December 2003 - cypherpunks-legacy

Legal Aspects of Computer Crime (LACC)
by Julian Assange 17 Dec '03

17 Dec '03

_ _____ _____ | | /\ / ____| / ____| | | / \ | | | | | | / /\ \ | | | | | |____ / ____ \ | |____ | |____ |______| /_/ \_\ \_____| \_____| Legal Aspects of Computer Crime "echo subscribe lacc|mail lacc-request(a)suburbia.net" WHEN YOU HAVE SUBSCRIBED ------------------------ Send in a brief synopsis of who you are and why you are interested in Computer Crime as your first message to the list (this helps to stimulate discussion and debate as well as provide a sense of the LACC community). As a [small] example: "Hello, My name is Jane Reynor. I am an articled clerk at the Director of Public Prosecutions. I have been assigned as an assistant legal researcher to the prosecution of a bank officer involved in fraudulent EDI transactions. My interest in computer crime stems not just from the case we are working on, but also from an otherwise unrelated passion for computer networking that I suffered under during my period as undergraduate." REASONS FOR INCEPTION --------------------- The growing infusion of computers and computing devices into society created a legislative and common law vacuum in the 1980's. State prosecutors attempted to apply traditional property protection and deception laws to new technological crimes. By and large they were successful in this endeavor. There were however a very few but well publicized failed cases against computer "hackers" (notably R vs Gold - UK House of Lords and the E911 case). To the informed, these cases demonstrated not so much a legislation vacuum, but prosecution incompetence in choosing which statute to lay charges under and mis-management by prosecuting cases where the real offence of the defendant was merely the embarrassment of the powerful. In an atmosphere of increased government reliance on computer databases and public fear and hostility towards computerization of the workplace, legislatures rushed to criminalise certain types of computer use. Instead of expanding the scope of existing legislation to more fully encompass the use of computers by criminals, changing phrases such as "utter or write" to "utter, write or transmit" (the former being the prosecutions undoing in the well publicized Gold case) as had been done with the computerization of copyright law, an entirely new class of criminal conduct was was introduced. The computer had been seen not just as another tool that criminals might use in committing a crime but something altogether foreign and removed from the rest of society and established Law. The result was a series of naively drafted, overly broad and under-defined statutes which criminalised nearly all aspects of computer use under certain conditions. In the early 1990's a fundamental and evolving shift in computer usage started to occur. Now, it is rare to see a white collar worker in the work-place without the possession of a computer. In western countries such as Australia, over one third of households have computer systems. The computer is no longer the "altogether foreign and removed from the rest of society" device it once was. It has come out of the domain of the technical specialist and into the main stream. Even our notoriously slow moving legal profession is adopting it as an essential tool. But there is another change. A qualitative one important to our discussion. When you link hundreds of thousands of computers together and thus the people that use them together you find something remarkable occurs. An event that you could never have predicted by merely summing the discrete components involved. A unique virtual society forms. Despite being designed with computer networking in mind, computer crime legislation copes very poorly with non homogeneous authorization [i.e partial authorization]. Societies are based around a common knowledge of history, beliefs, and current events. Each member of a society can be pinpointed as belonging to the society in question by the ideas, beliefs and knowledge held in common with other societal members. Any new member to a society learns this knowledge only because it is passed onto them; directly by other members or indirectly via its media, works of literature, music and art. Successful large scale computer networks like the Internet form for one reason and one reason only; information sharing. When a critical mass of diversity, interests, user population and information exchange is reached, a situation develops that mirrors in all important aspects a vibrant and evolving society. Citizens of the Internet have a nearly equal sized voice with which to convey their thoughts to other members and can do so quickly and without unwanted distortion. This is a remarkably democratic process compared to the very real _self_ censorship and top heavy direction that is so manifest in traditional broadcast and publishing industries. But unlike the physical societies that have here-to been the norm, the electronic network society is remarkably non-isolationist. It continues to draw from, mesh and feed its beliefs into the traditional societies it was populated out of. This coupling process between computer network and traditional societies will continue (at least for English speaking countries -- the cultural barriers imposed by primary language differences are non-trivial) until a stage is reached where the boundary between the two is blurred and intangible. Most citizens will then fall under the rule of appallingly drafted computer crimes legislation every day of their lives. In the vast majority of such legislation directed to address computer crime everything which can be performed on a computer unless "authorized" is defined as illegal. One might think that an individual could