TK0JUT2%NIU.BITNET@UICVM.uic.edu (09/23/90)
**************************************************************************** >C O M P U T E R U N D E R G R O U N D< >D I G E S T< *** Volume 2, Issue #2.04 (September 23, 1990) ** **************************************************************************** MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet) ARCHIVISTS: Bob Krause / Alex Smith USENET readers can currently receive CuD as alt.society.cu-digest. COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted as long as the source is cited. It is assumed that non-personal mail to the moderators may be reprinted, unless otherwise specified. Readers are encouraged to submit reasoned articles relating to the Computer Underground. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Contributors assume all responsibility for assuring that articles submitted do not violate copyright protections. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CONTENTS: File 1: Moderators' Corner File 2: Re: Evidence (was Re: Musing on Constitutionality) File 3: Why the FBI should be concerned about the Secret Service File 4: California Computer Abuse Law revisited File 5: Candidate for state governor supports electronic freedom & privacy File 6: Review of Steven Levy's CLOAK AND DAGGER File 7: The CU in the News ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ---------------------------------------------------------------------- ******************************************************************** *** CuD #2.04, File 1 of 7: Moderator's corner *** ******************************************************************** Date: September 23, 1990 From: Moderators Subject: Moderators' Corner ++++++++++ In this file: 1. CuD SURVEY 2. CuD FORMAT 3. LEN ROSE UPDATE ++++++++++++++++++ CuD Survey About Ready ++++++++++++++++++ Bob Krause has the survey of CuD readers about ready to send. The earlier announcement of the survey received positive responses, so he will send it out directly from his site. The purpose is to find out who the readership is. The subscribers are overwhelmingly professional (computer scientists, journalists, academics), with the rest divided up among students, law enforcement or computer security, and the generally curious. The results will remain in-house, although Bob intends to use some of the data for a conference paper. +++++++++++++++++++ CuD Format +++++++++++++++++++ We have tried to format CuD in response to the various suggestions that have come to us since we began. Since we moved to the current "standard" format, we have received few suggestions and no complaints. Sometimes a reality check is wise, so if you have suggestions, let us know. We currently format at 75 characters per line, but reader who print it out before reading may prefer 65 characters, our own preference. We are wondering if there is any strong feeling on the format, one way or the other. ++++++++++++++++++++++++ LEN ROSE UPDATE ++++++++++++++++++++++++ Len Rose's trial is still scheduled for February. His situation, however, continues to cause problems. Although even by the least charitable assessment his crimes are not serious, the publicity and that "taint" makes it difficult for him to find employment, and he has no steady source of income whatsoever. His problems are complicated by the seizure of his possessions. He lost his equipment, and even if ultimately exonerated as Craig Neidorf was, the financial burden makes it impossible to support his wife and children. Strong arguments have been made in the past for hiring people with competent computer skills, especially those who possess expertise in the realm of computer security. Len has demonstrated his competence in the past as a programmer and as a consultant, and his skills would be an asset to any employer. CuD is not an employment bulletin, but there are times when those seeking employment should have an alternative forum to engage in their search, and we are willing to provide space on occasion to put potential employers in contact with candidates. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ To: EFF-NEWS@NETSYS.COM Subject: Re: Evidence (was Re: Musing on Constitutionality) Date: 14 Sep 90 03:35:56 GMT ******************************************************************** *** CuD #2.04: File 2 of 7: From the Mailbag *** ******************************************************************** +++++++++++++++++++++++++++++ We received the following from one of the more interesting newsnets around, and the author gave permission to reprint it. ++++++++++++++++++++++++++++++ I have always been amused at reading how the goons confiscate printers when they move in. How silly! Yet it got me thinking... If I were a computer criminal, I might just create a very special printer with a bank of non-volatile storage in it. Or, for that matter, just buy one of the modern printers you can get these days with 4 megs ram, etc. I would use that storage, normally, to