Last modified on Fri Apr 19 8:57:57 PDT 1991 by denning Communications of the ACM, Vol. 34, No. 3, March 1991, pp. 24-43. The United States vs. Craig Neidorf A Viewpoint on Electronic Publishing, Constitutional Rights, and Hacking Dorothy E. Denning ``Congress shall make no laws ... abridging the freedom of speech, or of the press; or the right of the people peacefully to assemble ...'' First Amendment ``The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated ...'' Fourth Amendment ``No person shall be ... deprived of life, liberty, or property, without due process of law ...'' Fifth Amendment 1. Introduction In 1983, the media publicized a series of computer break-ins by teenagers in Wisconsin, the so-called ``414 hackers.'' At about the same time, the popular movie Wargames depicted a computer wizard gaining access to the North American Air Defense (NORAD) Command in Cheyenne Mountain, Colorado and almost triggering a nuclear war by accident. Since then, a stereotype of a computer ``hacker'' [foot 1] has emerged -- unscrupulous young people who use their computer skills to break into systems, steal information and computer and telecommunication resources, and disrupt operations without regard for the owners and users of the systems. Well-publicized incidents such as the Internet worm [Spafford 89] and the German hackers who broke into unclassified defense systems and sold information to the KGB [Stoll 90] have reinforced that stereotype and prompted policy makers and law enforcers to crack down on illegal hacking. In May 1990, 150 Secret Service agents executed 27 search warrants and seized 40 systems as part of Operation Sun Devil, a two-year investigation led by Arizona prosecutors into incidents estimated to have cost companies millions of dollars. Another investigation involving prosecutors in Atlanta and Chicago led to several indictments. Reports on some of the seizures and indictments provoked an outcry from people in the computer industry who perceived the actions taken by law enforcers as a threat to constitutional rights. One case in particular that was cited as an example of threats against freedom of the electronic press was that of Craig Neidorf, a college student accused by the U. S. Government of fraud and interstate transportation of stolen property regarding a document published in his electronic newsletter, Phrack. The trial began on July 23, 1990, and ended suddenly on July 27 when the government dropped the charges. I attended the trial as an expert witness for the defense. I will first discuss the case, and then turn to several larger issues related to it and to the crackdown. 2. Overview of the Case Craig Neidorf is a pre-law student at the University of Missouri. At age 13, he got interested in computers, which developed from an earlier intense interest in Atari 2600 and other video games. At 14, he adopted the handle Knight Lightning on computer networks and bulletin boards. At 16, he and a childhood friend started an electronic newsletter called Phrack. The name was composed from the words ``phreak'' and ``hack,'' which refer to telecommunications systems (``phreaking'') and computer systems (``hacking''). To Phrack readers and contributors, phreaking and hacking covered both legal and illegal activities, and some of the articles in Phrack provided information that could be useful for someone trying to gain access to a system or free use of telecommunications lines. To some law enforcers and computer security professionals, Phrack was seen as a possible breeding ground for computer criminals. They found issues of Phrack among the evidence of cases under investigation, and a hacker told them that Phrack had provided information that helped him get started. Phrack published thirty issues from November, 1985 through 1989. Neidorf's main role with the newsletter was editor of a column called ``Phrack World News.'' In addition, he was the publisher of issue 14, and co-editor/publisher of issues 20-30. As publisher, he solicited articles from authors, assembled the articles he received into an issue, and distributed the issue to an electronic mailing list. On January 18, 1990, Neidorf received a visit from Special Agent Tim Foley of the Secret Service and a representative of Southwestern Bell Security regarding a document about the Enhanced 911 (E911) emergency system. This document, which was in the form of a computer text file, had been published in Issue 24 of Phrack. During this visit, Neidorf, believing he had done nothing wrong, cooperated and turned over information. The next day, the visitors returned with a representative from the campus police and a search warrant. Neidorf was also asked to contact the U. S. Attorney's office in Chicago. He did, and on January 29 he went to their offices, accompanied by a lawyer, for further interrogation. Again, he turned over information and answered their questions. Neither he nor his attorney were