textfiles/magazines/CUD/cud0217.txt

  ****************************************************************************
                  >C O M P U T E R   U N D E R G R O U N D<
                                >D I G E S T<
              ***  Volume 2, Issue #2.17 (December 16, 1990)   **
  ****************************************************************************

MODERATORS:   Jim Thomas / Gordon Meyer  (TK0JUT2@NIU.bitnet)
ARCHIVISTS:   Bob Krause / Alex Smith
RESIDENT INSOMNIAC:  Brendan Kehoe

USENET readers can currently receive CuD as alt.society.cu-digest.

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may be reprinted as long as the source is
cited.  Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.
It is assumed that non-personal mail to the moderators may be reprinted
unless otherwise specified. Readers are encouraged to submit reasoned
articles relating to the Computer Underground.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent the
            views of the moderators. Contributors assume all responsibility
            for assuring that articles submitted do not violate copyright
            protections.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

CONTENTS:
File 1: Moderators' Corner
File 2: From the Mailbag
File 3: EFF Response to Atlanta Sentencing Memorandum
File 4: Some Thoughts on the Atlanta Sentencing
File 5: Earning your Stripes
File 6: Playgrounds of the Mind: Cyberspace
File 7: The CU in the News

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

----------------------------------------------------------------------

********************************************************************
***  CuD #2.17: File 1 of 7: Moderator's corner                  ***
********************************************************************

From: Moderators
Subject: Moderators' Corner
Date: December 16, 1990

++++++++++
In this file:
1. LEN ROSE UPDATE
2. FTP FILES
++++++++++

+++++++++++++++++++++
Len Rose Update
+++++++++++++++++++++

Len Rose will go to trial in Baltimore in late January barring any
extensions. He asked us to pass on his thanks to the many, many people who
responded to his request for witnesses.  Len is still unemployed and is
prevented from seeking menial work because his leg remains in a cast and he
cannot stand for extended periods of time. He sends his thanks to those who
have helped in financially and emotionally during this period.  Those
wishing to help him through the holidays are encouraged to send donations
to:


       Len Rose Donation
       c/o Sheldon Zenner
       Katten, Muchin and Zavis
       525 W. Monroe, Suite 1600
       Chicago,  IL  60606

Checks should be made out to either Sheldon Zenner or Len Rose.

+++++++++++++++
FTP Files
+++++++++++++++

A few more state statutes have been added to the ftp site along with a few
legal papers. The complete NIA (Network Information Access, #s 1-67) will
also be up by Christmas. DAVE BANISAR has been helpful in expanding the
legal documents.

The EFF NEWSLETTER, which just came out, will also be added.  We encourage
people to ftp it and upload it elsewhere. Their first issue is excellent
(we reprint their response to the Riggs sentencing memo in file 3).

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: From the Mailbag
Date:  December 16, 1990

********************************************************************
***  CuD #2.17: File 2 of 7: From the Mailbag                    ***
********************************************************************

From: Robert McClenon <76476.337@COMPUSERVE.COM>
Subject: Cowboys and Indians and the cyberfrontier
Date: 11 Dec 90 00:54:55 EST

   The question was posed as to whether hackers are cowboys seeking new
territory to stake out.  Maybe.  But I propose a different (electronic)
frontier metaphor.  Cowboys lived on the frontier in what they perceived to
be freedom but did not understand the limits of the world and eventually
wasted the commons.  There were another group of people, living further out
on the frontier, who in general did understand the limits of the world and
the interdependency of all things, and who had their own tribal culture and
ethic that was not well understood by outsiders.  They were called by many
names and called themselves by many names, but at the time most outsiders
called them Indians.  Their society was tribal, but most tribes had an
organization that at the same time was mostly democratic and yet placed a
great deal of authority and respect in a chief.  They had a few enemies.
Principal among their enemies were the federal cavalry.  The objective of
the cavalry was in general to herd the Indians onto reservations as a step
toward fencing in the free range, and some of the cavalry had the secondary
wish to massacre a few Indians in the process.  The cavalry often waited
for a provocation, which sometimes came from rogue Indians who interfered
with the white man's property, by raiding his sheep, or with his
communication, by cutting telegraph lines or harassing the pony express.