keep all the stolen access codes, calling card numbers, and other incriminating data. Pretty easy, with the high speed link I have to my printer, to fetch the codes from it. (I would also have the machine erase stuff if disconnected improperly, keeping backups somewhere far away.) Or I could hide this info in little hidden places in all kinds of semi-smart or smart peripherals -- including some off the shelf. So if we fight (correctly) to stop them from confiscating everything, this may drive the real criminals to such tricks, which may lead to grander confiscation. I point this out -- I don't know if there's an answer. (Author's name deleted by request) ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ Date: 22 Sep 90 04:02:57 GMT From: Anonymous Subject: Why the FBI should be concerned about the Secret Service ******************************************************************** *** CuD #2.04: File 3 of 7: The FBI and the Secret Service *** ******************************************************************** Rumors have it that the FBI is not very happy with the way the secret service is conducting investigations. According to the rumors, the FBI thinks it's hampering their own investigations and making it more difficult to go prosecute big time criminals. Here's the gist of the arguments. PROFESSIONALISM: When the FBI was investigating the nuPrometheus League's alleged involvement in theft and distribution of Apple Software, the people they visited had very different experiences than those the secret service visited. The FBI was, so it's said, was polite, courteous, and generally professional. They didn't try to act like they knew more than they did, and they didn't try to intimidate those they questioned. In a case related to Sun Devil, an FBI agent stopped by to just chat and discussed some of the tactics used by the secret service and didn't seem at all happy about either their methods or their competence. If one agency isn't professional, it makes people less willing to cooperate with members of other agencies when they come around. JURISDICTION: The FBI and secret service have jurisdiction over computer crimes under the 1986 federal law outline computer crimes. The FBI generally investigates crimes involving break-ins at government offices or military installations, or in which the government is the target. The secret service is involved with investigating crimes involving access devices, which generally means crimes employing a modem to get into other computers or rip-off telecom companies. There may be a jurisdictional fight going on, and the secret service may be trying to expand the scope of its activities. If successful, it means more visibility, more appropriations, more staff, and more glory. This might explain why there was so much initial publicity over the hacker busts this year and why they are go after relatively easy targets. RIGHTS: The FBI probably has far more experience in the subtleties of questioning than the secret service, and they are more likely to know the limits of what they can and can't do. The secret service, by contrast, has relatively young agents doing the investigation, and some of those responsible for the Sun Devil investigation who were in the field doing the searches are said to have as little as two or three years total experience and little field experience. Lacking an experienced agent-in-charge, it's more likely that rights will be violated by young agents who simply don't know any better. Most people don't distinguish between FBI and secret service, so if rights are violated all government agencies are tainted. The FBI has been criticized in the past for violation the rights of political groups in the 1960s and the 1970s, and has been caught violating the rights of groups sympathetic to Latin American countries the Reagan administration opposed in the 1980s. They don't need the aggravation of another agency renewing the issues of constitutional rights and further limiting the scope of their power to investigate. BACKLASH: If a backlash occurs against the secret service, the FBI will also feel it. If restrictions are placed on what agencies are allowed to do as a response to abuses, the FBI would itself become a victim of the secret service because of new laws and policies that restrict their powers. A backlash could also result in negative publicity that would reduce the dangers of serious computer crime by creating a "cry wolf" scenario in which so many non-threats were publicized that real threats would go unheeded. A final consequence of backlash could be reduction in appropriations for combating technological crimes. How can any agency expect to present a convincing argument that there are dangerous computer crooks out there when the experience with the secret service has an image of focusing on juvenile delinquents who abuse credit cards or is involved in publicized trials where the defendant has the charges dropped during a prosecutor's arguments? It's one thing for the secret service to wind up with egg on its face, but when they splatter other enforcement agencies and tarnish them as well it doesn't help those agencies. There are many sincere government agents who respect the law and individuals' rights. Let's keep in mind that, although prohibited from speaking out publicly, those agents and their agencies, whether investigators or other federal prosecutors, should be seen as upholders of law and not violators of it. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ Date: 19 September, 1990 From: Moderators Subject: California Computer Abuse Law revisited ******************************************************************** *** CuD #2.04: File 4 of 7: California Computer Abuse Law *** ******************************************************************** In a previous issue of Computer underground Digest (1.17, File 5), the California revision of Title 13 Sections 502 and 502.7 was described as an example of the potential dangers in "cracking down" on computer hackers. Upper case indicates emphasis that we have added. Title 13 Sect. 502.7: "(a) A person who, knowingly, willfully, and with intent to defraud a person providing telephone or telegraph service, avoids or attempts to avoid, OR AIDS ABETS OR CAUSES ANOTHER TO AVOID the lawful charge, in whole or in part, for telephone or telegraph service by any of the following means is guilty of a misdemeanor or a felony, as provided in subdivision (f):" There follows a list of proscribed means, including charging to non-existence credit cards and tampering with telecom facilities, most of which seem reasonable. One, however, strikes us as potentially dangerous. 502.7 (b) states: "Any person who MAKES, POSSESSES, SELLS, GIVES, OR OTHERWISE TRANSFERS TO ANOTHER, OR OFFERS OR ADVERTISES ANY INSTRUMENT, APPARATUS, OR DEVICE WITH INTENT TO USE IT or with knowledge or reason to believe it is intended to be used to avoid any lawful telephone or telegraph toll charge or to conceal the existence or place of origin of destination of any telephone or telegraph message; or (2) sells, gives, or otherwise transfers to another, or advertises plans or instruments for making or assemblying an instrument, apparatus, or device described in paragraph (1) of this subdivision with knowledge or reason to believe that they MAY BE {emphasis added} used to make or assemble the instrument, apparatus, or device is guilty of a misdemeanor or a felony, as provided in subdivision (f)." The broad wording of this laws would make it illegal to possess information on "boxing" or to possess an autodialer. The problematic language here is "with knowledge or reason to believe it is intended to avoid. . .". We have seen from Operation Sun Devil that, contrary to normal Constitutional procedures, the burden of proof of innocence lies on the "suspect." A BBS operator who puts boxing files in a text section, knowing that some users might try to apply the knowledge illegally, could, under the current philosophy of the Secret Service and others, be indicted. This may seen a remote possibility, but we have seen from recent activity that we simply cannot rely on good faith interpretations of the law by some prosecutors, especially those willing to distort "evidence" to strengthen a case. Further, the term "may be" is unnecessarily vague. Generally, the term means "expressing ability, permission, freedom, possibility, contingency, chance, competence..." (Chambers 20th Century Dictionary, 1972: p. 811). An automobile dealer presumably knows that a customer "may" use a car in the commission of a crime, or "may" drive the car while intoxicated. Yet, it is absurd to consider holding the dealer criminally liable for the sale in the event the customer "may" be able to do so. Our point is that the language of this Bill seems unnecessarily restrictive and open to potential abuses by law enforcement agents, especially those willing to seek "test cases" to test the laws. Californians should write their legislators with their concerns in hopes that the language would be revised in a way that allows legitimate targeting of "real" computer criminals, but reduces the potential for using the law to persecute those for whom less stringent and more productive responses are appropriate. Just as chilling is subdivision (g) of this passage. The language in (g) specifies: Any instrument, apparatus, device, plans, instructions, or written publication described in subdivision (b) or (c) may be seized under warrant or incident to a lawful arrest, and, upon the conviction of a person for a violation of subdivision (a), (b), or (c), the instrument, apparatus, device, plans, instructions, or written publication may be destroyed as contraband by the sheriff of the county in which the person was convicted or turned over to the person providing telephone or telegraph service in the territory in which it was seized. This section seems reasonable