informed that four days earlier evidence had been presented to a federal grand jury in Chicago for the purpose of indicting him. On February 1, the grand jury was given additional evidence and charged Neidorf with 6 counts in an indictment for wire fraud, computer fraud, and interstate transportation of stolen property valued at $5000 or more. In June, the grand jury met again and issued a new indictment that dropped the computer fraud charges, but added additional counts of wire fraud. Neidorf was now charged with 10 felony counts carrying a maximum penalty of 65 years in prison. The indictment centered on the publication of the E911 text file in Phrack. The government claimed that the E911 text file was a highly proprietary and sensitive document belonging to BellSouth and worth $23,900. They characterized the document as a road map to the 911 system, and claimed that its publication in Phrack allowed hackers to illegally manipulate the 911 computer systems in order to disrupt or halt 911 service. They further claimed that the document had been stolen from BellSouth by Robert Riggs, also known as The Prophet, and that the theft and publication of the document in Phrack was part of a fraudulent scheme devised by Neidorf and members of the hacking group Legion of Doom, of which Riggs was a member. The object of the scheme was to break into computer systems in order to obtain sensitive documents and then make the stolen documents available to computer hackers by publishing the documents in Phrack. The government claimed that as part of the fraudulent scheme, Neidorf solicited information on how to illegally access computers and telecommunication systems for publication in Phrack as ``hacker tutorials.'' The term ``hacker'' was defined in the indictment as an individual ``involved with the unauthorized access of computer systems by various means.'' On May 21, Neidorf called me to request a copy of my paper about hackers, which I was preparing for the National Computer Security Conference [Denning 90]. Although I had not talked with him before that, I knew who he was because I had been following his case in the Computer Underground Digest, an electronic newsletter, and in various Usenet bulletin boards. Based on what I had read, which included the E911 file as published in Phrack, I did not see how the E911 file could be used to break into the 911 system or, for that matter, any computer system. I was concerned that Neidorf may have been wrongly indicted. I was also concerned that a wrongful conviction -- a distinct possibility in a highly technical trial -- could have a negative impact on electronic publication. In late June, I received another phone call, this time from Neidorf's attorney, Sheldon Zenner of the firm Katten, Muchin & Zavis in Chicago. After several conversations with Neidorf and Zenner, I agreed to be an expert witness and provide assistance throughout the trial. Zenner told me that John Nagle, an independent computer scientist in Menlo Park, California, had gathered articles, reports, and books on the E911 system from the Stanford University library and local bookstores, and by dialing a Bellcore 800 number. After Nagle showed me the published documents, I agreed with his conclusion that Phrack did not give away any secrets. Nagle was also planning to go to Chicago to help with the defense and possibly testify. Meanwhile, I gathered articles, books, and programs that showed that there are as many materials in the public domain that are at least as useful for breaking into systems as anything published in Phrack. Some of these are referenced in Section 4. 3. The Trial The trial began on July 23, 1990 in Chicago's District Court for the Northern District of Illinois. It was expected to last two weeks, with the government presenting their case during the first week. I helped prepare the cross examinations of the government's witnesses and expected to testify sometime during the second week. After a day of jury selection, the trial began with Assistant U. S. Attorney William Cook making the opening remarks for the prosecution. Cook reviewed the government claims, weaving a tale of conspiracy between Neidorf, Riggs, and members of the Legion of Doom who had broken into BellSouth computers. Zenner then presented his opening remarks for the defense. He reviewed Neidorf's history and involvement with Phrack, noting that the goal of Phrack was the free exchange of information. He challenged the claims of the government and outlined the case for the defense. He noted how the government had indicted Neidorf despite his extensive cooperation with them. He said that Neidorf believed that his actions were covered by the First Amendment, and that his beliefs were formed from college classes he took as a pre-law student on constitutional law and civil liberties. The government's witnesses up through Thursday afternoon included Riggs, Foley, and employees of Bellcore and of