authorize themselves to do anything they wished with their own computer [not so, as France and Russia and the USA have demonstrated with anti-cryptography and other information processing and content laws] given their ownership of it. But how does the Law define this "ownership"? Does ownership of the "chattel" (CPU, memory, disks and other hardware) imply ownership of the information created on it? What about employees with "partial authorization" [examine disturbing outcome of Intel employee R.Swartz vs the State of Oregon 1995]? If the user of the computer system isn't the chattel owner, but has been given full control over it does this imply they are authorized for all interaction with the data stored on it? Is there such thing as implicit authorization? Can an operating system grant authorization (implicit or otherwise) as an authorized agent of the owner/operator? If not, is sending electronic mail to someone who doesn't want their computer system to receive it "unauthorized insertion of data"? In a networked topology a typical computer user may use or otherwise interact with hundreds or even thousands of other peoples computers in any given day. What is then the analogous "authorization topology"? In Law it has previously been the case that which was not expressly forbidden was generally permitted. Currently the digital equivalent of moving a chair [modification of trivial data] in someone else's office is illegal and carries with it in most countries a 5 to 10 year prison term. It is a sad reflection on the legislature of the day that the computer _medium_ was criminalised rather than the intent or damage caused to the victim. It is unlikely that law reform will occur until current political concern over computer networks such as the Internet is moderated. If anything the push so far from political drafters has being to once again introduce brand new medium criminalising legislation rather than revitalizing the existing codes. This unfortunate "labeled arrow" approach will continue as long as there exists an ill informed and technologically ignorant legislature that finds itself pliant to the whims of sensationalist media and honed to their dubious targets. Strong ideals do not equal strong policy. So ill defined and over broad are the terms used in most computer crime legislation that typically the pressing of a button on a silicon wrist watch without permission can be construed as "insertion of data into a computer without authority" an offense which carries 10 years penalty in countries such as Australia. The farse inherent is blatant. Surely the process going on within the wrist watch is utterly irrelevant. Victemless crimes should be avoided if at all possible. If interfering with the watch caused damage, even if that damage was to the intellectual property in the watch then the crime is one of Criminal Damage [or one of the other broad ranging damage statutes, depending on jurisdiction]. If changing the internal state of the watch led to fraud or theft, then the crime should be one of fraud or theft (possibly by deception). If pressing the button changed, for instance, the time of the watch and this lead to a death, then the crime should be that of manslaughter or murder. Actions that do not damage (or other wise attempt to negatively effect) the life of human beings directly, or indirectly by damage or loss of property or fundamental societal ideals (such as the right to privacy, freedom of association, speech & movement) should not be crimes. Actions that annoy but do not damage should also not be crimes, and traditionally are not. Crimes and the criminal process are serious. Annoyances by definition are not. In most Commonwealth countries physical trespass [despite the general view] is not a crime and with good reason. The Criminal law system wasn't intended to be the citizen's lacky and enforcer of personal whim, but rather to protect persons from genuine harm and preserve social order and the sovereign. Someone trespassing on your lands may annoy you. It may contradict your authorization. But it [typically] only becomes illegal when you ask the trespasser to leave and they refuse, or if their trespassing was directly associated with the commission or attempted commission of an offence. It is with this lack of appropriate legislation, precedents and judicial guidance that judiciary, practitioners, prosecutors, law enforcement personnel, defendants and drafters of future codes & policy have to struggle to find resolution. This list has been created in an attempt to mitigate the lack of tangible resources people involved with computer crime have at their disposal. It is hoped that by bringing together knowledgeable legal professionals together with para-legal personnel and informed lay persons that information and resources relevant to the difficult task of analyzing, presenting in court, formulating departmental or company policy or otherwise dealing with computer crime law and computer crimes may be shared and intelligent discussion and law reform stimulated. nb. this list it is also an appropriate forum to discuss computerized legal, law enforcement and criminology databases, such as Netmap, Watson, PROMIS, Lexis, APAIS, CRIM-L, et cetera. GUIDELINES ---------- In order to keep the semantic content high on this list, please consult the following before posting: DO POST DON'T POST ------- ---------- Un/reported decisions. Personal insults. Commentaries on cases. Signatures >4 lines. Reviews on relevant books. Quoted replies with more than 30% Relevant journal articles. quoted from the original. Information about proposed legislation. Short questions, or questions which Full text of CC legislation. otherwise do not convey useful Judicially defined terms. information in their own