to the extent that it specifies confiscation of an illegal "instrument" upon conviction. The problem, however, is the apparent tendency in some states to seize equipment even when indictments are not forthcoming. The wording would seem to offer incentives to agents to secure an arrest as a means to confiscate equipment, even if charges were subsequently dropped. Again, this may seem far-fetched, but the undeveloped state of computer law and the actions of prosecutors in early 1990 leave little room for confidence in good faith interpretation of the wording. Take an example: If a person were to be indicted for posession of an auto-dialer (which generally has but one purpose) pursuant to a search warrant for unrelated reasons, computer equipment could be confiscated. We have seen from the actions of agents that the definition of "equipment" is quite broad, and can include printers, modems, answering machines, or even books and pictures. If the person is convicted of possession, then the equipment could be lost. Again, "common sense," that sixth sense that tells us the world is flat, would tell us that such a possibility seems absurd. However, the zealousness of Sun Devil agents reduces the absurdity to the level of a "could be," and it is because of their actions that we are concerned with this wording. Title 13, Sect 502 (h) provides that: Any computer, computer system, computer network, or any software or data, owned by the defendant, which is used during the commission of any public offense described in this section any computer, owned by the defendant, which is used as a repository for the storage of software or data illegally obtained in violation of this section shall be subject to forfeiture. The chilling aspect of this passage is that is says nothing about conviction. Does "subject to forfeiture" mean that, even if found innocent, one could lose their equipment? A good faith reading suggests that the intent of the language at least implies that a conviction must occur. But, in reading the indictments of Craig Neidorf and Len Rose (neither from California), we should be cautious before assuming that prosecutors will not resort to creative interpretations to file an indictment. We should also be aware that at least one California prosecutor has published statements advocating an aggressive enforcement policy against "hackers" and has advocated responses that he acknowledges are probably unconstitutional. Given the broad interpretation of the law, and considering how companies such as BellSouth have grossly inflated the value of products (such as in the Neidorf case, in which information available for $13 was valued, according to the first indictment, at $79,449, and in the second indictment reduced to $23,900). Given their public statements in the media and the hyperbole of indictments, we cannot assume "good faith" prosecution by law enforcement, and the language of the California Act seems wide open for abuse. Our purpose is not simply to criticize this law, but to use it as an icon for other state and federal law. Some states are revising their laws, and it is crucial that computerists be aware of, and offer input into, their wording to assure that legitimate enforcement needs are met and potential for abuse or misuse removed. There must be a balance, and without public input such a balance is unlikely. We find Jim Warren's article (File 5, following) significant. It suggests that computerists introduce this as an issue in political campaigns as a means of educating both the public and the politicians. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ Date: Wed, 19 Sep 90 15:23:16 pdt From: well!jwarren@APPLE.COM(Jim Warren) Subject: Candidate for state governor supports electronic freedom & privacy ******************************************************************** *** CuD #2.04: File 5 of 7: Legal Changes / Electoral Processes *** ******************************************************************** [Please post & circulate] +++++++++++++++++++++++++++++++++++++ GUBERNATORIAL CANDIDATE SUPPORTS ELECTRONIC FREEDOM & PRIVACY Folks, we have a good chance of having a **State Governor** who (a) understands and favors technology, and -- more important -- (b) has signed and released the following statement (I just received a signed, dated copy by fax; I will fax it to anyone who requests it). -- Jim Warren, 9/16/90 [jwarren@well.sf.ca.us, or 415-851-7075/voice] +++++++++++++++++++++++++++++++++++++++++++ STATEMENT BY JIM GALLAWAY, CANDIDATE FOR GOVERNOR OF NEVADA I am the Republican candidate for Governor of the State of Nevada. I have been in the private telecomm industry for most of 20 years, and have been a principal in several telecomm and computer start-ups. I understand, support, and have practiced technological innovation. My wife and I have known Jim Warren for well over a decade. He has outlined some of the current issues about which owners and users of systems for e-mail, BBS, teleconferencing, electronic publishing and personal computing are deeply concerned. These are my positions, relative to some of the recent law enforcement practices by some government agents: 1. Government responses to alleged misdemeanors and crimes must be no more than comparable to the seriousness of the wrong-doings. 