howell@bert.llnl.gov (Louis Howell) (09/10/90)
The lack of a consensus on ethical standards among computer users is serious, but even if one existed I'm not sure how much effect it would have on law enforcement, the media, and the public in general, who wouldn't know what we were talking about. The destructive hackers would continue to get all the attention and thus color people's opinions of the whole community. All the agreement in the world won't help if the regulations are being written by outsiders who don't know what they are doing. For example, our society still has not come up with any consistent way to put a value on information. Copyright and patent laws have been tailored to the corporate arena, where typical infractions are large enough to merit serious penalties, the legal costs are minor compared to the other sums involved, and no lives are ruined in the process. Attempts to apply this legal system to individuals and small software sweatshops appears to be the moral equivalent of correcting a wayward child by swatting him over the head with a 2-by-4. In the recent Bell South fiasco, the company apparently put a value on the stolen 911 document roughly equivalent to the entire cost of producing it. This strikes me as completely absurd, since only a copy was made---Bell South did not lose the use of the document or suffer any other financial loss as a result of the incident. If you go by some kind of "fair market value" criterion, the value would be closer to that of a paperback book. Even if trade secrets were involved, as was originally thought, it still seems unfair to charge a thief with the cost of the entire development project. Some kind of lost revenue standard seems more reasonable, but computing it could be a legal nightmare. For an item that is on the market, even valuing the information at market value may not be appropriate. To be specific, suppose some software company spends about $100,000 to write a great C compiler. They put it on the market for $1000, and it sells. Now suppose some high school hacker manages to snarf a copy of this compiler for his own personal use. He gets caught, and is charged with stealing it. What now is the value of the object he has stolen (which can make a big difference in court)? To say $100,000 is absurd, since the company still has the compiler. Even $1000 may be too high, though. The company has not lost $1000 in revenue because there is no way the kid could have afforded to buy the program. If he couldn't steal it, he still wouldn't have bought it, so the effect on the company is the same as if he had done nothing at all! If the company loses nothing, is it not better that the kid have the use of the best tools for his work? This argument won't work for any tangible object. If a crook steals a diamond ring, it is silly to argue that he would not have otherwise bought it, since there is still a real diamond ring missing. With information theft, though, it's hard to say that anyone really loses. I'm not seriously suggesting that this type of software theft should be legal, since then there would be no way for the company to recoup its investment. There is no practical way to implement a socialist "welfare distribution" system, since even those who could pay would find it easy to obtain free copies of anything. The trouble is in trying to couple an economy of tangible goods that are expensive to reproduce with one of intangible goods that can be reproduced for almost nothing. It's a tough problem, and I don't claim to have a pat answer. On the other hand, in my example the fact does remain that no one was hurt. The offense strikes me as more comparable to a minor case of shoplifting than to the theft of a tangible $1000 object. I certainly wouldn't call it a felony, and seriously damaging the career of such a talented kid would probably be a net harm to society. I propose that the appropriate penalty be just enough to "teach the kid a lesson", but no more. Any thoughts? Just how much SHOULD information be worth? -- Louis Howell "A few sums!" retorted Martens, with a trace of his old spirit. "A major navigational change, like the one needed to break us away from the comet and put us on an orbit to Earth, involves about a hundred thousand separate calculations. Even the computer needs several minutes for the job."
