829 lines
35 KiB
Plaintext
829 lines
35 KiB
Plaintext
|
||
|
||
Computer underground Digest Wed July 14 1993 Volume 5 : Issue 52
|
||
ISSN 1004-042X
|
||
|
||
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
|
||
Archivist: Brendan Kehoe
|
||
Shadow-Archivists: Dan Carosone / Paul Southworth
|
||
Ralph Sims / Jyrki Kuoppala
|
||
Ian Dickinson
|
||
Cpyp Editor: Etaoin Shrdlu, Senior
|
||
|
||
CONTENTS, #5.52 (July 14 1993)
|
||
File 1--Subjective opinion (Paul Ferguson Responds to #5.51)
|
||
File 2--Update on 2600 Case
|
||
File 3--BBSes Carrying CuDs
|
||
File 4--Re: CRYPT Newsletter
|
||
|
||
Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
|
||
available at no cost electronically from tk0jut2@mvs.cso.niu.edu. The
|
||
editors may be contacted by voice (815-753-6430), fax (815-753-6302)
|
||
or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL
|
||
60115.
|
||
|
||
Issues of CuD can also be found in the Usenet comp.society.cu-digest
|
||
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
|
||
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
|
||
libraries and in the VIRUS/SECURITY library; from America Online in
|
||
the PC Telecom forum under "computing newsletters;"
|
||
On Delphi in the General Discussion database of the Internet SIG;
|
||
on the PC-EXEC BBS at (414) 789-4210; and on: Rune Stone BBS (IIRG
|
||
WHQ) (203) 832-8441 NUP:Conspiracy; RIPCO BBS (312) 528-5020
|
||
CuD is also available via Fidonet File Request from 1:11/70; unlisted
|
||
nodes and points welcome.
|
||
EUROPE: from the ComNet in LUXEMBOURG BBS (++352) 466893;
|
||
In ITALY: Bits against the Empire BBS: +39-461-980493
|
||
|
||
ANONYMOUS FTP SITES:
|
||
UNITED STATES: ftp.eff.org (192.88.144.4) in /pub/cud
|
||
uglymouse.css.itd.umich.edu (141.211.182.53) in /pub/CuD/cud
|
||
halcyon.com( 202.135.191.2) in /pub/mirror/cud
|
||
aql.gatech.edu (128.61.10.53) in /pub/eff/cud
|
||
AUSTRALIA: ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
|
||
EUROPE: nic.funet.fi in pub/doc/cud. (Finland)
|
||
ftp.warwick.ac.uk in pub/cud (United Kingdom)
|
||
|
||
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
||
information among computerists and to the presentation and debate of
|
||
diverse views. CuD material may be reprinted for non-profit as long
|
||
as the source is cited. Authors hold a presumptive copyright, and
|
||
they should be contacted for reprint permission. It is assumed that
|
||
non-personal mail to the moderators may be reprinted unless otherwise
|
||
specified. Readers are encouraged to submit reasoned articles
|
||
relating to computer culture and communication. Articles are
|
||
preferred to short responses. Please avoid quoting previous posts
|
||
unless absolutely necessary.
|
||
|
||
DISCLAIMER: The views represented herein do not necessarily represent
|
||
the views of the moderators. Digest contributors assume all
|
||
responsibility for ensuring that articles submitted do not
|
||
violate copyright protections.
|
||
|
||
----------------------------------------------------------------------
|
||
|
||
Date: Tue, 13 Jul 93 20:05:52 EDT
|
||
From: fergp@SYTEX.COM(Paul Ferguson)
|
||
Subject: File 1--Subjective opinion (Paul Ferguson Responds to #5.51)
|
||
|
||
Mr. Thomas (and readers of CuD),
|
||
|
||
While my first instinct was to not post any response to your
|
||
scathing series of highly volatile articles (albeit, on a highly
|
||
volatile subject, Cud 5.51), I reconsidered after a colleague
|
||
reminded me that, unfortunately, silence on my part may be
|
||
misinterpreted as some form of admission of guilt. I do regret
|
||
that this instance has created such a stir, but I do not apologize
|
||
for the attention brought upon the AIS system which ultimately
|
||
resulted in the removal of commented virus disassemblies from
|
||
public access.
|
||
|
||
Without launching into a dissertation about the harm caused by
|
||
virus code (both compiled executables and reverse-engineered
|
||
disassemblies), I would like to make a couple of points which are
|
||
commonly taken for granted or disregarded altogether.
|
||
|
||
The debate will obviously continue on virus eXchange systems,
|
||
which name they have been given due to the availability of virus
|
||
disassemblies, creation tools and the likes. (All of which were
|
||
available on AIS.) I get the distinct impression that we have not
|
||
heard the last on this topic. Far from it, I'd wager.