   I suggest that the BBS community are comparable to Indians, living
peacefully on the frontier, in harmony with the world, and mostly
respecting the authority of the chiefs (sysops), although not without
complaining.  Hackers are rogue Indians, who threaten communication and
property.  It does not take much of a provocation to bring on the feds.
And the feds do not respect the Indian culture and have shown a willingness
to slaughter Indian chiefs who tried to cooperate with the feds in
controlling the rogue Indians.

   What are the conclusions?  The rogue Indians threaten the continued
existence of the Indians.  The worse rogues are the feds, who do not seem
to respect anyone's law, even their own.  The only long-term hope for the
Indians is to maintain their own discipline.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: wex@PWS.BULL.COM
Subject: A Philosophical Reminder
Date: Mon, 10 Dec 90 13:41:49 est

Not to rain on Dark Adept's parade since I largely agree with him, but...

The ancient wizards he refers to, and whom he credits with things such as
Physics and Philosophy, were but pale imitations of their Greek, Babylonian,
and Chinese forbears.  It was these men (for women were systematically
excluded) who -- as far as we know -- founded such things as Philosophy.

The alchemists (and similar "wizards") were indeed similar to (some) hackers
in that they were unsystematic dabblers in things that were supposed to be
forbidden.  But credit where credit is due, please.  It was people like
Descartes and Russell who systematized and made Western science what it
became.

--Alan Wexelblat        phone: (508)294-7485
Bull Worldwide Information Systems  internet: wex@pws.bull.com

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Electronic Frontier Foundation
Subject: EFF Response to Atlanta Sentencing Memorandum
Date:  December 10, 1990

********************************************************************
***  CuD #2.17: File 3 of 7: EFF Response to Atlanta Sentencing  ***
********************************************************************

                      EFF News #1.00: Article 7 of 7:
            How Prosecutors Misrepresented the Atlanta Hackers

   Although the Electronic Frontier Foundation is opposed to unauthorized
computer entry, we are deeply disturbed by the recent sentencing of Bell
South hackers/crackers Riggs, Darden, and Grant. Not only are the sentences
disproportionate to the nature of the offenses these young men committed,
but, to the extent the judge's sentence was based on the prosecution's
sentencing memorandum, it relied on a document filled with
misrepresentations.

   Robert J. Riggs, Franklin E. Darden, Jr., and Adam E. Grant were sentenced
Friday, November 16 in federal court in Atlanta.  Darden and Riggs had each
pled guilty to a conspiracy to commit computer fraud, wire fraud,
access-code fraud, and interstate transportation of stolen property. Grant
had pled guilty to a separate count of possession of access codes with
intent to defraud.

   All received prison terms; Grant and Darden, according to a Department of
Justice news release, "each received a sentence of 14 months incarceration
(7 in a half-way house) with restitution payments of $233,000." Riggs, said
the release, "received a sentence of 21 months incarceration and $233,000
in restitution." In addition, each is forbidden to use a computer, except
insofar as such use may be related to employment, during his
post-incarceration supervision.

   The facts of the case, as related by the prosecution in its sentencing
memorandum, indicate that the defendants gained free telephone service and
unauthorized access to BellSouth computers, primarily in order to gain
knowledge about the phone system.  Damage to the systems was either minimal
or nonexistent.  Although it is well-documented that the typical motivation
of phone-system hackers is curiosity and the desire to master complex
systems (see, e.g., HACKERS: HEROES OF THE COMPUTER REVOLUTION, Steven
Levy, 1984), the prosecution attempts to characterize the crackers as major
criminals, and misrepresents facts in doing so.

   Examples of such misrepresentation include:

   1) Misrepresenting the E911 file.

