****************************************************************************
                  >C O M P U T E R   U N D E R G R O U N D<
                                >D I G E S T<
              ***  Volume 3, Issue #3.23 (June 27, 1991)   **
  ****************************************************************************

MODERATORS:   Jim Thomas / Gordon Meyer  (TK0JUT2@NIU.bitnet)
PHILEMEISTER: Bob Krause // VACATIONMEISTER: Bob Kusumoto
MEISTERMEISTER: Brendan Kehoe

            +++++     +++++     +++++     +++++     +++++

CONTENTS THIS ISSUE:
File 1: From the Mailbag  (Response to Dalton; Hacker Definitions)
File 2: Warrants issued for Indiana and Michigan "Hackers"
File 3: More on Thrifty-Tel
File 4: The CU in the News (Thackeray; Cellular Fraud; Privacy)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
CuD is available via electronic mail at no cost. Hard copies are available
through subscription or single issue requests for the costs of reproduction
and mailing.

USENET readers can currently receive CuD as alt.society.cu-digest.
   Back issues of Computer Underground Digest on CompuServe can be found
in these forums:
            IBMBBS, DL0 (new uploads) and DL4 (BBS Management)
            LAWSIG, DL1 (Computer Law)
            TELECOM, DL0 (New Uploads) and DL12 (Electronic Frontier)
Back issues are also available from:
GEnie, PC-EXEC BBS (414-789-4210), and at 1:100/345 for those on FIDOnet.
Anonymous ftp sites: (1) ftp.cs.widener.edu (192.55.239.132);
                     (2) cudarch@chsun1.uchicago.edu;
                     (3) dagon.acc.stolaf.edu (130.71.192.18).
E-mail server: archive-server@chsun1.uchicago.edu.

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may be reprinted as long as the source is
cited.  Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.  It is assumed
that non-personal mail to the moderators may be reprinted unless
otherwise specified. Readers are encouraged to submit reasoned
articles relating to the Computer Underground.  Articles are preferred
to short responses.  Please avoid quoting previous posts unless
absolutely necessary.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Contributors assume all
            responsibility for assuring that articles submitted do not
            violate copyright protections.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: From the Mailbag  (Response to Dalton; Hacker Definitions)
Date: June 27, 1991

********************************************************************
***  CuD #3.23: File 1 of 4: From the Mailbag                   ***
********************************************************************

From: "Chas. Dye -- Solarsys Mechanic" <chas@SOLUTION.COM>
Subject: Anonymous uucp from solarsys in Bay Area
Date: Mon, 24 Jun 91 19:13:32 PDT

   solarsys, the site available for anonymous uucp downloads in the Bay
Area, has had connectivity problems which have since been remedied.  If you
would like a listing of the available archives, you can grap the file

      /usr/uucppublic/ls-lR.Z

You need to have a line in you Systems (or L.Sys) file which looks like this:

   solarsys ANY ACU <speed> <number> ""-%n-gin: archinfo sword: knockknock
where
   <speed> is a standard modem speed between 300 and 19200
      (We have a Telebit T2500 modem)

            and

   <number> is whatever portion of "1 415 339 6540" you need from
      your site

Feel free to contribute files by writing them to the directory

      /usr/uucppublic/newfiles

and letting me know (via mail to chas@solution.com) that you have sent
something.

   We apologize for any inconvenience you may have experienced by with
earlier attempts to dial in.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: argonaut@PNET91.CTS.COM(C. Peter Constantinidis)
Subject: Dalton Spence's Imaginary Canadian BBS Crackdown
Date: Sun, 23 Jun 91 14:20:14 EDT

> However, I will not become TOO complacent, since the government of
> Canada has a history of following the lead of the United States, even
> when it would serve us better NOT to.  I am worried that the recent
> virus infestations of government computers, as described in the
> attached article from "Toronto Computes!" magazine (June 3, Vol. 7,
> #5, p. 3), may act as a catalyst for a crackdown on Canadian bulletin
> boards.  Which would be a shame, since I am just getting the hang of
> using them.

Give me a break Dalton. I would be very interested in understanding
how exactly you put two and two together to result in four. Because I
cannot seem to understand how it could possibly happen. So basically
you're saying, that if the government uses lousy computers with lousy
security and some 14 year old writes a virus program that says, for
example, "legalize marijuana" the government is going to take revenge
by taking away the computers of every single Canadian in the country?
Come on.. Unless the government goes dictatorship (doubtful) the
people would go ballistic and vote the government out of existence in
a hurry.