right. Articles on new arrests or Gossip about the moderator. cases. Articles about computer (in)security, Detailed questions. they should be sent to: Intelligent commentary. "best-of-security(a)suburbia.net" Personal experiences with computer "breaking into a computer is the same crime. as...." Well thought out analogies. Petitions (if you think they are Relevant transcripts. exceptionally relevant, send them to Defense or prosecution strategy. the moderator, who may post them). Relevant papers, thesis. Chain letters. Conference announcements and details. Advertising material. Locations of legal resources. Ethical considerations that are only Computer forensics information. "opinion". Trial/court dates, verdicts etc. Content free news reports or Reviews of legal software. articles. Pointers to any of the above. Abusive, antagonistic or otherwise, Cross post relevant information from non information rich or non other lists or news groups. constructive material. Relevant affidavits, court documents. Quotes from Dan Quayle. SUBSCRIBING ----------- Send mail to: lacc-request(a)suburbia.net with the body of: subscribe lacc UN-SUBSCRIBING ------------- Send mail to: lacc-request(a)suburbia.net with the body of: unsubscribe lacc POSTING ------- To send a message to the list, address it to: lacc(a)suburbia.net REPLYING -------- If you are replying to a message already on the LACC list using your mail programs reply facility you will almost certainly have to change the reply address to lacc(a)suburbia.net. This is because the LACC mailing list program is configured to have return replies sent no "nobody" in order to avoid receiving the replies of "vacation" programs which automatically send email saying "I've gone to the moon for two weeks to hunt rare bits". ARCHIVES -------- Monthly back issues of lacc since January 96 are available from: ftp://suburbia.net/pub/mailinglists/lacc Unfortunately the the 1995 archive was lost in a disk crash. If anyone still has a copy, then please contact the moderator. -- "I mean, after all; you have to consider we're only made out of dust. That's admittedly not much to go on and we shouldn't forget that. But even considering, I mean it's sort of a bad beginning, we're not doing too bad. So I personally have faith that even in this lousy situation we're faced with we can make it. You get me?" - Leo Burlero/PKD +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Financial Times, March 6, 1996, IT Section, p. V. Network Security: Operating under a cloud of uncertainty Companies face a complex web of technical, legal and moral questions The IT security threat has long been depicted in terms of wild-eyed hackers hunched over terminals late into the night. But while there is real cause for concern about criminal activity over computer networks, large corporations are very worried about another threat to their use of electronic communications. Meanwhile, government restrictions on the use of data encryption codes in various countries are limiting the ability of commercial organisations to protect themselves. Cryptography is at the heart of this dilemma. Governments all over the world rely on specialist intelligence units to break down data transmissions from other nations and individuals while encrypting their own messages. The US National Security Agency and the UK's Government Communications HQ are the best-known of these agencies. The NSA is notorious for obsessive secrecy. Meanwhile, in the UK, the GCHQ has lifted its traditional reticence in recent years to offer advice to British companies concerned with data security. Mr Roger James, chairman of Cheshire-based communications software specialist Boldon James, has worked with GCHQ to define data standards for UK government departments. Mr James plays down the cloak-and-dagger imagine of GCHQ, but instead he describes his contact with its staff as "horribly technical". He also portrays the Cheltenham code-breakers as "very down-to-earth people". There are two ways of looking at security, he says "one is the practical approach, which means accepting that perfect security is impossible to obtain. The other is the Ivory Tower approach, which involves dreaming of a world in which security is absolute. There are a lot of 'practicalists' in GCHQ". Mr James, whose clients include the Britannia Building Society and the German Navy, is active in the European Electronic Messaging Association. He is concerned at the lack of a co-ordinated European policy on encryption. And he fears that effective security measures could become illegal with the advent of future legislation curbing the availability of encryption software. It is illegal at the moment to use strong cryptography techniques in France without first depositing the key to unlocking your codes with the French government. UK companies developing sophisticated security programs find their software classified as munitions and subject to tight export restrictions, even within the EC. In the US, the author of strong encryption program, called 'Pretty Good Privacy', found himself facing a Grand Jury and possible charges of exporting prohibited technology. The NSA has proposed that all personal computers made in the US contain the Clipper Chip. This security feature would give easy access to any data communications, however the user chose to encode it. The proposal is currently stalled, having met with ferocious opposition. Both suppliers of information technology and industry at large need to clear a path through this international maze. The legal structure surrounding the use of encryption technology is of particular concern to anyone working in electronic commerce. "The Clipper Chip debate raised a fundamental moral issue," says Mr James. "Software technology means that strong