TK0JUT2%MVS.CSO.NIU.EDU@UICVM.uic.edu (06/28/91)
**************************************************************************** >C O M P U T E R U N D E R G R O U N D< >D I G E S T< *** Volume 3, Issue #3.23 (June 27, 1991) ** **************************************************************************** MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet) PHILEMEISTER: Bob Krause // VACATIONMEISTER: Bob Kusumoto MEISTERMEISTER: Brendan Kehoe +++++ +++++ +++++ +++++ +++++ CONTENTS THIS ISSUE: File 1: From the Mailbag (Response to Dalton; Hacker Definitions) File 2: Warrants issued for Indiana and Michigan "Hackers" File 3: More on Thrifty-Tel File 4: The CU in the News (Thackeray; Cellular Fraud; Privacy) +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CuD is available via electronic mail at no cost. Hard copies are available through subscription or single issue requests for the costs of reproduction and mailing. USENET readers can currently receive CuD as alt.society.cu-digest. Back issues of Computer Underground Digest on CompuServe can be found in these forums: IBMBBS, DL0 (new uploads) and DL4 (BBS Management) LAWSIG, DL1 (Computer Law) TELECOM, DL0 (New Uploads) and DL12 (Electronic Frontier) Back issues are also available from: GEnie, PC-EXEC BBS (414-789-4210), and at 1:100/345 for those on FIDOnet. Anonymous ftp sites: (1) ftp.cs.widener.edu (192.55.239.132); (2) cudarch@chsun1.uchicago.edu; (3) dagon.acc.stolaf.edu (130.71.192.18). E-mail server: archive-server@chsun1.uchicago.edu. COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted as long as the source is cited. Some authors, however, do copyright their material, and those authors should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to the Computer Underground. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Contributors assume all responsibility for assuring that articles submitted do not violate copyright protections. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Various Subject: From the Mailbag (Response to Dalton; Hacker Definitions) Date: June 27, 1991 ******************************************************************** *** CuD #3.23: File 1 of 4: From the Mailbag *** ******************************************************************** From: "Chas. Dye -- Solarsys Mechanic" <chas@SOLUTION.COM> Subject: Anonymous uucp from solarsys in Bay Area Date: Mon, 24 Jun 91 19:13:32 PDT solarsys, the site available for anonymous uucp downloads in the Bay Area, has had connectivity problems which have since been remedied. If you would like a listing of the available archives, you can grap the file /usr/uucppublic/ls-lR.Z You need to have a line in you Systems (or L.Sys) file which looks like this: solarsys ANY ACU <speed> <number> ""-\n-gin: archinfo sword: knockknock where <speed> is a standard modem speed between 300 and 19200 (We have a Telebit T2500 modem) and <number> is whatever portion of "1 415 339 6540" you need from your site Feel free to contribute files by writing them to the directory /usr/uucppublic/newfiles and letting me know (via mail to chas@solution.com) that you have sent something. We apologize for any inconvenience you may have experienced by with earlier attempts to dial in. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: argonaut@PNET91.CTS.COM(C. Peter Constantinidis) Subject: Dalton Spence's Imaginary Canadian BBS Crackdown Date: Sun, 23 Jun 91 14:20:14 EDT > However, I will not become TOO complacent, since the government of > Canada has a history of following the lead of the United States, even > when it would serve us better NOT to. I am worried that the recent > virus infestations of government computers, as described in the > attached article from "Toronto Computes!" magazine (June 3, Vol. 7, > #5, p. 3), may act as a catalyst for a crackdown on Canadian bulletin > boards. Which would be a shame, since I am just getting the hang of > using them. Give me a break Dalton. I would be very interested in understanding how exactly you put two and two together to result in four. Because I cannot seem to understand how it could possibly happen. So basically you're saying, that if the government uses lousy computers with lousy security and some 14 year old writes a virus program that says, for example, "legalize marijuana" the government is going to take revenge by taking away the computers of every single Canadian in the country? Come on.. Unless the government goes dictatorship (doubtful) the people would go ballistic and vote the government out of existence in a hurry. I would imagine those people who would like to ban BBSes are the same people who are unable to program a VCR's clock because they are simply too technologically stupid. There is an expression you might be familiar with, "those who cannot do, teach". But back to the topic, whipping out our handy copy of the Canadian Charter of Rights and Freedoms we see in section 2b that ALL forms of communication, electronic and otherwise are PROTECTED. The government could not ban BBSes or