856 lines
38 KiB
Plaintext
856 lines
38 KiB
Plaintext
Computer underground Digest Thu Aug 18, 1994 Volume 6 : Issue 74
|
|
ISSN 1004-042X
|
|
|
|
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
|
|
Archivist: Brendan Kehoe
|
|
Retiring Shadow Archivist: Stanton McCandlish
|
|
Shadow-Archivists: Dan Carosone / Paul Southworth
|
|
Ralph Sims / Jyrki Kuoppala
|
|
Ian Dickinson
|
|
Campy Editor: Shrdlu Etaionsky
|
|
|
|
CONTENTS, #6.74 (Thu, Aug 18, 1994)
|
|
|
|
|
|
Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
|
|
available at no cost electronically.
|
|
|
|
CuD is available as a Usenet newsgroup: comp.society.cu-digest
|
|
|
|
Or, to subscribe, send a one-line message: SUB CUDIGEST your name
|
|
Send it to LISTSERV@UIUCVMD.BITNET or LISTSERV@VMD.CSO.UIUC.EDU
|
|
The editors may be contacted by voice (815-753-0303), fax (815-753-6302)
|
|
or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL
|
|
60115, USA.
|
|
|
|
Issues of CuD can also be found in the Usenet comp.society.cu-digest
|
|
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
|
|
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
|
|
libraries and in the VIRUS/SECURITY library; from America Online in
|
|
the PC Telecom forum under "computing newsletters;"
|
|
On Delphi in the General Discussion database of the Internet SIG;
|
|
on RIPCO BBS (312) 528-5020 (and via Ripco on internet);
|
|
and on Rune Stone BBS (IIRGWHQ) (203) 832-8441.
|
|
CuD is also available via Fidonet File Request from
|
|
1:11/70; unlisted nodes and points welcome.
|
|
|
|
EUROPE: from the ComNet in LUXEMBOURG BBS (++352) 466893;
|
|
In ITALY: Bits against the Empire BBS: +39-461-980493
|
|
In BELGIUM: Virtual Access BBS: +32.69.45.51.77 (ringdown)
|
|
|
|
UNITED STATES: etext.archive.umich.edu (141.211.164.18) in /pub/CuD/
|
|
ftp.eff.org (192.88.144.4) in /pub/Publications/CuD
|
|
aql.gatech.edu (128.61.10.53) in /pub/eff/cud/
|
|
world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/
|
|
uceng.uc.edu in /pub/wuarchive/doc/EFF/Publications/CuD/
|
|
wuarchive.wustl.edu in /doc/EFF/Publications/CuD/
|
|
EUROPE: nic.funet.fi in pub/doc/cud/ (Finland)
|
|
ftp.warwick.ac.uk in pub/cud/ (United Kingdom)
|
|
|
|
JAPAN: ftp.glocom.ac.jp /mirror/ftp.eff.org/
|
|
|
|
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
|
information among computerists and to the presentation and debate of
|
|
diverse views. CuD material may be reprinted for non-profit as long
|
|
as the source is cited. Authors hold a presumptive copyright, and
|
|
they should be contacted for reprint permission. It is assumed that
|
|
non-personal mail to the moderators may be reprinted unless otherwise
|
|
specified. Readers are encouraged to submit reasoned articles
|
|
relating to computer culture and communication. Articles are
|
|
preferred to short responses. Please avoid quoting previous posts
|
|
unless absolutely necessary.
|
|
|
|
DISCLAIMER: The views represented herein do not necessarily represent
|
|
the views of the moderators. Digest contributors assume all
|
|
responsibility for ensuring that articles submitted do not
|
|
violate copyright protections.
|
|
|
|
----------------------------------------------------------------------
|
|
|
|
Date: 10 Aug 1994 16:58:23 -0500
|
|
From: mech@eff.org (Stanton McCandlish)
|
|
Subject: EFF Analysis of Leahy/Edwards Digital Telephony Bill
|
|
|
|
EFF SUMMARY OF THE EDWARDS/LEAHY DIGITAL TELEPHONY BILL
|
|
=======================================================
|
|
|
|
|
|
OVERVIEW
|
|
--------
|
|
|
|
The Edwards/Leahy Digital Telephony bill places functional
|
|
requirements on telecommunications carriers in order to enable law
|
|
enforcement to continue to conduct authorized electronic surveillance. It
|
|
allows a court to impose fines on carriers that violate the requirements,
|
|
and mandates that the processes for determining capacity requirements and
|
|
technical standards be open and public. The bill also contains significant
|
|
new privacy protections; including an increased standard for government
|
|
access to transactional data (such as addressing information contained in
|
|
electronic mail logs), a requirement that information acquired through the
|
|
use of pen registers or trap and trace devices not disclose the physical
|
|
location of an individual, and an expansion of current law to protect the
|
|
radio portion of cordless telephone conversations from unauthorized
|
|
surveillance.