encryption, previously available only to the military, can now be obtained by the public. If governments then find messages hard to break, it leads immediately to a conflict of interest." One company that has confronted this apparent conflict of interest between state and commerce, with its attendant uncertainty, is the Anglo-Dutch oil giant, Shell. Mr Nick Mansfield, a Shell technical consultant specialising in information security, says the company is enthusiastic about the potential for eliminating paperwork across its sprawling global operations -- "we are committed to electronic trading," he says. "We have a vast electronic-mail network. But there is still a section of our business where we have to use paper". Contract agreements are at issue here. Until security can be absolutely guaranteed, bilateral agreements must be seen to be tamper-proofed. Shell is about to deploy technology to secure personal computers and PC servers across the world. This e-mail security system will cost around L1m in software purchasing plus L100,000 a year to run. It will have 4,000 users. Far from escalating costs, Mr Mansfield explains that expenses are falling as security improves. Shell used to run a secure telex network that cost L4m in technology and required L200,000 a year to support 120 sites. This was superseded by a secure fax network costing L1m in systems, plus L100,000 in annual maintenance for 200 sites. The latest system will expand secure messaging beyond the fax network's remit. But setting up this security system involved Shell in a long and involved process. Its chosen security software is subject to close scrutiny by the UK authorities, who worked with Shell to customise the program before it could be released for use overseas. While Mr Mansfield is pleased that Shell's security system is so strong, it required an export licence and he echoes the concerns of EEMA's Mr James -- "it's a cart and horse situation. Until governments agree on policy and relax some restrictions, industry won't be encouraged to development extreme standards of encryption". There needs to be a broad European debate on this issue. Until this complex web of technical, legal and moral questions are resolved, secure commercial data networks will be operating under a cloud of uncertainty. Michael Dempsey [End] Note: Shell's Nick Mansfield was a speaker at the OECD cryptography conference in Paris in December. This issue of FT includes a 22-page special section on Information Technology.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Note: downloaded from www.vtw.org so cannot guarentee correctness- "§2804. Unlawful use of encryption to obstruct justice" "Whoever willfully endeavors by means of encryption to obstruct, impede, or prevent the communication of information in furtherance to a felony which may be prosecuted in a court of the United States, to an investigative or law enforcement officer shall-..." Interesting wording - sounds almost like if you impede the *commission* of a felony, you is been had. Keyword would seem to be "willingly". Suspect they meant to say "...obstruct (etc) the investigation of a felony..." "(b) CONTROL OF EXPORTS BY SECRETARY OF COMMERCE.- "(1) GENERAL RULE.-Notwithstanding any other law, subject to paragraphs (2), (3), and (4), the Secretary of Commerce shall have exclusive authority to control exports of all computer hardware, software, and technology for information security (including encryption), except computer hardware, software, and technology that is specifically designed or modified for military use, including command, control, and intelligence applications. This would seem to extend ITAR, not limit it. "(2) ITEMS NOT REQUIRING LICENSES.-No validated license may be required, except pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (but only to the extent that the authority of such Act is not exercised to extend controls imposed under this Act), for the export or reexport of- "(A) any software, including software with encryption capabilities, that is- "(i) generally available, as is, and designed for installation by the purchaser; or "(ii) in the public domain or publicly available because it is generally accessible to the interested public in any form; or "(B) any computing device solely because it incorporates or employs in any form software (including software with encryption capabilities) exempted from any requirement for a validated license under subparagraph (A). Microsoft's CryptoAPI seems OK. PGP would seem to fall under both (i) and (ii). "(3) SOFTWARE WITH ENCRYPTION CAPABILITIES.-The Secretary of Commerce shall authorize the export or reexport of software with encryption capabilities for nonmilitary end-uses in any country to which exports of software of similar capability are permitted for use by financial institutions not controlled in fact by United States persons, unless there is substantial evidence that such software will be- "(A) diverted to a military end-use or an end-use supporting international terrorism; "(B) modified for military or terrorist end-use; or "(C) reexported without requisite United States authorization. Thank you MasterCard/VISA for SET. Note that it does not seem to say that you do not need a license, just that one shall not be witheld without "substantial evidence". "(4) HARDWARE WITH ENCRYPTION CAPABILITIES.-The Secretary shall authorize the export or reexport of computer hardware with encryption capabilities if the Secretary determines that a product offering comparable security is commercially available from a foreign supplier without effective restrictions outside the United States. Same comment except that token & INE vendors will have to demonstrate that a foreign competitor exists. Real lawyers please comment. Warmly, Padgett

