i was recently playing games and this nasty windos logo key keep annoying me , cause i often accidently clicked it , and i start to search a solution to solve my problem, and found the following article in microsfot website, and it did work, hope this helps, thanks!
CODE
http://support.microsoft.com/?kbid=181348
or in other articles, u can copy the following messages into ur notepad and save as *.reg, and use it..
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout]
"Scancode Map"=hex:00,00,00,00,00,00,00,00,03,00,00,00,00,00,5b,e0,00,00,5c,e0,\
00,00,00,00
This tutorial is for people that don't know how to direct link to .php pages on the web. If you are on a private computer, and don't mind auto-logging in, you will be able to access your folders much faster than going straight to hotmail.com
You will need a bit of information. Log into the hotmail main page. You will see a web address similar to the following:
http://by211.bay211.hotmail.msn.com/cgi-bin/hmhome?fti=yes&curmbox=00000000%2d0000...
It won't be exactly the same but it will be similar.
It's time to shorten this up. The only bit of information you really need is the direct web address to the server that contains your particular account. In the above example, you would just need:
CODE
http://by211.bay211.hotmail.msn.com/cgi-bin/
Just copy this section from your particular server addy in your browser's address bar.
Now that the explanation is over, these are the commands you can append to the above example to reach specific pages.
'hmhome' - MSN Hotmail - Today
'HoTMaiL' - Inbox
'HoTMaiL?&curmbox=00000000-0000-0000-0000-000000000005' - Junk E-Mail
'HoTMaiL?&curmbox=00000000-0000-0000-0000-000000000004' - Drafts
'HoTMaiL?&curmbox=00000000-0000-0000-0000-000000000003' - Sent Messages
'HoTMaiL?&curmbox=00000000-0000-0000-0000-000000000002' - Trash Can
'compose' - Compose Message
'addresses' - Address Book
'options' - Options, Duh
'options?section=mail' - Mail Options
'options?section=personal' - Personal Details
'protect?screen=filter' - Junkmail Filter
'options?section=contacts' - Contact Options
------------------------------------------------------------------------------------
Remember, you just need to place these commands directly after 'http://.../cgi-bin/' without spaces.
If you have never tried this before, it works on many websites. So, if you don't like navigating websites, and would rather do that through your web-browser, go ahead and do it.
This tip requires a change to the Windows Registry. Please see the MSFN Guide "Backup Your Registry" if you are new to the Windows Registry.
Windows Media Player (WMP) is a built-in application that allows you to play multimedia files. Like many other applications, WMP remembers the most recently played files and displays them in the Recent File List under the File menu. This feature is useful if you regularly play certain files, but you may want to clear the list if you share the computer and a user account or create archives and CDs.
There are two ways you can clear the list:
I. The ClearMRU.exe Utility is available for free in the Windows Media Player Bonus Pack from Microsoft, but Microsoft does not support this tool.
II. You can also manually delete the list through the Windows Registry:
1. Start the Windows Registry Editor, regedit.exe, by typing regedit in the Windows Run Command Line.
2. Go to HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList.
3. Delete the RecentFileList subkey.
4. If you've also streamed content from the Internet, you can delete the RecentURLList subkey.
5. Exit the Registry Editor.
6. Restart the computer.
To keep certain files in the list, don't delete the entire key. Deleting individual entries within the key will get rid of the files that you no longer want in the Recent File List.
Open a Command Prompt window and leave it open.
Close all open programs.
Click Start, Run and enter TASKMGR.EXE
Go to the Processes tab and End Process on Explorer.exe.
Leave Task Manager open.
Go back to the Command Prompt window and change to the directory the AVI (or other undeletable file) is located in.
At the command prompt type DEL
Go back to Task Manager, click File, New Task and enter EXPLORER.EXE to restart the GUI shell.
Close Task Manager.
Or you can try this
Open Notepad.exe
Click File>Save As..>
locate the folder where ur undeletable file is
Choose 'All files' from the file type box
click once on the file u wanna delete so its name appears in the 'filename' box
put a " at the start and end of the filename
(the filename should have the extension of the undeletable file so it will overwrite it)
click save,
It should ask u to overwrite the existing file, choose yes and u can delete it as normal
Here's a manual way of doing it. I'll take this off once you put into your first post zain.
