AOH :: Political Bufu

AOH :: FBI1.TXT
FBI refuses to release info on BBS surveillance

Date: Sun, 8 Apr 90 12:13:27 -0700
From: <mrotenberg@cdp.uucp>
To: TK0JUT2
Subject: FBI BBS Surveillance (CPSR FOIA Request)

On August 18, 1989 CPSR submitted a Freedom of Information Act request
to the FBI asking for information about BBS surveillance. ÿAfter four
follow-up ÿletters, ÿÿa ÿÿseries of phone ÿcalls, ÿÿand ÿCongressional
testimony ÿthat ÿdiscussed the CPSR request, ÿthe FBI ÿhas ÿfailed ÿto
respond to our request. (The statutory time limit for the FOIA is ten
days).

If any one has information about possible FBI surveillance of bulletin
boards or networks, ÿplease send it to me. Specific dates, ÿlocations,
BBSs ÿare important. ÿ(You can send information to me anonymously ÿby
land mail, if you need to protect your identity).

Thanks for your assistance,

Marc Rotenberg, Director
CPSR Washington Office

8
1025 Connecticut Ave., NW, Suite 1015
Washington, DC 20036
202/775-1588 (voice)
202/775-1941 (Data)
rotenberg@csli.stanford.edu or
cdp!mrotenberg@arisia.xerox.com

Contents:
1. CPSR FOIA Request to the FBI Regarding BBS Surveillance
2. CPSR letter to Congressman Don Edwards regarding FOIA request
3. Chronology of events

[CPSR FOIA Request to the FBI Regarding BBS Surveillance]

CPSR Washington Office
1025 Connecticut Avenue, NW
Suite 1015
Washington, DC 20036
202 775-1588
202 775-1941 (fax)

Director
Marc Rotenberg
August 18, 1989
FOIA Officer
FBI
9th St. & Penn. Ave., NW
Washington, DC 20535
Dear FOIA Officer,
This is a request under the Freedom of Information Act, 5 U.S.C. 552.

Part I:
I ÿwrite to request a copy of all materials relating to ÿthe ÿFBI's
collection ÿof information from computer networks and bulletin boards,
such as PeaceNet (San Francisco CA) ÿor The Well (Berkeley CA), ÿÿthat
are used frequently by political or advocacy organizations.

In particular, ÿI ÿwould like any records which would indicate whether
the Bureau is intercepting, ÿcollecting, ÿreviewing, ÿor "downloading"
computer ÿtransmissions ÿfrom ÿany ÿof ÿthe ÿfollowing ÿnetworks ÿÿand
conferences: ÿÿAction Southern Africa, ÿAIDS Coalition ÿNetwork, ÿÿThe
American ÿÿPeace ÿÿTest, ÿÿAmnesty ÿInternational, ÿÿAssociation ÿÿfor
Progressive Communications, Beyond Containment, ÿCenter for Innovative
Diplomacy, ÿCentral America Resource Center, ÿCentral America Resource
Network (CARNet), The Christic Institute, Citizen Diplomacy, Community
Data Processing, ÿEcoNet, ÿFriends of the Earth, ÿFriends Committee on
National Legislation, ÿHandsNet, Institute for Peace and International
Security, ÿÿMedia ÿAlliance, ÿMeiklejohn ÿCivil ÿLiberties ÿInstitute,
National Execution Alert Network, ÿPalo Alto Friends Peace and ÿSocial
Action Committee, PeaceNet. Quaker Electronic Project, Web, The Well.

This request includes public communications that take place through
a ÿcomputer ÿbulletin board. ÿFor example, ÿthis would ÿinclude ÿboth
transmissions that are available for public perusal, a "conference" or
"posting," ÿas well as transmissions that are directed from one ÿparty
to ÿone ÿor ÿmore ÿother specific parties ÿand ÿintended ÿas ÿprivate,
"electronic mail."