|
|
|
|
|
|
SCOPE OF THE BILL. WHO IS COVERED?
|
|
-----------------------------------
|
|
|
|
The requirements of the bill apply to "telecommunications carriers", which
|
|
are defined as any person or entity engaged in the transmission or
|
|
switching of wire or electronic communications as a common carrier for hire
|
|
(as defined by section 3 (h) of the Communications Act of 1934), including
|
|
commercial mobile services (cellular, PCS, etc.). The bill also applies to
|
|
those persons or entities engaged in providing wire or electronic
|
|
communication switching or transmission service to the extent
|
|
that the FCC finds that such service is a replacement for a substantial
|
|
portion of the local telephone exchange.
|
|
|
|
The bill does not apply to online communication and information services
|
|
such as Internet providers, Compuserve, AOL, Prodigy, and BBS's. It also
|
|
excludes private networks, PBX's, and facilities which only interconnect
|
|
telecommunications carriers or private networks (such as most long
|
|
distance service).
|
|
|
|
|
|
REQUIREMENTS IMPOSED ON CARRIERS
|
|
--------------------------------
|
|
|
|
Telecommunications carriers would be required to ensure that they
|
|
possess sufficient capability and capacity to accommodate law enforcement's
|
|
needs. The bill distinguishes between capability and capacity
|
|
requirements, and ensures that the determination of such requirements occur
|
|
in an open and public process.
|
|
|
|
|
|
CAPABILITY REQUIREMENTS
|
|
-----------------------
|
|
|
|
A telecommunications carrier is required to ensure that, within four years
|
|
from the date of enactment, it has the capability to:
|
|
|
|
1. expeditiously isolate the content of a targeted communication
|
|
within its service area;
|
|
|
|
2. isolate call-identifying information about the origin and
|
|
destination of a targeted communication;
|
|
|
|
3. enable the government to access isolated communications at a point away
|
|
from the carrier's premises and on facilities procured by the
|
|
government, and;
|
|
|
|
4. to do so unobtrusively and in such a way that protects the privacy and
|
|
security of communications not authorized to be intercepted (Sec.
|
|
2601).
|
|
|
|
However, the bill does not permit law enforcement agencies or officers to
|
|
require the specific design of features or services, nor does it prohibit a
|
|
carrier from deploying any feature or service which does not meet the
|
|
requirements outlined above.
|
|
|
|
|
|
CAPACITY REQUIREMENTS
|
|
---------------------
|
|
|
|
Within 1 year of enactment of the bill, the Attorney General must
|
|
determine the maximum number of intercepts, pen register, and trap and
|
|
trace devices that law enforcement will require four years from the date of
|
|
enactment. Notices of capacity requirements must be published in the
|
|
Federal Register (Sec. 2603). Carriers have 4 years to comply with
|
|
capacity requirements.
|
|
|
|
|
|
PROCESS FOR DETERMINING TECH. STANDARDS TO IMPLEMENT CAPABILITY REQUIREMENTS
|
|
----------------------------------------------------------------------------
|
|
|
|
Telecommunications carriers, through trade associations or standards
|
|
setting bodies and in consultation with the Attorney General, must
|
|
determine the technical specifications necessary to implement the
|
|
capability requirements (Sec. 2606).
|
|
|
|
The bill contains a 'safe harbor' provision, which allows a carrier to meet
|
|
its obligations under the legislation if it is in compliance with publicly
|
|
available standards set through this process. A carrier may deploy a
|
|
feature or service in the absence of technical standards, although in such
|
|
a case the carrier would not be covered by the safe harbor provision and
|
|
may be found in violation.
|
|
|
|
Furthermore, the legislation allows any one to file a motion at the FCC in
|
|
the event that a standard violates the privacy and security of
|
|
telecommunications networks or does not meet the requirements of the bill
|
|
(Sec. 2606). If petitioned under this section, the FCC may establish
|
|
technical requirements or standards that:
|
|
|
|
1) meet the capability requirements (in Sec. 2602);
|
|
|
|
2) protect the privacy and security of communications not authorized
|
|
to be intercepted, and;
|
|
|
|
3) encourage the provision of new technologies and services to the public.
|
|
|
|
|
|
ENFORCEMENT AND PENALTIES
|
|
-------------------------
|
|
|
|
In the event that a court or the FCC deems a technical standard to be
|
|
insufficient, or if law enforcement finds that it is unable to conduct
|
|
authorized surveillance because a carrier has not met the requirements of
|
|
this legislation, the Attorney General can request that a court issue an
|
|
enforcement order (an order directing a carrier to comply), and/or a fine
|
|
of up to $10,000 per day for each day in violation (Sec. 2607). However, a
|
|
court can issue an enforcement order or fine a carrier only if it can be
|
|
determined that no other reasonable alternatives are available to law
|
|
enforcement. This provision allows carriers to deploy features and
|
|
services which may not meet the requirements of the bill. Furthermore,
|
|
this legislation does not permit the government to block the adoption or
|
|
use of any feature or service by a telecommunications carrier which does
|
|
not meet the requirements.
