PRIVACY Forum Digest     Friday, 20 November 1992     Volume 01 : Issue 26

         Moderated by Lauren Weinstein (lauren@cv.vortex.com)
                Vortex Technology, Topanga, CA, U.S.A.
	
                     ===== PRIVACY FORUM =====

   	  The PRIVACY Forum digest is supported in part by the 
	      ACM Committee on Computers and Public Policy.


CONTENTS
	Re: Wire Taps, Key Management, and Privacy (Dorothy Denning)
	SURVEY RESULTS: Is Big Brother Watching You? (Lorrayne Schaefer)


 *** Please include a RELEVANT "Subject:" line on all submissions! ***
            *** Submissions without them may be ignored! ***

-----------------------------------------------------------------------------
The PRIVACY Forum is a moderated digest for the discussion and analysis of
issues relating to the general topic of privacy (both personal and
collective) in the "information age" of the 1990's and beyond.  The
moderator will choose submissions for inclusion based on their relevance and
content.  Submissions will not be routinely acknowledged.

ALL submissions should be addressed to "privacy@cv.vortex.com" and must have
RELEVANT "Subject:" lines.  Submissions without appropriate and relevant
"Subject:" lines may be ignored.  Subscriptions are by an automatic
"listserv" system; for subscription information, please send a message
consisting of the word "help" (quotes not included) in the BODY of a message
to: "privacy-request@cv.vortex.com".  Mailing list problems should be
reported to "list-maint@cv.vortex.com".  All submissions included in this
digest represent the views of the individual authors and all submissions
will be considered to be distributable without limitations. 

The PRIVACY Forum archive, including all issues of the digest and all
related materials, is available via anonymous FTP from site "cv.vortex.com",
in the "/privacy" directory.  Use the FTP login "ftp" or "anonymous", and
enter your e-mail address as the password.  The typical "README" and "INDEX"
files are available to guide you through the files available for FTP
access.  PRIVACY Forum materials may also be obtained automatically via
e-mail through the listserv system.  Please follow the instructions above
for getting the listserv "help" information, which includes details
regarding the "index" and "get" listserv commands, which are used to access
the PRIVACY Forum archive.

For information regarding the availability of this digest via FAX, please
send an inquiry to privacy-fax@cv.vortex.com, call (310) 455-9300, or FAX
to (310) 455-2364.
-----------------------------------------------------------------------------

VOLUME 01, ISSUE 26

   Quote for the day:

	Psychiatrist: "Tell me Harold, what do you do for fun?
	   	       What activity gives you a different sense of 
		       enjoyment from the others?
		       What do you find fulfilling?
		       What gives you that special satisfaction?"

	Harold:	       "I go to funerals."
		
					-- G. Wood and Bud Cort
					   "Harold and Maude" (1972)
		   
----------------------------------------------------------------------

Date:    Thu, 19 Nov 92 17:57:01 EST
From:    denning@cs.georgetown.edu (Dorothy Denning )
Subject: Re: Wire Taps, Key Management, and Privacy

In PRIVACY Forum Digest V01 #25, Brinton Cooper writes:

  In RISKS DIGEST 13.87, Dorothy Denning .. spoke of the high costs of lawful
  surveillance and asserted, "Much of this is related to organized crime,"
  perhaps a scare tactic?

Actually the majority of taps goes to narcotics investigations. After
that comes racketeering and gambling.  According to the FBI, the
hierarchy of Organized Crime has been neutralized or destabilized
through the use of electronic surveillance, and thirty odd years of
successes would be reversed if the ability to conduct court-authorized
electronic surveillance was lost.  I believe this represents an honest
assessment of what they see would happen. 

   Her solution involves nongovernmental "key centers" which,
   presumably, would not give out keys to anyone without a properly
   executed court order.

By way of context, I'm looking for a way to balance our national
interests for privacy and security with those for effective law
enforcement.  This is one idea I proposed.  I am not pushing it as "the
solution".  In any case, the idea was for users to register their keys
with a trustee (key center).  Or, using a technique invented by Silvio
Micali, you could split your key into parts and register each part with
a different trustee.  Law enforcement would have to take a court order
to each trustee in order to get the pieces and reconstruct the key.

   She cites that the "...phone companies are so fussy about court
   orders that they send them back if the semicolons aren't right...,"
   apparently believing that the rights of the citizens are thereby
   protected.  For the following reasons, this is a politically naive
   position.

   1. It provides that our right to protection from illegal governmental
   search and seizure and/or illegal eavesdropping rests on the good will
   and integrity of a phone company!

Your statement does not follow from what I said.  I said the phone
companies are fussy.  I know of no cases where the phone companies
assisted with unauthorized taps.  If you do, please cite.  They could
go out of business if they didn't respect the rights of their
customers.  Even so, your right to protection does not rest entirely on
the phone company.  Title 18 makes tapping without a court order
illegal.