9
Part II:
I also request any records that would indicate whether
anyone acting at the behest or direction of the FBI, ÿhas any computer
accounts ÿon ÿany computer bulletin boards operated by an advocacy ÿor
political organization, and, if so, ÿthe names of the bulletin boards,
and ÿwhether ÿthe ÿBureau ÿhas ÿindicated ÿthe ÿactual ÿorganizational
affiliation of the account holders to the system operators.

Part III:
I ÿalso request any records that would indicate whether the ÿBureau
has ÿever ÿoperated, ÿÿis ÿcurrently operating, ÿis ÿinvolved ÿin ÿthe
operation ÿof, ÿor is planning to operate, ÿa ÿcomputer bulletin board
that is intended for public use.

Part IV:
I ÿÿwould ÿÿalso ÿlike ÿany ÿrecords ÿwhich ÿwould ÿÿindicate ÿÿthe
circumstances ÿunder ÿwhich ÿit would be appropriate for an ÿagent ÿor
authorized representative, ÿasset, informant, ÿor source of the Bureau
to intercept, collect, review, or "download" ÿthe contents of computer
bulletin boards.

Part V:
I ÿwould ÿlike ÿany ÿrecords relating ÿto ÿthe ÿFBI's ÿdevelopment,
research, ÿÿor assessment of computer systems for automated review ÿof
information ÿstored in an electronic format, ÿobtained from a computer
bulletin board or network.

Part VI:
Finally, I ÿrequest any records that would indicate whether the FBI
has ÿdeveloped, ÿÿor ÿis planning to develop, ÿa ÿÿsystem ÿthat ÿcould
automatically ÿreview the contents of a computer file, ÿscan the ÿfile
for ÿkey ÿterms or phrases, ÿand then recommend the initiation ÿof ÿan
investigation based upon this review.

I ÿask that you check with your regional offices in San ÿFrancisco,
San Jose, ÿAustin, Phoenix, Los Angeles, and New York, ÿin addition to
the files that are available in Washington, ÿDC. I ÿalso ask that you
consult ÿwith those agents involved in the investigation ÿof ÿcomputer
crime ÿto ÿdetermine whether they might be aware of the ÿexistence ÿof
such ÿrecords. ÿYou should also check any documents relating to ÿJohn
Maxfield, ÿÿwho ÿwas ÿemployed by the Bureau to ÿinvestigate ÿcomputer
bulletin boards.

Under the Freedom of Information Act, you may withhold all properly
exempted ÿmaterials. ÿÿHowever, ÿÿyou must ÿdisclose ÿall ÿnon-exempt
portions ÿthat ÿare reasonably segregable. ÿI ÿreserve the ÿright ÿto
appeal the withholding or deletion of any information.

Under the Freedom of Information Act, ÿCPSR is entitled to a waiver
of ÿall ÿfees ÿfor ÿthis ÿrequest ÿbecause ÿthe ÿ"disclosure ÿof ÿthis
information ÿis ÿlikely ÿto contribute ÿsignificantly ÿto ÿthe ÿpublic
understanding of the operations or activities of the government and is
not primarily in the commercial interest of the requester." CPSR is a
non-profit, ÿeducational organization of computer scientists. Our work
has ÿbeen cited in scholarly journals, ÿtrade publications, ÿÿand ÿthe
national media. ÿCPSR has particular expertise on the use of ÿcomputer
technology ÿby ÿthe FBI, ÿhaving prepared an extensive report ÿon ÿthe
proposed ÿexpansion ÿof ÿthe NCIC at the request ÿof ÿCongressman ÿDon
Edwards. For these reasons, CPSR is entitled to a waiver of all fees.

10
If you have any questions regarding this request, ÿplease telephone
me at the above number. ÿI ÿwill make all reasonable efforts to narrow
the request if you determine that it has been too broadly framed.

As ÿprovided in the Freedom of Information Act, ÿI ÿwill expect ÿto
receive a response within ten working days.

