation of privacy. But, at least in most states,
the employer can monitor conversations if it tells the workers that that
is what it is going to do.
That old legal issue surfaces in a new technological context in Silicon
Valley, with disturbing consequences for your ability to defend key
information assets. Take a look at how Borland International, a company
that should know better after almost a decade on the leading edge of
technology, may have hurt itself in a case involving an apparent theft of
trade secrets.
The allegations in the tangled legal affair are by now well known. On
Sept. 1 Eugene Wang, a vice president of Borland's computer languages
division, abruptly jumped ship to join competitor Symantec Corp. A
pattern of suspicious behavior in Wang's final days suggested that
perhaps he had traded Borland secrets along with his job. Borland had no
proof, but it knew where to look. Borland executives opened Wang's MCI
Mail account, where they found, they said, a number of messages that
they believe prove Wang delivered Borland product plans, memos and other
sensitive documents to Symantec. The evidence thus uncovered led to
police searches of Wang's and Symantec Chief Executive Gordon Eubanks'
homes and Symantec offices, to a pending criminal investigation of Wang
and Eubanks and to a civil suit by Borland against Symantec.
What has been scarcely addressed in newspaper coverage of these events
is what this case means to the rapidly growing business of electronic
mail.
Let's back up and consider the law that protects electronic mail users,
the federal Electronic Communications Privacy Act of 1986. The privacy
act protects messages while in transmission on a public mail service
such as MCI, as well as after messages are received and stored on that
service.
Borland and its attorneys, in a hurry to prove their suspicions about
Wang, justified their intrusion into the mailbox as a property right:
Borland was paying the bills for Wang's MCI account. "E-mail is like an
in-box on someone's desk,' says Borland spokesman Steven Grady in
defense of the search. "When they leave, it reverts to the corporation."
Case closed? Not quite. Borland's metaphors fall apart when tested
against the realities of electronic mail. Unlike in-boxes on an
abandoned desk, E-mail requires a password, and it can be administered
by a wholly separate communications company, like MCI. As it stands, in
a criminal case Wang could challenge the legality of all the evidence
collected on the basis of the messages found in his MCI account. He may
also have grounds for a countersuit under the electronic privacy act and
California law, which goes further in protecting individual privacy.
It's easy to understand the anger Borland executives felt in discovering
an apparent information hemorrhage. But the methods employed by Borland,
which likes to flaunt its "barbarian" ways, may have been a little too
barbarian by the standards of the federal statute. The one thing for
sure is that all parties will be involved in a lengthy and expensive
court battle to sort this out. The final result may be a draw between
Borland and Symantec, and a new definition of privacy for the rest of
corporate America.
Borland could have strengthened its case against Wang if it had followed
the recommendation of the Electronic Mail Association to announce its
policies on electronic mail. As it was, a source says the Santa Cruz
County District Attorney staff took potential violations of the
electronic privacy act so seriously that they used a top computer-crime
prosecutor from the San Francisco area to help write the search
warrants.
Despite Borland's hard-learned lessons, it continues to refuse to
implement a formal E-mail privacy policy that declares just when
electronic messages sent from company equipment are company property.
Perhaps Borland is afraid that announcing such a policy would simply
remind miscreants to erase incriminating E-mail files before they are
found. If so, that's naive and shortsighted.
Some companies may be reluctant to announce in advance that they are
constantly snooping. So be it, but then they should refrain from
scanning MCI in-boxes. Whatever they do, they have to confront the
reality of the enormous power of digital media. In an age when a
company's most valuable property may be intangible the source code for
a software package, for example an E-mail account may amount to an
unlocked door on a warehouse.
The electronic privacy act's procedures may need streamlining, and the
Borland case may be the ratchet that makes the adjustments. By the time
Borland could have obtained court authorization to examine Wang's
electronic mail, some of the messages might have been deleted by MCI's
automated five-day cleanup function. New legislation requires fine-
tuning in the light of the complexities of real world situations in
order to be effective for the purposes for which it was originally
designed. But the lesson here is that corporations must begin to adjust
their own policies to fit the technologies they use.
from Forbes Magazine November 9 1992
Mitch Ratcliffe, editor-at-large for MacWEEK, provided research assistance
for this column.