BellSouth and its subsidiaries. The evidence brought out during the examination and cross-examination of these witnesses showed that the E911 text file was not the highly sensitive and secret document that BellSouth had claimed, that BellSouth had not treated the document as though it were, and that Neidorf had not conspired with Riggs. Although this seemed like cause for optimism, Zenner reminded us that the government loses very few cases. On Friday morning, I arrived at the law offices to learn that the government had been talking with Zenner about dropping the felony charges in exchange for a guilty plea to a misdemeanor. Neidorf, however, would not accept a charge for something he had not done. Meanwhile, Zenner was meeting with the U. S. attorneys. I went to the court room, where Zenner told me that the government was now considering dropping all charges. Zenner was willing to lay out the case for the defense to the prosecution, and asked Nagle and me to go to the U. S. Attorney's office and answer all their questions. We went, and Cook went through the E911 file paragraph by paragraph asking us for evidence that the material was in the public domain. Nagle answered most of the questions, pointing Cook to the relevant public documents and demonstrating that the E911 Phrack file did not give away any secrets. We then went to the court room to await the final decision. Shortly thereafter, the court resumed, and Judge Nicholas Bua announced the government's decision to drop charges, dismissed the jury, and declared a mistrial. Five of the jurors were asked to remain and were interviewed by Bua and both attorneys. At midday, the court adjourned. Although Neidorf was freed of all criminal charges, he was not free of all costs. The trial cost him and his family $100,000. 4. Key Documents The government's case focused on several documents that were published in Phrack or were included in electronic mail between Neidorf and others. These included the E911 text file and Phrack version of that file, the ``hacker tutorials'' published in Phrack Issue 22, a Trojan horse login program, an announcement of The Phoenix Project in Phrack Issue 19, and some email correspondence between Neidorf and Riggs. All these documents were introduced as evidence by the government during the presentation of their case. 4.1 The E911 Text File Riggs testified that sometime during the summer of 1988, he accessed a BellSouth system called AIMSX and downloaded a file with a document issued by BellSouth Services titled ``Control Office Administration of Enhanced 911 Services for Special Services and Major Account Centers,'' Section 660-225-104SV, Issue A, March 1988. The document, which contains administrative information related to E911 service, installation, and maintenance, bears the following notice on the first page: ``Not for use or disclosure outside BellSouth or any of its subsidiaries except under written agreement.'' Sometime prior to September of 1988, Riggs transferred the file to a public UNIX [foot 2] system called Jolnet, where it remained until July 1989. Riggs testified that he sent the E911 text file to Neidorf via email from Jolnet in January 1989 for publication in Phrack. He said he asked Neidorf to edit the file so that it would not be recognizable by BellSouth, and to publish it under the handle ``The Eavesdropper.'' Neidorf removed the non-disclosure notice and deleted names, locations, and telephone numbers, and published it in Phrack Issue 24 on February 24, 1989. The edited document was less than half the size of the original document, and was split into two Phrack files, the first (file 5) containing the main text and the second (file 6) containing the glossary of terms. The government claimed that the E911 text file and Phrack version contained highly sensitive and proprietary information that provided a road map to the 911 system and could be used to gain access to the system and disrupt service. The claim was based on a statement made by an employee of Bellcore. As noted earlier, Nagle had located articles and pamphlets that contained much more information about the E911 system than the Phrack file. During cross examination of the government's witness who was responsible for the practice described in the E911 document, Zenner showed the witness two of these pamphlets available from Bellcore via an 800 number for $13 and $21 respectively. The witness, who had not seen either report before and was generally unfamiliar with the public literature on E911, agreed that the reports also gave road maps to the E911 system and included more information than was in Phrack. The witness also testified that a non-disclosure stamp is routinely put on every BellSouth document when it is first written, thereby weakening any argument that the document contained particularly sensitive trade secrets. The defense was prepared to argue that E911 text file contained no information that was directly