Sincerely yours,

Marc Rotenberg, Director
Washington Office,
Computer Professionals
for Social Responsibility

[CPSR letter to Congressman Don Edwards regarding FOIA request]

February 27, 1990
Representative Don Edwards
Subcommittee on Civil and
Constitutional Rights
House Judiciary Committee
806 House Annex 1
Washington, DC 20515

Dear Chairman Edwards:

I ÿam writing to you about a particular FOIA request that CPSR ÿhas
pursued since August of last year. ÿWe asked the FBI for ÿinformation
about ÿthe monitoring of computer networks and bulletin ÿboards. ÿÿWe
initiated ÿÿthis ÿrequest ÿbecause ÿof ÿthe ÿobvious ÿcivil ÿliberties
interests ÿ-- ÿspeech, ÿassociational, ÿand privacy -- ÿthat would ÿbe
endangered ÿif ÿthe ÿFBI's examination of ÿthe ÿcontents ÿof ÿcomputer
systems failed to satisfy appropriate procedural safeguards.

After six months of delay, ÿfive certified letters to the ÿBureau's
FOIA/Privacy ÿAct ÿoffice, ÿand many phone calls with the ÿFBI's ÿFOIA
officers, we have not received even a partial response to our request.

On September 20, ÿ1989 ÿa ÿFOIA officer at the FBI assured us ÿthat
information ÿwould be forthcoming "in a couple of weeks." ÿA ÿÿletter
from the FBI FOIA/PA office on December 22 ÿindicated that information
responsive ÿto our request "has been located and will be assigned ÿfor
processing ÿsoon." ÿÿBut ÿwhen ÿI spoke with a FBI ÿFOIA ÿOfficer ÿon
February 15, ÿless than two weeks ago, ÿI ÿwas told that they "haven't
even ÿstarted" ÿto process the request and that the FBI ÿcouldn't ÿsay
when we would receive a response. (Please see enclosed chronology and
attachments).

The need for this information is truly urgent. ÿFurther delay will
constitute ÿa denial. ÿCongress is now considering ÿseveral ÿcomputer
crime bills, ÿsuch as H.R. ÿ55 ÿand H.R. ÿ287, ÿthat could broaden the
authority ÿof ÿfederal ÿagents to examine ÿthe ÿcontents ÿof ÿcomputer
systems across the country. ÿThere is a good chance that a bill ÿwill
pass before the end of this session.

11
Before
Congress ÿand ÿthe public should have a complete picture of the ÿFBI's
current ÿÿpractices. ÿÿÿComputer ÿcommunications ÿÿare ÿÿparticularly
vulnerable ÿto ÿsurveillance ÿand routine monitoring. ÿÿComputer ÿmail
unrelated ÿto a particularized investigation could be swept up in ÿthe
government's ÿelectronic dragnet if the law is not carefully ÿtailored
to a well defined purpose. Without a clear understanding of the civil
liberties ÿproblems ÿassociated ÿwith the ÿinvestigation ÿof ÿcomputer
crime, ÿÿCongress may be exacerbating a problem it does not yet ÿfully
know about.

CPSR's Freedom of Information Act request could provide answers ÿto
these ÿquestions. ÿÿThe ÿFOIA ÿestablishes ÿa ÿpresumption ÿthat ÿthe
activities ÿof ÿgovernment should be open to public ÿreview ÿand ÿthat
agency ÿrecords ÿshould be disclosed upon request. ÿÿBut ÿthe ÿBureau
failed ÿto ÿcomply ÿwith the statutory requirements of ÿthe ÿFOIA ÿand
frustrated ÿour effort to obtain information that should be disclosed.
Without this information computer users, the public, and the Congress,
may ÿbe ÿunable ÿto ÿassess whether the ÿBureau's ÿcurrent ÿactivities
conform to appropriate procedural safeguards.