I would imagine those people who would like to ban BBSes are the same
people who are unable to program a VCR's clock because they are simply
too technologically stupid. There is an expression you might be
familiar with, "those who cannot do, teach".

But back to the topic, whipping out our handy copy of the Canadian
Charter of Rights and Freedoms we see in section 2b that ALL forms of
communication, electronic and otherwise are PROTECTED. The government
could not ban BBSes or crack down on them unless it could prove that
it would benefit the people to do so and obviously they can't. Because
of the protection in section 2b they cannot regulate bbses because
then it would be controlling people's ability to read,write and
communicate with other people.

Canada has better protections in the Charter of Rights and Freedoms
than the Americans do in their Constitution. The Canadian Charter was
written in 1982 which makes it more up to date and contemporary. So
you needn't worry that tomorrow morning you'll be woken up by big
thugs shining a bright light into your eyes, having them drag you
outside and shoot you just because of some scare mongers (which you
tried to do) or out of date laws in OTHER countries.

Dalton, last time I looked, Canada was still a sovereign country. And
the government has more important things to worry about than computers
bbses.  So just take it easy and don't worry. Of course one knows one
shouldn't send email to the government over and over saying "fuck you!
i'm a BBS user! what are you gonna do about that?! hahahahahah"
Jesus...

Hope this has helped in clearing up any confusion.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: "76012,300 Brad Hicks" <76012.300@COMPUSERVE.COM>
Subject: Phreaks/Crackers/Hackers and Assundry Others
Date: 20 Jun 91 10:59:54 EDT

Attn: Computer Underground Digest
REGARDING                Re: Please Explain the Terms 'Hacker' and
"Phreaker'
In TELECOM Digest vol 11, #471, jdl@pro-nbs.cts.com (Jennifer
Lafferty) asked:

 > I'm kind of lost here. Exactly what is "phreaking" and "hacking"
 > as you are using the terms.

This should make a LONG thread.  Everybody has their own definitions.
Pat Townson, the TELECOM moderator, chimed in with his own.  If I may
paraphrase in the interest of brevity, Pat sez that a phreaker is
someone who likes to rip of the Phone Cops; a hacker, a bright
computer programmer; and a cracker, someone who rips off computer
users.

If true, this leaves a gaping hole in the language: what do we call a
bright phone system expert who isn't a bright computer programmer?
That aside, let me chip in my own definitions, which hopefully will
shed as much light as they will heat (grin):

HACKER: (n)  Derived from "to hack," a verb used at MIT for dozens of
years now to mean "to throw something together quickly" with an
alternate, but related meaning, "to prank."  (In MIT usage, a great
prank is still called a hack, whether or not it has anything to do
with computers.)  Computer hackers are people who live for their
hobby/profession.  What separates a truly brilliant hacker from a
truly brilliant programmer is that the hacker is only interested in
results; s/he will achieve the impossible in record time but with code
that cannot be maintained and no documentation.

As one of Nancy Lebovitz's buttons says, "Real programmers don't
document. If it was hard to write, it SHOULD be hard to understand."
Or as we used to say at Taylor U., a hacker is someone who will sit at
a computer terminal for two solid days, drinking gallons of
caffeinated beverages and eating nothing but junk food out of vending
machines, for no other reward than to hear another hacker say, "How
did you get it to do THAT?"

PHREAK: (n)  Derived from the word "phone" and the Sixties usage,
"freak," meaning someone who is very attached to, interested in,
and/or experienced with something (e.g., "acid freak").  A "phone
freak," or "phreak," is to the world-wide telephone system what a
hacker is to computers: bright, not terribly disciplined, fanatically
interested in all of the technical details, and (in many cases) prone
to harmless but technically illegal pranks.

CRACKER: (n)  A hacker who specializes in entering systems against the
owner and/or administrator's wishes.  Used to be fairly common
practice among hackers, but then, computing used to be WAY outside the
price range of almost anybody and computers used to have lots of empty
CPU cycles in the evenings.  (There also used to be a lot fewer
hackers; what is harmless when four or five people do it may become a
social problem when four or five thousand do it.)  Now hackers who
don't illegally enter systems insist on a distinction between
"hackers" and "crackers;" most so-called crackers do not, and just
call themselves hackers.

CRASHER: (n)  Insult used by computer bulletin board system operators
(sysops) to describe a cracker who enters for the malicious purpose of
destroying the system or its contents.  Used to be unheard of, but
when I was last sysoping, was incredibly common.  Crashers (who insist
on calling themselves hackers) insist that this is because sysops are
more obnoxious about asking for money and insisting on collecting
legal names and addresses.