   The E911 file, an administrative document, was copied by Robert Riggs and
eventually published by Craig Neidorf in the electronic magazine PHRACK.
Says the prosecution: "This file, which is the subject of the Chicago
[Craig Neidorf] indictment, is noteworthy because it contains the program
for the emergency 911 dialing system. As the Court knows, any damage to
that very sensitive system could result in a dangerous breakdown in police,
fire, and ambulance services. The evidence indicates that Riggs stole the
E911 program from BellSouth's centralized automation system (i.e., free run
of the system). Bob Kibler of BellSouth Security estimates the value of the
E911 file, based on R&D costs, is $24,639.05."

   This statement by prosecutors is clearly false. Defense witnesses in the
Neidorf case were prepared to testify that the E911 document was not a
program, that it could not be used to disrupt 911 service, and that the
same information could be ordered from Bell South at a cost of less than
$20. Under cross-examination, the prosecution's own witness admitted that
the information in the E911 file was available in public documents, that
the notice placed on the document stating that it was proprietary was
placed on all Bell South documents (without any prior review to determine
whether the notice was proper), and that the document did not pose a danger
to the functioning of the 911 system.

    2) Guilt by association.

   The prosecution begins its memorandum by detailing two crimes: 1) a plot
to plant "logic bombs" that would disrupt phone service in several states,
and 2) a prank involving the rerouting of calls from a probation office in
Florida to "a New York Dial-A-Porn number."

   Only after going to some length describing these two crimes does the
prosecution state, in passing, that *the defendants were not implicated in
these crimes.*

   3) Misrepresentation of motives.

   As we noted above, it has been documented that young phone-system hackers
are typically motivated by the desire to understand and master large
systems, not to inflict harm or to enrich themselves materially. Although
the prosecution concedes that "[defendants claimed that they never
personally profited from their hacking activities, with the exception of
getting unauthorized long distance and data network service," the
prosecutors nevertheless characterize the hackers' motives as similar to
those of extortionists: "Their main motivation [was to] obtain power
through information and intimidation." The prosecutors add that "In
essence, stolen information equalled power, and by that definition, all
three defendants were becoming frighteningly powerful."

   The prosecution goes to great lengths describing the crimes the defendants
*could* have committed with the kind of knowledge they had gathered. The
prosecution does not mention, however, that the mere possession of
*dangerous* (and non-proprietary) information is not a crime, nor does it
admit, explicitly, that the defendants never conspired to cause such damage
to the phone system.

   Elsewhere in the memorandum, the prosecution attempts to suggest the
defendants' responsibility in  another person's crime.  Because the
defendants "freely and recklessly disseminated access information they had
stolen," says the memorandum, a 15-year-old hacker committed $10,000 in
electronic theft. Even though the prosecution does not say the defendants
intended to facilitate that 15-year-old's alleged theft, the memorandum
seeks to implicate the defendants in that theft.

   4) Failure to acknowledge the outcome of the Craig Neidorf case.

   In evaluating defendants' cooperation in the prosecution of Craig Neidorf,
the college student who  was prosecuted for his publication of the E911
text file in an electronic newsletter, the government singles out Riggs as
being less helpful than the other two defendants, and recommends less
leniency because of this. Says the memorandum: "The testimony was somewhat
helpful, though the prosecutors felt defendant Riggs was holding back and
not being as open as he had been in the earlier meeting." The memorandum
fails to mention, however, that Riggs's testimony tended to support
Neidorf's defense that he had never conspired with Riggs to engage in the
interstate transportation of stolen property or that the case against
Neidorf was dropped. Riggs's failure to implicate Neidorf in a crime he did
not commit appears to have been taken by prosecutors as a lack of
cooperation, even though Riggs was simply telling the truth.

Sending a Message to Hackers?

   Perhaps the most egregious aspect of the government's memorandum is the
argument that Riggs, Grant, and Darden should be imprisoned, not for what
*they* have done, but send the right "message to the hacking community."
The government focuses on the case of Robert J. Morris Jr., the
computer-science graduate student who was sentenced to a term of probation
in May of this year for his reckless release of the worm program that
disrupted many computers connected to the Internet. Urging the court to
imprison the three defendants, the government remarked that "hackers and
computer experts recall general hacker jubilation when the judge imposed a
probated sentence. Clearly, the sentence had little effect on defendants
Grant, Riggs, and Darden."