|
||
|
||
On one hand, we have those who argue that virus exchange (Vx) BBSs
|
||
do not further the spread of viruses and efforts to curtail their
|
||
activities are akin to stifling freedom of expression and the flow
|
||
of information. On the other hand, we have those who argue that Vx
|
||
BBSs most certainly aid in the spread of computer viruses simply
|
||
because they allow live computer viruses, source code and
|
||
disassemblies to be freely exchanged as would youngsters trade
|
||
baseball cards.
|
||
|
||
However, baseball cards do not inflict damage, but many times
|
||
viruses do exactly this, in the hands of an unwitting or
|
||
inexperienced computer user.
|
||
|
||
Let's examine, for a moment, some points on both sides of the
|
||
argument.
|
||
|
||
Pro Vx
|
||
|
||
o Individuals in favor of Vx claim that they have seen no
|
||
evidence that virus exchange systems have contributed to
|
||
the spread of viruses.
|
||
|
||
o Proponents of virus exchanges claim that by making viruses
|
||
and disassemblies available to their users, they are providing
|
||
them with the tools necessary to understand how computer viruses
|
||
work. Similarly, once this information is understood, they also
|
||
claim that it contributes to the overall enhancement of the
|
||
computer security knowledge-base of their users.
|
||
|
||
o Many advocates of Vx systems claim that attempts at stemming the
|
||
flow of computer viruses is an idealism which should be protected
|
||
under freedom of expression and freedom of information concepts.
|
||
|
||
Con Vx
|
||
|
||
o Figures reflected in statistics compiled by virtually all
|
||
computer security and antivirus organizations, show a dramatic
|
||
increase in the number of computer viruses within the past three
|
||
years. Since Todor Todorov's Virus eXchange BBS in Bulgaria (which
|
||
was the first of its kind in the world), the number of "underground"
|
||
systems which mimic Todorov's system has risen. And so has the
|
||
number of viruses. Exponentially. Sara Gordon has documented quite
|
||
a bit concerning the impact of these systems; I'd recommend her
|
||
paper(s) on the subject which she has presented on several
|
||
occasions. <vfr@netcom.com>
|
||
|
||
o Viruses and disassemblies which are made available on these
|
||
systems are a potential danger. While live viruses present a more
|
||
immediate threat in the wrong hands, disassemblies can be
|
||
considered even more of a danger (in most cases) because of their
|
||
ability to be easily modified, recompiled and redistributed as
|
||
undetectable variants of existing viruses. These instances have
|
||
happened with increasing frequency and can be directly attributed
|
||
to Vx systems and virus creation groups such as Phalcon/Skism,
|
||
YAM, NuKe and ARCV.
|
||
|
||
o With the availability of virus creation "kits," such as the VCL,
|
||
PS-MPC and the G-squared, even "wannabe" virus writers with little
|
||
or no skill at all can make viruses and distribute them at their
|
||
leisure.
|
||
|
||
o While it should be realized that this type of activity cannot be
|
||
stopped completely, we must acknowledge the fact that Virus
|
||
exchange systems _do_ contribute to the spread of viruses. Virus
|
||
exchanges _do_ contribute to the propagation of new and undetectable
|
||
viruses. Access to live viruses and disassemblies are not necessary
|
||
for gaining knowledge and understanding how they work. A basic
|
||
understanding of assembler language and some practical examples
|
||
(including Ralf Brown's compendium) would suffice.
|
||
|
||
Can there be a common ground on this issue? Probably not. The
|
||
computer virus arena is filled with complex and diversified idealisms
|
||
on the subject. I consider myself a proponent of freedom of
|
||
information, but I also believe there are limits to one's freedom.
|
||
In fact, I'm most fond of the adage,"The freedom to swing your fist
|
||
ends when it meets my face." In other words, one's right to a
|
||
particular freedom ends where it infringes on someone else's rights
|
||
for safety or privacy, in this instance. And the government should
|
||
certainly not allow systems which participate in these type of
|
||
questionable activities to function within their realm of
|
||
responsibility. Simply the appearance of government sponsorship
|
||
tends to lend some form of legitimacy to the activities in question.
|
||
|
||
Proponents of virus exchanges remain unconvinced that making live
|
||
viruses, source code and disassemblies available endangers end-users.
|
||
I'm convinced that not all instances do cause damage, but I'm also
|
||
convinced that many times, it has done exactly this.