CYBERPUNK: (n)  A cyberpunk is to hackers/phreaks/crackers/crashers
what a terrorist is to a serial killer; someone who insists that their
crimes are in the public interest and for the common good, a
computerized "freedom fighter" if you will.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Moderators
Subject: Warrants issued for Indiana and Michigan "Hackers"
Date: 18 June, 1991

********************************************************************
***  CuD #3.23: File 1 of 4: Indiana/Michigan Hackers Busted     ***
********************************************************************

%Moderators note: The following is the news release distributed
by the Indianapolis Police Department.%


NEWS RELEASE                       May 31, 1991

        _Search Warrants Served in Computer "Hacking" Scheme_

INDIANAPOLIS -- The Indianapolis Police Department, the Federal Bureau
of Investigation, and the United States Secret Service served search
warrants at five Indianapolis locations on Wednesday, May 29, 1991,
for computer-related equipment. The warrants were served by five teams
of law enforcement officials forming a group known as the Special
Computerized Attack Team (SCAT).

SCAT is a cooperative effort between the Indianapolis Police
Department the FBI, the Secret Service and other federal, state and
local law enforcement agencies aimed at tracking computer "hackers"
who illicitly enter the computer systems of companies in an attempt to
gain sensitive information, money, or company secrets.

The White Collar Crime Unit of IPD obtained information from the FBI
and Secret Service concerning illegal computer access to the PBX
system of an Indianapolis company. Armed with search warrants, SCAT
members confiscated computer equipment from fie Indianapolis residences
which linked several juveniles to the crime. The Indianapolis company
has experienced losses which approach $300,000. A search warrant was
served simultaneously by FBI agents, the Secret Service and Michigan
State Police in West Bloomfield, Michigan, in this same case.

Information gained from the search warrants has led police to continue
the investigation in other cities as well.

Suspects in the case are all juveniles and the investigation is
continuing to determine if the evidence collected will support
arrests. The SCAT unit is currently investigating other
computer-related crimes and hopes to send a strong message to computer
"hakers" that their illegal actions are being monitored closely bylaw
enforcement officials.

For further information, please contact Special Agent in Charge Roy
Yonkus, U.S. Secret Service (Indiana) at 317/ 639-3301; or John M.
Britt, Assistant to the Special Agent in Charge, U.S. Secret Service
(Detroit Office) at 313/ 226-6400.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: John Higdon and Dennis Rears
Subject: More on Thrifty-Tel
Date: June 25, 1991

********************************************************************
***  CuD #3.23: File 1 of 4: More on Thrifty-Tel                 ***
********************************************************************

%Moderators' note: The following is reprinted from Telecom Digest%

Date: Sat, 15 Jun 91 02:24 PDT
From: John Higdon <john@zygot.ati.com>

Mark Seecof <marks@capnet.latimes.com> quotes the %LA Times%:

> %%Little Phone Company on a Hacker Attack''
>  By Susan Christian, Times Staff Writer.

On June 13, the %San Jose Mercury% ran a story about Ms. Bigley's
courageous efforts. The writer, Alex Barnum, did a little more
investigating and presented a little more balanced picture than Ms.
Christian. Excerpts below:

Firm's Big Phone Fees Hang up Hackers
by Alex Barnum, Mercury Staff Writer

"A year ago, Thrifty Tel Inc. won approval from the state Public
Utilities Commission ot charge unauthorized users of its long-distance
lines a 'special' rate: a $3,000 'set-up' charge, a $3,000 daily line
fee, $200 an hour for labor and the costs of investigating and
prosecuting the offender.

"Since then, the Garden Grove company has netted $500,000 and caught
72 hackers, ranging from an 11-year-old girl to a grandma-grandpa team
of professional phone hackers."

[Doesn't sound as if Thrifty Tel came off too badly on that one, does
it? That's $500,000 NET profit on hackers. JH]

"But while many have applauded Thrifty Tel's ingenuity, others have
criticized the company for taking the law into its own hands. Some Los
Angeles law enforcement officials, in fact, say the approach borders
on extortion ...

"Others charge that Thrifty Tel is deliberately baiting its long-distance
system with lax security to catch hackers and bring in new revenue.
Thrifty Tel is 'a vigilante,' says John Higdon, a San Jose phone
network expert." [blush]....

"Even a single call can cost a hacker more than $6,000. And Thrifty
Tel charges an extra $3,000 for every access code the hacker uses.
Since about half of Thrifty Tel's hacker 'customers' are minors, their
parents usually wind up footing the bill.