1. Start
2. Run
3. Type: command
4. To move into a directory type: cd c:\*** (The stars stand for your folder)
5. If you cannot access the folder because it has spaces for example Program Files or Kazaa Lite folder you have to do the following. instead of typing in the full folder name only take the first 6 letters then put a ~ and then 1 without spaces. Example: cd c:\progra~1\kazaal~1
6. Once your in the folder the non-deletable file it in type in dir - a list will come up with everything inside.
7. Now to delete the file type in del ***.bmp, txt, jpg, avi, etc... And if the file name has spaces you would use the special 1st 6 letters followed by a ~ and a 1 rule. Example: if your file name was bad file.bmp you would type once in the specific folder thorugh command, del badfil~1.bmp and your file should be gone. Make sure to type in the correct extension.
First, create a shortcut on your desktop by right-clicking on the desktop, choosing New, and then choosing Shortcut. The Create Shortcut Wizard appears. In the box asking for the location of the shortcut, type shutdown. After you create the shortcut, double-clicking on it will shut down your PC.
But you can do much more with a shutdown shortcut than merely shut down your PC. You can add any combination of several switches to do extra duty, like this:
shutdown -r -t 01 -c "Rebooting your PC"
Double-clicking on that shortcut will reboot your PC after a one-second delay and display the message "Rebooting your PC." The shutdown command includes a variety of switches you can use to customize it. Table 1-3 lists all of them and describes their use.
I use this technique to create two shutdown shortcuts on my desktop—one for turning off my PC, and one for rebooting. Here are the ones I use:
shutdown -s -t 03 -c "Bye Bye m8!"
shutdown -r -t 03 -c "Ill be back m8 ;)!"
Switch
What it does
-s
Shuts down the PC.
-l
Logs off the current user.
-t nn
Indicates the duration of delay, in seconds, before performing the action.
-c "messagetext"
Displays a message in the System Shutdown window. A maximum of 127 characters can be used. The message must be enclosed in quotation marks.
-f
Forces any running applications to shut down.
-r
Reboots the PC.
Requirements:
Serv-U
No-IP.com Website
Quote:
Step 1. Getting a static IP address.
Get a static address for your FTP server. You will want to do this as opposed to using your IP address for several reasons. First, it’s easier keeping up-to-date. Imagine having to change all of your setting every time your IP changed. With No-IP, the No-IP service runs in background on your computer and updates your current IP address with your FTP server’s URL (for example, you get ftp://rkchoolie.serveftp.com). Second reason, you don’t want your IP address posted out there for everyone to see.
1. Go to www.No-IP.com to create a new user account.
2. Fill in the information that is required and the click Register button.
3. Your account has now been created and your account password has been emailed to you.
4. Check your email mailbox and wait for the mail that contains your password
5. Go back to www.No-IP.com and type your email address and password to login to your account.
6. Once in your account, click on Add a host in the left menu
7. Type in the Hostname you want (example: rkchoolie) and pick a Domain from the list (example: ftpserve.com)
8. Check Allow Wildcards and click the Submit button
9. You now have your static address (example: rkchoolie.serveftp.com)
10. Click on your OS link in the Dyn-Update Client in the bottom right menu and follow links to download the client
11. Once downloaded, install the software and type in your email address and password when asked.
12. Finally tick the checkbox near your static address.
You now have a static web address .
Quote:
Step 2. Installing and setting the FTP server
1. Install Serv-U 4.0.
2. Start Serv-U and use the wizard to setup your ftp.
3. Click next until you're asked for an IP address, leave it blank and then click next.
4. Type the domain name you've just registered above (example: preacher.serveftp.com) in the domain name field and then click Next.
5. You are asked if you want to allow anonymous access, select No and then click next.
6. You are then asked to create a named account, check yes and then click next.
7. Type in the user name you wish for this account (example: Harrie) and click next.
8. Type a password for this account (example: $p3c1aL). For security reasons, try to create a password with some letters, numbers and special characters. Then click next.
