May 1994 Computer Fraud & Security Bulletin

women . Most c u s t o m e r s are hacker masturbators - - they wouldn't dream of following through on any of the instructions.

But it is the sheer cheapness of the product and the vastness of the material contained that has me worried. You only need a handful of readers to be prepared to move towards serious experimentation and only a small number of files which contain really workable instructions and we - - computer users and others - - have serious problems.

PROTECTING DATA BY PROTECTING DISKS

Brian Riggs

Disknet, a security software application, ensures PC networks protection against floppy diskette-borne viruses by preventing infected viruses from entering the system. Unlike most anti-virus applications, which do not detect computer viruses until they have already entered the system, Disknet ensures that only clean diskettes enter the computer in the first place.

The system works be designating all PCs in a network as 'clients' except one which acts as an 'administrator'. Diskettes loaded onto the client machines cannot be accessed until they have first been examined for viruses by the administrator PC. Running a virus scan program, the administrator encrypts clean diskettes wth an authorization signature which allows them to be run on client PCs in the network.

Diskettes that have received authorization may be used on other PCs outside of the Disknet-protected network. However, if they are written to they must be rescanned by the administrator before they can be used on the protected network.

R e p r e s e n t a t i v e s of Ref lex Ltd, the developers of Disknet, consider ease of use among the s y s t e m ' s most laudab le

characteristics. Because the administrator PC is the only machine in the network that runs virus scanning programs, these applications can be easily upgraded over time without having to install them on every PC on the network.

Additional features of the Disknet security application include a password protection system that prevents unauthorized access to the network and a 'program security guard' that prevents a virus from entering the network through modems and other non-diskette pathways.

Disknet can be run form both Windows and DOS and is compatible with Novell Netware among other networking applications. In the UK Disknet is sold by London-based Reflex Ltd, which boasts Lloyds Bank PIc, Metropolitan Police and the University of London among its Disknet clients.

FBI AND US JUSTICE DEPARTMENT SEEK GUARANTEE TO TAP NETWORKS

Mike Moeller

Fearing that its ability to monitor voice and data communications will be threatened as ne two rk ing t echno logy advances , the US Federal Bureau of Investigations and the US Justice Department have introduced a piece of legislation that would guarantee the ability to tap and monitor new forms of networks.

FBI director Loius Freech held a press conference in Washington, DC and said that new techno log ies and a lack of suppor t by communications companies has forced the FBI to introduce the bill. Seeking to gain funding to develop new networking software - - at a cost of US$500 million - - the FBI director said that unless the US Government had access to all forms of communications, "The country would be unable to protect itself against terrorism, violent crimes, foreign threats and drug trafficking and espionage."

©1994 Elsevier Science Ltd 9

Computer Fraud & Security Bulletin May 1994

The new bill wou ld force US telecommunications companies to grant access to investigators or face stiff penalties if they do not comply. The bill would allow the attorney general to seek fines of US$10 000 per day for firms that do not provide access, and, in some cases, completely shut down a network.

The bill was sharply crit icized by the Electronic Frontier Foundation (EFF) - - a US privacy watchdog. A spokesperson for the EFF said that the bill was the blueprint for an electronic surveillance society.

Donn Parker, senior management consultant and security expert at SRI International, said that the bill was nothing more than a "bluff" by the FBI to get the telecommunications industry to open up and said that there is no need to develop new networking software because telecommunication companies already have it. He added that instead of threats of fines and shut-off by the FBI, a bill should be passed that would strictly limit the FBI and other Government agencies in the types of surveillance that they could conduct.

"It makes more sense to grant the Government access but to set firm guidelines for gaining authorization and boundaries as to where the Government can observe and where they cannot", said Parker. "No-one should have 'absolute privacy', but the Government should also be limited as to what it can do."

CLINTON ADMINISTRATION REPORT ON HUMAN RIGHTS IGNORES DATA PRIVACY ABUSES

Wayne Madsen

The US State Department has issued its annual report in human rights around the world. Entitled 'Country Reports on Human Rights Practices for 1993', the report was expected to pay somewhat closer attention to data-privacy abuses than its forerunners. The reason for this expectation was the Clinton appointment of John

Shattuck, a civil liberties and privacy advocate, as Assistant Secretary of State for Human Rights and Humanitarian Affairs. Many privacy experts and advocates expected Shattuck to avoid the blatant bias evident in previous human rights reports. However, the 1993 report overlooked, ignored and glossed over data protection and privacy violations in numerous countries around the world.

The scant attention given to data privacy abuses may not entirely be the fault of Mr. Shattuck. The 1993 report includes information gleaned from US embassies and consulates around the world. Some of the information undoubtedly emanated from embassy staffers and attaches who were officially serving as State Department employees, but are in reality Central Intelligence Agency (CIA) operatives operating under State Department cover. Such individuals clearly lack the mind set to recognize privacy abuses in the countries in which they serve. In fact, many of these operatives have established long-term and close working relationships with the very host country agencies that are responsible for the most extreme data privacy abuses. For example, even though the report describes the Indonesian practice of including the designator 'ex-tapol' (meaning ex-political prisoner) on the identity cards and computer records of former Indonesian Communist Party members and other political opponents, it fails to state that these names were originally provided to Indonesia by the CIA. Although the report states that wiretapping in El Salvador is illegal, but commonly occurs, no mention is made of the sophisticated telecommunications espionage network discovered in 1993 in the national te lecommunicat ions administrat ion offices (Antell). Some observers saw the hands of the US intelligence in the eavesdropping scandal pointing out that in addition to bugging the lines of the leftist Farabundo Marti National Liberation Front, the eavesdroppers also listened in on private conversations of conservative President Alfredo Cristiani, the former mayor of San Salvador and scores of other diplomatic, religious, media and social personali t ies.

10 ©1994 Elsevier Science Ltd