"Moreover, as a condition of the settlement, Thrifty Tel requires
hackers to hand over their computers which mirrors a provision in the
criminal code. Bigley usually turns the computer over to authorities,
although she says she kept one once. [She kept more than that
according to her own conversation with me. JH]

"While praising Bigley's basic strategy, law enforcement officials say
she has taken it a step too far. 'She can threaten a civil suit, but
not criminal charges,' says one official. 'You don't use a criminal
code to enforce a civil settlement.'"...

"Other critics charge that Thrifty Tel is deliberately baiting hackers
with antiquated switching technology and short access codes that are
easier to hack than the more modern, secure technology and 14-digit
access codes of the major long-distance carriers."

Mr. Barnum has all the quotes from Ms. Bigley that the %LA Times%
article had, which essentially contain the circular argument that it
costs money to upgrade to FGD and why should Thrifty have to spend
that money on account of "thugs and criminals" while whining about all
the losses suffered at the hands of the hackers. Thrifty's technique
looks more like a profit center than hacker "prevention".
****************************************************************

%Moderators' note: The following is reprinted from TELECOM Digest, #476%.

Date: Fri, 21 Jun 91 11:07:35 EDT
From: "Dennis G. Rears (FSAC)" <drears@pica.army.mil>
Subject: Re: Speaking in Defense of ThriftyTel (was Fighting Hackers)


Kurt Guntheroth <kurt@tc.fluke.com> writes:

> John Higdon says:

>>  Mr. Barnum has all the quotes from Ms. Bigley that the %LA Times%
>>  article had, which essentially contain the circular argument that it
>>  costs money to upgrade to FGD and why should Thrifty have to spend
>>  that money on account of "thugs and criminals" while whining about all
>>  the losses suffered at the hands of the hackers. Thrifty's technique
>>  looks more like a profit center than hacker "prevention".

> Let's suppose ThriftyTel is deliberately baiting hackers (though using
> older equipment because it is cheap sounds more reasonable to me).
> How can this be considered more reprehensible than stealing network
> services in the first place?  I find it quite just that a company
> should hang hackers with their own rope.  If ThriftyTel was posting
> the access codes on pirate BBS's, this might be going a bit too far on
> the entrapment side, but there is no evidence this is happening.

Have you ever heard of an attractive nuisance?  Granted it may be
stretching a point, but hey we are talking about California? :-) It
could be argued that ThriftyTel has created an attractive nuisance by
not securing their systems in accordance with industry standards; just
like the homeowner who does not build a secure enough fence to keep
the little cretins out of his/her pool.

> And whoever asked whether ThriftyTel was inducing minors to enter into
> an unenforceable contract, or an ex-post-facto contract, this may be
> true.  The hackers do have the option of refusing the contract and
> letting ThriftyTel make good on its threat to initiate criminal
> proceedings if it can.  Probably most hackers, caught crouched over
> the body with the smoking gun in their hand, and with the knowledge of
> their guilt in mind, are reluctant to test their luck in court.

Contract, hell it is extortion.  As any first year law student could
tell you the following must exist to be a contract:

      o legality of object    # OK
      o mutual consideration     # OK
      o contractual capacity     # OK; minors create
                  # a voidable contract
      o manifestion of consent
        (offer/acceptance)    # NO
      o meeting of the minds

The hacker is not aware of the offer (tariff), there is no manifestion
of consent, and there is not meeting of the minds.

Another point, California has the Uniform Commercial Code, thus the
statue of frauds would apply.  This means the contract (including
acceptance) must be in writing for amount of over $500.00.

One last point if they are saying a contract was formed, it becomes a
civil matter only not a criminal.  Either it is a contract in all
cases or a contract in no cases.  If they decide it is a contract they
have to sue for breach of contract; they can't have criminal charges
too.  They must be consistent.

BTW, I don't approve of what the hackers/phreakers are doing either,
but ThriftyTel response is just as abusive of the laws as
hackers/phreakers.  We are still innocent until proven guilty, and
there is no way I can tolerate any company or government "official"
altering this.

dennis

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Subject: Re: Speaking in Defense of ThriftyTel (was Fighting Hackers)
Date: 21 Jun 91 12:32:56 PDT (Fri)
From: John Higdon <john@mojave.ati.com>

Kurt Guntheroth <kurt@tc.fluke.com> writes:

> Record me as a supporter of ThriftyTel.

