textfiles/magazines/CUD/cud0852.txt

Computer underground Digest    Wed  Jul 10, 1996   Volume 8 : Issue 52
                           ISSN  1004-042X

       Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
       News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
       Archivist: Brendan Kehoe
       Shadow Master: Stanton McCandlish
       Field Agent Extraordinaire:   David Smith
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest

CONTENTS, #8.52 (Wed, Jul 10, 1996)

File 1--DOJ calls for "Manhattan Project" to combat "the new cyber threats"
File 2--Cu Digest Header Info (unchanged since 7 Apr, 1996)

CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION ApPEARS IN
THE CONCLUDING FILE AT THE END OF EACH ISSUE.

---------------------------------------------------------------------

Date: Sun, 9 Jun 1996 01:04:51 -0500
From: Mike Godwin <mnemonic@eff.org>
Subject: File 1-- DOJ calls for "Manhattan Project" to combat "the new cyber threats"


 [The following document was typed in from a photocopy by Mike
 Godwin, mnemonic@well.com. Any errors in transcription are his.]

              NATIONAL SECURITY IN THE INFORMATION AGE
             Conference at the U.S. Air Force Academy,
                     Colorado Springs, Colorado
                          29 February 1996

                  THE HONORABLE JAMIE S. GORELICK,
            DEPUTY ATTORNEY GENERAL OF THE UNITED STATES

 Thank you for that kind introduction. I very much appreciate the
 opportunity to speak with you this evening about national
 security in the information age.  You have brought together a
 truly remarkable collection of people for this conference. This
 is precisely the sort of cross-section of government and
 industry that is needed for us to begin working through the
 difficult policy questions that must be resolved.

 In some ways, what we are experiencing today is sort of the "Big
 Bang" moment in the development of information technology: New
 technology is virtually exploding onto the scene, with important
 developments occurring almost daily. With each new technological
 innovation, there are not only myriad new opportunities for
 business and new conveniences for consumers, but also new legal
 and policy issues for national policymakers to confront. And
 since, as many of you know,


 Begin Page 2

 policy making in Washington is not always lightning-quick, it
 will not surprise you to learn that the development of
 technology has to a large degree outpaced our planning and
 actions.

 Fortunately, though, this has begun to change. Tonight, I would
 like to speak with you about some of the important developments
 that are taking place in Washington concerning national security
 in the information age. More importantly, I want to underscore
 the importance of developing and continuing a dialogue between
 government and industry on these issues. Simply put, no matter
 what we try to do in Washington, we will get nowhere unless we
 successfully enlist the assistance and cooperation of the
 private sector.

 At the same time, though, The private sector must recognize that
 a government role is also indispensable.  Government and private
 industry are, in a very real way, interdependent in this area.
 No workable solution to the myriad problems can be devised by
 one or the other unilaterally. We have to work together.


 Begin Page 3

 * * *

 One of the most striking things about the explosion of new
 information technology over the last couple of years, in this
 "Age of the Internet," is the way in which that technology is
 often portrayed as an unqualified "good." The exponential growth
 of the Internet, the expansion of digital and cellular phone
 systems, and the proliferation of unbreakable encryption are
 viewed by some as unconditionally positive developments.
 Correspondingly, any effort to regulate the use of these new
 technologies is seen as "bad," as the work of neo-Luddites, and
 as inevitably doomed to failure.

 We are witnessing this phenomenon right now in the raging debate
 over efforts to restrict pornography on the Internet. We saw it
 last year in the debate over the FBI's effort to ensure that it
 can continue to conduct legally authorized wiretaps on digital
 telephones. And we see it, too, in the ongoing effort to develop
 a national encryption policy, in which we


 Begin Page 4

 seek to encourage the use of strong encryption while protecting
 the interests that all of us have in effective law enforcement
 and national security systems.

 In all of these debates, the decibel level is high. Many critics
 of government start from the proposition that any involvement by
 Washington is necessarily bad. In such circumstances, it is
 difficult even to engage in rational discourse, let alone find
 common ground.