crack down on them unless it could prove that it would benefit the people to do so and obviously they can't. Because of the protection in section 2b they cannot regulate bbses because then it would be controlling people's ability to read,write and communicate with other people. Canada has better protections in the Charter of Rights and Freedoms than the Americans do in their Constitution. The Canadian Charter was written in 1982 which makes it more up to date and contemporary. So you needn't worry that tomorrow morning you'll be woken up by big thugs shining a bright light into your eyes, having them drag you outside and shoot you just because of some scare mongers (which you tried to do) or out of date laws in OTHER countries. Dalton, last time I looked, Canada was still a sovereign country. And the government has more important things to worry about than computers bbses. So just take it easy and don't worry. Of course one knows one shouldn't send email to the government over and over saying "fuck you! i'm a BBS user! what are you gonna do about that?! hahahahahah" Jesus... Hope this has helped in clearing up any confusion. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: "76012,300 Brad Hicks" <76012.300@COMPUSERVE.COM> Subject: Phreaks/Crackers/Hackers and Assundry Others Date: 20 Jun 91 10:59:54 EDT Attn: Computer Underground Digest REGARDING Re: Please Explain the Terms 'Hacker' and "Phreaker' In TELECOM Digest vol 11, #471, jdl@pro-nbs.cts.com (Jennifer Lafferty) asked: > I'm kind of lost here. Exactly what is "phreaking" and "hacking" > as you are using the terms. This should make a LONG thread. Everybody has their own definitions. Pat Townson, the TELECOM moderator, chimed in with his own. If I may paraphrase in the interest of brevity, Pat sez that a phreaker is someone who likes to rip of the Phone Cops; a hacker, a bright computer programmer; and a cracker, someone who rips off computer users. If true, this leaves a gaping hole in the language: what do we call a bright phone system expert who isn't a bright computer programmer? That aside, let me chip in my own definitions, which hopefully will shed as much light as they will heat (grin): HACKER: (n) Derived from "to hack," a verb used at MIT for dozens of years now to mean "to throw something together quickly" with an alternate, but related meaning, "to prank." (In MIT usage, a great prank is still called a hack, whether or not it has anything to do with computers.) Computer hackers are people who live for their hobby/profession. What separates a truly brilliant hacker from a truly brilliant programmer is that the hacker is only interested in results; s/he will achieve the impossible in record time but with code that cannot be maintained and no documentation. As one of Nancy Lebovitz's buttons says, "Real programmers don't document. If it was hard to write, it SHOULD be hard to understand." Or as we used to say at Taylor U., a hacker is someone who will sit at a computer terminal for two solid days, drinking gallons of caffeinated beverages and eating nothing but junk food out of vending machines, for no other reward than to hear another hacker say, "How did you get it to do THAT?" PHREAK: (n) Derived from the word "phone" and the Sixties usage, "freak," meaning someone who is very attached to, interested in, and/or experienced with something (e.g., "acid freak"). A "phone freak," or "phreak," is to the world-wide telephone system what a hacker is to computers: bright, not terribly disciplined, fanatically interested in all of the technical details, and (in many cases) prone to harmless but technically illegal pranks. CRACKER: (n) A hacker who specializes in entering systems against the owner and/or administrator's wishes. Used to be fairly common practice among hackers, but then, computing used to be WAY outside the price range of almost anybody and computers used to have lots of empty CPU cycles in the evenings. (There also used to be a lot fewer hackers; what is harmless when four or five people do it may become a social problem when four or five thousand do it.) Now hackers who don't illegally enter systems insist on a distinction between "hackers" and "crackers;" most so-called crackers do not, and just call themselves hackers. CRASHER: (n) Insult used by computer bulletin board system operators (sysops) to describe a cracker who enters for the malicious purpose of destroying the system or its contents. Used to be unheard of, but when I was last sysoping, was incredibly common. Crashers (who insist on calling themselves hackers) insist that this is because sysops are more obnoxious about asking for money and insisting on collecting legal names and addresses. CYBERPUNK: (n) A cyberpunk is to hackers/phreaks/crackers/crashers what a terrorist is to a serial killer; someone who insists that their crimes are in the public interest and for the common good, a computerized "freedom fighter" if you will. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Moderators Subject: Warrants issued for Indiana and Michigan "Hackers" Date: 18 June, 1991 ******************************************************************** *** CuD #3.23: File 1 of 4: Indiana/Michigan Hackers Busted *** ******************************************************************** {Moderators note: The following is the news release distributed by the Indianapolis Police Department.} NEWS RELEASE May 31, 1991 _Search Warrants Served in Computer "Hacking" Scheme_ INDIANAPOLIS -- The Indianapolis Police Department, the Federal Bureau of Investigation, and the United States Secret Service served search warrants at five Indianapolis locations on Wednesday, May 29, 1991, for computer-related equipment. The warrants were served by five teams of law enforcement officials forming a group known as the Special Computerized Attack Team (SCAT). SCAT is a cooperative effort between the Indianapolis Police Department the FBI, the Secret Service and other federal, state and local law enforcement agencies aimed at tracking computer "hackers" who illicitly enter the computer systems of companies in an attempt to gain sensitive information, money, or company secrets. The White Collar Crime Unit of IPD obtained information from the FBI and Secret Service concerning illegal computer access to the PBX system of an Indianapolis company. Armed with search warrants, SCAT members confiscated computer equipment from fie Indianapolis residences which linked several juveniles to the crime. The Indianapolis company has experienced losses which approach $300,000. A search warrant was served simultaneously by FBI agents, the Secret Service and Michigan State Police in West Bloomfield, Michigan, in this same case. Information gained from the search warrants has led police to continue the investigation in other cities as well. Suspects in the case are all juveniles and the investigation is continuing to determine if the evidence collected will support arrests. The SCAT unit is currently investigating other computer-related crimes and hopes to send a strong message to computer "hakers" that their illegal actions are being monitored closely bylaw enforcement officials. For further information, please contact Special Agent in Charge Roy Yonkus, U.S. Secret Service (Indiana) at 317/ 639-3301; or John M. Britt, Assistant to the Special Agent in Charge, U.S. Secret Service (Detroit Office) at 313/ 226-6400. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: John Higdon and Dennis Rears Subject: More on Thrifty-Tel Date: June 25, 1991 ******************************************************************** *** CuD #3.23: File 1 of 4: More on Thrifty-Tel *** ******************************************************************** {Moderators' note: The following is reprinted from Telecom Digest} Date: Sat, 15 Jun 91 02:24 PDT From: John Higdon <john@zygot.ati.com> Mark Seecof <marks@capnet.latimes.com> quotes the {LA Times}: > ``Little Phone Company on a Hacker Attack'' > By Susan Christian, Times Staff Writer. On June 13, the {San Jose Mercury} ran a story about Ms. Bigley's courageous efforts. The writer, Alex Barnum, did a little more investigating and presented a little more balanced picture than Ms. Christian. Excerpts below: Firm's Big Phone Fees Hang up Hackers by Alex Barnum, Mercury Staff Writer "A year ago, Thrifty Tel Inc. won approval from the state Public Utilities Commission ot charge unauthorized users of its long-distance lines a 'special' rate: a $3,000 'set-up' charge, a $3,000 daily line fee, $200 an hour for labor and the costs of investigating and prosecuting the offender. "Since then, the Garden Grove company has netted $500,000 and caught 72 hackers, ranging from an 11-year-old girl to a grandma-grandpa team of professional phone hackers." [Doesn't sound as if Thrifty Tel came off too badly on that one, does it? That's $500,000 NET profit on hackers. JH] "But while many have applauded Thrifty Tel's ingenuity, others have criticized the company for taking the law into its own hands. Some Los Angeles law enforcement officials, in fact, say the approach borders on extortion ... "Others charge that Thrifty Tel is deliberately baiting its long-distance system with lax security to catch hackers and bring in new revenue. Thrifty Tel is 'a vigilante,' says John Higdon, a San Jose phone network expert." [blush].... "Even a single call can cost a hacker more than $6,000. And Thrifty Tel charges an extra $3,000 for every access code the hacker uses. Since about half of Thrifty Tel's hacker 'customers' are minors, their parents usually wind up footing the bill. "Moreover, as a condition of the settlement, Thrifty Tel requires hackers to hand over their computers which mirrors a provision in the criminal code. Bigley usually turns the computer over to authorities, although she says she kept one once. [She kept more than that according to her own conversation with me. JH] "While praising Bigley's basic strategy, law enforcement officials say she has taken it a step too far. 'She can threaten a civil suit, but not criminal charges,' says one official. 