|
|
|
|
The bill requires the government to reimburse carriers for all reasonable
|
|
costs associated with complying with the capacity requirements. In other
|
|
words, the government will pay for upgrades of current features or
|
|
services, as well as any future upgrades which may be necessary, pursuant
|
|
to published notices of capacity requirements (Sec. 2608).
|
|
|
|
There is $500,000,000 authorized for appropriation to cover the costs of
|
|
government reimbursements to carriers. In the event that a smaller sum is
|
|
actually appropriated, the bill allows a court to determine whether a
|
|
carrier must comply (Sec. 2608 (d)). This section recognizes that
|
|
telecommunications carriers may not be responsible for meeting the
|
|
requirements if the government does not cover reasonable costs.
|
|
|
|
The government is also required to submit a report to congress within four
|
|
years describing all costs paid to carriers for upgrades (Sec. 4).
|
|
|
|
|
|
ENHANCED PRIVACY PROTECTIONS
|
|
----------------------------
|
|
|
|
The legislation contains enhanced privacy protections for transactional
|
|
information (such as telephone toll records and electronic mail logs)
|
|
generated in the course of completing a communication. Current law permits
|
|
law enforcement to gain access to transactional information through a
|
|
subpoena. The bill establishes a higher standard for law enforcement
|
|
access to transactional data contained electronic mail logs and other
|
|
online records. Telephone toll records would still be available through a
|
|
subpoena. Under the new standard, law enforcement is required to obtain a
|
|
court order by demonstrating specific and articulable facts that electronic
|
|
mail logs and other online transactional records are relevant and material
|
|
to an ongoing criminal investigation (Sec. 10).
|
|
|
|
Law enforcement is also prohibited from remotely activating any
|
|
surveillance capability. All intercepts must be conducted with the
|
|
affirmative consent of a telecommunications carrier and activated by a
|
|
designated employee of the carrier within the carrier's facilities (Sec.
|
|
2604).
|
|
|
|
The bill further requires that, when using pen registers and trap and trace
|
|
devices, law enforcement will use, when reasonably available, devices which
|
|
only provide call set up and dialed number information (Sec. 10). This
|
|
provision will ensure that as law enforcement employs new technologies in
|
|
pen register and trap and trace devices, it will not gain access to
|
|
additional call setup information beyond its current authority.
|
|
|
|
Finally, the bill extends the Electronic Communications Privacy Act (ECPA)
|
|
protections against interception of wireless communications to cordless
|
|
telephones, making illegal the intentional interception of the radio
|
|
portion of a cordless telephone (the transmission between the handset
|
|
and the base unit).
|
|
|
|
|
|
CELLULAR SCANNERS
|
|
-----------------
|
|
|
|
The bill makes it a crime to possess or use an altered telecommunications
|
|
instrument (such as a cellular telephone or scanning receiver) to obtain
|
|
unauthorized access to telecommunications services (Sec. 9). This
|
|
provision is intended to prevent the illegal use of cellular and other
|
|
wireless communications services. Violations under this section face
|
|
imprisonment for up to 15 years and a fine of up to $50,000.
|
|
|
|
|
|
IMPROVEMENTS OF THE EDWARDS/LEAHY BILL OVER PREVIOUS FBI PROPOSALS
|
|
------------------------------------------------------------------
|
|
|
|
The Digital Telephony legislative proposal was first offered in 1992 by the
|
|
Bush Administration. The 1992 version of the bill:
|
|
|
|
* applied to all providers of wire or electronic communications
|
|
services (no exemptions for information services, interexchange
|
|
carriers or private networks);
|
|
|
|
* gave the government the explicit authority to block or enjoin a
|
|
feature or service that did not meet the requirements;
|
|
|
|
* contained no privacy protections;
|
|
|
|
* contained no public process for determining the capacity
|
|
requirements;
|
|
|
|
* contained no government reimbursement (carriers were responsible
|
|
for meeting all costs);
|
|
|
|
* would have allowed remote access to communications by law
|
|
enforcement, and;
|
|
|
|
* granted telecommunications carriers only 18 months to comply.
|
|
|
|
The Bush Administration proposal was offered on capitol hill for almost a
|
|
year, but did attract any congressional sponsors.
|
|
|
|
The proposal was again offered under the Clinton Administration's FBI in
|
|
March of 1993. The Clinton Administration's bill was a moderated version
|
|
of the original 1992 proposal:
|
|
|
|
* It required the government to pay all reasonable costs incurred by
|
|
telecommunications carriers in retrofitting their facilities in
|
|
order to correct existing problems;
|
|
|
|
* It encouraged (but did not require), the Attorney General to consult
|
|
with telecommunications industry representatives and standards
|
|
bodies to facilitate compliance,
|
|
|
|
* It narrowed the scope of the legislation to common carriers, rather
|
|
than all providers of electronic communications services.