-==--==--==-<>-==--==--==-
BUILDING BLOCKS TO SYSTEM SECURITY
By Rebecca Mercuri
(mercuri@gradient.cis.upenn.edu)
A Report from the 15th National Computer Security Conference
October 13 -16, Baltimore, Maryland.
I attended the 15th National Computer Security Conference with the hope
of coming away with some solutions for the security problems I had
encountered over the past few years. I left with a longer list of
problems, and the vague feeling that our industry has become remiss in
providing us with answers that we can use, or has answers and is either
incapable or unwilling to yield them publicly.
Let me state clearly here that this comment does not reflect negatively
on the conference organizers. They performed their task well, creating a
superbly orchestrated event that covered a broad spectrum of
topics. Indeed, "rookies" were liberally mixed on panels with esteemed
"greybeards" and many women (sans beards) were in evidence as session
chairs and presenters (although I was somewhat dismayed to note that
females appeared to constitute less than 10% of the attendees, lower
than in the computing community in general). The breadth and extent of
the conference does not allow one reporter to describe it fully, so I
offer these remarks merely as comment and commentary, perhaps to
stimulate discussion.
The conference had an international flavor. The keynote was by Roland
Hueber (Directorate General of the Commission of the European
Communities) and the closing plenary on International Harmonization
serving as bookends. There were repeated calls for cooperation in
developing global security standards, with the primary advantages of
such appearing to be in commerce. In the wake of the cold war, there
seems to be a spirit of openness in this regard. I offer the
speculation that it may be foolhardy to enter into conformity of thought
and solutions. Diversity, particularly in commerce, inspires
creativity. Monopoly, or single-mindedness, often leaves one at risk of
exploitation by a strong central power, or of attack by those who are
close enough or who understand the system well enough to side-track it
We may need "fault-tolerant" and "diversified" answers.
It is useful to juxtapose thoughts about covert channels with those
about encryption systems. For the uninitiated, covert channels are
created when internal intermittent polling is performed in an effort to
conceal illicit data collection activities. Bob Morris provided the
statistic that 1/10 of a bit per second is enough to expose a key in
approximately 1 month. This is at current processing rates, but one can
extrapolate out the Silicon Valley curve and surmise that our current
key encryption systems will be inadequate within the end of the century
(if not now, perhaps).
In the quest for security tools one encounters the debate on provability
and formal top level specification. With respect to covert channels,
Virgil Gligor referred to "formal top level specification as an
unmitigated waste of time," saying that data structures and source may
not map to the top level, there may not be enough relevant details
provided, and excessive false illegal flows may occur. Earl Boebert
stated that formal proving methods have worth in analysis of
specifications, but have failed utterly in spec/code, code/object, and
code/behavior correspondence. Still, formal methods have their
supporters, most notably SRI, as indicated by John Rushby,
one of their directors (who also publicly revealed that there had been a
major successful break-in at the lab last month). Interestingly, the
panel on Intrusion Detection was chaired by SRI's Teresa Lunt, who
discussed the use of expert systems to encode vulnerabilities, attack
methods and known suspicious behaviors. Steve Snapp expressed the
divide and conquer approach, saying that there may be no single
generalizable model of intrusion, and that static, incidence/existence,
and data driven methods should all be used.
The matter of viruses was explored throughout various sessions. The
general consensus of opinion seemed to be that rigorous procedures and
policies need to be implemented so that recovery is possible to some
level following contamination or invasion.
In the talks I attended, no clear method for handling the recovery from
a "new" virus (that can not be eradicated with existing software) was
offered. This was not consoling to someone who had just last week left a
client's law office with the admonishment "don't use any of the text
files that you've created in the last 6 months until I can find out what
the new virus strain is that appears to have adhered to some unknown
quantity of them." Here too, the standardization on certain operating
systems and environments (such as Microsoft Windows(TM)), and uniform
acceptance of specific tools (such as the legal community's reliance on
Word Perfect(TM)) encourages the proliferation of attacks that could
potentially disable large sectors of the user base.
Losses seem to be tied heavily to the bottom line. In banking, it may
not be advantageous to implement a $10M or more security system that
still does not assure total impenetrability when insurance coverage can
be obtained at a cost of $1M (even if this price only remains low until
there is a hit).