useful for breaking into the E911 system or any computer system. There were no dial-up numbers, no network addresses, no accounts, no passwords, and no mention of computer system vulnerabilities. The government claimed that the names, locations, organization phone numbers, and jargon in the E911 text file could be useful for ``social engineering,'' that is, deceiving employees to get information such as computer accounts and passwords. However, the Phrack version omitted the names, locations, and phone numbers, and the jargon was all described in the published literature. Thus, the E911 Phrack file seemed no more useful for social engineering than the related public documents. The defense was also prepared to show that BellSouth had not treated the document as one would expect a document of such alleged sensitivity to be treated. Riggs testified that the account he had used to get into AIMSX had no password. AT&T security was notified in September, 1988, that the E911 text file was sitting publicly available in Riggs's directory on Jolnet, and Bellcore security was notified of this in October. This was two months before Riggs mailed the file to Neidorf for inclusion in Phrack, and about four months before publication in Phrack. Still, no legal action was taken until July of 1989, nine months from the time Bellcore was aware of the file's presence on Jolnet. At that point, Bellcore and BellSouth alleged to the government that a highly sensitive and dangerous document was stolen. They urged the U. S. Secret Service to act immediately because of the purported risk posed by the availability of this ``dangerous'' information. However, they did not tell the Secret Service that they had discovered all of this nine months earlier. The government responded immediately with a subpoena for Jolnet. The defense believed that BellSouth's delay in acting to protect the E911 document was inconsistent with their claim that the document contained sensitive information. To their credit, however, BellSouth did strengthen the security of their systems following the break-ins. 4.2 The Hacker Tutorials The government claimed that three files in Phrack Issue 22 were tutorials for breaking into systems and, as such, evidence of a fraudulent scheme to break into systems, steal documents, and publish them in Phrack. These files, which corresponded to one count of the indictment, were: 4. ``A Novices Guide to Hacking -- 1989 Edition'' by The Mentor. 5. ``An Indepth Guide In Hacking UNIX and The Concept of Basic Networking Utility'' by Red Knight. 6. ``Yet Another File on Hacking Unix'' by Unknown User. Files 4 and 5 of Phrack 22 briefly introduce the art of getting computer access through weak passwords and default accounts, while File 6 contains a password cracking program. Most of file 5 is a description of basic commands in UNIX, which can be found in any UNIX manual. After examining these and other Phrack files, I concluded that Phrack contained no more information about breaking into systems than articles written by computer security specialists and published in journals such as the Communications of the ACM, AT&T Bell Technical Journal, Information Age, and UNIX/WORLD, and in books. For example, Cliff Stoll's popular book ``The Cuckoo's Egg'' [Stoll 90] has been characterized as a ``primer on hacking.'' Information that could be valuable for breaking passwords is given in the 1979 paper on password vulnerabilities by Morris and Thompson of Bell Laboratories [Morris & Thompson 79]. A recent article by Spafford gives details on the workings of the Internet worm [Spafford 89]. Password cracking programs are publicly available intentionally so that system managers can run them against their own password files in order to discover weak passwords. An example is the password cracker in COPS, a package that checks a UNIX system for different types of vulnerabilities. The complete package can be obtained by anonymous FTP from ftp.uu.net. Like the password cracker published in Phrack, the COPS cracker checks whether any of the words in an on-line dictionary correspond to a password in the password file. Another file that the prosecution brought into evidence during the trial was file 6 in Phrack Issue 26, ``Basic Concepts of Translation,'' by The Dead Lord and The Chief Executive Officers. This file, which described translation in ESS (Electronic Switching System) switches, contained a phrase ``Anyone want to throw the ESS switch into an endless loop????'' in a section on indirect addressing in an index table. This remark can be interpreted as a joke, but even if were not, the information in the article seems no worse than Ritchie's code for crashing a system, which is published in the UNIX Programmer's Manual with the comment ``Here is a particularly ghastly shell sequence guaranteed to stop the system: ...'' [Ritchie]. The government's claims that these files were part of a fraudulent scheme were