|
|
|
|
Although the Clinton Administration version was an improvement
|
|
over the Bush Administration proposal, it did not address the
|
|
larger concerns of public interest organizations or the
|
|
telecommunications industry. The Clinton Administration version:
|
|
|
|
* did not contain any protections for access to transactional
|
|
information;
|
|
|
|
* did not contain any public process for determining the capability
|
|
requirements or public notice of law enforcement's capacity needs;
|
|
|
|
* would have allowed law enforcement to dictate system design and
|
|
bar the introduction of features and services which did not meet
|
|
the requirements, and;
|
|
|
|
* would have allowed law enforcement to use pen registers and trap and
|
|
trace devices to obtain tracking or physical location information.
|
|
|
|
|
|
* * *
|
|
|
|
|
|
Locating Relevant Documents
|
|
===========================
|
|
|
|
** Original 1992 Bush-era draft **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/Old/digtel92_old_bill.draft
|
|
gopher.eff.org, 1/EFF/Policy/FBI/Old, digtel92_old_bill.draft
|
|
http://www.eff.org/pub/EFF/Policy/FBI/Old/digtel92_old_bill.draft
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel92.old
|
|
|
|
|
|
** 1993/1994 Clinton-era draft **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94_bill.draft
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94_bill.draft
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94_bill.draft
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.dft
|
|
|
|
|
|
** 1994 final draft, as sponsored **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94.bill
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94.bill
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94.bill
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.bil
|
|
|
|
|
|
** EFF Statement on sponsored version **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94_statement.eff
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94_statement.eff
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94_statement.eff
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.eff
|
|
|
|
|
|
|
|
|
|
=========================================================================
|
|
From: mech@eff.org (Stanton McCandlish)
|
|
Subject: EFF Analysis of Leahy/Edwards Digital Telephony Bill
|
|
Date: 10 Aug 1994 16:58:23 -0500
|
|
|
|
EFF SUMMARY OF THE EDWARDS/LEAHY DIGITAL TELEPHONY BILL
|
|
=======================================================
|
|
|
|
|
|
OVERVIEW
|
|
--------
|
|
|
|
The Edwards/Leahy Digital Telephony bill places functional
|
|
requirements on telecommunications carriers in order to enable law
|
|
enforcement to continue to conduct authorized electronic surveillance. It
|
|
allows a court to impose fines on carriers that violate the requirements,
|
|
and mandates that the processes for determining capacity requirements and
|
|
technical standards be open and public. The bill also contains significant
|
|
new privacy protections; including an increased standard for government
|
|
access to transactional data (such as addressing information contained in
|
|
electronic mail logs), a requirement that information acquired through the
|
|
use of pen registers or trap and trace devices not disclose the physical
|
|
location of an individual, and an expansion of current law to protect the
|
|
radio portion of cordless telephone conversations from unauthorized
|
|
surveillance.
|
|
|
|
|
|
SCOPE OF THE BILL. WHO IS COVERED?
|
|
-----------------------------------
|
|
|
|
The requirements of the bill apply to "telecommunications carriers", which
|
|
are defined as any person or entity engaged in the transmission or
|
|
switching of wire or electronic communications as a common carrier for hire
|
|
(as defined by section 3 (h) of the Communications Act of 1934), including
|
|
commercial mobile services (cellular, PCS, etc.). The bill also applies to
|
|
those persons or entities engaged in providing wire or electronic
|
|
communication switching or transmission service to the extent
|
|
that the FCC finds that such service is a replacement for a substantial
|
|
portion of the local telephone exchange.
|
|
|
|
The bill does not apply to online communication and information services
|
|
such as Internet providers, Compuserve, AOL, Prodigy, and BBS's. It also
|
|
excludes private networks, PBX's, and facilities which only interconnect
|
|
telecommunications carriers or private networks (such as most long
|
|
distance service).
|
|
|
|
|
|
REQUIREMENTS IMPOSED ON CARRIERS
|
|
--------------------------------
|
|
|
|
Telecommunications carriers would be required to ensure that they
|
|
possess sufficient capability and capacity to accommodate law enforcement's
|
|
needs. The bill distinguishes between capability and capacity
|
|
requirements, and ensures that the determination of such requirements occur
|
|
in an open and public process.
|
|
|
|
|
|
CAPABILITY REQUIREMENTS
|
|
-----------------------
|
|
|
|
A telecommunications carrier is required to ensure that, within four years
|
|
from the date of enactment, it has the capability to:
|
|
|
|
1. expeditiously isolate the content of a targeted communication
|
|
within its service area;
|
|
|
|
2. isolate call-identifying information about the origin and
|
|
destination of a targeted communication;
|
|
|
|
3. enable the government to access isolated communications at a point away
|
|
from the carrier's premises and on facilities procured by the
|
|
government, and;
|
|
|
|
4. to do so unobtrusively and in such a way that protects the privacy and
|
|
security of communications not authorized to be intercepted (Sec.