|
||
|
||
In the case of the AIS BBS, it was operating under the auspices,
|
||
whether explicitly or implied, of a Federal Office, namely the US
|
||
Department of Treasury. The point in all of this is not necessarily
|
||
what AIS did, but rather, how it was done and the apparent moral
|
||
"high ground" of legitimacy it portrayed by being an apparatus of
|
||
a United States Government office, financed (in part) with taxpayer
|
||
money.
|
||
|
||
I admit that I am dismayed that people do not see the problem here.
|
||
|
||
I certainly claim no "moral high ground" on the issue. I took what I
|
||
thought was the best venue of approach, which was to bring this topic
|
||
out of the shadows and into the forefront for discussion.
|
||
Unfortunately, the discussion was brief, the actions behind the
|
||
scenes were apparently swift and apparently, I've been portrayed as
|
||
some type of computer stool-pigeon who can't stand to see something
|
||
"successful" succeed. Actually, my part in this entire scenario is
|
||
actually very small, although rumor and innuendo would suggest
|
||
otherwise.
|
||
|
||
In an ideal world, we all share the freedom to express our concerns
|
||
and ideas in an open forum. Although I may not agree with what you may
|
||
say, I would give my life for your right to freedom of expression.
|
||
However, let's not confuse concepts of freedom of expression and
|
||
reckless computing (my opinion, implied).
|
||
|
||
After reading my thoughts on the matter, reasonable deduction is an
|
||
exercise left to the reader.
|
||
|
||
To briefly address some selected points made in Cud 5.51:
|
||
|
||
Jim Thomas writes (in File 1 -- Introduction to the AIS BBS
|
||
Controversy) -
|
||
|
||
"Perhaps the anonymous accusers are correct: Some types of
|
||
information may pose a risk if abused. But, in an open democracy,
|
||
the potential for abuse has been neither a necessary nor a
|
||
sufficient justification to silence those with whom we disagree."
|
||
|
||
I am flattered that you suggest I actually have enough clout to
|
||
personally silence AIS, if that is the gist. I took the liberty
|
||
of making it public knowledge, while concurrently voicing _my_
|
||
opinion about its merits. This street goes both ways. Most of us
|
||
are painfully aware of the numerous virus underground systems
|
||
around the world, yet the attention is focused on a solitary
|
||
system run by an employee of the U.S. Treasury Department. Why is
|
||
that? I suggest that most who squeak the loudest in opposition
|
||
to my anonymous (hardly) posting are either a.) not familiar with
|
||
the amount of damage, in both manhours and dollars, caused by
|
||
computer viruses each year, b.) overly radical proponents of
|
||
information exchange who care not what damage may result in said
|
||
exchange, or c.) banging their drum just to bang their drum.
|
||
|
||
(Please note the use of the word "most" in the statement above.)
|
||
|
||
Jim Thomas again writes (in File 6 -- Media, Anti-virus
|
||
personnel, Ethics, and AIS) -
|
||
|
||
"Let's keep some facts straight. 'Mr. Smith (Kouch)' did *not*
|
||
'nail Clancy's coffin.' Paul Ferguson and his friends did with
|
||
anonymous inflammatory posts and with other posts that
|
||
irresponsibly suggest illegal and 'underground' activity."
|
||
|
||
I'll address this directly, since it is obviously your opinion,
|
||
not fact, as you seem to imply. In fact, I think you should have
|
||
used "opinionated" instead of "inflammatory," but that is your
|
||
prerogative. I find it odd that after so much "underground"
|
||
exposure as was afforded AIS in the months preceding my
|
||
"anonymous" post, not an eyebrow was raised. Perhaps Kouch's
|
||
publication is truly "underground" catering specifically to
|
||
hush-hush underground circles of computer vandals? I don't
|
||
think so. Perhaps Cud is truly an "underground" publication?
|
||
I think not. So where's the beef?
|
||
|
||
One "anonymous" post, strategically placed razed the house of
|
||
cards.
|
||
|
||
Mr. Thomas makes one excellent point, however, in the midst of
|
||
the remaining text -
|
||
|
||
"It's said that some people, angered at this affair, are planning
|
||
to retaliate against those judged responsible. This would be an
|
||
ethically bankrupt response."
|
||
|
||
At least we can agree on this point.
|
||
|
||
One final note, for what its worth. I did not post the forwarded
|
||
article to damage Clancy's reputation or to prove any particular
|
||
political point. Personally, I have nothing to gain by the
|
||
results. I do not foolishly sally forth and and do someone else's
|
||
bidding in hopes of gaining favor. I do not publish software
|
||
which would be directly or indirectly beneficial to myself,
|
||
especially anti-virus software (I have done extensive work in
|
||
assembly and have reversed-engineered viruses since their
|
||
appearance, however). I posted the article because I believe
|
||
it is a conflict of interest for any governmental agent to
|
||
openly make viruses and disassemblies available, regardless of
|
||
intent. If only one instance of damage resulted directly from the
|
||
virus-related material available from AIS, then that is one too
|
||
many and I would happily rest my case.