Computer ÿcrime ÿis a serious problem in the United ÿStates. ÿÿOne
auditing ÿfirm ÿplaces ÿthe annual loss between ÿ$3 ÿÿbillion ÿand ÿ$5
billion. Nonetheless, it is necessary to ensure that new criminal law
does ÿnot undermine the civil liberties of computer users ÿacross ÿthe
country. We requested information from the FBI under the FOIA to help
assess ÿthe ÿadequacy ÿof current safeguards. ÿThe Bureau ÿfailed ÿto
respond. ÿThe result is that the public is left in the dark at a time
when significant legislation is pending.

We would appreciate whatever assistance with this request you might
be able to provide.

Sincerely yours,

Marc Rotenberg, Director
CPSR Washington Office

Enclosure
Chronology of CPSR's FOIA Request regarding
FBI Monitoring of Computer Networks with attachments

cc: Representative Charles Schumer
Representative Wally Herger

FBI FOIA/PA Office

[Chronology of events]
Chronology of events

CPSR FOIA Request

FBI Monitoring of Computer Networks

12
CHRONOLOGY

Aug. 18, 1989

CPSR ÿsends FOIA request to FBI seeking agency records ÿregarding ÿthe
FBI's ÿmonitoring ÿof computer networks and computer ÿbulletin ÿboards
used by political and advocacy organizations. ÿThe FOIA request seeks
information about:

% ÿÿthe ÿFBI's surveillance of computer bulletin boards and ÿnetworks
used by political organizations;

% ÿÿthe ÿFBI's creation of clandestine accounts on computer ÿbulletin
boards and networks operated by political organizations;

% the FBI's creation of secret accounts on public bulletin boards;

% ÿÿthe ÿFBI's ÿprocedures regarding the downloading ÿof ÿinformation
contained on a computer bulletin board;

% ÿÿthe ÿFBI's research on the automated review of ÿthe ÿcontents ÿof
information contained on computer bulletin board and networks; and

% the FBI's research on the automation of the decision to initiate a
criminal ÿÿinvestigation, ÿÿbased ÿon ÿthe ÿcontents ÿof ÿa ÿÿcomputer
communication.

The ÿletter requests a fee waiver based on the ÿpublic ÿinterest
standard. The letter indicates that CPSR has particular expertise in
the evaluation of the civil liberties implications of law ÿenforcement
computer ÿsystems, ÿhaving completed an extensive report for the House
Judiciary ÿCommittee on the proposed expansion of the ÿFBI's ÿcomputer
system, the NCIC. The letter further states that CPSR would work with
the FOIA/PA office to facilitate the processing of the request.

Aug. 31, 1989

FBI response #1. ÿFBI sends a letter to CPSR ackn
the ÿFOIA request and designating the request "FBI's Computer Networks
and Bulletin Board Collection," request no. 319512.

Sept. 20, 1989

CPSR speaks with FOIA Officer Keith Gehle regarding status of request.
Mr. ÿÿGehle states that he can not send a response "until he ÿreceives
responses from various agencies." It is "difficult to go to computing
indices." He says that he expects to have information "in a couple of
weeks,"and will have a response "by October 5, at the latest."

Oct. 16, 1990

CPSR Follow-up letter #1. ÿCPSR confirms conversation with Mr. ÿGehle
regarding ÿOct. ÿÿ5 ÿÿtarget date and asks FOIA Officer ÿto ÿcall ÿto
indicate the status of the FBI's response to the request.

Oct. 26, 1989

CPSR ÿspeaks ÿwith ÿMr. ÿGehle. ÿHe says, ÿ"we are ÿworking ÿon ÿyour
request." ÿÿ"We should have something soon. ÿHate to give a specific

13
date, but should have a letter for you within two weeks."

Nov. 22, 1989

CPSR follow-up letter #2. ÿCPSR writes to Mr. ÿGehle, ÿnotes that Mr.
Gehle said he was working on the request, and the that response should
have been sent by Nov. ÿ9. ÿCPSR requests that FOIA officer call CPSR
by Dec. 1 to indicate the status of the request.