|
|
2601).
|
|
|
|
However, the bill does not permit law enforcement agencies or officers to
|
|
require the specific design of features or services, nor does it prohibit a
|
|
carrier from deploying any feature or service which does not meet the
|
|
requirements outlined above.
|
|
|
|
|
|
CAPACITY REQUIREMENTS
|
|
---------------------
|
|
|
|
Within 1 year of enactment of the bill, the Attorney General must
|
|
determine the maximum number of intercepts, pen register, and trap and
|
|
trace devices that law enforcement will require four years from the date of
|
|
enactment. Notices of capacity requirements must be published in the
|
|
Federal Register (Sec. 2603). Carriers have 4 years to comply with
|
|
capacity requirements.
|
|
|
|
|
|
PROCESS FOR DETERMINING TECH. STANDARDS TO IMPLEMENT CAPABILITY REQUIREMENTS
|
|
----------------------------------------------------------------------------
|
|
|
|
Telecommunications carriers, through trade associations or standards
|
|
setting bodies and in consultation with the Attorney General, must
|
|
determine the technical specifications necessary to implement the
|
|
capability requirements (Sec. 2606).
|
|
|
|
The bill contains a 'safe harbor' provision, which allows a carrier to meet
|
|
its obligations under the legislation if it is in compliance with publicly
|
|
available standards set through this process. A carrier may deploy a
|
|
feature or service in the absence of technical standards, although in such
|
|
a case the carrier would not be covered by the safe harbor provision and
|
|
may be found in violation.
|
|
|
|
Furthermore, the legislation allows any one to file a motion at the FCC in
|
|
the event that a standard violates the privacy and security of
|
|
telecommunications networks or does not meet the requirements of the bill
|
|
(Sec. 2606). If petitioned under this section, the FCC may establish
|
|
technical requirements or standards that:
|
|
|
|
1) meet the capability requirements (in Sec. 2602);
|
|
|
|
2) protect the privacy and security of communications not authorized
|
|
to be intercepted, and;
|
|
|
|
3) encourage the provision of new technologies and services to the public.
|
|
|
|
|
|
ENFORCEMENT AND PENALTIES
|
|
-------------------------
|
|
|
|
In the event that a court or the FCC deems a technical standard to be
|
|
insufficient, or if law enforcement finds that it is unable to conduct
|
|
authorized surveillance because a carrier has not met the requirements of
|
|
this legislation, the Attorney General can request that a court issue an
|
|
enforcement order (an order directing a carrier to comply), and/or a fine
|
|
of up to $10,000 per day for each day in violation (Sec. 2607). However, a
|
|
court can issue an enforcement order or fine a carrier only if it can be
|
|
determined that no other reasonable alternatives are available to law
|
|
enforcement. This provision allows carriers to deploy features and
|
|
services which may not meet the requirements of the bill. Furthermore,
|
|
this legislation does not permit the government to block the adoption or
|
|
use of any feature or service by a telecommunications carrier which does
|
|
not meet the requirements.
|
|
|
|
The bill requires the government to reimburse carriers for all reasonable
|
|
costs associated with complying with the capacity requirements. In other
|
|
words, the government will pay for upgrades of current features or
|
|
services, as well as any future upgrades which may be necessary, pursuant
|
|
to published notices of capacity requirements (Sec. 2608).
|
|
|
|
There is $500,000,000 authorized for appropriation to cover the costs of
|
|
government reimbursements to carriers. In the event that a smaller sum is
|
|
actually appropriated, the bill allows a court to determine whether a
|
|
carrier must comply (Sec. 2608 (d)). This section recognizes that
|
|
telecommunications carriers may not be responsible for meeting the
|
|
requirements if the government does not cover reasonable costs.
|
|
|
|
The government is also required to submit a report to congress within four
|
|
years describing all costs paid to carriers for upgrades (Sec. 4).
|
|
|
|
|
|
ENHANCED PRIVACY PROTECTIONS
|
|
----------------------------
|
|
|
|
The legislation contains enhanced privacy protections for transactional
|
|
information (such as telephone toll records and electronic mail logs)
|
|
generated in the course of completing a communication. Current law permits
|
|
law enforcement to gain access to transactional information through a
|
|
subpoena. The bill establishes a higher standard for law enforcement
|
|
access to transactional data contained electronic mail logs and other
|
|
online records. Telephone toll records would still be available through a
|
|
subpoena. Under the new standard, law enforcement is required to obtain a
|
|
court order by demonstrating specific and articulable facts that electronic
|
|
mail logs and other online transactional records are relevant and material
|
|
to an ongoing criminal investigation (Sec. 10).