disproved by Riggs's testimony and email (discussed later) showing that Neidorf and Riggs had not conspired to commit fraud by stealing property and publishing stolen documents. By publishing articles that expose system vulnerabilities, Phrack, in one sense, is not unlike some professional publications such as those of the ACM. The ACM has encouraged such articles on the grounds that in the long term, the knowledge of vulnerabilities will lead to the design of systems that are resistant to attacks and failures. But, there is an important difference between the two publications. ACM explicitly states that it does not condone unauthorized use or disruption of systems, it discourages authors of articles about vulnerabilities from writing in a way that makes attacks seem like a worthy activity, and it declines to publish an article that appears to endorse attacks of any kind. In addition, the ACM is willing to delay publication of an article for a short time if publishing the information could make existing systems subject to attack. By comparison, Phrack appears to encourage people to explore system vulnerabilities. In ``A Novice's Guide to Hacking,'' The Mentor gives eleven guidelines to hacking. The last says ``Finally, you have to actually hack. ... There's no thrill quite the same as getting into your first system ...'' Although the guidelines tell the reader ``Do not intentionally damage *any* system'', they also tell the reader to alter those system files ``needed to ensure your escape from detection and your future access.'' [foot 3]. The wording can be interpreted as encouraging unauthorized but non-malicious break-ins. Thus, whereas reading Phrack could lead one to the assessment that it promotes illegal break-ins, reading an ACM publication is likely to lead to the assessment that it discourages such acts and promotes protective actions. The actual effect of either publication on illegal activities or computer security, however, is much more difficult to determine, especially since both publications are available to anyone. Computer security specialists who read Phrack may have found it useful to know what vulnerabilities intruders were likely to exploit, while hackers who read the Communications may have learned something new about breaking into systems or implanting viruses. The Phrack reports on people who were arrested may have discouraged some budding young hackers from performing illegal acts; they also may have reminded hackers to take greater measures to cover up their tracks and avoid being caught. Even if Phrack promoted certain illegal actions, this does not make the publication itself illegal. The First Amendment protects such publication unless it poses an imminent danger to society. The threshold for this condition is sufficiently high that, although courts have discussed its theoretical existence, it has never been met. 4.3 The Trojan Horse Login Program The government found a modified version of the AT&T System V 3.2 login program in Neidorf's files. The program, which was modified and sent to Neidorf by someone currently under indictment, was part of the AT&T UNIX source code and had ``copyright'' and ``proprietary'' stamps scattered throughout. The modifications included a Trojan horse that captured accounts and passwords, saving them in a file that could be later retrieved. The government claimed that Neidorf's possession of this program demonstrated his intentions to promote illegal break-ins and the theft of proprietary information. To support their case, they brought into evidence email where Neidorf was relaying messages between two other parties. One party said he had other UNIX sources, including 4.3 BSD Tahoe, and the other asked for the Tahoe source so he could install the login program on some Internet sites. The defense believed that the government's allegations against Neidorf were weak on three grounds. First, like any publisher, the mere receipt of a document is not proof of intent to perform illegal acts. Second, after observing that the source code contained notices that the code was copyrighted and proprietary, Neidorf asked someone at Bellcore security for advice on what to do. These actions added credibility to his claim that he had no intent to perform illegal acts and that he did not know that publishing the E911 text file could be illegal. Although the E911 file had a non-disclosure notice, the notice did not contain the words ``copyright'' or ``proprietary.'' Third, how to write a Trojan horse login program is no secret. For example, such programs have been published in Stoll's book [Stoll 90] and an article by Grampp and Morris [Grampp & Morris 84]. Also, in his ACM Turing lecture, Ken Thompson, one of the Bell Labs co-authors of UNIX, showed how to create a powerful Trojan horse that would allow its author to log onto any account with either the password assigned to the account or a password chosen by the author [Thompson 84]. Thompson's Trojan horse had the additional property of being undetectable in the login source code. This was achieved by modifying the C-compiler so that it would compile the Trojan horse into the login program. 