2. Simple electronic trespass without harm must be treated as any other simple trespass. It does not justify armed raids on teenagers, forced entry of private homes, nor seizure of telephone handsets, answering machines, computer printers, published documentation, audio tapes and the like. 3. The notion that equipment can be "arrested" and held inaccessible to its owner, without promptly charging the owner with a crime, is absolutely unacceptable. The practice of holding seized equipment and data for months or years is a serious penalty that must be imposed only by a court of law and only after a fair and public hearing and judicial finding of guilt. 4. Teleconferencing and BBS systems must have the same protections against suppression, prior restraint, search or seizure as do newspapers, printing presses and public meeting places. 5. The contents of electronic-mail and of confidential or closed teleconferencing exchanges must have the same protections against surveillance or seizure as does First Class Mail in a U.S. Post Office, and private discussions among a group in a home or boardroom. As Governor of the State of Nevada I will vigorously support all of these positions -- both statewide and nationally. /s/ Jim Gallaway, candidate for the Governor of Nevada [dated] 9/16/90 ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ Date: 22 September, 1990 From: Gordon Meyer Subject: Review of Steven Levy's CLOAK AND DAGGER ******************************************************************** *** CuD #2.04: File 6 of 7: Review of Levy's Cloak and Dagger *** ******************************************************************** CuD Synopsis "Code and Dagger" by Steven Levy The Iconoclast, MacWorld 9/90 p69-80 Summary by Gordon Meyer ------------------------ In the spring of 1988 a group using the name "The nuPrometheus League (Software Artists for Information Dissemination)" mailed unmarked computer disks to several prominent computer industry journalists and authors. These disks contained Apple Computer source code to the Color Quick Draw routines used in the Macintosh operating system. One year later the author, Steven Levy, reports that he recently received a series of phone calls from an FBI agent investigating the case. Levy's column ("The Iconoclast") in the September 1990 issue of MacWorld paints an interesting story about the investigation, much of it mirroring the issues raised by the Secret Service's "Operation Sun devil" and other computer crime investigations. In his article Levy tells of the Agent repeatedly questioning him about nuPrometheus, despite Levy's denials of have any real knowledge of the matter. The agent appeared to be reading the questions of a list, without any real understanding of the answers he was receiving. Two weeks later Levy received a call from a different agent and when this agent was queried how he came to be questioning the author the reply was "Somehow your name came up". When asked why the FBI was pursuing the case one year later, despite the fact that no other nuPrometheus activity had occurred since the original incident, the answer was that this was a significant case of Interstate Transportation of Stolen Property and could be equated with the theft of a national secret. For, the agent explained, if a spy were to come by this code he could use to break into the Macintosh computer and steal the secrets within! Levy reports that others have been interviewed in conjunction with the case as well. One, Mitch Kapor, described his interview as being almost surrealistic and profoundly disturbing. Levy quotes Kapor as saying: "It seemed obvious to me they didn't have a clear sense of the technology - there was such a lack of understanding that the effort to investigate wouldn't bear fruit. They were lost in cyberspace." Others who were interviewed report similar experiences. John Perry Barlow was told that the annual Hacker's Conference (a yearly meeting of highly-skilled computer programmers) was actually a gathering of computer outlaws. Grady Ward, a former Apple programmer, was told that the stolen source codes was filtering back to Communist enemies (via Toshiba electronics). Levy, attempting to tip the scales of discourse back towards more rational thought, writes: "That (the claim that this is a case of interstate theft) may be the legal charge, but the theft of source code involved in nuPrometheus is quite a different matter from hijacking a truck or robbing a bank. Software is a much trickier object than swag or money - it can move in elusive ways, and therefore access to protected software is a technically complicated matter. And the