|
|
|
|
Law enforcement is also prohibited from remotely activating any
|
|
surveillance capability. All intercepts must be conducted with the
|
|
affirmative consent of a telecommunications carrier and activated by a
|
|
designated employee of the carrier within the carrier's facilities (Sec.
|
|
2604).
|
|
|
|
The bill further requires that, when using pen registers and trap and trace
|
|
devices, law enforcement will use, when reasonably available, devices which
|
|
only provide call set up and dialed number information (Sec. 10). This
|
|
provision will ensure that as law enforcement employs new technologies in
|
|
pen register and trap and trace devices, it will not gain access to
|
|
additional call setup information beyond its current authority.
|
|
|
|
Finally, the bill extends the Electronic Communications Privacy Act (ECPA)
|
|
protections against interception of wireless communications to cordless
|
|
telephones, making illegal the intentional interception of the radio
|
|
portion of a cordless telephone (the transmission between the handset
|
|
and the base unit).
|
|
|
|
|
|
CELLULAR SCANNERS
|
|
-----------------
|
|
|
|
The bill makes it a crime to possess or use an altered telecommunications
|
|
instrument (such as a cellular telephone or scanning receiver) to obtain
|
|
unauthorized access to telecommunications services (Sec. 9). This
|
|
provision is intended to prevent the illegal use of cellular and other
|
|
wireless communications services. Violations under this section face
|
|
imprisonment for up to 15 years and a fine of up to $50,000.
|
|
|
|
|
|
IMPROVEMENTS OF THE EDWARDS/LEAHY BILL OVER PREVIOUS FBI PROPOSALS
|
|
------------------------------------------------------------------
|
|
|
|
The Digital Telephony legislative proposal was first offered in 1992 by the
|
|
Bush Administration. The 1992 version of the bill:
|
|
|
|
* applied to all providers of wire or electronic communications
|
|
services (no exemptions for information services, interexchange
|
|
carriers or private networks);
|
|
|
|
* gave the government the explicit authority to block or enjoin a
|
|
feature or service that did not meet the requirements;
|
|
|
|
* contained no privacy protections;
|
|
|
|
* contained no public process for determining the capacity
|
|
requirements;
|
|
|
|
* contained no government reimbursement (carriers were responsible
|
|
for meeting all costs);
|
|
|
|
* would have allowed remote access to communications by law
|
|
enforcement, and;
|
|
|
|
* granted telecommunications carriers only 18 months to comply.
|
|
|
|
The Bush Administration proposal was offered on capitol hill for almost a
|
|
year, but did attract any congressional sponsors.
|
|
|
|
The proposal was again offered under the Clinton Administration's FBI in
|
|
March of 1993. The Clinton Administration's bill was a moderated version
|
|
of the original 1992 proposal:
|
|
|
|
* It required the government to pay all reasonable costs incurred by
|
|
telecommunications carriers in retrofitting their facilities in
|
|
order to correct existing problems;
|
|
|
|
* It encouraged (but did not require), the Attorney General to consult
|
|
with telecommunications industry representatives and standards
|
|
bodies to facilitate compliance,
|
|
|
|
* It narrowed the scope of the legislation to common carriers, rather
|
|
than all providers of electronic communications services.
|
|
|
|
Although the Clinton Administration version was an improvement
|
|
over the Bush Administration proposal, it did not address the
|
|
larger concerns of public interest organizations or the
|
|
telecommunications industry. The Clinton Administration version:
|
|
|
|
* did not contain any protections for access to transactional
|
|
information;
|
|
|
|
* did not contain any public process for determining the capability
|
|
requirements or public notice of law enforcement's capacity needs;
|
|
|
|
* would have allowed law enforcement to dictate system design and
|
|
bar the introduction of features and services which did not meet
|
|
the requirements, and;
|
|
|
|
* would have allowed law enforcement to use pen registers and trap and
|
|
trace devices to obtain tracking or physical location information.
|
|
|
|
|
|
* * *
|
|
|
|
|
|
Locating Relevant Documents
|
|
===========================
|
|
|
|
** Original 1992 Bush-era draft **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/Old/digtel92_old_bill.draft
|
|
gopher.eff.org, 1/EFF/Policy/FBI/Old, digtel92_old_bill.draft
|
|
http://www.eff.org/pub/EFF/Policy/FBI/Old/digtel92_old_bill.draft
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel92.old
|
|
|
|
|
|
** 1993/1994 Clinton-era draft **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94_bill.draft
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94_bill.draft
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94_bill.draft
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.dft
|
|
|
|
|
|
** 1994 final draft, as sponsored **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94.bill
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94.bill
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94.bill
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.bil
|
|
|
|
|
|
** EFF Statement on sponsored version **
|
|
|
|
ftp.eff.org, /pub/EFF/Policy/FBI/digtel94_statement.eff
|
|
gopher.eff.org, 1/EFF/Policy/FBI, digtel94_statement.eff
|
|
http://www.eff.org/pub/EFF/Policy/FBI/digtel94_statement.eff
|
|
bbs: +1 202 638 6120 (8N1, 300-14400bps), file area: Privacy - Digital
|
|
Telephony; file: digtel94.eff
|
|
|
|
------------------------------
|
|
|
|
Date: 10 Aug 1994 13:33:30 -0500
|
|
From: stahlman@radiomail.net (Mark Stahlman (via RadioMail))
|
|
Subject: Re: EFF Statement on Leahy/Edwards Digital Telephony Bill
|
|
|
|
Jerry, Danny, Stanton, et al:
|
|
|
|
Well, what a fine kettle of fish you've gotten yourselves into this time.