4.4 The Phoenix Project and Email Correspondence Issue 19, File 7 of Phrack announced ``The Phoenix Project,'' and portrayed it as a new beginning to the phreak/hack community where ``Knowledge is the key to the future and it is FREE. The telecommunications and security industries can no longer withhold the right to learn, the right to explore, or the right to have knowledge.'' The new beginning was to take place at SummerCon '88 in St. Louis. The government claimed that this announcement was the beginning of the fraudulent scheme to solicit and publish information on how to access systems illegally, and its publication accounted for one of the counts in the indictment. Yet, the announcement explicitly says ``The new age is here and with the use of every *LEGAL* means available, the youth of today will be able to teach the youth of tomorrow. ... the practice of passing illegal information is not a part of this convention.'' Security consultants and law enforcers were invited to attend SummerCon. Although Neidorf was not charged with any crimes in 1988, the Secret Service sent undercover agents to SummerCon '88 to observe the meeting. They secretly video-taped Neidorf and others through a two-way mirror during the conference for fifteen hours. What did they record? A few minors drinking beer and eating pizza. Zenner asked to introduce these tapes as evidence for the defense, but the prosecution objected and Judge Bua sustained their objection. Two counts of the indictment involved email messages from Neidorf to Riggs and ``Scott C.'' These messages, which were also alleged to be part of the fraudulent scheme, were basically discussions of particular individuals, mainly members of the Legion of Doom. The messages contained no plots to defraud any organization and no solicitations for illegal information. 5. Rights and Responsibilities Neidorf's indictment came in the midst of a two-year investigation of illegal activity that involved the FBI, Secret Service, and other federal and local law enforcement agencies. As part of the investigation, the government seized over forty systems and 23,000 disks. Several bulletin board systems were shut down in the process, including the Jolnet system on which Riggs stored the E911 document. In most cases, no charges have yet been made against the person owning the equipment, and equipment that seemed to have little bearing on any illegal activity, such as a phone answering machine, was sometimes included in the haul. The Phrack case and computer seizures raised concerns about freedom of the press, protection from unnecessary searches and seizures, and the liabilities and responsibilities of system operators and owners. In this section, I shall discuss these issues and give some of my personal opinions about them. 5.1 Electronic Publications Some observers interpreted Neidorf's indictment as a threat to freedom of the press in the electronic media. The practice of publishing materials obtained by questionable means is common in the news media, and publication of the E911 file in Phrack was compared with publication of the Pentagon Papers in the New York Times and Washington Post. The government had tried unsuccessfully to stop publication of the Pentagon Papers, arguing that publication would threaten national security. The Supreme Court held that such action would constitute a ``prior restraint'' on the press, prohibited by the First Amendment. It threfore surprises me that there is any doubt that electronic publications should be accorded the same protection as printed ones. Shortly before the Phrack case came to trial, Mitchell Kapor and John Barlow founded the Electronic Frontier Foundation (EFF) in order to help raise public awareness about civil liberties issues and to support actions in the public interest to preserve and protect constitutional rights within the electronic media. The EFF hired the services of Terry Gross, attorney with the New York law firm Rabinowitz, Boudin, Krinsky & Lieberman, to provide legal advice for the Phrack case; Gross submitted two friend-of-the-court briefings seeking to have the indictment dismissed because it threatened constitutionally protected speech. The trial court judge denied EFF's motion, but as it turned out, the charges were dropped before the issue was seriously discussed during the Neidorf trial. Although certain information may be published legally, authors and publishers should consider how such information might be interpreted and used. In the case of hacker publications, the majority of readers are impressionable young people who are the foundation of the future. Articles which encourage illegal break-ins or contain information obtained thusly should not simply be dismissed as proper just because they are protected under First Amendment rights. 