 Clearly, we need to step back, take a deep breath, and recognize
 a fundamental principle for starters:  technology is not
 inherently "good." Nor is it inherently "evil." Rather, it is a
 tool whose virtue and worth depend on the use to which people
 put it.

 Everyone recognizes this simple proposition in the case of
 nuclear technology. Obviously, that technology can be enormously
 useful -- if harnessed correctly, it can end our dependence on
 fossil fuels, satisfy our energy needs, and reduce pollution
 caused by burning coal, oil, or gas. But it also is potentially
 evil, if


 Begin Page 5

 it is turned into nuclear weapons used by a rogue state or
 terrorists to kill innocent people.

 But this notion of "moral neutrality" is not the universal view
 when it comes to information technology.  It is easy to grasp
 the potential good of this technology. The spread of the
 Internet, for instance, can greatly enhance our lives in
 countless ways: It can connect people across vast distances; it
 can disseminate knowledge to far-flung corners of the earth; it
 can spread the message of democracy to people who labor under
 tyrannical regimes; it can improve our own democratic process by
 allowing candidates to distribute their message more broadly and
 cheaply or by permitting the people to make their voices -- and
 their votes --heard more clearly; it can allow parents to spend
 more time with their children by "telecommuting"; it can improve
 our children's education by providing even the poorest school
 districts with electronic access to our best teachers; and it
 can improve the lives of our senior citizens by allowing them to
 communicate with


 Begin Page 6

 relatives or shop without leaving their homes. The possibilities
 are truly endless.

 Similarly, strong encryption has the potential for better
 protecting people's privacy and for increasing our ability to
 conduct electronic commerce without fear of theft or fraud.

 But what has too often been ignored is the potential for the new
 technology to be put to evil uses. Thus, absent regulation, the
 Internet allows the distribution of child pornography nationwide
 at the push of a button, without any control over who is exposed
 to it.  Similarly, it can permit much greater invasion of
 privacy and damage to reputation if private facts about a
 person, or malicious slander, can be spread so quickly and
 easily. In the old days, when gossip spread by word of mouth,
 harm was necessarily limited. But now someone can be
 "electronically slammed" around the world in minutes. And, the
 more people begin to rely on the Internet to conduct electronic
 commerce and everyday communications, the greater potential
 there is for


 Begin Page 7

 invasion of their privacy as credit companies and service
 providers acquire vast amounts of personal information about
 people's purchases, hobbies, interests, phone records, and other
 details of their everyday lives. In the past, it would have
 taken weeks of intensive investigation into a person's life to
 put together a picture of him that can now be developed in
 minutes. And electronically stored private information - - such
 as credit or health records -- not only can be accessed quickly,
 but also can be altered.

 Encryption, too, can be used for sinister purposes. With the
 proliferation of unbreakable encryption, law enforcement stands
 to lose some of its most effective tools against terrorists and
 organized crime groups.  Court-ordered wiretaps that allows us
 to intercept communications and prevent a terrorist plot are
 rendered worthless. Stored data files that might hold the key to
 bringing down an international drug cartel or child pornography
 ring will be undecipherable, allowing some of the most heinous
 criminals to go free.


 Begin Page 8

 Just imagine, for a moment, if we found someone who was abusing
 innocent children to manufacture graphic, hard-core child
 pornography. Imagine that law enforcement successfully obtained
 a warrant to search his office for evidence, including his
 computer files. Imagine, though, that we go to all that effort
 to catch this criminal, only to find that the list of children
 that he uses to produce his pornography is encrypted with DES.
 He's disposed of his only key (or at least he claims he did).
 No key is held in escrow. Dead end for us. Is this really the
 type of constraint we want? Unfortunately, this is _not_ an
 imaginary scenario. This problem is a real one.

 Or, imagine an employee who encrypts crucial company documents
 just before he quits the company, leaving the company helpless
 to access the plain text . Or a widow who finds that all of her
 deceased spouse's probate files are encrypted, but he did not
 leave a key.