|
|
EFF "supports" a Digital Telephony (wiretap) bill. Quick, who's got the
|
|
smelling salts?
|
|
|
|
You've gone from "Jackboots on the InfoBahn" to "substantially less
|
|
intrusive", "significant privacy advances" and "enhanced protection." And,
|
|
just whose picture is that in the dictionary next to the definition of
|
|
"cyberdupes" anyway?
|
|
|
|
After successfully defeating draconian legislation for years, EFF now helps
|
|
to . . . draft the kinder-gentler wiretap bill. Because Leahy and Edwards
|
|
"concluded that the passage of such a bill was inevitable this year", EFF
|
|
is called upon to perform the one-eyed act in the land of the blind.
|
|
|
|
What happened from last year to this? Why was any bill "inevitable" in
|
|
this Congress? Did EFF lose it's clout? Did the Information-SuperHypeway
|
|
blitz (that EFF cynically fanned) help tip the balance?
|
|
|
|
I have no doubt that this bill is "better" than the FBI's proposal. I also
|
|
have no doubt that the FBI knew that it's bill was only the starting point
|
|
for the negotiations. And, if passed, this bill will certainly deliver to
|
|
the FBI everything that it wants. That's the way Washington works. Wake
|
|
up.
|
|
|
|
As I've said all along, EFF made themselves part of a process far larger,
|
|
more powerful and more professional than they could ever become when they
|
|
scrapped the chapters and moved to DC to become lobbyists. And, since the
|
|
"groups" that EFF "represents" are not particularly powerful, EFF's efforts
|
|
will inevitably be confined to providing language that helps the truly
|
|
powerful groups (like the FBI -- which lest we forget is just the Clinton
|
|
administration) get their way.
|
|
|
|
But don't be fooled. EFF is not an "opposition" group wrestling with the
|
|
weighty issues of cyberspace politics. Despite the advertisements, EFF is
|
|
not "hacking politics and then fixing it." They have opted to become an
|
|
integral part of the "system". Is that a bad thing? Certainly not. The
|
|
"system" delivers enormous benefits to most of it's citizens. And, it
|
|
needs it's functionaries -- like EFF.
|
|
|
|
But, as Toffler would have put it, ours is a completely obsolete Second
|
|
Wave "system" which needs to be radically transformed. Reread the
|
|
concluding section of Toffler's "Third Wave" on 21st Century Democracy.
|
|
Published in 1980, this book lays out the issues and predicts the outcomes
|
|
that are still worthy of very serious debate, study and action.
|
|
|
|
The technologies we are so intimately involved with will inevitably lead to
|
|
profound social and psychological changes which in turn will force the
|
|
development of something akin to Toffler's "Third Wave" government. I
|
|
don't know if it will be 20% or 50% the size of current government but it
|
|
certainly won't tolerate anything like Gore's NII or this administration's
|
|
Information Industrial Policy initiatives. Nor will it support a police
|
|
force bent on wiretaps to catch electronic tax cheats -- a far more
|
|
plausible motivation for this legislation than hunting
|
|
porno-smuggling-kiddie-grabbing-terror-toting hairballs.
|
|
|
|
We need organizations (and individuals) which are dedicated to working on
|
|
the thorny problems of inventing a new government which will be capable of
|
|
supporting and defending a cyberspace economy. This is a process which is
|
|
probably best conducted *outside* of the current "system". As EFF has
|
|
shown us, the talk-show temptations of being an "insider" are just too
|
|
powerful to be resisted. Principles don't matter when you're on the
|
|
"inside". Clear, careful and even "radical" thinking doesn't help when the
|
|
horse-trading takes over.
|
|
|
|
Re-read the EFF's founding principles, re-read "Across The Electronic
|
|
Frontier." Then, compare the text with the reality. Take it as an object
|
|
lesson in politics. Disappointed? Well, maybe that's part of growing up.