Crypto will make it much more difficult for anyone to tap illegally. If
the keys are registered with a trustee other than the phone company, someone
would have to subvert both the trustee and the phone company (to get the
bits).

   3. Court orders, search warrants, and the like protect citizens only
   when the information or evidence gathered is to be used in court against
   a suspect.  If information is being gathered for political purposes,
   blackmail, or other subversion of law (Watergate, Iran-Contra, the
   Italian bank scandal, etc), the purloined information will never see a
   public forum but can still do great harm to innocent persons.  Thus, the
   constraints of court orders are obviated.

I expect that most of this information is not being obtained by wiretapping.
It is popular to suggest it is and difficult to refute.  If someone
in law enforcement is found to be tapping without a court order, they
could be convicted of violating Title 18.  

But in any case, it will be very difficult for LE to intercept without a
court order with the new digital technologies and crypto.

  The FBI needs to fund its own R&D from its own budget, just as the
  rest of the government at all levels must do.  There is talent that can
  "red team" modern telecommunications and find trapdoors when necessary.

Are you suggesting that it would be better for the FBI to break the
cryptosystems than go through a trustee with a court order?

Dorothy Denning 

------------------------------

Date:    Fri, 13 Nov 92 09:16:56 EST
From:    lorrayne@smiley.mitre.org
Subject: SURVEY RESULTS:  Is Big Brother Watching You?

   [ These results refer to a survey originally seen here in the 
     PRIVACY Forum on Monday, 6 July 1992 (Volume 01 : Issue 07).
     The survey size was reported as 100 people.  The original
     survey introduction is included below. -- MODERATOR ]

---

The purpose of this survey is to collect data for a presentation that I
will give at this year's National Computer Security Conference in October.
I would like to thank you for taking the time to fill out this survey.  If
you have any questions, you can call me at 703-883-5301 or send me email at
lorrayne@smiley.mitre.org.  Please send your completed survey to:

Lorrayne Schaefer
The MITRE Corporation
M/S Z213
7525 Colshire Drive
McLean, VA 22102

1.	What is your title?

Engineer		31%		Manager			14%
Computer Scientist	25%		Systems Administrator	10%
Administrator		4%		Student			10%
Not Provided		2%		Professor		3%
Author			1%


2.	What type of work does your organization do?

Education		24%		Software Development	19%
Hardware Development	15%		Research		11%
Not Provided		6%		Other			8%
Government		6%		System Administration	2%
Telephone		5%		System Development	2%
Network Development	2%

3.	Does your organization currently monitor computer activity?  (Yes/No)

Yes			67%
No			32%
Unknown			1%

If yes, what type of monitoring does your company do (e.g., electronic
mail, bulletin boards, telephone, system activity, network activity)?

All			16%		System Activity			17%
Bulletin Boards		4%		Network Activity & Other	12%
Other			3%		Telephone Usage			7%
E-mail			2%		System & Network Activity	5%
Unknown			1%		N/A				1%

4.	If you are considering (or are currently) using a monitoring tool,
	what exactly would you monitor?  How would you protect this 
	information?

System Usage		17%		N/A				43%
Accounting		5%		Nothing				11%
Everything		4%		Network Traffic			10%
Don't Know		3%		Other				2%
Bulletin Board		1%		Security			3%
E-mail			1%

5.	Are you for or against monitoring?  Why/why not?  Think in terms of
	whether it is ethical or unethical ("ethical" meaning that it is
	right and "unethical" meaning it is wrong) for an employer to
	monitor an employee's computer usage.  In your response, consider
	that the employee is allowed by the company to use the computer and
	the company currently monitors computer activity.

Against			52%
For			47%
N/A			1%

6.	If your company monitors employees, is it clearly defined in your
	company policy?

N/A			35%
No			34%
Yes			31%

7.	In your opinion, does the employee have rights in terms of being
	monitored?

Yes			90%
No			8%
Don't Know		2%

8.	In your opinion, does the company have rights to protect its as
	sets by using a form of monitoring tool?

Yes			91%
No			6%
Don't Know		3%

9.	If you are being monitored, do you take offense?  Managers: How do
	you handle situations in which the employee takes offense at being
	monitored?

No			42%
Yes			36%
N/A			22%

10. 	What measures does your company use to prevent misuse of monitoring in
        the workplace?

None			36%		Don't Know		17%
N/A			22%		Policy			6%
Control of Information	4%		Security		6%
Honor System		4%		Warnings		3%
Other			2%

11.	If an employee is caught abusing the monitoring tool, what would
	happen to that individual?  If your company is not using any form of
	monitoring, what do you think should happen to an individual who
	abused the tool?

Reprimand		64%		Don't Know		17%
N/A			10%		Termination		5%
Nothing			4%

12.	Is it unethical to monitor electronic mail to determine if the
	employee is not abusing this company resource (e.g., suppose the
	employee sends personal notes via a network to others that are not
	work related)?  Why or why not?

No			49%
Yes			49%
N/A			2%

------------------------------

End of PRIVACY Forum Digest 01.26
************************