 Beyond these examples of potential ill-uses [sic] of information
 technologies, there are broader social


 Begin Page 9

 problems that are harder to measure, but which we are slowly
 coming to recognize instinctively. For instance, if people are
 spending hours on end in chat room, conversing with faceless
 strangers thousands of miles away, will they spend less time
 actually talking with their children, their parents and their
 friends? What will this do to interpersonal relations and
 children's intellectual and emotional development?

 And what effect will the Internet have on the nature of
 communication itself? Anyone who has used e-mail has experienced
 the misunderstandings that arise so frequently in electronic
 conversations. Something odd happens, whether it is that people
 feel more free to discard social conventions like politeness and
 to be brutally candid when they are looking at a computer screen
 instead of a human face; or whether it is the lack of tone,
 intonation or facial expression that accompanies spoken
 communication and can subtly change the meaning of a person's
 actual words or signal that someone is only joking; or whether
 it is the lack of care that goes into messages that someone
 fires off on


 Begin Page 10

 her keyboard rather than taking the time to think out a
 handwritten letter. Something happens that simply engenders
 misunderstandings and hurt feelings more frequently in e-mail
 than in casual conversations by the water cooler or written
 letters to friends. We've all experienced this, but we don't
 quite know what the implications are.

 The metaphor of the "information Superhighway" has become a
 cliche by now, but let me invoke it one last time before putting
 it to rest! Imagine if, at the advent of the automobile, all of
 the states, as well as individual companies, just started
 building their own roads all over the place, with no speed
 limits, no lane markings, no highway patrol or emergency rescue
 services, no emergency exits, no safety inspections for trucks
 or passenger vehicles. I think everyone would recognize that
 this would be a recipe for disaster. But now as we are
 constructing our "information superhighway," which is a thousand
 times more complicated than our automotive highway system -- and
 provides opportunity for much greater damage if abused


 Begin Page 11

 -- many people are telling the government to just get out of the
 way and let NII develop its own, with no restrictions,
 nonregulation, no effort even to protect our information
 infrastructures from attack or abuse.  This simply does not make
 sense.

 In my view, we really have two choices: We can begin now,
 jointly, to try to come up with solutions to some of the
 difficult issues raised by the growth of the information
 infrastructure in a rational, measured, and prudent way. Or we
 can wait until a crisis occurs, until some cyber catastrophe
 suddenly crystallizes these issues in the public's mind and
 leads to an outcry and a call for immediate government response.
 But, if history teaches us anything, it is exactly this sort of
 crisis mode, when the government is pressured to respond to some
 recent outrage, that we are most likely to overreact and enact
 bad policy [sic]. Let's try to do it now, while cooler heads
 prevail; let's work together to come up with solutions that
 serve the public interests.


 Begin Page 12

 The telecommunications industry, to its great credit,
 understands this interdependence. As a result, I think the
 president's national security telecommunications advisory
 committee -- a joint government-industry body - - has been
 highly successful in crafting solutions to the particular
 problems faced by the telecommunications industry. The NSTAC
 serves as a model, in many ways, for what we need to do for the
 rest of our industries that rely on the national information
 infrastructure.

 * * *

 Let me now turn to the particular problems posed by the
 information revolution for our national security. You have heard
 a lot over the last two days about the growing dependence on the
 information infrastructure in all sectors of society --
 military, political, economic, academic, and cultural -- and
 about the increasing interconnectedness of all these sectors.
 The implications for national security are becoming more
 apparent: as we become more interconnected, we are also


 Begin Page 13

 more vulnerable to attack from many different sources.  The
 information and control systems for our critical industries, for
 instance, are more vulnerable to penetration and disruption;
 information can be more easily stolen, distorted, or destroyed;
 and the very operation of those industries can be brought to a
 halt more quickly and easily.

 The issue of how we address our vulnerability to such attacks
 has often been referred to as a "defensive information warfare."
 But this term can be misleading.  It suggests that the issue is
 a problem only for our defense establishment, and should be
 addressed as part of our national defense strategy. Certainly,
 the military sits on a vulnerable platform consisting of
 different critical infrastructures. But civil society sits on
 that same platform. This is therefore also an issue for the
 civilian world. Every person and institution that is connected
 to the "information superhighway" is vulnerable to attack, not
 just those people and institutions involved in our defense
 mission.