In health care, as described in Deborah Hamilton's award-winning paper,
the bottom line may indeed be one or more people's lives. As true with
drug approvals, it is easy to see that holding back an inadequately
tested computer system may cost more lives than providing it while
make improvements and corrections. How does one weigh security,
reliability and verifiability issues when there is a crying need for
access to the developing technology? We are faced with a moral dilemma
without a governing body to set policies.
The area of privacy was eloquently addressed by Attorney Christine
Axsmith who said that our reasonable expectations of privacy, as
expressed by the 4th Amendment, protect people, not just places. But she
went on to say that with regard to the computer industry, the Privacy
Act and other legislation efforts still suffer from a lack of court
rulings necessary to define their interpretations. Will our efforts to
improve security undermine privacy?
Curt Symes (from IBM) stated that "we'll all be using smart cards in the
future, for a higher level of authentication." Does this mean that I
will eventually be required to be bioidentified (DNA, fingerprint,
retinal scan, voiceprint) in order to obtain access to my own data and
research? A chilling thought.
In conclusion, to paraphrase Peter Neumann, perhaps the conference theme
"Information Systems Security: Building Blocks to the Future" should be
read not as "building-blocks" (the small bricks), but as "building
BLOCKS" or obstacles to our future as security professionals. There is a
sense of urgency now -- many of us need more than a foundation of toy
blocks, requiring true solutions which appear to not be forthcoming.
What we don't want are systems and design structures that are so
cumbersome as to impede computational progress. Discussion may be
fruitful, but let us put our noses to the grindstone and provide
functional tools and answers, rather than guidelines and assertions.
While some are working in this direction, many others are needed.
NCSC '92 -- Comment and Commentary
Copyright (c) 1992 by Rebecca Mercuri. All Rights Reserved.
Reposting and/or reprint not granted without prior written permission
from the author. Address questions, response and corrections to:
mercuri@gradient.cis.upenn.edu
-==--==--==-<>-==--==--==-
THIS OLD DOS
Hi, I'm Bob Wheeler Dealer, and welcome to This Old DOS. Last week you
may remember we renovated the Charles Babbage Family computer. We
upgraded their antique CPM to the IBM operating system known as MS DOS.
And this week on This Old DOS, we're continuing our renovation by
installing a brand new operating system, supposed to be real easy to
use, called Windows. And boy am I excited. So let's go around back and
see how Norm is doing with it.
Bob: Hi Norm; how's it going?
Norm: Oh, hi Bob. Well as you can see I'm about to install Windows on
our old machine.
Bob: No glass in these Windows, huh Norm? Ha ha.
Norm: Ha ha. That's right, just a handful of floppy disks. This is an
attempt at making an IBM PC work *a little bit more* like an Apple
Macintosh. Instead of typing commands, you just move a lot of little
pictures around on a screen.
Bob: I can't wait. Sounds simple enough; let's take a whack at it.
Norm: Well, ok, the first thing we do is install these disks. Pop them
in the computer and follow the uh directions on the screen. Here you
try (sound of hard drive grinding). That's it.
Bob: Simple enough.
Norm: Ok, Bob, now the machine wants to know if you want to modify your
config.sys or change your autoexec.bat to automatically load when the
machines boots up. What do you want to do?
Bob: What's a config.sys? I don't anything about this stuff.
Norm: Never mind, it's ok Bob, I'll take care of it. There. Now to be
really state of the art, we've got to upgrade our microprocessor (sound
of sawing). That's the computer chip inside inside so that these
Windows will work fast enough. Otherwise, you know, you might as well
go out and get a cup of coffee while the screen draws pretty pictures,
heh heh. So let me get one of these uh 486 chips. We've got a crane
here. Hey fellas.. fellas! You wanna load that puppy here inta place?
Careful! (sound of machinery) Don't bend the pins! There, all snapped
in.
Bob: All right, now we're ready to open Windows, right?
Norm: Not on your life, Bob. While we're at it we're building an
extention onto the memory board for those fat, greedy programs that
gobble the stuff up. I'll just hammer a few of these 4 megabyte chips
into place (bang bang). There, now we've got 16 megabytes on board.