|
||
|
||
What happened to the hacker ethic? I seem to recall a "no damage
|
||
clause" which still echoes in my mind, especially with the advent
|
||
of this fiasco. "Damage?" "Damage," you say, "What Damage?" "AIS
|
||
only made it available -- they're not responsible for what is
|
||
done with it!"
|
||
|
||
Now that I think about about it again, I'm really "not sorry."
|
||
|
||
Cynically,
|
||
|
||
Paul Ferguson | "Confidence is the feeling you get
|
||
Network Integrator | just before you fully understand
|
||
Centreville, Virginia USA | the problem."
|
||
fergp@sytex.com | - Murphy's 7th Law of Computing
|
||
|
||
Quis Custodiet Ipsos Custodes?
|
||
|
||
------------------------------
|
||
|
||
Date: Tue, 13 Jul 1993 14:33:44 EST
|
||
From: David Sobel <dsobel@WASHOFC.CPSR.ORG>
|
||
Subject: File 2--Update on 2600 Case
|
||
|
||
UPDATE ON 2600 CASE
|
||
|
||
The Secret Service recently admitted that it possesses six previously
|
||
unacknowledged documents relating to the break-up of a 2600 meeting at
|
||
Pentagon City Mall last November. In conjunction with that admission,
|
||
the agency has filed an affidavit executed by the Special Agent in
|
||
Charge of its Washington field office. The affidavit, which is
|
||
re-printed below, provides the most detailed explanation yet of the
|
||
Secret Service's role in this affair.
|
||
|
||
The most important parts of the affidavit appear to be paragraphs
|
||
22-24, which state that "the Secret Service received information from
|
||
a business indicating that that business' PBX had been manipulated,"
|
||
and that the business provided the agency with "certain information
|
||
concerning the individual(s) who had entered the system." Based on
|
||
these statements, here is the best guess of what happened: 1) the
|
||
"victim business" had some reason to believe that the individual
|
||
involved had some relationship to 2600; 2) the business passed this
|
||
information on to the Secret Service; 3) the Secret Service knew that
|
||
people associated with 2600 met at the mall on a regular basis; and 4)
|
||
the Secret Service recruited the mall security personnel to identify
|
||
the individuals attending the monthly meetings.
|
||
|
||
The litigation of CPSR's FOIA case against the Secret Service is
|
||
proceeding, and new information will continue to be posted as it is
|
||
obtained.
|
||
|
||
CPSR is a national organization of individuals concerned about the
|
||
impact of computer technology on society. The best way to support
|
||
CPSR's work is to become a member. For more information, write to
|
||
<cpsr@cpsr.org> .
|
||
|
||
David Sobel
|
||
CPSR Legal Counsel
|
||
dsobel@washofc.cpsr.org
|
||
|
||
|
||
================================================================
|
||
|
||
UNITED STATES DISTRICT COURT
|
||
FOR THE DISTRICT OF COLUMBIA
|
||
|
||
|
||
|
||
Computer Professionals )
|
||
for Social Responsibility, )
|
||
)
|
||
Plaintiff )
|
||
) Civil Action No. 93-0231
|
||
v. )
|
||
)
|
||
United States Secret Service, )
|
||
)
|
||
Defendant )
|
||
|
||
|
||
PUBLIC DECLARATION OF WILLIAM F. BURCH,
|
||
SPECIAL AGENT IN CHARGE,
|
||
UNITED STATES SECRET SERVICE, WASHINGTON FIELD OFFICE
|
||
|
||
|
||
I, William F. Burch hereby depose and say:
|
||
|
||
1. I am the Special Agent in Charge (SAIC) of the
|
||
United States Secret Service (hereinafter Secret Service),
|
||
Washington Field office having held this position since
|
||
January 24, 1993. I have been employed as a Special Agent of
|
||
the Secret Service since January 20, 1969.
|
||
|
||
2. I am providing this declaration in connection with the
|
||
above-captioned civil action arising under the Freedom of
|
||
Information Act (FOIA). The purpose of this declaration is to
|
||
address matters raised by the plaintiff in Plaintiff's Memorandum
|
||
in Opposition to Defendant's Motion for Summary Judgement and in
|
||
Support of Plaintiff's Cross-motion for Summary Judgement
|
||
(hereinafter Plaintiff's Memorandum).
