Previous | TOC | Next
COMPUTER SECURITY AND DATA THEFT
THE HACKERS -- FROM CURIOUS
HI, JUST CALLED TO SAY 1001010010010011001001101001110100
Chicago attorney Paul Bernstein is a lawyer, CPA and computer consultant
who ardently believes that every attorney should not only know how to use
a computer, but also learn telecommunications and E-MAIL. Furthermore,
he believes lawyers who do not learn telecommunications will be at a distinct
disadvantage in a competitive field. "In a competitive environment,
lawyers who know [about telecommunications and computers] even at a threshold
level, can retain and obtain clients," says Bernstein. "Those
who do not learn will find that their clients tire and become concerned
about paying their lawyers to educate them" Bernstein is president
of the Chicago-based LAW MUG, the Lawyers Micro-Computer Users Group, and
to emphasize his link to the computer world, his business card does NOT
list his voice phone number, but instead lists six access codes to reach
him by computer. If you want to reach him using the Source Information
Network, the code is TCX488. The monthly Chicago Lawyer newspaper asked
Bernstein to explain how attorneys can use telecommunications. His examples
illustrate why individual use of telecommunications, especially by professionals,
is inevitably going to increase - and why privacy problems are inherent
in the system:
"A not uncommon situation is that a lawyer
is on trial in a collar county or in another state. A question of law
comes up as the day closes in, let's say, California. The office in
Chicago is long since closed and the research is needed that night.
If the lawyer had a portable micro with a modem, the lawyer could do
the research at night on the available data bases and be more than
ready for court the next day."
"Another example is the same lawyer too
far away from the office who has an unexpected question of law come
up during trial or while a contested motion is being heard. The Judge
adjourns the hearing for two hours so that counsel can go to the library
and retrieve citation of authority. Our computerized lawyer remembers
that the law firm did a brief on that very topic some months ago. The
computerized attorney, with his portable micro in hand, could dial
up the law firm's data base, talk to a paralegal on the phone, have
a revised draft of the memorandum of law done immediately and have
it telecommunicated to him or her for printout and delivery to opposing
counsel and the Court when the adjourned hearing recommences."
"Your tax partner is out of town and
very hard to reach as the client matter she is involved with is very
significant. However, you have a pretty big problem too and need a
quick tax opinion. If the traveling tax attorney was hooked up to the
ABA/Net and/or the law firm's own Bulletin Board System, the problem
could be communicated and the answer received overnight. Telephone
tag is impossible, we've all gone through it over and over again, and
telecommunications and electronic mail is the ONLY method of clearly
solving the problem today."
"Your client has some questions for you
about their case. They need an immediate answer, but you're on trial!
And when you're on trial, not even the President of the United States
can get to you. But the client wants an answer. Telecommunications
again is the key. You get off trial at 6:00, have dinner, and at midnight
your preparation for the next day is over. Why not access your telecommunications
network, see your client's inquiry and answer it!"
COMPUTER SECURITY AND DATA THEFT
The problem of the handful of computer "Hackers" who have penetrated
military, medical, credit, and other sensitive data bases using home computers
hit the headlines hard last year. Computer crime has been with us since
we have had computers, and stories about the discovery of illicit fund
or data transfer do circulate more frequently now than a few years ago.
The increase in publicity about these nefarious abuses unique to the computer
age has prompted a long-overdue reaction -- and moves to install better
security systems on electronic data bases is well underway. One problem
in implementing electronic data security systems has been what Privacy
expert Professor George Trubow regards as a "natural technological
conflict" especially for those data bases with many clients who need
to access a system without specialized training - the simpler and more "user
friendly" the system, the easier it is to penetrate ... and conversely,
the harder a system is to penetrate, the harder it is to use. This conflict,
however, has a technical solution which time, experience, and some talented
programming should be able to solve.
In reality, in corporate offices the real data security questions do not
revolve around high school students in Wisconsin, but a researcher at a
competing firm or worse yet, professional industrial espionage pirates
sailing the digital high seas. Much of the information stored in electronic
data bases or transmitted electronically on behalf of clients is very sensitive.
So too is internal information generated by corporations themselves. How
would you like it if some competing firms had your client list?" Asks
Trubow, or if you are an attorney, "what if you were preparing for
trial and someone obtained your litigation theory in a particular controversy,
or your witness list with notations on who was going to prove which elements
in a prima facia case?" With penetration of data bases and data transmission
a regular feature of the computer age, there needs to be a clarification
of laws regarding expectations of privacy and liability, yet the question
of ultimate liability for computer data theft is a difficult issue with
much disagreement among those studying the issue.
On a practical level, persons who use electronic data transfer systems
or who have their computers hooked up the LEXIS, NEXIS, Dow Jones, DIALOG
or other services which rely on phone links should investigate security
measures. Physical isolation devices, monitoring and logging software,
passwords, and data encryption schemes are becoming more readily available
from computer and software vendors. For an excellent discussion of the
intricacies of property rights and privacy issues in data bases and telecommunication,
see the article by Anne Wells Branscomb available at the conference.