Dec. 22, 1989

FBI response #2. ÿFBI sends letter, acknowledging receipt of Oct. ÿ16
and Nov. 22 ÿletters. The letter states that "[i]nformation which may
be ÿresponsive to your request has been located and will ÿbe ÿassigned
for ÿprocessing soon." ÿThe letter indicates that the ÿFOIA/PA ÿoffice
receives a large number of requests and that delays are likely.

Jan. 9 , 1990

CPSR follow-up letter #3. CPSR writes to Mr. Moschella, ÿchief of the
FOIA/PA office at the FBI, acknowledges Dec. 22 letter and location of
responsive ÿinformation. ÿÿRequests that records be sent by ÿFeb ÿ18,
1990.

Jan. 19, 1990

FBI ÿresponse ÿ#3. ÿÿFBI ÿsends letter stating that ÿthe ÿBureau ÿhas
allocated ÿmany ÿagents ÿto FOIA processing, ÿthat a large ÿnumber ÿof
requests ÿare ÿreceived. ÿThe letter further states that "a delay ÿof
several ÿmonths ÿor ÿmore may be anticipated before ÿyour ÿrequest ÿis
handled in turn."

Feb. 2, 1990

CPSR follow-up letter #4. ÿCPSR writes to Mr. Moschella, acknowledges
Jan. ÿ19, ÿexpresses concern about delay. ÿLetter notes that CPSR was
assured by a FOIA officer in the fall that "request would be ÿanswered
within 'a couple of weeks.'"

Feb. 15, 1990

CPSR receives call from Mr. ÿBoutwell. According to Mr. Boutwell, FBI
can't ÿsay ÿwhen ÿrequest will be processed. ÿ"Haven't ÿeven ÿstarted.
Backlogs ÿand lay-offs during past year . . ." ÿCPSR: ÿÿFOIA ÿOfficer
indicated information had been located. FBI: Too optimistic. ÿ"Request
not yet assigned to an analyst . . . working now on 1988 ÿrequests .
. ÿ. ÿLitigation is taking up time . . . analyst is taking time ÿaway
from document review for litigation . . . increased requests, ÿfewer
personnel, lots of other factors. Would expedite for life and death or
due process, ÿÿpursuant ÿto agency regulations." ÿCPSR: ÿso when do we
receive a response? FBI: "Can't say."

The United States Government is monitoring the message activity on several
bulletin boards across the country. This is the claim put forth by Glen L.
Roberts, author of "The FBI and Your BBS." The manuscript, published by The
FBI Project, covers a wide ground of FBI/BBS related topics, but unfortunately
it discusses none of them in depth.

It begins with a general history of the information gathering activities of the
FBI. It seems that that the FBI began collecting massive amounts of
information on citizens that were involved with "radical political" movements.
This not begin during the 1960's as one might expect, but rather during the
1920's! Since then the FBI has amassed a HUGE amount of information on
everyday citizens... citizens convicted of no crime other than being active in
some regard that the FBI considers potentially dangerous.

After discussing the activities of the FBI Roberts jumps into a discussion of
why FBI snooping on BBS systems is illegal. He indicates that such snooping
violates the First, Fourth, and Fifth amendments to the Constitution. But he
makes his strongest case when discussing the Electronic Communications Privacy
Act of 1987. This act was amended to the Federal Wiretapping Law of 1968 and
But as with all good laws, it was written in such broad language that it can,
and does, apply to privately owned systems such as Bulletin Boards. Roberts
(briefly) discusses how this act can be applied in protecting *your* bulletin
board from snooping by the Feds.

How to protect your BBS: Do NOT keep messages for more than 180 days. Becaus
the way the law is written, messages less then 180 days old are afforded more
protection then older messages. Therefore, to best protect your system purge,
archive, or reload your message base about every 150 days or so. This seems
silly but will make it harder (more red tape) for the government to issue a
search warrant and inform the operator/subscriber of the service that a search
will take place. Roberts is not clear on this issue, but his message is state
emphatically... you will be better protected if you roll over your message bas
sooner.