gl8f@astsun7.astro.Virginia.EDU (Greg Lindahl) (09/11/90)
In article <1990Sep10.095011@bert.llnl.gov> howell@bert.llnl.gov (Louis Howell) writes: >The lack of a consensus on ethical standards among computer users is >serious, but even if one existed I'm not sure how much effect it would >have on law enforcement, the media, and the public in general, who >wouldn't know what we were talking about. The destructive hackers would >continue to get all the attention and thus color people's opinions of >the whole community. Actually, I think that most hackers DO have a fairly common ethical standard, which criminals just don't share. We could force everyone to sit through 6 hours of ideological instruction a day, and it's not clear that a single crime will be prevented. Effective law enforcement, on the other hand, could deter crime without running all over our constitutional rights. I'm sure lots of us have ideas on that topic. We don't have to throw away our rights just to catch a few bad apples. -- "Perhaps I'm commenting a bit cynically, but I think I'm qualified to." - Dan Bernstein
sblair@synoptics.com (Steven Blair) (09/11/90)
In article <1990Sep10.190108.29008@murdoch.acc.Virginia.EDU>, gl8f@astsun7.astro.Virginia.EDU (Greg Lindahl) writes: |> In article <1990Sep10.095011@bert.llnl.gov> howell@bert.llnl.gov (Louis Howell) writes: |> [BUNCH OF STUFF DELETED]... |> |> Effective law enforcement, on the other hand, could deter crime |> without running all over our constitutional rights. I'm sure lots of |> us have ideas on that topic. We don't have to throw away our rights |> just to catch a few bad apples. |> |> -- |> "Perhaps I'm commenting a bit cynically, but I think I'm qualified to." |> - Dan Bernstein Define effective law enforcement. Perhaps, you meant Educated law enforcement. Ask Steve Jackson, or many of the other *persecuted* others whether they felt that the law enforcement was effective. I submit that you're missing the whole point here. If law enforcement was effective, the war on (drugs, alcohol, sex, prostitution, gambling) would be won. Absolute power corrupts absolutely is one result of a non educated law enforcement community. Deterence to crime is best shown in a Middle-Eastern country's behavior: break the law, loose a body appendage. That's deterrence to crime. Unless you can crash educate the law enforcement authorities, you'll never achive any sort of parity. As far as constitutional right, that's a joke. You no longer have any -- Steven C. Blair Network Operations Center SynOptics Communications Inc. Mountain View, California INTERNET: sblair@synoptics.com sblair@excalibur.synoptics.com PROBLEMS/EMAIL: HOSTMASTER@SYNOPTICS.COM postmaster@synoptics.com ---->>RIP Stevie Ray Vaughan 1954-1990 You Will Be *Missed*<<----
gl8f@astsun.astro.Virginia.EDU (Greg Lindahl) (09/11/90)
In article <1990Sep10.131335@synoptics.com> sblair@synoptics.com (Steven Blair) writes: > >Define effective law enforcement. I mean law enforcement wich deters without violating constitutional rights. I have no idea if this is posible; however, this is what the law should be. Note that there is no "War on Hacking" -- you're pretty much free to do whatever you want in your basement, with no phone line ;-) The serious computer crimes involve stealing classified secrets and money, while happening to use a computer. Feel free to try to figure out if the police can deter robbery; that is a bit outside this groups' charter. We can, at the very least, help the law remember the constitution. -- "Perhaps I'm commenting a bit cynically, but I think I'm qualified to." - Dan Bernstein
brnstnd@kramden.acf.nyu.edu (Dan Bernstein) (09/13/90)
In article <1990Sep10.095011@bert.llnl.gov> howell@bert.llnl.gov (Louis Howell) writes: > For an item that is on the market, even valuing the information at > market value may not be appropriate. To be specific, suppose some > software company spends about $100,000 to write a great C compiler. > They put it on the market for $1000, and it sells. Now suppose some > high school hacker manages to snarf a copy of this compiler for his > own personal use. He gets caught, and is charged with stealing it. No. He hasn't stolen anything; he's only broken copyright law. Assuming the company has registered the copyright, that's $50,000. Our society values information quite highly. ---Dan
howell@bert.llnl.gov (Louis Howell) (09/13/90)
In article <29892:Sep1300:33:5290@kramden.acf.nyu.edu>, brnstnd@kramden.acf.nyu.edu (Dan Bernstein) writes: |> In article <1990Sep10.095011@bert.llnl.gov> howell@bert.llnl.gov (Louis Howell) writes: |> > For an item that is on the market, even valuing the information at |> > market value may not be appropriate. To be specific, suppose some |> > software company spends about $100,000 to write a great C compiler. |> > They put it on the market for $1000, and it sells. Now suppose some |> > high school hacker manages to snarf a copy of this compiler for his |> > own personal use. He gets caught, and is charged with stealing it. |> |> No. He hasn't stolen anything; he's only broken copyright law. Assuming |> the company has registered the copyright, that's $50,000. |> |> Our society values information quite highly. A fine that large is intended to deter a publisher from illegally reproducing a document, a fairly large-scale enterprize. It isn't fair to apply similar penalties to individuals just because technological advances make it possible for them to do something only an organization could do before. I'm asking what a reasonable penalty SHOULD be. Anyway, has he really broken copyright law? He hasn't tried to sell it or otherwise distribute it, publicly perform it, or anything like that. If I steal a book, and use (read) it, all I've done is steal a book. I haven't broken its copyright. What's the difference? Does it make a difference to the law if he steals a physical floppy disk or if he copies it? How about if he steals it but doesn't run it? It strikes me as odd that copyright law could apply to making copies only for your own use. It seems like yet another unenforcable law, since violations are difficult to detect. -- Louis Howell "A few sums!" retorted Martens, with a trace of his old spirit. "A major navigational change, like the one needed to break us away from the comet and put us on an orbit to Earth, involves about a hundred thousand separate calculations. Even the computer needs several minutes for the job."