   The government's criticism is particularly unfair in light of the fact
that the Morris sentencing took place almost a year *after* the activities
leading to the defendants' convictions! (To have been deterred by the
Morris sentencing the Atlanta defendants would have to have been able to
foretell the future.)

   The memorandum raises other questions besides those of the prosecutors'
biased presentation of the facts. The most significant of these is the
government's uncritical acceptance of BellSouth's statement of the damage
the defendants did to its computer system. The memorandum states that "In
all, [the defendants] stole approximately $233,880 worth of
logins/passwords and connect addresses (i.e., access information) from
BellSouth.  BellSouth spend approximately $1.5 million in identifying the
intruders into their system and has since then spent roughly $3 million
more to further secure their network."

   It is unclear how these figures were derived. The stated cost of the
passwords is highly questionable: What is the dollar value of a password?
What is the dollar cost of replacing a password?

   And it's similarly unclear that the defendants caused BellSouth to spend
$4.5 million more than they normally would have spent in a similar period
to identify intruders and secure their network. Although the government's
memorandum states that "[t]he defendants ... have literally caused
BellSouth millions of dollars in expenses by their actions," the actual
facts as presented in the memorandum suggest that BellSouth had *already
embarked upon the expenditure of millions of dollars* before it had heard
anything about the crimes the defendants ultimately were alleged to have
committed. Moreover, if the network was insecure to begin with, wouldn't
BellSouth have had to spend money to secure it regardless of whether the
security flaws were exploited by defendants?

   The Neidorf case provides an instructive example of what happens when
prosecutors fail to question the valuations a telephone company puts on its
damages. But the example may not have been sufficiently instructive for the
federal prosecutors in Atlanta.

   Not only are there questions about the justice of the restitution
requirement in the sentencing of Riggs, Darden, and Grant, but there also
are Constitutional issues raised by the prohibition of access to computers.
The Court's sentencing suggests a belief that anything the defendants do
with computers is likely to be illegal; it ignores the fact that computers
are a communications medium, and that the prohibition goes beyond
preventing future crimes by the defendants--it treads upon their rights to
engage in lawful speech and association.

   EFF does not support the proposition that computer intrusion and
long-distance theft should go unpunished. But we find highly disturbing the
misrepresentations of facts in the prosecutors' sentencing memorandum as
they seek disproportionate sentences for Riggs, Darden, and Grant--stiff
sentences that supposedly will "send a message" to the hackers and
crackers.

   The message this memorandum really sends is that the government's
presentation of the facts of this case has been been heavily biased by its
eagerness to appear to be deterring future computer crime.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: The Advocate / return deleted
Subject: Some Thoughts on the Atlanta Sentencing
Date: Tue, 11 Dec 90 15:37:23 -0500

********************************************************************
***  CuD #2.17: File 4 of 7: Thoughts on the Atlanta Sentencing  ***
********************************************************************

I find the statement in the sentencing memo "these three had acquired
tremendous information, enough to become frighteningly powerful" to be the
key to the governments prosecution.

The governemnt has always feared those who have gained power outside of the
channels of normal authority, and sought to destroy all those who have
gained this power.

The FBI sought to destroy King and the SCLC, not because he was a bad man,
but because he threatened the status quo.  The Black Panthers threatened
the status quo and they were destroyed. Read the history of organized
labor.  Every initial unionization attempt was met with violence and legal
assault, until the unions became part of the establishment.  Jesus was
crucified because he threatened the order.

Now hackers have started to seize information and power.  That power is a
potential force for good or evil.  That power could shake the world as they
know it.  So now all forces of law enforcement have begun to turn on those
who may threaten the order.