'You don't use a criminal code to enforce a civil settlement.'"... "Other critics charge that Thrifty Tel is deliberately baiting hackers with antiquated switching technology and short access codes that are easier to hack than the more modern, secure technology and 14-digit access codes of the major long-distance carriers." Mr. Barnum has all the quotes from Ms. Bigley that the {LA Times} article had, which essentially contain the circular argument that it costs money to upgrade to FGD and why should Thrifty have to spend that money on account of "thugs and criminals" while whining about all the losses suffered at the hands of the hackers. Thrifty's technique looks more like a profit center than hacker "prevention". **************************************************************** {Moderators' note: The following is reprinted from TELECOM Digest, #476}. Date: Fri, 21 Jun 91 11:07:35 EDT From: "Dennis G. Rears (FSAC)" <drears@pica.army.mil> Subject: Re: Speaking in Defense of ThriftyTel (was Fighting Hackers) Kurt Guntheroth <kurt@tc.fluke.com> writes: > John Higdon says: >> Mr. Barnum has all the quotes from Ms. Bigley that the {LA Times} >> article had, which essentially contain the circular argument that it >> costs money to upgrade to FGD and why should Thrifty have to spend >> that money on account of "thugs and criminals" while whining about all >> the losses suffered at the hands of the hackers. Thrifty's technique >> looks more like a profit center than hacker "prevention". > Let's suppose ThriftyTel is deliberately baiting hackers (though using > older equipment because it is cheap sounds more reasonable to me). > How can this be considered more reprehensible than stealing network > services in the first place? I find it quite just that a company > should hang hackers with their own rope. If ThriftyTel was posting > the access codes on pirate BBS's, this might be going a bit too far on > the entrapment side, but there is no evidence this is happening. Have you ever heard of an attractive nuisance? Granted it may be stretching a point, but hey we are talking about California? :-) It could be argued that ThriftyTel has created an attractive nuisance by not securing their systems in accordance with industry standards; just like the homeowner who does not build a secure enough fence to keep the little cretins out of his/her pool. > And whoever asked whether ThriftyTel was inducing minors to enter into > an unenforceable contract, or an ex-post-facto contract, this may be > true. The hackers do have the option of refusing the contract and > letting ThriftyTel make good on its threat to initiate criminal > proceedings if it can. Probably most hackers, caught crouched over > the body with the smoking gun in their hand, and with the knowledge of > their guilt in mind, are reluctant to test their luck in court. Contract, hell it is extortion. As any first year law student could tell you the following must exist to be a contract: o legality of object # OK o mutual consideration # OK o contractual capacity # OK; minors create # a voidable contract o manifestion of consent (offer/acceptance) # NO o meeting of the minds The hacker is not aware of the offer (tariff), there is no manifestion of consent, and there is not meeting of the minds. Another point, California has the Uniform Commercial Code, thus the statue of frauds would apply. This means the contract (including acceptance) must be in writing for amount of over $500.00. One last point if they are saying a contract was formed, it becomes a civil matter only not a criminal. Either it is a contract in all cases or a contract in no cases. If they decide it is a contract they have to sue for breach of contract; they can't have criminal charges too. They must be consistent. BTW, I don't approve of what the hackers/phreakers are doing either, but ThriftyTel response is just as abusive of the laws as hackers/phreakers. We are still innocent until proven guilty, and there is no way I can tolerate any company or government "official" altering this. dennis +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Subject: Re: Speaking in Defense of ThriftyTel (was Fighting Hackers) Date: 21 Jun 91 12:32:56 PDT (Fri) From: John Higdon <john@mojave.ati.com> Kurt Guntheroth <kurt@tc.fluke.com> writes: > Record me as a supporter of ThriftyTel. You are overlooking a major flaw in Thrifty Tel's scam. In the United States, the system of jurisprudence requires the plaintiff in a civil case to 1.) prove damages and 2.) show mitigation of damages. Thrifty Tel does neither. In a five-day period, Thrifty Tel whisked a "Hacker Tariff" through the CPUC without comment, showing, documentation, or any justification WHATSOEVER. This tariff, which provides for "charges" that are around three hundred times the company's going rate for services, is then used in civil suits to claim damages. Thrifty Tel sits back in court, presents the logs showing the intruder's usage and then holds up this bogus