 Begin Page 14

 Moreover, the sources of attacks are not limited to nation
 states or other foreign powers during times of war. Rather, they
 can run the gamut, from the disgruntled employee who steals or
 destroys his employers information out of malice; to the
 criminal who steals proprietary information for pecuniary gain;
 to terrorists who seek to cause widespread death or destruction
 to intimidate or coerce the government; to foreign intelligence
 agents who want surreptitiously to access or manipulate
 classified or proprietary information; and, finally, to the
 hostile state using cyber attacks as an instrument of war.
 Obviously, not all of these attacks are directly related to
 defense.  All of them are, however, of interest to law
 enforcement.

 The statistics illustrate, in broad strokes at least, how the
 cyber threat is increasing. From 1991 to 1995, the number of
 Internet hosts increased from approximately 750,000 to over 5
 million, an expansion of over 500%. Not surprisingly, over a
 three-year period from 1991 to


 Begin Page 15

 1994, the number of security incidents reported to the Computer
 Emergency Response Team (or CERT) at Carnegie Mellon University
 increased 498%, and the number of sites affected worldwide was
 up 702%.

 Recent surveys reinforce the CERT statistics. One survey of 246
 companies revealed that the monthly rate of incidents involving
 the theft of corporate proprietary information rose 260% from
 1985-1993. Only 32 of these companies were willing to quantify
 their losses, which amounted to $1.8 billion. In the other
 survey, almost one quarter of the 898 organizations queried
 reported a computer crime within the previous 12 months. And
 last summer, the Defense Information Systems Agency (DISA),
 reported that attacks on DOD computer systems had doubled from
 only the year before and were then running at a rate of two a
 day.

 Let me give you a few examples of the types of "cyber" crimes we
 have seen in recent years to put some flesh on the bones of
 these statistics. These cases illustrate how vulnerable we
 already are, both as


 Begin Page 16

 individuals and as institutions, and provide a window into our
 future.

 * In 1994, nine people, including an MCI employee, were indicted
 for a scheme involving a $50-million telephone calling card
 fraud. Using a sniffer program (which monitors network traffic),
 they captured and used more than 150,000 calling card numbers.
 The scheme had been directed by hackers in Germany who then made
 international calls to attack U.S. computer networks.

 * A computer hacker broke into files at a bank and a credit
 union, and then used the information to apply for credit cards
 in the victim's name. The criminal then used these cards to go
 on a buying spree. The victim's ability to obtain credit was
 ruined and had to be painstakingly reestablished.


 Begin Page 17

 Hackers broke into Lawrence Livermore Laboratory computers and
 used them to store illegal hard-core pornography. Nearly 2,000
 megabytes with 1,000 images were found on one Internet-linked
 computer.

 * We have seen transmission of child pornography files by e-mail
 through America Online.

 * Con artists have used electronic bulletin board systems to
 hype recently-purchased penny stocks, driving up the price and
 giving the con artists a profit.

 For the most part, these attacks appear to come from
 "unstructured" sources: That is, they are unrelated incursions
 by individuals or small groups usually seeking to steal
 information or services or to cause disruption purely out of
 malice, but with no grand design or organization. In terms of
 national security, though, the greatest threat will come from
 "structured" sources: organized crime groups (we have seen
 instances


 Begin Page 18

 of this), and, more importantly, terrorist organizations,
 foreign intelligence agencies, and foreign military services.
 These are the entities whose efforts are the best financed, the
 most focused, and the most likely to cause widespread damage to
 our national security by disrupting elements of our
 infrastructures that depend on the information superhighway.

 Even for these structured threats, law enforcement plays a
 critical role. Under Presidential Decision Directive 39, which
 was issued last summer and sets out the administration's
 counterterrorism policy, the Department of Justice (through its
 component, the FBI) is the lead agency responsible for
 combatting terrorism in the United States. And Executive Order
 12333, which has been the guiding instrument for the
 intelligence community since 1981, designates the FBI as the
 lead agency for counterintelligence matters. So clearly, law
 enforcement has an important role in protecting our national
 security against the new cyber threats.