THE HACKERS -- FROM CURIOUS TO CRIMINAL
The original computer hackers who broke into databases and networks were
careful to leave no traces of their entry and to not disturb the data.
This soon changed as less sophisticated and more malicious computer hackers
came on the scene. The malicious Hacker horror stories have filled newspapers
and magazines for over a year. Often the less responsible computer "hackers" prowl
the electronic alleyways at night, when many firms leave their computer
systems on and attached to phone lines to transmit large blocks of data
when phone rates are cheaper. With nobody in the office, penetration of
data bases which lack proper security is often only a matter to time and
patience. Some hackers have been amazed to discover that firms which have
installed password protection schemes to prevent unauthorized access have
failed to change the original password which came with the system -- "PASSWORD." What
can happen if your system is easy to penetrate?
While not all Hackers are data thiefs or vandals, some few malicious modem
miscreants have been known to penetrate a computer system and not only
steal but also scramble the data. Imagine switching on your terminal one
morning only to discover 300 pages of text had been transformed into a
series of seemingly random numbers? As is often the case, the best sense
of Hacking and Hacker morality comes from the literature of that subculture
itself. Here are excerpts from three articles in a recent issue (Number
91!) of the original newsletter for Hackers and "Phone Phreaks" called,
appropriately "TAP: The Hobbyist's Newsletter for the Communications
DUNN AND BRADSTREET: Do They Know Something
That We Don't
By BOIC Agent 003 and Tuc
In issue #90, we explained how to use the
Dunn and Bradstreet system (which is now known as Dunsprint). A week
after the issue was maileed a phellow phreak found out that a copy
of the issue had fallen into the hands of our "friends" and
D & B. To say the least, they weren't exactly thrilled about it.
In fact, they did not even believe that they had a security problem!
Well, that just goes to prove that if you are good (or they are incredibly
stupid, whichever the case may be) no one will now that you are there!
In a big effort to defeat hackers, they called in an outside service
to spruce up their "security." Fortunately for us, we were
able to find out about the new system! This was not really a problem,
though. First, they had the new dial-ups posted when you logged on.
Secondly, they have a nice little place on Telenet! (Where we do most
of our "work" -- [deleted]) Sorry D & B .... Good news
A Lesson in Phreaking and Hacking Morality:
By Big Brother
I find it truly discouraging when people,
intelligent people seeking intellectual challenges, must resort to
becoming common criminals. The fine arts of hacking and boxing have
all but died out. Though you newcomers, you who have appeared on the
scene in the last year or two, may not realize it, we had it much better.
People didn't recognize our potential for destruction and damage because
we never flaunted it, nor did we exercise it. For hacking, it was the
intellectual challenge which drove us to do it. The thrill of bypassing
or breaking through someone's computer security was tremendous. It
wasn't a case of getting a password from a friend, logging on, and
destroying an entire database. We broke in for the challenge of getting
in and snooping around WITHOUT detection. We loved the potential for
destruction that we gave ourselves but never used. Today, after so
much publicity, the fun has turned to true criminality. Publicity we
have received is abhorring. From WarGames to the headlined October
Raids, to the 404's, the Inner Circle, Fargo 4A, and the recent NASA
breakins -- not to mention all the local incidents that never made
the big newspapers, like breakins at school computers or newspaper
computers. TRW credit information services claim hackers used the three
stolen accounts to aid them in abusing stolen credit cards. The thrill
of entering and looking around has shifted to criminal practicality
-- how can I make my bank account fatter -- how may I use this stolen
credit card to its fullest -- how could I take revenge upon my enemies.
By Cheshire Catalyst, Managing Editor
The corporate types should realize that if
a teenager hacker is getting into thier system, an industrial spy could
have been logging in regularly for the past 3 years. While I may not
particularly care for a TRW or [Citibank] having "Confidential
Information" about me, I especially don't like the idea of unauthorized
people spreading the data around. There are no quick answers, because
computer security is not just a matter of hardware, software, locks
and walls. Security is a people problem. When you put in locks, you
watch the people you give the keys to (notice an analogy to encryption
here). If these people FEEL they're being watched, they may get "disgruntled." Needless
to say, a disgruntled employee is worse than almost anything else you
could be combating. Any of our corporate subscribers who would like
to wake up their management to the vulnerabilities of computer systems
should be made aware that I am available for lectures and consulting.
Just drop me a line at the TAP maildrop, or via MCI Mail (Username:
TAP), or telex number 650-119-5732.
Well, you ask yourself, what are we supposed to learn from that?
· There will be Hackers who manage to penetrate data bases and networks
as long as human children (and adults) have the desire to open closed drawers
and cookie jars. There is no ultimate technological solution to the problem.
It is an ethical/legal problem.
· There is a difference between "Curious Hacking" and "Malicious
Hacking" which legislation should recognize.
· Hackers make terrific security consultants. Which is related to
the above since sentencing apprehended Curious Hackers to do security consulting
has a certain symmetry and elegance. (Although Hackers should only be hired
along with other more mainstream security analysts).
· A bill introduced March 7, 1985, in the California Senate by Senator
Doolittle (SB 1012) takes these points into account (see Appendix L), and
provides a solid foundation for further discussion.
Previous | TOC | Next