problem of the criminal's motive requires an even deeper understanding. In order to understand and ultimately apprehend the perpetrator, one must realize that this particular crime seems motivated not by greed or maliciousness, but by a peculiar attitude toward technology in general and the role of Apply Computer in particular." ... "One has to feel some sympathy for the agents here - it's a terrible burden to have to solve this rather bizarre ideological crime without being steeped in the lore of Silicon Valley." (p.74) CuD readers will immediately recognize the similarities between this investigation and those associated with Operation sun devil. In both instances the investigators have constructed a list of suspects based on associations with "suspected hackers" and have defined cultural and socially normative activities as "conspiratorial" or "criminal" without regard for other, less accusatory, interpretations that could apply. The nuPrometheus investigation has resulted, thus far, in at least three people being directly accused of the crime, but (like in the sun devil cases) no formal charges have been filed. One suspect, Grady Ward, was told by an agent "we know you did it" and is evidently considered a suspect because he's one of five likeliest Apple employees that had requested access to the source code shortly before it fell into the hands of nuPrometheus. The feds consider him a suspect because "He had since left Apple, he had attended a liberal arts college, and had once formed an intellectual society called Cincinnatus, thus betraying the same fondness for antiquity shown by the name nuPrometheus." (p.76) Ward admits having had the source code at one time, but it was part of his job to have it, and besides, he says, it was distributed to hundreds of people in the project group via Internet. In his article Levy poses several questions concerning this investigation. One of which, he says, is why the FBI is spending it's resources to follow this case rather than chasing the white-collar thieves who sacked the country for a trillion dollars in the Savings-and-Loan fiasco. After all, he notes, Apple has managed to stay in business despite the theft of the code, and nuPrometheus has not followed up on their promise to release other inside information. Levy goes on to suggest that some in Silicon Valley believe that Apple, perhaps via it's security firm (Kroll Associates, believed to have a number of former federal agents on staff), has pressured the FBI into pursuing the case. Again, this sounds quite similar to the "Phrack - E911" case where it has been conjectured that Bell South persuaded the Government to pursue a case that could not be won. Levy concludes by suggesting that we may not have heard the least of the nuPrometheus investigation. Stephen Satchell, a computer writer in Reno, told Levy that the FBI agent who interviewed him had a list of potential interviewees that numbered around 60 people, in 39 states. Levy leaves us with one final question. "... when does an investigation become a witch-hunt?" It's a question that CU followers have heard before. --------- GRM Internet: 72307.1502@Compuserve.com Moderators Note: CuD-ites are encouraged to see Levy's full article in MacWorld. Like his work _Hackers_, Mr. Levy consistently produces entertaining and thought-provoking articles. END ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ Date: 23 September, 1990 From: Various Contributors Subject: The CU in the News ******************************************************************** *** CuD #2.04: File 7 of 7: The CU in the News *** ******************************************************************** "Justice Department Computer Security Questioned" The General Accounting Office (GAO) has issued a report criticizing the Justice Department (DOJ) for failing to have a management system in place to secure its highly sensitive computer systems and has concluded that classified files were at risk. The report concludes that immediate action is required to correct security weaknesses at the main Justice Department data center and in computer systems used by DOJ litigating organizations. The report found several security weaknesses at DOJ's new data center in Rockville, MD, a site leased by DOJ from Control Data Corp. for 17 years. According to GAO, there are "numerous uncontrolled entrances...through which individuals could easily remove sensitive data." In addition, the report is critical of DOJ's lack of contingency plans for emergencies at the center and has not conducted a complete risk assessment that takes into account possible adverse actions by disgruntled employees. Copies of the report, entitled "Justice Automation: Tighter Computer Security Needed" may be obtainable from the GAO (202/225-6241). The report is GAO/IMTEC-90-69 and is dated July 30, 1990. ------------------------------ TRENTON, N.J. (UPI) -- Assembly Speaker Joseph Doria said Monday he was concerned by news