You are overlooking a major flaw in Thrifty Tel's scam. In the United
States, the system of jurisprudence requires the plaintiff in a civil
case to 1.) prove damages and 2.) show mitigation of damages. Thrifty
Tel does neither.

In a five-day period, Thrifty Tel whisked a "Hacker Tariff" through
the CPUC without comment, showing, documentation, or any justification
WHATSOEVER. This tariff, which provides for "charges" that are around
three hundred times the company's going rate for services, is then
used in civil suits to claim damages. Thrifty Tel sits back in court,
presents the logs showing the intruder's usage and then holds up this
bogus tariff. In other words, TT has at no time ever proved its claim
for the extortion it pulls on the "criminals and thugs" that it so
actively crusades against.

Concerning point two, let me give you an analogy. Let us suppose that
I have decided to go into the banking business, but find that the cost
of constructing a vault is prohibitively expensive. So I leave all the
cash sitting around in the tellers' drawers. Word gets around that my
bank is an easy mark, and consequently I find that frequently the cash
has been cleaned out by thieves the night before.  To combat this, I
install a very sophisticated intrusion detection system with cameras
and the like. I am now able to identify the thieves and I manage to
get a law passed that allows my bank to claim damages against the
burglars at about three hundred times the value of the cash stolen.

Obviously, a bank vault would solve the lion's share of my problem,
but why should I have to pay for a vault when it is "criminals and
thugs" that are at the root of my "losses"? This is precisely the
argument that TT uses when it is suggested that it upgrade its
equipment and use FGD instead of FGB.

Of course, FGD would not allow it to skim intraLATA traffic from
Pac*Bell as it now does, but that is a different matter altogether.
Believe me when I tell you that Thrifty Tel has no moral high ground
to stand on.

John Higdon <john@zygot.ati.com> (hiding out in the desert)

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: The CU in the News (Thackeray; Cellular Fraud; Privacy)
Date: 27 June, 1991

********************************************************************
***  CuD #3.23: File 1 of 4: CU in the News / Thackeray;Privacy  ***
********************************************************************

From: Barbara E. McMullen & John F. McMullen (Reprinted from Newsbytes)
Subject: Gail Thackeray & Neal Norman Form Security Firm
Date: June 21, 1991

 NORMAN & THACKERAY FORM SECURITY FIRM 06/21/91

 DALLAS, TEXAS U.S.A., 1991 JUNE 21 (NB) -- Neal Norman, a veteran of
 34 years with AT&T, has announced the formation of GateKeeper
 Telecommunications Systems, Inc. The new firm will introduce a
 product which it says "provides an airtight defenses against
 unauthorized computer access."

 Norman told Newsbytes "we think we have a product that will
 revolutionize telecommunications by stopping unauthorized access to
 computer systems." Norman said that the system, which is scheduled to
 become available in the early fall, will provide protection for
 terminals, mainframes,  and PBXs.

 Norman also told Newsbytes that Gail Thackeray, ex-Arizona assistant
 attorney general known for her activities in the investigation of
 computer crime, will be a vice president of the new firm. "I am
 extremely happy to have someone of Gail's ability and presence
 involved in this endeavor right from the beginning. Additionally,"
 Norman said, "we have enlisted some of the industry's most well known
 persons to serve on a board of advisors to our new company.  These
 respected individuals will provide guidance for us as we bring our
 system to market. Among those who have agreed to serve in this group
 are Donn Parker of SRI; Bill Murray, formerly of IBM; and Bob Snyder,
 Chief Computer Crime Investigator for the Columbus, Ohio, police.

 Synder told Newsbytes "I am excited about working with such bright
 people on something of real importance and I hope to contribute to an
 improvement in computer security."

 (Barbara E. McMullen & John F. McMullen/19910621)

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Anonymous
Subject: Cellular Phone Fraud
Date:  Thu, 27 Jun 91 13:35:41 CDT

From: The Wall Street Journal, June 6, 1991. Pp. A-1, A-7.
By John J. Keller

                             DIALING FOR FREE
                                   ****
        Thanks to Hackers, Cellular Phone Firms Now Face Crime Wave
                                    ***
 An Altered Computer Chip is Permitting Easy Access to Networks Nationwide
                                    ***
                        Mr. Sutton's Crucial Error
                                    ***

Robert Dewayne Sutton wants to help stop the tide of fraud sweeping the
cellular telephone industry. The 35-year old clearly knows plenty about
fraud. After all, he helped spark the crime wave in the first place.