Perhaps the best way to protect your BBS is to make it a private system. This
means that you can not give "instant access" to callers (I know of very few
underground boards that do this anyway) and you can not allow just anyone to b
a member of your system. In other words, even if you make callers wait 24
hours to be validated before having access you need to make some distinctions
about who you validate and who you do not. Your BBS needs to be a PRIVATE
system and you need to take steps to enforce and proclaim this EXPECTED
PRIVACY. One of the ways Roberts suggests doing so is placing a message like
this in your welcome screen:

"This BBS is a private system. Only private citizens who are not
involved in government or law enforcement activities are authorized
gained from this system to any government agency or employee."

Using this message, or one like it, will make it a criminal offense (under the
ECPA) for an FBI Agent or other government snoop to use your BBS.

The manuscript concludes with a discussion of how to verify users and what to
do when you find an FBI agent using your board. Overall, I found Roberts book
to be moderately useful. It really just whetted my appetite for more
information instead of answering all my questions. If you would like a copy o
the book it sells for $5.00 (including postage etc). Contact;

THE FBI PROJECT
Box 8275
Ann Arbor, MI 48107

Visa/MC orders at (313) 747-7027. Personally I would use a pseudonym when
dealing with this organization. Ask for a catalog with your order and you wil
the FBI would be interested in knowing who is doing business with this place.
The manuscript, by the way, is about 20 pages long and offers references to
other FBI expose' information. The full citation of the EPCA, if you want to
look it up, is 18 USC 2701.

Additional Comments: The biggest weakness, and it's very apparent, is that
Roberts offers no evidence of the FBI monitoring BBS systems. He claims that
they do, but he does not give any known examples. His claims do make sense
however. As he states, BBS's offer a type of "publication" that is not read b
any editors before it is "published." It offers an instant form of news and
one that may make the FBI very nervous. Roberts would do well to include some
supportive evidence in his book. To help him out, I will offer some here.

* One of the Ten Commandments of Phreaking (as published in the
famous TAP Magazine) is that every third phreaker is an FBI agent.
This type of folklore knowledge does not arise without some kind of
justification. The FBI is interested in the activities of phreakers
and is going to be looking for the BBS systems that cater to them. I
your system does not, but it looks like it may, the FBI may monitor i
just to be sure.

* On April 26, 1988 the United States Attorney's Office arrested 19
people for using MCI and Sprint credit card numbers illegally. These
numbers were, of course, "stolen" by phreakers using computers to hac
them out. The Secret Service was able to arrest this people by posin
as phone phreaks! In this case the government has admitted to placin
there, the success of theis "sting" will only mean that they will try
it again. Be wary of people offering you codes.

* In the famous bust of the Inner Circle and the 414s, the FBI monitore
electronic mail for several months before moving in for the kill.
While it is true that the owners of the systems being hacked (Western
Union for one) invited the FBI to snoop through their files, it does
establish that the FBI is no stranger to the use of electronic
snooping in investigating crimes.

Conclusion: There is no reason to believe that the government is *not*
monitoring your bulletin board system. There are many good reasons to believe
that they are! Learn how to protect yourself. There are laws and regulations
in place that can protect your freedom of speech if you use them. You should
take every step to protect your rights whether or not you run an underground
system or not. There is no justification for the government to violate your
rights, and you should take every step you can to protect yourself.

I have no connections with Roberts, his book, or The FBI Project other then
being a mostly-satisfied customer. I'm not a lawyer and neither is Roberts.
No warranty is offered with this text file. Read and use it for what you thin
it is worth. You suffer the consequences or reap the benefits. The choice is
yours, but above all stay free.
.

Make REAL money with your website!

The entire AOH site is optimized to look best in Firefox® 2.0 on a widescreen monitor (1440x900 or better). Site design & layout copyright © 1986-2008 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.