tariff. In other words, TT has at no time ever proved its claim for the extortion it pulls on the "criminals and thugs" that it so actively crusades against. Concerning point two, let me give you an analogy. Let us suppose that I have decided to go into the banking business, but find that the cost of constructing a vault is prohibitively expensive. So I leave all the cash sitting around in the tellers' drawers. Word gets around that my bank is an easy mark, and consequently I find that frequently the cash has been cleaned out by thieves the night before. To combat this, I install a very sophisticated intrusion detection system with cameras and the like. I am now able to identify the thieves and I manage to get a law passed that allows my bank to claim damages against the burglars at about three hundred times the value of the cash stolen. Obviously, a bank vault would solve the lion's share of my problem, but why should I have to pay for a vault when it is "criminals and thugs" that are at the root of my "losses"? This is precisely the argument that TT uses when it is suggested that it upgrade its equipment and use FGD instead of FGB. Of course, FGD would not allow it to skim intraLATA traffic from Pac*Bell as it now does, but that is a different matter altogether. Believe me when I tell you that Thrifty Tel has no moral high ground to stand on. John Higdon <john@zygot.ati.com> (hiding out in the desert) ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Various Subject: The CU in the News (Thackeray; Cellular Fraud; Privacy) Date: 27 June, 1991 ******************************************************************** *** CuD #3.23: File 1 of 4: CU in the News / Thackeray;Privacy *** ******************************************************************** From: Barbara E. McMullen & John F. McMullen (Reprinted from Newsbytes) Subject: Gail Thackeray & Neal Norman Form Security Firm Date: June 21, 1991 NORMAN & THACKERAY FORM SECURITY FIRM 06/21/91 DALLAS, TEXAS U.S.A., 1991 JUNE 21 (NB) -- Neal Norman, a veteran of 34 years with AT&T, has announced the formation of GateKeeper Telecommunications Systems, Inc. The new firm will introduce a product which it says "provides an airtight defenses against unauthorized computer access." Norman told Newsbytes "we think we have a product that will revolutionize telecommunications by stopping unauthorized access to computer systems." Norman said that the system, which is scheduled to become available in the early fall, will provide protection for terminals, mainframes, and PBXs. Norman also told Newsbytes that Gail Thackeray, ex-Arizona assistant attorney general known for her activities in the investigation of computer crime, will be a vice president of the new firm. "I am extremely happy to have someone of Gail's ability and presence involved in this endeavor right from the beginning. Additionally," Norman said, "we have enlisted some of the industry's most well known persons to serve on a board of advisors to our new company. These respected individuals will provide guidance for us as we bring our system to market. Among those who have agreed to serve in this group are Donn Parker of SRI; Bill Murray, formerly of IBM; and Bob Snyder, Chief Computer Crime Investigator for the Columbus, Ohio, police. Synder told Newsbytes "I am excited about working with such bright people on something of real importance and I hope to contribute to an improvement in computer security." (Barbara E. McMullen & John F. McMullen/19910621) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Anonymous Subject: Cellular Phone Fraud Date: Thu, 27 Jun 91 13:35:41 CDT From: The Wall Street Journal, June 6, 1991. Pp. A-1, A-7. By John J. Keller DIALING FOR FREE **** Thanks to Hackers, Cellular Phone Firms Now Face Crime Wave *** An Altered Computer Chip is Permitting Easy Access to Networks Nationwide *** Mr. Sutton's Crucial Error *** Robert Dewayne Sutton wants to help stop the tide of fraud sweeping the cellular telephone industry. The 35-year old clearly knows plenty about fraud. After all, he helped spark the crime wave in the first place. Mr. Sutton is a computer hacker, a technical whiz who used an acquaintance's home-grown computer chip to tap into the local cellular phone network and dial for free. Mr. Sutton went into business selling the chips, authorities say, and soon fraudulent cellular phone calls were soaring nationwide. In February, 1989, police finally nabbed Mr. Sutton in his pick-up truck at a small Van Nuys, Calif., gas station. He was about to sell five more of the custom chips to a middleman. But by then it was too late. The wave of fraud Mr. Sutton helped launch was rolling on without him. ((stuff deleted explaining that industry currently loosing about $200 million a year, "more than 4% of annual U.S. revenue" to cellular phone fraud, and could rise to %600 million annually. Celluar system first cracked in 1987, by Kenneth Steven Bailey an acquaintance of Sutton from Laguna Niguel, Calif. Bailey used his PC to rewrite the