Mr. Sutton is a computer hacker, a technical whiz who used an
acquaintance's home-grown computer chip to tap into the local cellular
phone network and dial for free. Mr. Sutton went into business selling the
chips, authorities say, and soon fraudulent cellular phone calls were
soaring nationwide.

In February, 1989, police finally nabbed Mr. Sutton in his pick-up truck at
a small Van Nuys, Calif., gas station. He was about to sell five more of
the custom chips to a middleman. But by then it was too late. The wave of
fraud Mr. Sutton helped launch was rolling on without him.

((stuff deleted explaining that industry currently loosing about $200
million a year, "more than 4% of annual U.S. revenue" to cellular phone
fraud, and could rise to %600 million annually.  Celluar system first
cracked in 1987, by Kenneth Steven Bailey an acquaintance of Sutton from
Laguna Niguel, Calif.  Bailey used his PC to rewrite the software in the
phone's memory chi to change the electronic serial number. By replacing the
company chip with his own, Bailey could gain free access to the phone
system.))

((More stuff deleted, explaining how drug dealers use the phones, and small
businesses sprung up selling free calls to anyplace in the world for a few
dollars. Sutton denied selling the chips, but apparently sold his program
for a few hundred dollars, and anybody with a copy could duplicate it. This
is, according to the story, an international problem.))

When the dust settled in U.S. District Court in Los Angeles this April, Mr.
Sutton pleaded guilty to production of counterfeit access devices and, after
agreeing to cooperate with investigators, was sentenced to three years'
probation and a $2,500 fine.

((stuff deleted))

But in adversity there is opportunity, or so believes Mr. Sutton.  He says
he's got a marketable expertise--his knowledge of weaknesses in cellular
phone security systems--and he wants to help phone companies crack down on
phone fraud. He'll do that, of course, for a fee.

** end article**

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From:     <Silicon Surfer@unixville.edu>
Subject:  How Did They Get My Name?
Date:     Tue,  8 Jun 91 19:09 EDT

                       How Did They Get My Name?
                            By John Schwartz
                         Newsweek: June 3, 1991

When Pam Douglas dropped by Michelle Materres's apartment, Michelle
was on the phone--but Pam knew that already. She and her son, Brian,
had been playing with his new walkie-talkie and noticed the toy was
picking up Michelle's cordless-phone conversation next door. They had
come over to warn her that her conversation was anything but private.
Materres was stunned. It was as if her neighbors could peek through a
window into her bedroom-except that Michelle hadn't known that this
window was there. "It's like Nineteen Eighty-four ;" she says.

Well, not quite. In Orwell's oppressive world, Big Brother-the police
state-was watching. "We don't have to worry about Big Brother
anymore," says Evan Hendricks, publisher of the Washington-based
Privacy Times.  "We have to worry about little brother." Until
recently, most privacy fears focused on the direct mail industry; now
people are finding plenty of other snoops.  Today's little brothers
are our neighbors, bosses and merchants, and technology and modern
marketing techniques have given each a window into our lives.

Suddenly privacy is a very public issue. A 1990 Harris poll, conducted
for consumer-data giant Equifax, showed that 79 percent of respondents
were concerned with threats to their personal privacy-up from 47
percent in 1977. Privacy scare stories are becoming a staple of local
TV news; New York City's ABC affiliate showed journalist Jeffrey
Rothfeder poking into Vice President Dan Quayle's on-line credit
records-a trick he had performed a year before for a story he wrote
for Business Week. Now Congress is scrambling to bring some order to
the hodgepodge of privacy and technology laws, and the U.S. Office of
Consumer Affairs has targeted privacy as one of its prime concerns.
Advocacy groups like the Consumer Federation of America and the
American Civil Liberties Union are turning to privacy as one of the
hot-button issues for the '90s . "There's a tremendous groundswell of
support out there," says Janlori Goldman, who heads the ACLU Privacy
Project.

Snooping boss: Concern is on the rise because, like Materres,
consumers are finding that their lives are an open book. Workers who
use networked computers can be monitored by their bosses, who in some
cases can read electronic mail and could conceivably keep track of
every keystroke to check productivity. Alana Shoars, a former e-mail
administrator at Epson America, says she was fired after trying to
make her boss stop reading co-workers' e-mail.  The company says
Shoars got the ax for in subordination; Shoars counters that the
evidence used against her was in her own e-mail--and was
misinterpreted. Other new technologies also pose threats: cordless and
cellular phones are fair game for anyone with the right receiver, be
it a $1,000 scanner or a baby monitor. Modern digital-telephone
networks allow tapping without ever placing a physical bug; talented
"phone phreaks" can monitor calls through phone companies or corporate
switchboards.