|
||
|
||
|
||
|
||
[1]
|
||
|
||
|
||
|
||
3. This declaration is provided for the public record
|
||
and is somewhat limited, as the records which are at issue in this
|
||
case were compiled by the Secret Service in the course of a
|
||
criminal matter which is currently open and ongoing. I have,
|
||
however, also provided a separate and more detailed declaration
|
||
for in camera review by this Court.
|
||
|
||
4. In my position as the Special Agent in Charge of the
|
||
Washington Field Office, I am aware that plaintiff submitted to
|
||
the Secret Service a FOIA request for information in the
|
||
possession of the Secret Service which concerns "the breakup of
|
||
a meeting of individuals" associated with the "2600 Club" at the
|
||
"Pentagon City Mall in Arlington, Virginia on November 6, 1992."
|
||
|
||
5. In January of 1993, my office received a written request
|
||
from the Secret Service's Freedom of Information and Privacy Acts
|
||
(FOI/PA) Office asking that my office search its records to
|
||
determine if it maintained information concerning plaintiff's FOIA
|
||
request.
|
||
|
||
6. Pursuant to this request my office realized that it was
|
||
maintaining records concerning an ongoing criminal matter and that
|
||
these records might contain information which was responsive to
|
||
plaintiff's FOIA request.
|
||
|
||
7. It was then directed that a copy of all records
|
||
concerning this criminal investigation be provided to Secret
|
||
Service headquarters.
|
||
|
||
|
||
|
||
2
|
||
|
||
|
||
|
||
8. In May of this year I was asked to provide an in camera
|
||
and a public declaration concerning the underlying criminal
|
||
investigation and the records concerning that investigation which
|
||
related to plaintiff's FOIA request.
|
||
|
||
9. In the original draft of these declarations I noted that
|
||
they referred only to certain newspaper articles and two specific
|
||
records. Through my discussions with the "case agent" assigned to
|
||
the underlying criminal matter, I was, however, personally aware
|
||
that my office maintained certain additional records which
|
||
appeared to concern plaintiff's FOIA request.
|
||
|
||
10. Upon further review I found that inadvertently copies
|
||
of certain records which were in the possession of my office and
|
||
which appeared to be responsive to plaintiff's FOIA request were
|
||
not in the possession of the Secret Service FOI/PA.
|
||
|
||
11. Copies of all records maintained by my office which
|
||
records concern plaintiff's FOIA request, and which records were
|
||
in the possession of my office at the time this office's original
|
||
search for material responsive to plaintiff's FOIA request,l
|
||
have now been provided to Secret Service headquarters.
|
||
|
||
|
||
------------------------
|
||
1 The underlying criminal investigation has continued and,
|
||
therefore, additional records have been compiled by the Secret
|
||
Service in regard to that investigation.
|
||
|
||
|
||
|
||
3
|
||
|
||
|
||
|
||
12. Additionally, a record by record, page by page
|
||
comparison has been made of the information maintained in the
|
||
Washington Field Office, which information was in the possession
|
||
of the Secret Service at the time of my office's original search
|
||
for information responsive to plaintiff's FOIA request, with the
|
||
copies of the records which have now been provided to Secret
|
||
Service headquarters. This comparison showed that these two
|
||
groups of records are now identical.
|
||
|
||
13. The records which concern plaintiff's FOIA request,
|
||
with the exception of the newspaper articles, had been provided to
|
||
the Secret Service fron a confidential source and had been
|
||
compiled for law enforcement purposes.
|
||
|
||
14. The information contained in these records was compiled
|
||
in order to identify and to further investigate individual(s) who
|
||
are considered to be possible suspect(s) in a criminal
|
||
investigation being conducted by the Secret Service, which
|
||
investigation relates to a violation of Title 18 of the United
|
||
States Code, Section 1029, and/or 1030, "Fraud and related
|
||
activity in connection with access devices," and "Fraud and
|
||
related activity in connection with computers."
|
||
|
||
15. More specifically, the Secret Service has reason to
|
||
believe that the suspect(s) in this case had gained access to a
|
||
Public Branch Exchange (PBX) owned by a private company and
|
||
manipulated that PBX so as to enable the commission of several
|
||
tens of thousands of dollars of telephone toll fraud.
|
||
|
||
|
||
|
||
4
|
||
|
||
|
||
|
||
16. It is my understanding that at the request of my
|
||
office the records at issue in this case, with the exception of
|
||
the newspaper articles, were withheld from release due to the
|
||
ongoing nature of the enforcement proceeding, as to release the
|
||
information could constitute an invasion of the privacy of certain
|
||
individuals, as the records at issue had been provided to the
|
||
Secret Service by a confidential source, and as to release the
|
||
records would reveal the identity of confidential sources.