I would recommend that all those who wish to hack, listen to "Ruby, an
intergalactic gumshoe".  It's a radio drama from the people who did the
"fourth tower of Inverness"(best guess).  There there is an organization
called the digital circus, who build wrestling robots.  THey wrestle
against the rulers machines.  They never win, but always come a little
closer before throwing the match.

I would suggest that the sentencing memo serve as a warning to all other
hackers.

   SQUEALERS NEVER PROSPER.........

   John Doe the indiana stool pigeon, got for his troubles,
   a search warrant and indictment.

   The atlanta three got for their guilty plea and cooperation
   about 8 years and $250,000 in punishment.

I have been around criminal lawyers and investigators, for the better part
of my life.  I cannot suggest any case where cooperation brings help.  Now
all of them are also vulnerable on civil charges.

Had they all sat odwn, said prove the case and fought it out, they would
have done no worse.  and probably could have demolished the case with Dr
Dennings testimony.  But no, they squealed.  Someone ought to slap around
their attorneys.

   Craig Neidorf had it right with sheldon zenner.  Fight all the way.
Don't fight the good fight.  Fight with every drop of blood you have.
Fight constitutionality.  fight civilly.  fight in the press.  fight in the
legislature.

   If you are indicted, use your rights.  Subpoena every document of the
firms opposing you.  They claim billions in damages,  subpoena all their
operating records.  get their expense records of top officials.  Use your
subpoena rights to find dirt on their witnesses.  It's there, you just
have to look for it.

   IF there is going to be a computer underground, then it's going to have to
learn how to fight and win in the courts and legislatures and public
opinion.  that means controlling our excesses.  learning how to measure
performance, and developing ethics.

   Ethics.  The Dark adept wrote about these.  Why break into yet another TSO
machine?  Don't damage data.  Learn to respect privacy rights.  IF you find
a security bug, publish it, but learn how to offer your services to fix
these.  Learn to realize that trespassing via computer is no different then
trespass by foot.  Create playlands.  The LOTS machine at stanford provided
many a safe outlet.  Get these machines going at the larger colleges.  Why
can't their still be LOTS?

   Learn to realize limits, as well.  well best of luck for those of you out
there.

 I remain, The Advocate.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

Subject: Earning your Stripes
From: Silver Surfer
Date: Tue, 11 Dec 90 07:06 EDT

********************************************************************
***  CuD #2.17: File 5 of 7: Earning your Stripes                ***
********************************************************************

In an article by Katie Hafner entitled "Morris Code", she describes a long
standing tradition that computer security experts have earned their stripes
by defeating the computer's barriers. But now instead of earning pin
stripes, hackers are earning their prison stripes for defeating computer's
barriers. What has happened to change the norms and values in the computer
world in the last 10 to 15 years?

Now it is a crime to pursue forbidden unlawful computer knowledge.  Just
recently the "Atlanta Three" (Robert Riggs, Adam Grant and Franklin Darden)
have been sentenced to prison terms for breaking into the BellSouth
computer systems.  It is stated by the government that these individuals
have a vast knowledge concerning computer and telecommunication services.
So with this aptitude they are being sent to prison where they might learn
a lesson. What lesson might they learn, I do not know.  It is hard to
believe that the government would not impose a fine on them and community
service similar to what Morris received (but then again I bet none of their
fathers are at the NSA..or could afford the lawyers Morris's family
provided their son).

I think the "Atlanta Three" should be viewed as technological clepto
maniacs.  They would pursue information and knowledge even though they knew
the means were illegal.  You could say that their value system of right and
wrong was skewed. But is this a reason to imprison these young men?  Their
critics site the millions of dollars lost (just like the thousands of
dollars for the 911 manuscript ....it's revised net value is under $20 now)
and the threat to life they could have caused through network disruption.
The key words are COULD HAVE CAUSED. They never actually caused loss of
life or injury to anyone. If that was the case, I would drive them to
prison myself.