software in the phone's memory chi to change the electronic serial number. By replacing the company chip with his own, Bailey could gain free access to the phone system.)) ((More stuff deleted, explaining how drug dealers use the phones, and small businesses sprung up selling free calls to anyplace in the world for a few dollars. Sutton denied selling the chips, but apparently sold his program for a few hundred dollars, and anybody with a copy could duplicate it. This is, according to the story, an international problem.)) When the dust settled in U.S. District Court in Los Angeles this April, Mr. Sutton pleaded guilty to production of counterfeit access devices and, after agreeing to cooperate with investigators, was sentenced to three years' probation and a $2,500 fine. ((stuff deleted)) But in adversity there is opportunity, or so believes Mr. Sutton. He says he's got a marketable expertise--his knowledge of weaknesses in cellular phone security systems--and he wants to help phone companies crack down on phone fraud. He'll do that, of course, for a fee. ** end article** ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: <Silicon Surfer@unixville.edu> Subject: How Did They Get My Name? Date: Tue, 8 Jun 91 19:09 EDT How Did They Get My Name? By John Schwartz Newsweek: June 3, 1991 When Pam Douglas dropped by Michelle Materres's apartment, Michelle was on the phone--but Pam knew that already. She and her son, Brian, had been playing with his new walkie-talkie and noticed the toy was picking up Michelle's cordless-phone conversation next door. They had come over to warn her that her conversation was anything but private. Materres was stunned. It was as if her neighbors could peek through a window into her bedroom-except that Michelle hadn't known that this window was there. "It's like Nineteen Eighty-four ;" she says. Well, not quite. In Orwell's oppressive world, Big Brother-the police state-was watching. "We don't have to worry about Big Brother anymore," says Evan Hendricks, publisher of the Washington-based Privacy Times. "We have to worry about little brother." Until recently, most privacy fears focused on the direct mail industry; now people are finding plenty of other snoops. Today's little brothers are our neighbors, bosses and merchants, and technology and modern marketing techniques have given each a window into our lives. Suddenly privacy is a very public issue. A 1990 Harris poll, conducted for consumer-data giant Equifax, showed that 79 percent of respondents were concerned with threats to their personal privacy-up from 47 percent in 1977. Privacy scare stories are becoming a staple of local TV news; New York City's ABC affiliate showed journalist Jeffrey Rothfeder poking into Vice President Dan Quayle's on-line credit records-a trick he had performed a year before for a story he wrote for Business Week. Now Congress is scrambling to bring some order to the hodgepodge of privacy and technology laws, and the U.S. Office of Consumer Affairs has targeted privacy as one of its prime concerns. Advocacy groups like the Consumer Federation of America and the American Civil Liberties Union are turning to privacy as one of the hot-button issues for the '90s . "There's a tremendous groundswell of support out there," says Janlori Goldman, who heads the ACLU Privacy Project. Snooping boss: Concern is on the rise because, like Materres, consumers are finding that their lives are an open book. Workers who use networked computers can be monitored by their bosses, who in some cases can read electronic mail and could conceivably keep track of every keystroke to check productivity. Alana Shoars, a former e-mail administrator at Epson America, says she was fired after trying to make her boss stop reading co-workers' e-mail. The company says Shoars got the ax for in subordination; Shoars counters that the evidence used against her was in her own e-mail--and was misinterpreted. Other new technologies also pose threats: cordless and cellular phones are fair game for anyone with the right receiver, be it a $1,000 scanner or a baby monitor. Modern digital-telephone networks allow tapping without ever placing a physical bug; talented "phone phreaks" can monitor calls through phone companies or corporate switchboards. Such invasions may sound spooky, but privacy activists warn that the bigger threat comes from business. Information given freely by consumers to get credit or insurance is commonly sold for other uses without the individual's knowledge or consent; the result is a flood of junk mail and more. Banks study personal financial data to target potential credit-card customers. Data sellers market lists of people who have filed Worker Compensation claims or medical-malpractice suits; such databases can be used to blackball prospective employees or patients. Citicorp and other data merchants are even pilot testing systems in supermarkets that will record your every purchase; folks who buy Mennen's Speed Stick could get pitches and discount coupons to buy Secret