|
||
|
||
17. I have been advised that plaintiff is now claiming that
|
||
the Secret Service's action in withholding these records was
|
||
improper. In particular, I have been advised that plaintiff is
|
||
alleging that the records have been improperly withheld as the
|
||
Secret Service does not have the authority to conduct investiga-
|
||
tions in the area of computer crime, and, as the Secret Service is
|
||
not conducting a criminal investigation, but "'merely engaging in
|
||
a general monitoring of private individuals activities' .... or
|
||
conducting an inquiry 'for purposes of harassment'." Plaintiff's
|
||
Memorandum, page 5.
|
||
|
||
18. While I am not an expert in the proprieties of releasing
|
||
or withholding information under the FOIA, as the Special Agent in
|
||
Charge of the Secret Service's Washington Field office, I can
|
||
provide relevant information concerning the Secret Service's
|
||
investigative authority and the underlying criminal investigation
|
||
through which the records in question came into the possession of
|
||
the Secret Service.
|
||
|
||
|
||
|
||
5
|
||
|
||
|
||
|
||
19. The Secret Service is a criminal law enforcement agency
|
||
which operates under the provisions of Title 18 of the United
|
||
States Code, Section 3056. Under Section 3056, Subsection (b),
|
||
the Secret Service is specifically authorized to detect and arrest
|
||
any person who violates federal criminal laws relating to coins,
|
||
obligations, and securities of the United States and foreign
|
||
governments, electronic fund transfers, credit or debit card
|
||
fraud, false identification documents or devices, false
|
||
identification documents and devices, and certain laws relating to
|
||
financial institutions. Additionally, pursuant to Title 18 of
|
||
the United States Code, Sections 1029 and 1030, the Secret Service
|
||
is specifically charged with the authority to investigate offenses
|
||
concerning fraud and related activity in connection with computers
|
||
and/or access devices. See Title 18 U.S.C. 1030(d), Fraud and
|
||
related activity in connection with computers ("The United States
|
||
States Secret Service shall ... have the authority to investigate
|
||
offenses under this section."). Contrary to plaintiff's argument,
|
||
the Secret Service does, therefore, have clear statutory authority
|
||
to conduct criminal investigations relating to computer fraud.
|
||
|
||
20. With regard to plaintiff's allegation that the Secret
|
||
Service was "merely engaging in a general monitoring of private
|
||
individuals' activities" .... or conducting an inquiry "for
|
||
purposes of harassment," (Plaintiff's Memorandum, page 5), I
|
||
would state that there is absolutely no truth to plaintiff's
|
||
suggestion.
|
||
|
||
|
||
|
||
6
|
||
|
||
|
||
|
||
21. The records which are at issue in this case were
|
||
provided to the Secret Service by a confidential source and were
|
||
compiled by the Secret Service for law enforcement purposes --
|
||
the identification of possible suspect(s) in a criminal
|
||
investigation and the further investigation of the suspect(s).
|
||
|
||
22. In connection with its law enforcement
|
||
responsibilities, the Secret Service received information from a
|
||
business indicating that that business' PBX had been manipulated
|
||
and that as a result the business had been the victim of long
|
||
distance telephone toll fraud.
|
||
|
||
23. The victim business provided the Secret Service with
|
||
information which might lead to the individual(s) who had
|
||
manipulated the system or utilized the manipulated system to
|
||
steal telephone time.
|
||
|
||
24 The victim business had access to certain information
|
||
concerning the individual(s) who had entered the system, but could
|
||
not directly identify the individual(s) involved. It was,
|
||
through a follow-up investigation and an attempt to identify the
|
||
individual(s) who had committed this fraud, that the Secret
|
||
Service came into the possession of the information which is at
|
||
issue in this case.
|
||
|
||
25. The details of the law enforcement proceeding which
|
||
underlies this matter are set out in my in camera declaration.
|
||
I believe, however, that the generic facts as described above show
|
||
|
||
|
||
|
||
7
|
||
|
||
|
||
|
||
that the records which are at issue in this case were compiled by
|
||
the Secret Service for valid law enforcement purposes.
|
||
|
||
26. I am aware that plaintiff is arguing that the records at
|
||
issue have been improperly withheld as the records consist of
|
||
information which is already known to the subject(s) of the
|
||
investigation. To the knowledge of the Secret Service, however,
|
||
this is not correct. At this time the Secret Service has no
|
||
reason to believe that the suspect(s) in its investigation, or the
|
||
plaintiff in this case, are aware of the nature of the Secret
|
||
Service's investigation, who is under investigation by the
|
||
Secret Service, what information is in the possession of the
|
||
Secret Service, or who has provided information to the Secret
|
||
Service in regard to this matter.