Such invasions may sound spooky, but privacy activists warn that the
bigger threat comes from business. Information given freely by
consumers to get credit or insurance is commonly sold for other uses
without the individual's knowledge or consent; the result is a flood
of junk mail and more. Banks study personal financial data to target
potential credit-card customers. Data sellers market lists of people
who have filed Worker Compensation claims or medical-malpractice
suits; such databases can be used to blackball prospective employees
or patients. Citicorp and other data merchants are even pilot testing
systems in supermarkets that will record your every purchase; folks
who buy Mennen's Speed Stick could get pitches and discount coupons to
buy Secret instead. "Everything we do, every transaction we engage in
goes into somebody's computer, " says Gary Culnan, a Georgetown
University associate professor of business administration.

How much others know about you can be unsettling. Architect David
Harrison got an evening call from a local cemetery offering him a deal
on a plot. The sales rep mentioned Harrison's profession, family size
and how long he had lived in Chappaqua, N.Y. Harrison gets several
sales calls a week, but rarely with so much detail: "This one was a
little bizarre."

High tech is not the only culprit.  As databases grow in the '80s, the
controls were melting away, says Hendricks.  "Reagan came in and said,
'We're going to get government off the backs of the American people.'
What he really meant was, 'We're going to get government regulators
off the i backs of business.' That sent signals to the private sector
that 'you can use people's personal information any way you want'"'
The advent of powerful PCs means that the field is primed for another
boom. Today companies can buy the results of the entire 1990 census
linked to a street-by-street map of the United States on several
CD-ROM disks.

Defenders of the direct-marketing industry point out that in most
cases companies are simply, trying to reach consumers efficiently-and
that well targeted mail is not "junk" to the recipient. Says Equifax
spokesman John Ford: "People like the kinds of mail they want to
receive." Targeting is now crucial, says Columbia University professor
Alan Westin: "If you can't recognize the people who are your better
prospects, you can't stay in business." Ronald Plesser, a lawyer who
represents the Direct Marketing Association, says activists could end
up hurting groups they support: "It's not just marketers. It's
nonprofit communication, it's political parties. It's environmental
groups. "

E-mail protest: Consumers are beginning to fight back. The watershed
event was a fight over a marketing aid with data on 80 million
households, Lotus MarketPlace: Households, proposed by the Cambridge,
Mass.- based Lotus Development Corp. Such information had been readily
available to large corporations for years, but MarketPlace would have
let anyone with the right PC tap in. Lotus received some 30,000
requests to be taken off the households list. Saying the product was
misunderstood, Lotus killed MarketPlace earlier this year. New York
Telephone got nearly 800,000  "opt out" requests when it wanted to
peddle its customer list; the plan was shelved.

With the MarketPlace revolt, a growing right-to-privacy underground
surfaced for the first time.  Privacy has become one of the most
passionately argued issues on computer networks like the massive
Internet, which links thousands of academic, business nd military
computers. Protests against MarketPlace were broadcast on the Internet
and the WELL (an on-line service that has become a favorite electronic
hangout for privacy advocates and techie journalists), and many
anti-MarketPlace letters to Lotus were relayed by e-mail.

Consumers are also taking new steps to safeguard their own privacy
often by contacting the Direct Marketing Association, which can remove
names from many mailing lists. But compliance is voluntary, and relief
is slow.  In one chilling case, an unknown enemy began flooding
business manager Michael Shapiro's Sherman Oaks, Calif., home with
hundreds of pieces of hate junk mail.  Suddenly Shapiro, who is
Jewish, was receiving mail addressed to "Auschwitz Gene Research" and
"Belsen Fumigation Labs." Shapiro appealed to the DMA and the mailing
companies directly but got no responses to most of his calls and
letters. "They ignore you, throw your letter away and sell your name
to another generation of people with computers," he complains. Finally
one marketing executive publicized Shapiro's plight within the DM
industry.  Eight months after the onslaught began, the letters have
slowed-though some companies still have not removed him from their
lists.

How else can privacy be protected? It doesn't have to mean living like
a hermit and only paying cash, but it does mean not saying anything
over cellular and cordless phones that you wouldn't want others to
overhear. Culnan of Georgetown uses her American Express card
exclusively, because while the company collects voluminous data on its
cardholders, it shares relatively little of it with other companies.

Some privacy activists look hopefully, across the Atlantic Ocean. The
European Community is pushing tough new data rules to take effect
after 1992. The Privacy Directive relies on consumer consent;
companies would have to notify consumers each time they intend to pass
along personal information. The direct-marketing industry claims the
regulations would be prohibitively expensive. The rules may be
softened but could still put pressure on U.S. marketers who do
business abroad.