5.2 Searches and Seizures The seizures of bulletin boards and other systems raised questions about the rights of the government to take property and retain it for an extended period of time when no charges have been made. At least one small business, Steve Jackson Games, claims to have suffered a serious loss as a result of having equipment confiscated for over three months. According to Jackson, the Secret Service raid cost his company $125,000, and he had to lay off almost half of his employees since all of the information about their next product, a game called GURPS CYBERPUNK, was on the confiscated systems. Some of the company's equipment was severely damaged, and data was lost. No charges have been made. Seizing a person's computer system can be comparable to taking every document and piece of correspondence in that person's office and home. It can shut down a business. Moreover, by taking the system, the government has the capability to read electronic mail and files unrelated to the investigation; such broad seizures of paper documents are generally not approved by judges issuing search warrants. For these reasons, it has been suggested that the government not be allowed to take complete systems, but only the files related to the investigation. In most cases, this seems impractical. There may be megabytes or even gigabytes of information stored on disks, and it takes time to scan through that much information. In addition, the system may have non-standard hardware or software, making it extremely difficult to transfer the data to another machine and process it. Similarly, if a computer is seized without its printer, it may be extremely difficult to print out files. Finally, originals are needed for evidence in court, and the evidence must be protected up to the time of trial. However, if the government can be reasonably confident that the owner of the system has not participated in or condoned the activities under investigation, then it may be practical for the government to issue a subpoena for certain files rather than seize the entire system. When a complete system is seized, it seems reasonable that the government be required under court order to provide copies of files to the owner at the owner's request and expense within some time limit, say one week or one month. If a system shared by multiple users is seized, the search should be restricted to mail and files belonging to the users under investigation. 5.3 Liabilities and Responsibilities of System Operators and Owners The bulletin board seizures sent a chill through the legitimate network community, raising questions about the liabilities of an operator of a bulletin board or of any system. Operators of these boards asked if they needed to check all information passing through the system to make sure there is nothing that could be interpreted as a stolen, proprietary document or as part of a fraudulent scheme. Computer bulletin boards have been referred to metaphorically as electronic meeting places where assembly of people is not constrained by time or distance. Public boards are also a form of electronic publication. It would seem, therefore, that they are protected by the constitution in the same way that public meeting places and non-electronic publications such as newspapers are protected. This, of course, does not necessarily mean they should be free of all controls, just as public meetings are not entirely free of control. Bulletin board systems often provide private directories and electronic mail. Private mail and files should be given the same protections from surveillance and seizure as First Class Mail and private discussions that take place in homes or businesses. I believe the Electronic Communications Privacy Act provides this protection. The E911 text file was obtained from a system with a null password. While this does not excuse the person who got into the system and copied the file, I believe that system owners should take greater measures to prevent break-ins and unauthorized use of their systems. There are known practices for protecting systems. While none of these is foolproof, they will with high probability keep intruders out and detect those that enter. Although the risks associated with insecure systems may not have been great until recently, thereby justifying weak security in favor of allocating more resources for other purposes, the risks are now sufficiently great that weak security is inexcusable for many environments. Moreover, system owners may be vulnerable to lawsuits if they do not have adequate protection for customer information or for life-critical operations such as patient monitoring or traffic control. Our current laws allow a person to be convicted of a felony for simply entering a system through an account without a password. I recommend that we consider adopting a policy where unauthorized