9. You will then be asked for the Home directory of the account you just created. Select the directory and then click next.
10. Select yes to lock this account to the Home directory. You want to do this so that the user can not go any further up that his home directory. Click next.
11. The account is now set so click finish.
Quote:
Step 3. Configuring user accounts
1. In the left tree-menu, select the account you've just created and then click on the General tab.
2. Check Hide ‘Hidden’ Files.
3. Check Allow only and enter the number one in the box.
4. Set the Max. download speed to what ever you want. If this is an account that many will be using, set it low to save on your bandwidth. I usually have mine set between 10 – 20. If you leave it blank, users will be able to download from you at full bandwidth.
5. Set the Max no. of users to how many you want to be able to log on at one time. This depends on your connection speed but try these (56 - 1, ISDN - 3, ADSL or cable - 5-6 users.)
6. Now, click on the Dir Access tab.
7. You should see the home folder in there. Highlight it and make your permissions.
8. If you only want users to be able to download check only Read, List, & Inherit.
9. If you want users to be able to upload, but to only one particular folder but not download, click the add button and then select that folder. Now highlight the folder and set these permissions on that folder. Check Write, Append, List, Create, & Inherit. Once you have made the permissions click on the up arrow that is located at the bottom right-hand corner. You want this special upload folder to be list first, before the home folder.
10. If there is a folder that you don’t want anyone to have access to, but it is inside the home folder, then click the add button and then select that folder. Now highlight the folder and make sure that all checkboxes are left. Once you have made the permissions click on the up arrow that is located at the bottom right-hand corner. You want this no access folder to be listed at the very top.
11. There are many other different sets of permissions you can play with. I just covered your basics.
12. Your server is now set!
13. Try logging on with the username and password and see if it works.
This isnt a tweak, but a great little feature! For a great way to put your digital photos to work, try creating a slide show presentation for use as a screen saver. Here's how:
1. Right-click an empty spot on your desktop and then click Properties.
2. Click the Screen Saver tab.
3. In the Screen saver list, click My Pictures Slideshow.
4. Click Settings to make any adjustments, such as how often the pictures should change, what size they should be, and whether you'll use transition effects between pictures, and then click OK.
Now your screen saver is a random display of the pictures taken from your My Pictures folder.
Launch Crap Software Pro and click to highlight the "Overview"
tab on the left hand side . In the pane that appears on the right
hand side click the "Preferences" tab and in the section "Check for updates" check "Manually".
In the "General" section you can also configure Crap Software to load at
start up which is advisable because this software is your first line
defence against uninvited invasion of your computer by a whole
gamult of virii, spyware, adware and bots! Virus checking software
does have its place but remember that prevention is always better
than a cure!
Crap Software Pro's program control is automatically configured.
When you run it for the first time it will ask on behalf of programs
installed on your system for permission to access the Internet.
Your Browser will be the first to request - just tick the "Yes"
box and the "Remember this setting" box and Crap Software will
always allow your browser access automatically.
Unless you use online databases etc., there should be no
reason for any application other than a browser, email client, ftp client,
streaming media player or a download manager to gain access to the Internet.
So consider what type of program it is that needs Internet access
before giving Crap Software permission to allow it. If it is just a driver file
(.DLL) that requests Internet access, always search Windows to try
and identify it. Many seudo-virii such as AdWare and sub class
seven Trojans access the Internet from your system using .dll files.
----------------------------------------------
Configuring The Advanced Settings
If you are not on a LAN (connected to another computer in a network)
you can use this guide to give your firewall some real muscle:
Launch Crap Software Pro and click to highlight the "Firewall" tab on
the left hand side . In the pane that appears on the right hand side
in the section "Internet Zone Security" set the slider control to "High"
Then click the "Custom" button in the same section.
The next settings page is divided into two sections with tabs Internet
Zone and Trusted Zone at the top of the page.
Under the Internet Zone tab there is a list of settings that can
be accessed by scrolling.
At the top is the high security settings and the only thing that should
check from there is "allow broadcast/multicast".