instead. "Everything we do, every transaction we engage in goes into somebody's computer, " says Gary Culnan, a Georgetown University associate professor of business administration. How much others know about you can be unsettling. Architect David Harrison got an evening call from a local cemetery offering him a deal on a plot. The sales rep mentioned Harrison's profession, family size and how long he had lived in Chappaqua, N.Y. Harrison gets several sales calls a week, but rarely with so much detail: "This one was a little bizarre." High tech is not the only culprit. As databases grow in the '80s, the controls were melting away, says Hendricks. "Reagan came in and said, 'We're going to get government off the backs of the American people.' What he really meant was, 'We're going to get government regulators off the i backs of business.' That sent signals to the private sector that 'you can use people's personal information any way you want'"' The advent of powerful PCs means that the field is primed for another boom. Today companies can buy the results of the entire 1990 census linked to a street-by-street map of the United States on several CD-ROM disks. Defenders of the direct-marketing industry point out that in most cases companies are simply, trying to reach consumers efficiently-and that well targeted mail is not "junk" to the recipient. Says Equifax spokesman John Ford: "People like the kinds of mail they want to receive." Targeting is now crucial, says Columbia University professor Alan Westin: "If you can't recognize the people who are your better prospects, you can't stay in business." Ronald Plesser, a lawyer who represents the Direct Marketing Association, says activists could end up hurting groups they support: "It's not just marketers. It's nonprofit communication, it's political parties. It's environmental groups. " E-mail protest: Consumers are beginning to fight back. The watershed event was a fight over a marketing aid with data on 80 million households, Lotus MarketPlace: Households, proposed by the Cambridge, Mass.- based Lotus Development Corp. Such information had been readily available to large corporations for years, but MarketPlace would have let anyone with the right PC tap in. Lotus received some 30,000 requests to be taken off the households list. Saying the product was misunderstood, Lotus killed MarketPlace earlier this year. New York Telephone got nearly 800,000 "opt out" requests when it wanted to peddle its customer list; the plan was shelved. With the MarketPlace revolt, a growing right-to-privacy underground surfaced for the first time. Privacy has become one of the most passionately argued issues on computer networks like the massive Internet, which links thousands of academic, business nd military computers. Protests against MarketPlace were broadcast on the Internet and the WELL (an on-line service that has become a favorite electronic hangout for privacy advocates and techie journalists), and many anti-MarketPlace letters to Lotus were relayed by e-mail. Consumers are also taking new steps to safeguard their own privacy often by contacting the Direct Marketing Association, which can remove names from many mailing lists. But compliance is voluntary, and relief is slow. In one chilling case, an unknown enemy began flooding business manager Michael Shapiro's Sherman Oaks, Calif., home with hundreds of pieces of hate junk mail. Suddenly Shapiro, who is Jewish, was receiving mail addressed to "Auschwitz Gene Research" and "Belsen Fumigation Labs." Shapiro appealed to the DMA and the mailing companies directly but got no responses to most of his calls and letters. "They ignore you, throw your letter away and sell your name to another generation of people with computers," he complains. Finally one marketing executive publicized Shapiro's plight within the DM industry. Eight months after the onslaught began, the letters have slowed-though some companies still have not removed him from their lists. How else can privacy be protected? It doesn't have to mean living like a hermit and only paying cash, but it does mean not saying anything over cellular and cordless phones that you wouldn't want others to overhear. Culnan of Georgetown uses her American Express card exclusively, because while the company collects voluminous data on its cardholders, it shares relatively little of it with other companies. Some privacy activists look hopefully, across the Atlantic Ocean. The European Community is pushing tough new data rules to take effect after 1992. The Privacy Directive relies on consumer consent; companies would have to notify consumers each time they intend to pass along personal information. The direct-marketing industry claims the regulations would be prohibitively expensive. The rules may be softened but could still put pressure on U.S. marketers who do business abroad. U.S. firms might find another incentive to change. Companies don't want to alienate privacy-minded customers. "We're in the relationship business," says James Tobin, vice president for consumer affairs at American Express. "We don't want to do anything to jeopardize that relationship." Citicorp's supermarket plan makes privacy advocates nervous; but Citicorp rewards customers for giving up their privacy with incentives like discount coupons, and it reports that no consumers have complained. Eventually, strong privacy-protection policies could make companies more attractive to consumers, says Columbia's Westin-and may even provide a competitive edge. Then consumers might get some of their privacy back-not necessarily because it's the law, or even because it's right, but because it's good business. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: <Silicon Surfer@unixville.edu> Subject: Would New Laws Fix the Privacy Mess? Date: Tue, 8 Jun 91 19:09 EDT Would New Laws Fix the Privacy Mess? By Annetta Miller and John Schwartz with Michael Rogers Newsweek: June 3, 1991 Congress is scrambling to catch up with its constituents in the battle over privacy. It has a daunting task ahead: to make sense of the jumble of laws that have been passed-or are currently under consideration-to regulate privacy. Why, for example, is it legal to listen in on someone's cordless phone conversation but illegal to listen to a cellular call? Why are video-rental records protected but records of health-insurance claims largely unprotected? (That one has to do with an impertinent reporter revealing the video-renting habits of Supreme Court nominee Robert Bork.) The present foundations of privacy law have their roots in the U.S. Constitution. Although the word "privacy" does not appear in the document, the Supreme Court has interpreted the Constitution to grant individuals a right of privacy based on the First, Fourth, Fifth, Ninth and Fourteenth amendments. Since the mid-1960s, Congress has enacted no fewer than 10 privacy laws-including the landmark 1974 Privacy Act. And yet a national right to privacy is far from firmly established. On its face, for example, the Fair Credit Reporting Act limits access to credit reports. But it also grants an exception to anyone with a "legitimate business need." The Right to Financial Privacy Act of 1978 severely restricts the federal government's ability to snoop through bank-account records; but it exempts state agencies, including law-enforcement agencies, and private employers. "It's easy to preach about the glories of privacy," says Jim Warren, who organized a recent "Computers, Freedom & Privacy" conference. But it's hard to implement policies without messing things up." That hasn't stopped people from trying. James Rule, a State University of New York sociology professor, says that new legislation is warranted "on the grounds that enough is enough . . . [Privacy infringement] produces a world that almost nobody likes the look of." Data board: The newest efforts to regulate privacy range from simple fixes to a full-fledged constitutional amendment. Last week a Senate task force recommended extending privacy laws to cover cordless tele-phones. One bill, proposed by Rep. Robert Wise of West Virginia, would create a federal "data-protection board" to oversee business and gov-ernmental use of electronic information. Another, being prepared by Sen. Patrick Leahy of Vermont, would apply the Freedom of Informa-tion Act to electronic files as well as to paper. Rep. Andy Jacobs of Indiana has held hearings on the misuse of social-security numbers to link computerized information. And several bills have been introduced to stop credit reporters from selling personal data to junk mailers. Possibly the most sweeping proposal for change comes from Harvard University law professor Laurence Tribe. In March, Tribe proposed a constitutional amendment that would, among other things protect individuals from having their private data collected and shared without approval. "Constitutional principles should not vary with accidents of technology," Tribe said at the "Computers, Freedom & Privacy" conference earlier this spring. He said an amendment is needed because the letter of the Constitution can seem, at the very least, "impossible to take seriously in the world as reconstituted by the microchip." But some experts argue that well-meaning reform could do more harm than good. Requiring marketers to get permission every time they want to add a name to a mailing list would make almost any kind of mass mailing hopelessly expensive. "It's nice to talk about affirmative consent, but it really will kill the industry," warns Ronald Plesser, who represents the Direct Marketing Association. "And then people who live out in the country won't have access to the L.L. Bean catalog and the services they like." In this technological age, how much privacy Americans enjoy will depend partly on how high a price they are willing to pay to keep it. ******************************************************************** ------------------------------ **END OF CuD #3.23** ********************************************************************