|
||
|
||
27. I am also aware that the plaintiff argues that "the
|
||
shopping mall was clearly the source of the records being
|
||
withheld." Again contrary to plaintiff's argument, to date there
|
||
has been no public statement that the "Mall" is the source of the
|
||
information which is being withheld.
|
||
|
||
28. Additionally, the Secret Service recently contacted the
|
||
source to determine the position of the source in regard to this
|
||
matter. At this time, the source reiterated the source's original
|
||
position and understanding that the fact that it had provided
|
||
certain information to the Secret Service would not be revealed.
|
||
|
||
|
||
|
||
8
|
||
|
||
|
||
|
||
29. Further, the records at issue also contain information
|
||
concerning a second source of information which source has since
|
||
provided information to the Secret Service in regard to the
|
||
underlying criminal case.
|
||
|
||
30. Due to the nature of the investigative work conducted
|
||
by the Secret Service, this agency must protect from exposure the
|
||
sources which the Secret Service utilizes to gain information in
|
||
the course of its criminal investigations. In the course of its
|
||
investigative function the Secret Service routinely receives
|
||
information from various sources with the understanding that,
|
||
unless the source is needed to provide testimony or records
|
||
in a criminal trial, the fact of that source's cooperation will
|
||
not be revealed to the public. Further, information is often
|
||
provided by a source with the understanding that at the time of a
|
||
criminal trial a subpoena will be issued to protect the fact of
|
||
the earlier cooperation of the source. Therefore, if such
|
||
confidential sources are compromised by premature exposure, the
|
||
result could have a chilling effect on the law enforcement
|
||
function of the Secret Service in that, in the future, such
|
||
sources would be less cooperative with the Secret Service, and
|
||
federal law enforcement in general.
|
||
|
||
31. It is, then, reasonable and necessary that the Secret
|
||
service preserve its relationship with confidential sources by
|
||
protecting from release information which would expose the
|
||
cooperation of such sources with the Secret Service.
|
||
|
||
|
||
|
||
9
|
||
|
||
|
||
|
||
32. As I have attempted to describe above, the records which
|
||
are being withheld in this case are records which were compiled
|
||
by the Secret Service for law enforcement purposes. Further,
|
||
the release of the records could result in interference with an
|
||
open enforcement proceeding, an invasion of the personal privacy
|
||
of third parties, reveal information provided by a confidential
|
||
source and compromise the future cooperation of a confidential
|
||
source, by revealing the cooperation of those sources with the
|
||
Secret Service. My office has, therefore, requested that the
|
||
records involved in this matter continue to be withheld.
|
||
|
||
|
||
I declare under penalty of perjury that the foregoing is true
|
||
to the best of my knowledge and belief.
|
||
|
||
|
||
|
||
/Signed/
|
||
|
||
William F. Burch
|
||
Special Agent in Charge
|
||
Washington Field Office
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
10
|
||
|
||
=================================================================
|
||
|
||
------------------------------
|
||
|
||
Date: Wed, 7 July, 1993 21:43:12 CDT
|
||
From: CuD Moderators <tk0jut2@mvs.cso.niu.edu>
|
||
Subject: File 3--BBSes Carrying CuDs
|
||
|
||
We receive a number of letters, faxes, phone calls, and psychic vibes
|
||
each week from non-net users asking how CuDs can be retrieved without
|
||
Internet access. We will periodically run BBS numbers where ya'll can
|
||
obtain CuDs. Canadian readers are especially interested in Montreal,
|
||
Toronto, and Vancouver boards, so we'd like to receive some numbers to
|
||
pass.
|
||
|
||
The CuD header lists a variety of world-wide outlets for CuD. We
|
||
encourage U.S. readers to call RIPCO (312-528-5020), The Works
|
||
(617-861-8976), or Rune Stone (203-832-8441).
|
||
|
||
+++++++++++++
|
||
|
||
Date--Tue, 6 Jul 93 21:19:42 CST
|
||
From--bazooka%podbox@CS.UTEXAS.EDU(Bob Anderson)
|
||
Subject--BBSes that carry CuD
|
||
|
||
Dear CuD,
|
||
|
||
Thanks for being there!
|
||
|
||
Here's a listing for you of another BBS that has CuD available.