1 0

Test of email netnews post.
by uunet!in2.uu.net!news.ner.bbnplanet.net!news3.near.net!yale!news-mail-gateway!daemon＠warwick.com 17 Dec '03

17 Dec '03

Test of email netnews post. -- Rich Carreiro rcarreiro(a)bos.saic.com Software Engineer (617)221-7607 (voice/voice mail) SAIC (617)270-0063 (fax) 20 Mall Road, Suite 130 Burlington, MA 01803

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

David Lesher wrote: | How about code that goes out & fetches keys upon demand, al-la DNS? This works with procmail to get keys for all mail I receive. I discovered the problem is your keyrings get unmanageably large when you do this. # auto key retreival # # I have an elm alias, pgp, points to a keyserver :0BW * -----BEGIN PGP *!^FROM_DAEMON KEYID=|/home/adam/bin/sender_unknown :0 ahc # added h 8 jan 95 * ! ^X-Loop: Adams akr | formail -a"X-Loop: Adams akr" |elm -s"mget $KEYID" pgp # add the incoming keys to the ring :0 * From bal(a)swissnet.ai.mit.edu { # if we accidentally get the whole thing. :0 h * >10000 /dev/null :0 h *^Subject:.*no keys match /dev/null :0: *Subject: Your command, ADD $DEFAULT :0E | pgp +batchmode -fka } sender_unknown: #!/bin/sh # unknown returns a keyid, exits 1 if the key is known # $output is to get the exit status. Othierwise, this would be a one liner. OUTPUT=`pgp -f +VERBOSE=0 +batchmode -o /dev/null` echo $OUTPUT | egrep -s 'not found in file' EV=$? if [ $EV -eq 0 ]; then echo $OUTPUT | awk '{print $6}' fi exit $EV -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

POO_bah
by jya＠pipeline.com 17 Dec '03

17 Dec '03

3-6-96. TWP and NYT give additional reports on WW II atomic spying by the Soviets revealed by decoding cables under NSA's Venona program. With more on the role of physicist Theodore Hall and others initially reported by TWP on February 25. NYT quotes David Kahn on the "unquestionable" code-breaking and doubts of FBI "gumshoe" follow-up of decrypted leads. TWP's is more robust, quotes poo-bahs. POO_bah

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Post Test -- John G. Jones Director, Computer Services UTDS, Inc. <http://www.utech.net> <mailto:john@utech.net> 1593 E. Chestnut Lompoc, CA 93436 (805) 735-4447

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> This is a test... Follow up on test...test...test -- Live on the edge, push the limits, and go EXTREME... -------------------------------------------------------------------------- Svein Ove Solsvik * E-Mail: sveinove(a)ringnett.no -Dyslexic atheists don't believe in Dog.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> In the "real world" there is nothing to prevent someone from forging > your real signature on a check or document or from disguising themselves > as you and taking your place at an important business meeting. The > digital equivalents can be slightly more secure, but nothing is ever > perfect. > > jim > Heh. Whoops. I may be a beginner but I'm not THAT green. I shoulda known better than to use that exact wording. Please excuse the inappropriate wording, all. Sincerely. Quentin Holte. ( aka Charles Choi. ) You are all the Buddha. - Last words of Buddha. If you see the Buddha, kill him. - Zen proverb.

1 0