So the federal government has issued a message to hackers and phreaks, that
the only stripes you can earn now are prison stripes.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Silicon Surfer / <address deleted>
Subject: Playgrounds of the Mind: Cyberspace
Date: Tue, 11 Dec 90 07:06 EDT

********************************************************************
***  CuD #2.17: File 6 of 7: Playgrounds of the Mind: Cyberspace ***
********************************************************************

             Playgrounds Of The Mind: Cyberspace
                              By
                        Silicon Surfer

Why do hackers hack?  The majority seem to say it's a thrill or a challenge
to get into a system.  Others say that it's a means to learn about
mainframe computers and their various communication networks.

Every year the government and with donations from industry pour millions of
dollars into athletic facilities for it's youth and adult citizens.  There
is even a President's Fitness Council to encourage Americans to exercise
their bodies.  The government and industry does spend millions of dollars
to fight computer "hackers" and fix security holes.  But where are the
playgrounds for the mind?

If the government and industry provided regionally located computer centers
for the young and old computer enthusiasts to use or break into what would
happen?  Industry and the government would have a place to test it's new
software and find security holes.  It would also be developing a young crop
of computer programmers and security experts.  Imagine what it would be
like to develop young adults with years of computer experience, we already
see this result in sports every year during the various professional drafts
and attempts by colleges to recruit players.

And what of the crime of computer hackers?  There would be no excuse if you
were allowed to use or crack a specific computer system.  There would still
be the thrill, challenge and knowledge to achieve, BUT it would be legal.
It would also teach ethics. Imagine a hacker defeating a system and gaining
an account, then only weeks later to lose that account to another hacker
(of course a large increase of computer expertise would be developed by
hackers to defend their own accounts).

And if a hacker broke into a system that was outside the allowed
systems...there would be no excuse except for criminal mischief.

There already exits a network called the Internet that would allow various
playgrounds of cyberspace to be connected.  Today, most high school
districts have minicomputers or mainframe systems (imagine students staying
after school to work and learn with a computer...they would most likely
have to sign up for time...images of the old days of the old hackers of the
70's) that could connect to the Internet.  And what of the computing
resources of community colleges and state universities that could be opened
up to the public.  They already open up their gyms, athletic fields, and
pools to the community, why not their computers?  A perfect example is the
Cleveland Free-Net by CASE Western.  They have developed a computer city
that exists on the Internet and is accessible to anyone at NO cost.  The
EFF wants to encourage the growth and inhabitance of cyberspace. Why not
develop outposts at various academic sites to accommodate the "greenhorns"
that are venturing out into this new and open frontier?  The EFF does not
need to spend vast amounts of money, instead it should provide
encouragement.  They could aid in the development of a program to bring
computers to the people (..help establish a Community Memory
Project...like the one that existed in the late 70's in California).  It
would be easier for the more famous of their members to get donations from
industry of used or new equipment.

But then again it is easier for the government and industry to spend
resources of time and money to monitor and hunt hackers.  It is better to
foster the idea that computer access and knowledge should be the realm of
the few.  That it would be better to complain and wring their hands saying
that the US should do something to regain it's technological edge and by
the way, let's get rid of these dangerous and evil hackers.

Of course the media is of no help. What profit is it to print news stories
or support an initiative like this.  There is no sensationalism in law and
order.  The bed time horror stories of 15 year olds breaking into military
computers and emergency networks would disappear, leaving them instead with
stories of a educated and ethical computer community.

I believe we are at a turning point in the computer culture. We have
reached the cross roads, we can encourage the open development of computer
knowledge by providing open systems or we can make it a crime to pursue
knowledge.  After reading this you might ask what have I done to encourage
computer knowledge? I have taught computer courses for elementary students
while in college and later developed a course outline to use a state
university's mainframe computer to provide accounts and instruction for
high school students (the program although was shot down by the state
university's bureaucracy plan to fight this decision).  That is why I am
posting this article under a handle, to protect any future projects of mine
from misinterpretation.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: The CU in the News
Date:  15 December, 1990

********************************************************************
***  CuD #2.17: File 7 of 7: The CU in the News                  ***
********************************************************************

From: someplace!anonymous@UUNET.UU.NET
Subject: Well, did anything happen?
Date: Wed, 12 Dec 90 02:59:59 -0500

Or was it a case of hysterical or malicious rumor mongering?