|
||
|
||
BBS name: Pair O Dice
|
||
BBS numbers: 1.512.451.4610 @ 300 - 2400 baud
|
||
1.512.451.7117 @ 2400 - 14400 baud
|
||
BBS hours: 24 hours
|
||
BBS location: Austin, Texas, USA
|
||
|
||
Pod both subscribes to comp.society.cu.digest and also keeps current
|
||
and past issues online in it's gfile area as well as various other
|
||
ezines that deal with the computer underground, art and virtual
|
||
culture.
|
||
|
||
We specialize in original computer graphics and are also a dialup
|
||
site for the OTIS image collection. We have also just received
|
||
permission from the Smithsonian to stock images from their PHOTO1
|
||
collection.
|
||
|
||
Pair O Dice is an official Info Site for EFF-Austin and the
|
||
sysop is a long time member of the EFF.
|
||
|
||
We offer about 75 newsgroups, publicly subscribe to a few mailing
|
||
lists, have a good selection of online games and carry basic
|
||
support programs for the Amiga as well as important programs for
|
||
the Mac and MS-DOS users such as PD graphic viewers and convertors.
|
||
|
||
The system is run on an Amiga and uses the CNet bbs software and
|
||
Amiga UUCP.
|
||
|
||
++++++
|
||
|
||
From--ehunt%bsc835@UUNET.UU.NET
|
||
Subject--CuD Carrying BBS
|
||
Date--Mon, 5 Jul 93 14:31:55 CDT
|
||
|
||
BBS Name: The MATRIX
|
||
BBS Phone: 205-323-2016 - 2400 bps only
|
||
205-323-6016 - V.32/V.32bis/HST only (no 2400)
|
||
205-458-3449 - V.32/V.32bis only (no 2400)
|
||
21 total incoming phone lines
|
||
Hours: 24
|
||
CuDs from Volume 2 to current online. All issues of EFFector Online.
|
||
All issues of Quanta and InterText (ASCII only).
|
||
|
||
CuD and EFFector Online available for DL on first call. 15 hour
|
||
complimentary subscription given to all new callers, but takes 1-2
|
||
weeks for activation.
|
||
|
||
Home BBS for the American BBS Association (ABBSA)
|
||
|
||
Over 130,000 files available in addition to CuD and EFFector Online.
|
||
Most major PC based echonets as well as an Internet Email feed and
|
||
small assortment of UseNet newsgroups.
|
||
|
||
Located in Birmingham, Alabama.
|
||
|
||
+++++++
|
||
|
||
From--Chuck Frieser <summarized from snailmail>
|
||
|
||
Chuck Frieser's BBS, in Beverly, Mass, carries CuD online through
|
||
the ReadRoom Door (written by Michael Gibbs of The Infomat BBS).
|
||
Chuck's board number is (508) 927-6712.
|
||
|
||
------------------------------
|
||
|
||
Date: Mon, 12 Jul 93 09:04:36 EDT
|
||
From: morgan@ENGR.UKY.EDU(Wes Morgan)
|
||
Subject: File 4--Re: CRYPT Newsletter
|
||
|
||
>Date--Mon, 21 Jun 93 21:18:31 EDT
|
||
>From--Urnst Kouch <70743.1711@COMPUSERVE.COM>
|
||
>Subject--File 5--Fear and Loathing--On the Virus Code Trail at AIS
|
||
>
|
||
>((Urnst Kouch is editor of CRYPT NEWSLETTER. Additional details on the
|
||
>background of the incident and those involved can be found
|
||
>in CRYPT NEWSLETTER #16)).
|
||
|
||
I'd like to make a public apology to Urnst Kouch and the authors/editors
|
||
of CRYPT Newsletter.
|
||
|
||
After reading an interview with Urnst Kouch in a previous issue of CuD,
|
||
I made several comments about both him and CRYPT Newsletter. A kind
|
||
individual (who shall remain nameless) sent me a sample copy of CRYPT,
|
||
and I found that the excerpts printed in CuD were in no way represen-
|
||
tative of the editorial slant of the newsletter as a whole. In fact,
|
||
I found it both comprehensive and well-written in all respects; if
|
||
subscriptions are available via email, I'd greatly appreciate the ad-
|
||
dition of my address to the subscription list. (I don't cruise the
|
||
BBSs as much as I once did; a new daughter tends to cut down on one's
|
||
time online.)
|
||
|
||
Again, I offer my apologies to Urnst and his associates. I may not
|
||
condone every position presented by individual articles, but my com-
|
||
ments about CRYPT were "way out of line." Please consider my earlier
|
||
comments retracted, and feel free to either delete my previous com-
|
||
ments in your archive files or append to them this apology/retraction.
|
||
|
||
--Wes Morgan
|
||
|
||
------------------------------
|
||
|
||
End of Computer Underground Digest #5.52
|
||
************************************
|
||
|
||
|
||
|