|
|
|
|
Hopefully, EFF will take up the case of the Milpitas porn-BBS conviction on
|
|
appeal. Now that's real cyberspace politics! This administration (yes,
|
|
they still run the DoJ) decided to attack cyberspace information rights by
|
|
trying to impose the "community standards" of Memphis on all of cyberspace.
|
|
A non-Internet connected private board with $99 annual fees was convicted
|
|
of 11 counts of delivering porn over the phone (and acquitted of a kiddie
|
|
porn count because the board refused to post the kiddie-GIFs the Feds sent
|
|
them). Yes, there's plenty of important work left for EFF to do.
|
|
|
|
And, what about you? Start something new, something bold. Have the
|
|
courage to just say no to cyber-crats and digital control freaks. Forget
|
|
mortibund ideologies. Stop trying to summon Jefferson's (or Marx's or
|
|
Rand's) ghost from the grave. Face up to the fact that we already live in
|
|
a networked economy and that millions of people have already entered into
|
|
Toffler's new "psycho-sphere". Pick up the tools at hand and take
|
|
responsibility to invent the future. Your Softbot descendants will honor
|
|
you for your valor.
|
|
|
|
Mark Stahlman
|
|
New Media Associates
|
|
New York City
|
|
stahlman@radiomail.net
|
|
|
|
------------------------------
|
|
|
|
Date: Thu, 18 Aug 1994 14:25:22 -0600 (MDT)
|
|
From: "Rob Slade, Ed. DECrypt & ComNet, VARUG rep, 604-984-4067"
|
|
Subject: "Secrets of a Super Hacker" by Fiery
|
|
|
|
BKSCSUHK.RVW 940609
|
|
|
|
Loompanics Unlimited
|
|
P.O. Box 1197
|
|
Port Townsend, WA 98368 206/385-5087 fax 206/385-7785
|
|
loompanx@pt.olympus.net
|
|
"secrets of a super hacker",
|
|
Fiery, 1994; 1-55950-106-5, U$19.95
|
|
|
|
Despite Loompanics' reputation as a "dark side" publisher, this may be
|
|
a very good book. It deals primarily with social engineering, despite
|
|
the purported coverage of other topics. It would therefore be
|
|
valuable reading material around corporate lunchrooms, since
|
|
forewarned is just a little bit more paranoid and, therefore,
|
|
forearmed. As those involved with data security in the real world
|
|
well know, cracking is basically a con job. Thus, The Knightmare, if
|
|
he really is "super", is a con artist par excellence--and is pulling
|
|
off a really great con here!
|
|
|
|
Revealing the secrets of social engineering poses very little threat
|
|
to security. Con men already exist and will continue to exist.
|
|
Cracker wannabes are unlikely to be able to carry off a successful con
|
|
if they need to rely on canned advice like this. On the other hand,
|
|
it is much more likely to shock naive and non-technical users into an
|
|
awareness of the need for suspicion and proper procedures--albeit
|
|
possibly only temporarily. Thus, this information is almost
|
|
inherently of more use in data protection than in data penetration.
|
|
|
|
As for technical help for the cracker; well, are you really expecting
|
|
great technical revelations from someone who knows there is a
|
|
difference between baud and bits per second--and gets it backwards?
|
|
Or, who thinks 140 and 19,900 baud are standard modem speeds? Who
|
|
thinks Robert Morris' worm found "original" bugs? (And who doesn't
|
|
know the difference between "downgrade" and "denigrate"?) All the
|
|
successful hacks in the book rely on social engineering rather than
|
|
technology. Lots of jargon is thrown in along the lines of, "You need
|
|
X," but without saying what X really is, where to get it, or how to
|
|
use it.
|
|
|
|
The official definition of a hacker in the book is of the "good side"
|
|
seeker after knowledge. As it is stated early on, a hacker *could* do
|
|
lots of mischief--but doesn't. In the course of the text, though, the
|
|
image is much more convoluted. The book almost seems to be written by
|
|
two people; one who is within the culture and has the standard
|
|
confused cracker viewpoint, and another, sardonically aware of pulling
|
|
the wool over all the wannabes' eyes. The chapter on contacting the
|
|
*true* hacker community is EST-like in its refusal to define when you
|
|
might have made it, or how.
|
|
|
|
Like I said, buy it for the corporate or institutional lunchroom.
|
|
Make sure that the non-techies get first crack at it. If you'll
|
|
pardon the expression.
|
|
|
|
copyright Robert M. Slade, 1994 BKSCSUHK.RVW 940609
|
|
|
|
======================
|
|
DECUS Canada Communications, Desktop, Education and Security group newsletters
|
|
Editor and/or reviewer ROBERTS@decus.ca, RSlade@sfu.ca, Rob Slade at 1:153/733
|
|
DECUS Symposium '95, Toronto, ON, February 13-17, 1995, contact: rulag@decus.ca
|
|
|
|
------------------------------
|
|
|
|
End of Computer Underground Digest #6.74
|
|
************************************
|
|
|