COMPUTER JOCKEYS THREATEN PHONE WAR
SAN JOSE MERCURY NEWS (SJ) - Friday, November 16, 1990
By: Associated Press
Edition: Stock Final  Section: Front  Page: 16A

Telephone  companies  are  taking  precautions  today  against  a  possible
disruption of service somewhere in the country by computer vandals breaking
into the phone network.

Non-specific  threats had been made to invade the massive computers that
control  the  telephone  network,  but  not  to attack physical facilities,
industry sources said.

Sources  who spoke on condition of anonymity said the threats apparently
were  in  connection  with a sentencing scheduled in Atlanta this afternoon
for  three  members  of  a computer group called the Legion of Doom who had
broken into BellSouth Corp. computers.

Franklin  E.  Darden Jr. and Robert J. Riggs pleaded guilty earlier this
year  in  federal court to one conspiracy count each. Adam E. Grant pleaded
guilty to possessing 15 or more access devices with intent to defraud.

'Everyone is on alert'

"We  have  not  been  able  to  assess the validity of the threats, but we
certainly  take  any  threats  seriously,  and  we've  taken precautions to
minimize the risk of intrusion," BellSouth spokesman Bill McCloskey said.

"We  are  aware of the purported threat to try and disrupt at least part of
the  nationwide  network,"  said  Herb Linnen, a spokesman for American
Telephone  and  Telegraph Co. "Our corporate security organization has sent
word  around  the  country  to make sure everyone is on alert in the coming
days."

Linnen  said the purported threat was not against any single company. He
said  the  rumor  of  the  attempted  disruption was discussed at a regular
meeting Wednesday of technical executives of a number of phone companies.

"We  have  no  idea  how  widespread  the  threat might be, but it's our
understanding  that  the  group  may  be  national,"  said Peter Goodale, a
spokesman for Nynex Corp., parent of the New England Telephone and New York
Telephone  companies.  "We've  taken  the  appropriate security measures to
ensure the integrity of our network."

Copied 911 program

FBI  and  Defense  Department officials said they were unaware of any such
threat.

Federal  prosecutors  in  Chicago  last year charged that members of the
Legion  of  Doom  had used their computers in February 1989 to tap into the
911 system of Atlanta-based BellSouth and copy the program.

The  information  then  was  published  in  an  electronic newsletter in
Chicago for hackers, but the 911 network was not disrupted.

Charges against the Chicago publisher were dropped in July.

Copyright 1990, San Jose Mercury News

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: elroy!grian!alex@AMES.ARC.NASA.GOV(Alex Pournelle)
Subject: Esquire Hacking Article
Date: Wed, 5 Dec 90 09:55:23 GMT

In the December Esquire magazine (with Michelle Pfeiffer on the cover),
there is an article on "hacking" (system-cracking or password-stealing,
really): "Terminal Delinquents", pp. 174ff, by Jack Hitt and Paul Tough,
under the "Outlaws" banner.  And it deserves some comments.

I plan a rather lengthier commentary on this article, to be sent to the
magazine, but thought it appropriate to tell the hacking community how they
are portrayed.  Certainly, all readers of cu-digest would do well to pick
it up.

The article is written about a small group of New York-based juvenile
hackers (their term) who break into the Nynex billing and phone
add/move/change system--to play around, look around, and just fiddle.  A
little time is spent on the background of phone phreaking (Draper
discovering Cap'n Crunch whistles, blue boxes), essentially none on the
history of actual hacking.

The actions of these teenage trespassers are taken at face value; the only
fact-checking appears to be one call for comment to the Nynex security
office (they had no comment).  Even when they are shown the "White House
PROF system" (perhaps they meant PROFS?), they make no effort at
independent corroboration.

I find it even more disturbing that no editor at Esquire even suggested
some fact-checking.