 Begin Page 19

 Our most immediate concern right now is the terrorist threat. As
 our society becomes more and more dependent on the information
 superhighway, we must expand our focus beyond the traditional
 "physical" attacks by terrorists that we have encountered in the
 past, and to anticipate and protect against cyber attacks that
 could cause as great, if not greater, impact as a well-placed
 bomb.

 It's not hard to imagine how terrorists could use cyber tools to
 wreak massive havoc in this country. Consider the World Trade
 Center case, for example. There was some evidence suggesting
 that the conspirators in that case intended to cause the tower
 to collapse, in order to disrupt the financial markets on wall
 street. That same objective could also be accomplished through
 an electronic attack on the energy or telecommunications systems
 that supply lower Manhattan, or on the information systems of
 the banking and financial institutions themselves.


 Begin Page 20

 The threat is _not_ simply hypothetical. We have already seen
 attacks on elements of the infrastructure that, although
 apparently not committed by terrorists, illustrate the
 vulnerabilities that are present in our information networks,
 and demonstrate the urgency of our situation.

 * The pending case involving Citibank is one example.  Between
 June and October in 1994, approximately 40 wire transfers were
 attempted from Citibank's cash management system through the use
 of a computer and phone lines from St. Petersburg, Russia, by
 compromising the password and user identification code system.
 Citibank was successful in blocking most of the transfers or
 recovering the funds from recipient banks, limiting its losses.
 But the potential loss was enormous. Still, imagine what the
 impact might have been if the intruders' intent was not to steal
 funds from a few accounts, but to bring down the entire bank's
 accounting system; or to zero out the


 Begin Page 21

 records of thousands of accounts; or to disrupt several major
 banks simultaneously.

 * In 1989, the "Legion of Doom" in Atlanta, Georgia, remotely
 accessed the administrative computers of Bell South and
 wiretapped calls and altered phone services.  It could have shut
 down the phone network for the Southeastern United States.

 * From 1993 to 1995, a man in California gained control of the
 computers running local telephone switches, and discovered
 information concerning U.S. government wiretaps conducted
 pursuant to the Foreign Intelligence Surveillance Act (FISA). He
 also uncovered a criminal wiretap and warned the target.

 Now, in part through the efforts by joint industry-government
 bodies such as the President's National Security Advisory
 Committee (NSTAC), telecommunications carriers have taken steps
 to prevent,


 Begin Page 22

 or to minimize and contain the damage from, this sort of attack,
 in order to avoid the sort of regional disruption threatened by
 the Legion of Doom. But I don't know anyone who thinks that this
 sort of disruption is no longer a real possibility.

 The banking and telecommunications infrastructures are not the
 only ones that have been affected.

 * In 1992, a computer intruder was arrested for tampering with
 the Emergency 911 systems in Virginia, Maryland, and New Jersey
 in order to introduce a virus and bring down the systems.

 * Also in 1992, a fired employee of an emergency alert network
 sabotaged the firm's computer system by hacking into the
 company's computers, causing them to crash for about 10 hours.
 During that time, there was an emergency at an oil refinery. The
 disabled system was therefore unable to alert thousands of
 nearby residents to a noxious release from the


 Begin Page 23

 refinery. Beyond that, the computer crash potentially
 jeopardized hundreds of thousands of people in 22 states and 6
 areas of Canada where the alert network operated.

 And, of course, the government itself has not been immune to
 such attacks.

 * A computer hacker penetrated computer or phone systems of
 universities, government departments, and companies.  In the
 U.S. marshals' computer, he found the locations of individual
 federal prisoners, putting the security of our institutions at
 risk. He also stole from an air force base a computer access
 card, which he then sold through the mail.

 * Finally, a sniffer was introduced into computers of NASA's
 Goddard Space Flight Center, permitting someone to download a
 large volume of complex calibration telemetry calculations
 transmitted from satellites. The


 Begin Page 24

 sniffer remained undetected for an unprecedented length of time.

 These are just some examples of the cases we've already seen.
 But they should convey to you the urgency of the situation.