entry into a system is at most a misdemeanor if certain standards have not followed by the owner of the system and the damage to information on the system is not high. However, I recognize that it may be very difficult to set appropriate standards and to determine whether an organization has adhered to them. I also recommend we consider establishing a range of offenses, possibly along the lines of those in the U. K. Computer Misuse Act, which became effective in August, 1990: - Unauthorized access: seeking to enter a computer system knowing that the entry is unauthorized. Punishable by up to six months imprisonment. - Unauthorized access in furtherance of a more serious crime. Punishable by up to five years imprisonment. - Unauthorized modification of computer material: introducing viruses, Trojan horses, etc., or causing malicious damage to computer files. Punishable by up to five years imprisonment. 6. Conclusions Making a sound assessment of the claims made in the Phrack case requires expertise in the domains of computers, the UNIX system, computer security, phone systems, and the public literature. Whereas Zenner brought in outside technical expertise to help with the defense, the prosecution relied on experts belonging to the victim, namely, employees of Bell. The indictment and costly trial may have been avoided if the government had consulted neutral experts before deciding whether to pursue the charges. The professional community represented by ACM may be a good source of such help. In the context of the new milieu created by computers and networks, a new form of threat has emerged -- the computer criminal capable of damaging or disrupting the electronic infrastructure, invading people's privacy, and performing industrial espionage. While the costs associated with these crimes may be small compared with computer crimes caused by company employees and former employees, the costs are growing and are becoming significant. For many young computer enthusiasts, illegal break-ins and phreaking are a juvenile activity that they outgrow as they see the consequences of their actions in the world. However, a significant number of these hackers may go on to become serious computer criminals. To design an intervention that will discourage people from entering into criminal acts, we must first understand the hacker culture since it reveals the concerns of hackers that must be taken into account. We must also understand the concerns of companies and law enforcers. We must understand how all these perspectives interact. The 1985 ACM Panel on Hacking [Lee 86] offered several suggestions for actions that could be taken to reduce illegal hacking, and my own investigation confirmed these while speculating about others [Denning 90]. Teaching computer ethics may help, and I applaud recent efforts on the part of computer professionals and educators to bring computer ethics not only into the classroom, but into their professional forums for discussion. Acknowledgments Special thanks to Chuck Bushey, Peter Denning, Jef Gibson, Cynthia Hibbard, Steve Lipner, Craig Neidorf, Mike Schroeder, and Sheldon Zenner for many helpful suggestions; to Pete Mellor for information about the U. K. laws; and to my many friends and colleagues who patiently educate me in areas where I am vulnerable to my own blindness. The views here are my own and do not represent those of my employer. References [Denning 90] Dorothy E. Denning, ``Concerning Hackers Who Break Into Computer Systems,'' Proc. of the 13th National Computer Security Conf., Oct. 1990. [Grampp & Morris 84] F. T. Grampp and R. H. Morris, ``UNIX Operating System Security,'' AT&T Bell Laboratories Technical Journal, Vol. 63, No. 8, Oct. 1984. [Lee 86] John A. N. Lee, Gerald Segal, and Rosalie Stier, ``Positive Alternatives: A Report on an ACM Panel on Hacking,'' Comm. ACM, Vol. 29, No. 4, April 1986, p. 297-299; full report available from ACM Headquarters, New York. [Morris & Thompson 79] Robert Morris and Ken Thompson, ``Password Security: A Case History,'' Comm. ACM, Vol. 22, No. 11, Nov. 1979. [Ritchie] Dennis Ritchie, ``On the Security of UNIX,'' UNIX Programmer's Manual, Section 2, AT&T Bell Laboratories. [Spafford 89] Eugene H. Spafford, ``The Internet Worm: Crisis and Aftermath,'' Comm. ACM, Vol. 32, No. 6, June 1989. [Stoll 90] Clifford Stoll, The Cuckoo's Egg, Doubleday, 1990. [Thompson 84] Ken Thompson, ``Reflections on Trusting Trust,'' Turing Award Lecture, Comm. ACM, Vol. 27, No. 8, p. 761-763. Footnotes 1. The term ``hacker'' originally meant anyone with a keen interest in learning about computer systems and using them in novel and clever ways. Many computer enthusiasts still call themselves hackers in this non-pejorative sense. 2. UNIX is a trademark of AT&T. 3. Most system managers regard any modification of system files as damage, because they must restore these files to a state that does not permit the intruder to re-enter the system.