The authors have not, to my eye, even done basic research like reading The
Cuckoo's Egg.  They talk about "The Internet Virus", not worm; their long
treatise on "social-engineering of passwords" (getting people to tell
them to you, or guessing them) only implicitly and offhandedly mentions the
knife-edge balance between access and security.  There is a lot of
computer-as-electronic-phlogiston talk, some more successful than others.
There is much scare talk about how any dam' fool can get your credit
history from TRW.  There's no direct discussion of how random
system-breakins might endanger lives.

There is essentially no talk about the morality, guidance or beliefs of the
hackers--are we to presume that some Big Brother of government or school is
supposed to teach the good and bad of computers?  Or is this just a
scary-but-true-to-life story about how any pimply-faced bag of teenage
hormones with a modem can change your credit rating forever?

I think the latter.

In short, the piece is maddeningly obtuse in a magazine with a circulation
of over 800,000.  It is long on anecdote and very short on fact.  It is a
disservice to anyone who calls him/her/itself a hacker.  The magazine
deserves to be told this.

      Sincerely,
Alex Pournelle

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From:        P.A.Taylor@EDINBURGH.AC.UK
Subject: Virus Planters from Eastern Europe?
Date:        27 Nov 90  17:22:04 gmt

         FEARS OF COMPUTER VIRUS ATTACK FROM EASTERN EUROPE GROW.
  From: The Independent, Sat 24.11.90, By Susan Watts, Science reporter.

The computer industry in Britain is being warned against an influx of
malicious viruses from eastern Europe.

Governments and companies there use computers less widely than those in the
West. The range of applications is limited and so programmers have time to
write these destructive programs.

Bryan Clough, a computer consultant based in Hove, East Sussex, returned
last week from Bulgaria with 100 viruses unknown in the West.

"People have been writing these as a form of protest against the
authorities.  Some are very good indeed...I am terrified of running them on
my machine but until I do I will have no idea of what they are capable of",
he says.  Mr Clough predicts a wave of virus attacks on Britain, launched
mainly through electronic message systems known as Bulletin boards. One
bulletin board in Birmingham already believes it has been hit by Bulgarian
viruses.  These programs  can corrupt or destroy data stored on a
computer's hard disk.  Jim Bates, who dismantles viruses for Scotland
Yard's Computer Crime Unit,says "I'm having a hell of a job keeping up with
the viruses coming through already.  The problem is that we can only screen
for viruses that we know about".

He warns the computer industry against rogue software from eastern Europe,
Bulgaria and Russia are thought to harbour the most virulent viruses.  The
small but legitimate software industry in Bulgaria complains that
programming is one of the few skills that the industry can exploit. Recent
concern is killing off even this slim chance of gaining hard currency from
overseas.

Part of the problem is that the authorities  do not believe in copyright or
patent protection for software. "Programmers are used to ripping off
software" Mr Clough says, "so that they are expert at hacking into each
others systems and planting viruses."

He found at least 30 people producing viruses in Bulgaria. Most are known
to the police who can do little to stop them since the country has no laws
against computer crime. Even in Britain which introduced legislation
against hacking this summer, virus writers can be arrested only if they
enter a computer system without authority or cause damage once inside.

Scotland Yard's anti-virus team can extradite foreign programmers who flout
this law, if Britain has an extradition treaty with the country concerned.
One of the most worrying of the virus-writers calls himself the "Dark
Avenger".  He has written a number of malicious programs, and Mr Clough
believes he intends to plant these in Britain shortly. Virus detectives are
dismantling one such program called "Nomenklatura", thought to have been
written by this man.

Security experts in Britain fear programmers in the Soviet Union may soon
follow Bulgaria's lead. The Soviet Union has no copyright laws, and some
sections of the software industry are already using viruses as a way to
punish those who steal programs. One such virus displays the message
"Lovechild in "Lovechild:in reward for stealing software" on the screen.

Less than two years ago there were only 20 or so virus programs around, now
there are hundreds. In Bulgaria a new virus appears once a week, Mr Clough
says.

********************************************************************

------------------------------

                           **END OF CuD #2.17**
*********************************************************************