Narly, man!
Bob: All right, let her rip, Norm.
Norm: Not so fast, Bob! Those big Windows programs need lots and lots
of storage space. Charles talked to his banker and decided to spring for
that 200 megabyte beauty there. Hand me that..uh
Bob: You mean this thing here? (groaning and grunting)
Norm: Yeah, that's the hard drive. Ah, thanks. And they want to do
multimedia.. you know sound, graphics, computer games... the latest --
so we'll add on a new super VGA monitor..
Bob: Something else?
Norm: A CD ROM drive..
Bob: Something else? More stuff?
Norm: Yeah, we have a sound board and special speakers if you want that
great sound.
Bob: This .. this isn't so simple anymore!
Norm: Well, we're just about ready to go. That's about it.
Bob: All right now, with all this preparation Norm, this had better be
great.
Norm: Well, I hope so, let's (sound of drive grinding) load up Word
Perfect, Lotus 1.-2-3, Excel, and FileMaker Pro and watch her rip!
(beep.. crash). Oh-oh.
Bob: What happened? What happened?
Norm: Well, it looks like a system crash.
Bob: Oh no!
Norm: Don't worry! We can fix this thing. We can fix it.
Bob: What do we do now, give up?
Norm: No, Never! We drop everything and start over. That's the American
Way. You keep changing stuff until you find what's wrong.
Bob: Now, how long is this gonna take? I haven't got all weeks to..?
Norm: Don't worry! We'll I'll have this thing running like top, Bob.
In the mean time you can go back in my shop there and use my Mac.
Bob: All right, you keep working at it Norm. We're out of time folks.
Join us tomorrow for the start of our new 50-part series: "How to
install and maintain a Local Area Network." Until then, bye bye for
This Old DOS!
(c) Copyright National Public Radio (R) 1992. The segment by NPR's Ira
Plato was originally broadcast on National Public Radio's "Talk of the
Nation" on September 11, 1992 and is used with permission of National
Public Radio. Any unauthorized duplication is prohibited.
-==--==--==-<>-==--==--==-
MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION
If you support our goals and our work, you can show that support by
becoming a member now. Members receive our bi-weekly electronic
newsletter, EFFector Online, the @eff.org newsletter
and special releases and other notices on our activities. But because
we believe that support should be freely given, you can receive these
things even if you do not elect to become a member.
Our memberships are $20.00 per year for students, $40.00 per year for
regular members. You may, of course, donate more if you wish.
Our privacy policy: The Electronic Frontier Foundation will never, under
any circumstances, sell any part of its membership list. We will, from
time to time, share this list with other non-profit organizations whose
work we determine to be in line with our goals. If you do not grant
explicit permission, we assume that you do not wish your membership
disclosed to any group for any reason.
---------------- EFF MEMBERSHIP FORM ---------------
Mail to: The Electronic Frontier Foundation, Inc.
155 Second St. #39
Cambridge, MA 02141
I wish to become a member of the EFF I enclose:$__________
$20.00 (student or low income membership)
$40.00 (regular membership)
$100.00(Corporate or company membership.
This allows any organization to
become a member of EFF. It allows
such an organization, if it wishes
to designate up to five individuals
within the organization as members.)
I enclose an additional donation of $
Name:
Organization:
Address:
City or Town:
State: Zip: Phone:( ) (optional)
FAX:( ) (optional)
Email address:
I enclose a check [ ] .
Please charge my membership in the amount of $
to my Mastercard [ ] Visa [ ] American Express [ ]
Number:
Expiration date:
Signature:
Date:
I hereby grant permission to the EFF to share my name with
other non-profit groups from time to time as it deems
appropriate [ ] .
Initials:
Your membership/donation is fully tax deductible.
=====================================================================
EFFector Online is published by
The Electronic Frontier Foundation
155 Second Street, Cambridge MA 02141
Phone: +1 617 864 0665 FAX: +1 617 864 0866
Internet Address: eff@eff.org
Reproduction of this publication in electronic media is encouraged.
Signed articles do not necessarily represent the view of the EFF.
To reproduce signed articles individually, please contact the authors
for their express permission.
=====================================================================
This newsletter is printed on 100% recycled electrons.