 Now, some of my colleagues in government think it's best not to
 discuss such cases, or to speculate about possible terrorist
 cyber attacks, publicly, for fear of inspiring would-be
 terrorists to carry out just the sort of attacks we're concerned
 about. But I think keeping quiet about the problem is the wrong
 approach. Silence will not appreciably lessen the probability of
 an attack. We must take it as a given that someone is already
 scheming.

 Instead, our main concern should be to get our own house in
 order and begin constructing our defenses. This means, first and
 foremost, that we need to raise people's consciousness -- both
 within the government and in the relevant sectors of industry.
 This requires that


 Begin Page 25

 we talk about the threat and how to combat it. That is why this
 conference is so valuable. Second, it means we have to figure
 out how to organize ourselves within government, and in the
 private sector, to fight the threat.

 While the Justice Department is designated as the lead agency
 for fighting terrorism in the U.S., we do not look at the cyber
 threat solely as a subset of terrorism. The potential sources of
 attack are simply too varied. It would be self-defeating to
 concentrate on protecting against terrorist attacks, but to
 ignore the problem of hackers, foreign espionage agents, or
 organized crime groups. Yet, despite the breadth of the problem,
 right now, there is no single agency, no focal point within the
 government responsible for protecting against such attacks. In
 fact, at last count there some 22 agencies and task forces that
 thought they had responsibility for some segment of this
 problem.  Similarly, while many individual companies have taken
 steps to secure their information systems, very few industries
 have begun considering this problem on an


 Begin Page 26

 industry-wide scale. But clearly this problem begs for a
 comprehensive approach that involves both industry and
 government in a cooperative effort.

 So, what needs to be done? Let me set out a roadmap for you, and
 identify in particular where I think help from industry is
 critical.

 _First_, we have to identify our vulnerabilities. This means
 identifying those components of government and the private
 sector that, if attacked, would result in the greatest harm to
 society, on a regional or national scale These are what we have
 begun calling "critical national infrastructures." We currently
 break those infrastructures into roughly eight categories:
 telecommunications; electrical power systems; transportation;
 water supply systems; emergency services (including medical,
 police, and fire and rescue services); and continuity of
 government and government operations.


 Begin Page 27

 We already have a foundation for this effort. Both the Defense
 Department and the FBI have what they call key asset programs,
 which consist of databases identifying key assets within each
 category of critical infrastructures, and containing
 vulnerability information and emergency points of contact for
 each key asset.

 Until now, however, both of these programs have focused on
 vulnerabilities to _physical_ attack. DOD and FBI have already
 set out to broaden the focus of these programs to include
 vulnerabilities to cyber attacks and to coordinate the two
 databases. In expanding into the cyber area, we will need a lot
 of cooperation from industry, a willingness to share information
 with us (on a confidential basis) and to work jointly with us in
 determining vulnerabilities.

 The _second_ thing we need to do is identify the scope and
 sources of the threat. Again, the defense and intelligence
 communities have been concerned with identifying military and
 espionage threats in this


 Begin Page 28

 field. But there has been very little effort to assess
 comprehensively the full range of cyber threats to our
 infrastructures: who poses a threat? What are their
 capabilities? What have they done in the past? What are their
 intentions?

 This will require a joint effort by the defense, intelligence,
 and law enforcement communities, combining their data and doing
 joint analyses. But it will also require cooperation by
 industry. No analysis can be complete without information about
 what attacks industry has already experienced, and by whom.

 On this point, let me say that under-reporting of computer
 crimes has been a major problem in getting a handle on the
 nature and scope of the threat. There are two principal reasons
 for this under-reporting. First, many victims don't even now
 they are victims. Let me give you one example. The Justice
 Department handled a case in 1992 involving a hacker intrusion
 into Boeing's supercomputer center in Seattle. The hacker
 downloaded encrypted password files and used Boeing's computers
 to


 Begin Page 29

 run hacker and cracker programs. To its great credit, Boeing
 reported the intrusion to the FBI and partitioned its system to
 allow agents to trace the hackers to the source.