that an alleged Republican break-in of Democratic computer files took place with the knowledge of the GOP's highest-ranking staff member. Doria, D-Hudson, said he had instructed all Assembly members and staff with knowledge of the ``hacking'' incident to turn their information over to Attorney General Robert Del Tufo, who is investigating the repeated break-ins. John Kohler, executive director of the GOP Assembly staff, resigned Friday admitting he had been aware of the activities of Jeffrey Land, a low-level staffer who reportedly broke into Democrats' files in the legislative computer system and discovered that Democrats had used the state-owned computer for political work. State law bars use of state equipment for political work or doing political work on state time. Previous to Kohler's resignation, however, top lawmakers had dismissed the break-ins as a computer hacker's prank. ------------------------------ "Think that Computer Message you just sent was Secret? Think Again" By Bart Ziegler Associated Press +++++++++++++++++ NEW YORK -- Next time you push that button on your computer to send a co-worker a racy electronic mail message about the boss, think twice. Someone may be reading your mail. Every day, millions of computer users send electronic messages to fellow employees, supervisors, clients and friends. Many assume these computer-to-computer electronic mail systems -- the postal system of the Information Age -- are confidential. But a recent lawsuit challenges that notion. The class action contends a California company spied on employees for months by monitoring thousands of their electronic messages. The lawsuit, filed last month by several employees again Epson America Inc. of Torrance, Calif., claims the company's computer operations manager made printed copies of electronic mail sent and received by 700 Epson workers. The suit claims such snooping violates a state wiretap law. Epson, a Japanese-owned company that sells personal computers, calls the lawsuit unfounded. "It is clearly not the policy of Epson to indiscriminately read electronic mail," said spokesman Scot Edwards. He declined to comment on the suit's specific allegations. The lawsuit is an example of a growing privacy debate surrounding "E-mail," which has mushroomed in popularity during the past decade with the growth in personal computers. Among other cases: o The mayor of Colorado Springs, Colo., caused a stir this year when it was discovered he had been reading printouts of electronic messages that City Council members had sent each other in confidence. o The Iran-Contra affair unraveled partly because investigators discovered electronic messages sent by L. Col. Oliver North and supporters. The North team didn't realize that every message was stored on computer tape. Computer experts say some E-mail systems automatically destroy electronic messages once they are read. Others keep a copy. But even systems that erase old messages aren't safe from snoops. In most systems, computer room operators can rea messages that haven't yet been opened by recipients, said Mike Zisman, president of SoftSwitch Inc., a Wayne, Pa., company that helps corporations link E-mail systems. "When you send a message, most people think it's as private as sending it through the U.S. Postal System. But in some companies it can be as private as writing it on the bathroom wall," said David Atlas, an E-Mail analyst at International Data Corp., a research firm. Atlas said he knows of another suit similar to the Epson class action, as well as employees at two other companies who are considering their own lawsuits, but he declined to identify them. Few employers have explicit policies on the use and privacy of E-Mail, said Walter Ulrich, an office automation specialist at the consulting firm Arthur D. Little Inc. "That's an area where companies should give guidance to employees," said Ulrich, who estimates that there are 10 million E-Mail users in North America. Ulrich recommended companies state they will not snoop in E-Mail systems unless they believe users are using them illegally or abusively. But he doesn't think companies should be barred outright from reading E-Mail, since the companies own the systems. The American Civil Liberties Union takes a stronger stance. It believes federal privacy safeguards are needed to prevent employers from eavesdropping on employees' personal affairs that happen to be contained in computer files. "There's virtually no law that would stop any employer from systematically reading al of the computerized information of any of their employees," said Lewis Maltby, coordinator of the ACLU's National Task Force on Civil Liberties in the World Place. Federal laws that bar wiretapping don't apply to computer systems, Maltby said. ******************************************************************** ------------------------------ **END OF CuD #2.04** ********************************************************************