U.S. firms might find another incentive to change. Companies don't
want to alienate privacy-minded customers. "We're in the relationship
business," says James Tobin, vice president for consumer affairs at
American Express. "We don't want to do anything to jeopardize that
relationship." Citicorp's supermarket plan makes privacy advocates
nervous; but Citicorp rewards customers for giving up their privacy
with incentives like discount coupons, and it reports that no
consumers have complained.  Eventually, strong privacy-protection
policies could make companies more attractive to consumers, says
Columbia's Westin-and may even provide a competitive edge. Then
consumers might get some of their privacy back-not necessarily because
it's the law, or even because it's right, but because it's good
business.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From:     <Silicon Surfer@unixville.edu>
Subject:  Would New Laws Fix the Privacy Mess?
Date:     Tue,  8 Jun 91 19:09 EDT

                  Would New Laws Fix the Privacy Mess?
        By Annetta Miller and John Schwartz with Michael Rogers
                         Newsweek: June 3, 1991

Congress is scrambling to catch up with its constituents in the battle
over privacy.  It has a daunting task ahead: to make sense of the
jumble of laws that have been passed-or are currently under
consideration-to regulate privacy.  Why, for example, is it legal to
listen in on someone's cordless phone conversation but illegal to
listen to a cellular call?  Why are video-rental records protected but
records of health-insurance claims largely unprotected?  (That one has
to do with an impertinent reporter revealing the video-renting habits
of Supreme Court nominee Robert Bork.)

The present foundations of privacy law have their roots in the U.S.
Constitution. Although the word "privacy" does not appear in the
document, the Supreme Court has interpreted the Constitution to grant
individuals a right of privacy based on the First, Fourth, Fifth,
Ninth and Fourteenth amendments. Since the mid-1960s, Congress has
enacted no fewer than 10 privacy laws-including the landmark 1974
Privacy Act. And yet a national right to privacy is far from firmly
established. On its face, for example, the Fair Credit Reporting Act
limits access to credit reports. But it also grants an exception to
anyone with a "legitimate business need." The Right to Financial
Privacy Act of 1978 severely restricts the federal government's
ability to snoop through bank-account records; but it exempts state
agencies, including law-enforcement agencies, and private employers.
"It's easy to preach about the glories of privacy," says Jim Warren,
who organized a recent "Computers, Freedom & Privacy" conference. But
it's hard to implement policies without messing things up."

That hasn't stopped people from trying. James Rule, a State University
of New York sociology professor, says that new legislation is
warranted "on the grounds that enough is enough . . . [Privacy
infringement] produces a world that almost nobody likes the look of."

Data board: The newest efforts to regulate privacy range from simple
fixes to a full-fledged constitutional amendment. Last week a Senate
task force recommended extending privacy laws to cover cordless
tele-phones. One bill, proposed by Rep. Robert Wise of West Virginia,
would create a federal "data-protection board" to oversee business and
gov-ernmental use of electronic information. Another, being prepared
by Sen. Patrick Leahy of Vermont, would apply the Freedom of
Informa-tion Act to electronic files as well as to paper. Rep. Andy
Jacobs of Indiana has held hearings on the misuse of social-security
numbers to link computerized information. And several bills have been
introduced to stop credit reporters from selling personal data to junk
mailers.

Possibly the most sweeping proposal for change comes from Harvard
University law professor Laurence Tribe. In March, Tribe proposed a
constitutional amendment that would, among other things protect
individuals from having their private data collected and shared
without approval.  "Constitutional principles should not vary with
accidents of technology," Tribe said at the "Computers, Freedom &
Privacy" conference earlier this spring. He said an amendment is
needed because the letter of the Constitution can seem, at the very
least, "impossible to take seriously in the world as reconstituted by
the microchip."

But some experts argue that well-meaning reform could do more harm
than good. Requiring marketers to get permission every time they want
to add a name to a mailing list would make almost any kind of mass
mailing hopelessly expensive. "It's nice to talk about affirmative
consent, but it really will kill the industry," warns Ronald Plesser,
who represents the Direct Marketing Association. "And then people who
live out in the country won't have access to the L.L. Bean catalog and
the services they like." In this technological age, how much privacy
Americans enjoy will depend partly on how high a price they are
willing to pay to keep it.

********************************************************************

------------------------------

                         **END OF CuD #3.23**
********************************************************************