 In the course of the investigation, the FBI soon learned that
 the hackers had gained access to the entire computer system
 serving the federal district court in Seattle. In fact, he had
 obtained the passwords of both the system administrator and a
 federal judge, forcing the courthouse system to close for a day.
 Yet, without Boeing's call to law enforcement, the federal court
 administrator would not have known that an intruder had acquired
 unfettered access to the court's computers.

 A second reason for under-reporting is the collateral
 consequences of reporting. To put it bluntly, there may be a lot
 of explaining to do -- to managers, customers, regulators, or
 the public. If it is your job to secure a company's information
 systems, how eager will you be to confess to people that your
 defenses didn't work? Banks are a prime example. If


 Begin Page 30

 you are Citibank, you maybe loath to reveal to depositors that
 their accounts may be vulnerable to electronic theft. Similarly,
 a telecommunications carrier may not want to publicize that its
 customers' conversations have been accessed by so-called "phone
 phreakers."

 The extent of under-reporting is illustrated by some statistics
 compiled by DISA. As many of you probably know, DISA tests the
 security of DOD computer systems by having its tiger teams
 "attack" the computes using standard hacker methods and tools.
 Over the course of this program, DISA has accumulated some
 telling statistics. At last count, DISA tiger teams had
 successfully penetrated 88% of the computer systems they
 attacked. More startling, system administrators at the
 successfully attacked sites only detected 4% of these
 penetrations. And of the 4 % who discovered the intrusion, only
 5% reported it! If you do the math, you'll see that of the
 10,000 machines attacked, 8,800 were penetrated, only 352
 discovered it, and only 18 reported it. Or put another way, for
 each report of a


 Begin Page 31

 computer intrusion, there were 490 others that went unreported.

 The FINAL step, and probably the most difficult, is to figure
 out how to organize ourselves to address the problem. Again, I
 believe it is a mistake to think about this problem in
 compartments: that is, for DOD as a military problem; for
 Justice and FBI as a terrorism problem; for the CIA and NSA as
 an espionage problem and for private industry as a white-collar
 crime problem.  The threat is too varied. and the problems too
 overlapping, to permit such a fragmented approach. We clearly
 need one focal point in the government to take the lead in
 addressing this issue comprehensively -- to develop national
 policy, coordinate the necessary other agencies, and with
 industry on developing solutions.  We need the equivalent of the
 "Manhattan Project" to address the technological issues and to
 help us harden our infrastructures against attack.  It might be
 that we can just designate an existing agency to take the lead.
 Or we may need a new agency or some interagency body to perform
 the task.


 Begin Page 32

 But some centralized entity is direly needed to push this effort
 along.

 Most importantly, though, whatever we decide to do within the
 government, we need to enlist the private sector to join in this
 cooperative venture -- not just in assessing vulnerabilities and
 threats, but in devising and implementing solutions. Simply put,
 without the participation of the private sector, any effort is
 bound to come up short.

 There are several reasons for this. _First_, at the most basic
 level, most components of the national information
 infrastructure, as well as the critical industries and
 institutions that depend on the NII, are in private hands. This
 means that, absent statutory authority to regulate a particular
 industry, the government has limited ability to require private
 companies to take protective measures; it can merely advise
 industry and urge it to "do the right thing." And even if
 government convinces industry to take protective measures, there
 remains the knotty question


 Begin Page 33

 of who will pay for such measures (or for restoration of service
 after an attack). Although private companies have an obvious
 financial incentive to take steps to reduce thefts, it is less
 clear that they are willing to incur the costs necessary to
 protect their plants or information systems against a purely
 malicious or terrorist attack. These are issues that need to be
 worked out by industry and government together.

 _Second_, private sector involvement in crafting and
 implementing solutions is needed in order to engender the trust
 in government that will be necessary to implement any solution.
 Few people question the need for a government role, at some
 level, in protecting the physical plant of the nation's critical
 infrastructures.  But the same cannot be said in the information
 technology arena. The notion of government involvement in this
 area immediately raises concerns about privacy, economic
 competitiveness, and protection of proprietary information. The
 raging debate over the government's encryption policy is just
 one example. These concerns are not easily reconciled with the
 interests in national

 Page 34

 security and law enforcement; but to ignore them would render
 any effort futile.

 We are currently trying to come up with a framework for
 addressing all these issues. No decisions have been made yet, so
 I cannot report to you on precisely where we are headed. But I
 do know that, in the very near future, we will be reaching out
 to critical industries to get them integrally involved in the
 process. I ask you to join us in this vital effort; to sit down
 with us and share your concerns, your ideas, your skill and
 expertise, and your energy; and to work with us to begin
 addressing this problem.

 There are many skeptics who say that we will have to endure the
 electronic equivalent of Pearl Harbor or Oklahoma City before
 the key players in government or industry wake up to the problem
 of protecting our information and other critical infrastructures
 from the new cyber threats. The fact that the Olin Foundation
 and the Air Force are holding this conference, however, and


 Begin Page 35

 have succeeded in getting such a diverse and high-level group of
 participants disproves this pessimistic view.

 But we cannot stop here. It is not enough to identify the
 problem and to talk about it. After this conference, we need to
 begin taking action. So I ask you to join us in taking those
 next steps. We need to educate industry about the problem,
 determine its scope, and create a joint approach to developing
 solutions. If we in government begin to pause or stumble, prod
 us or help us up. There will be much resistance along the way;
 but given the importance of the issue, inaction would be
 intolerable.

 Thank you.

 ---------------

------------------------------


------------------------------

Date: Thu, 21 Mar 1996 22:51:01 CST
From: CuD Moderators <cudigest@sun.soci.niu.edu>
Subject: File 2--Cu Digest Header Info (unchanged since 7 Apr, 1996)

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost electronically.

CuD is available as a Usenet newsgroup: comp.society.cu-digest

Or, to subscribe, send post with this in the "Subject:: line:

     SUBSCRIBE CU-DIGEST
Send the message to:   cu-digest-request@weber.ucsd.edu

DO NOT SEND SUBSCRIPTIONS TO THE MODERATORS.

The editors may be contacted by voice (815-753-0303), fax (815-753-6302)
or U.S. mail at:  Jim Thomas, Department of Sociology, NIU, DeKalb, IL
60115, USA.

To UNSUB, send a one-line message:   UNSUB CU-DIGEST
Send it to  CU-DIGEST-REQUEST@WEBER.UCSD.EDU
(NOTE: The address you unsub must correspond to your From: line)

Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
libraries and in the VIRUS/SECURITY library; from America Online in
the PC Telecom forum under "computing newsletters;"
On Delphi in the General Discussion database of the Internet SIG;
on RIPCO BBS (312) 528-5020 (and via Ripco on  internet);
and on Rune Stone BBS (IIRGWHQ) (860)-585-9638.
CuD is also available via Fidonet File Request from
1:11/70; unlisted nodes and points welcome.

EUROPE:  In BELGIUM: Virtual Access BBS:  +32-69-844-019 (ringdown)
         Brussels: STRATOMIC BBS +32-2-5383119 2:291/759@fidonet.org
         In ITALY: ZERO! BBS: +39-11-6507540
         In LUXEMBOURG: ComNet BBS:  +352-466893

  UNITED STATES: etext.archive.umich.edu (192.131.22.8) in /pub/CuD/CuD
                  ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/
                  aql.gatech.edu (128.61.10.53) in /pub/eff/cud/
                  world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/
                  wuarchive.wustl.edu in /doc/EFF/Publications/CuD/
  EUROPE:         nic.funet.fi in pub/doc/CuD/CuD/ (Finland)
                  ftp.warwick.ac.uk in pub/cud/ (United Kingdom)


The most recent issues of CuD can be obtained from the
Cu Digest WWW site at:
  URL: http://www.soci.niu.edu/~cudigest/

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted for non-profit as long
as the source is cited. Authors hold a presumptive copyright, and
they should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified.  Readers are encouraged to submit reasoned articles
relating to computer culture and communication.  Articles are
preferred to short responses.  Please avoid quoting previous posts
unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

------------------------------

End of Computer Underground Digest #8.52
************************************