The rest should be unchecked
Scroll down until you get to the medium security settings area.
Check all the boxes in this section until you get to "Block Incomming
UDP Ports". When you check that you will be asked to supply
a list of ports, and in the field at the bottom of the page enter
1-65535
Then go back to the list and check the box alongside "Block
Outgoing UDP Ports" and at the bottom of the page enter
1-19, 22-79, 82-7999, 8082-65535
Repeat this proceedure for the following settings
"Block Incomming TCP Ports": 1-65535
"Block Outgoing TCP Ports": 1-19, 22-79, 82-7999, 8082-65535
Then click "Apply", "Ok" at the bottom of the page.
Back in the right hand "Firewall" pane go next to the yellow
"Trusted Zone Security" section and set it to "high" with the slider.
Click "Custom" and repeat the ABOVE proceedure this time choosing
the *Trusted Zone* tab at the top of the settings page.
These settings will stop all incoming packets at ports 1-65535
and also block all pings, trojans etc. These settings will also stop all
spyware or applications from phoning home from your drive without your knowledge!.
In the last few years, computer security has received a
great deal more attention than it has in the past. Compu-
terized break-ins and criminal activity, once merely the
product of the imagination of science fiction writers, has
became a fairly common occurence in both commercial and
academic circles. In this paper, I will go over the prob-
lems that face any multiuser computing system, then discuss
how these problems apply to UNIX[1] specifically, and
finally present in detail a suite of programs that were
developed in an attempt to address some of the main problems
that could be solved via software. UNIX, although con-
sidered to be a fairly secure operating system ([Wood 88],
[Duff 89], etc), has the advantage of having many published
works ([Grampp and Morris 84], [Bishop 83], etc) on the
problems that a computing site can have with security, and
in addition, on how a UNIX
system administrator might make
his/her system more secure by monitoring various aspects of
his/her UNIX site. This, combined with UNIX's popularity,
make it an ideal target for a software security system to
operate on.
In this report I am not going to discuss specific ways
of breaking into a given UNIX machine (for a more detailed
description on how to compromise UNIX security, see either
[Baldwin88], [Bishop83], [Wood & Kochran 86], or [Grampp &
Morris 84]) -- instead, I will concentrate on how to improve
and strengthen the potentially good security of a generic
UNIX system by means of a software toolkit that examines the
weaker areas of UNIX that are either traditionally ignored
(due to the time constraints or ignorance of the system
administrators) or are simply reoccurring problems that need
to be watched over. In addition, this report is not meant
for UNIX neophytes -- although a great deal of proficiency
is not needed to read this report and use the programs
described herein, a familiarity with basic UNIX features --
the file system and file permission modes for example -- and
commands such as awk,grep,sed as well as a working
knowledge of shell and C programming are necessary to
_________________________
9 [1] Although originally designed and developed by Ken
Thompson and Dennis Ritchie of AT&T, UNIX has grown far
beyond its' original design and now numerous companies
market their own "flavor" of UNIX. When I use the term
UNIX in this paper, I don't mean merely AT&T's version,
but instead I mean the majority of the most popular
varieties, made by developers at Berkely, Sun, and a
host of other manufacturers. I believe UNIX is still a
trademark of Bell Laboratories.
9
February 19, 1991
- 2 -
understand the internal workings of the security system
described in this paper.
Although there is no reasonable way that all security
problems can be solved (at least not with a software solu-
tion) on any arbitrary UNIX system, administrators and sys-
tem programs can be assisted by a software security tool.
The Computer Oracle Password and Security system (COPS) that
will be described in this paper is just such a device. The
COPS system is a collection of programs and shell scripts
that attempt to address as many of these problems as possi-
ble in an efficient, portable, and above all in a reliable
and safe way. The main goal of COPS is one of prevention;
it tries to anticipate and eliminate security problems by
making sure people don't get a chance to compromise security
in the first place. Alerting the administrators of a poten-
tial intruder or that a virus has infected the system is
beyond the scope of the present system, although with work
with such capabilities could be added ([Bauer and Koblentz
88] and [Duff 89].)
To understand the reason COPS might check any specific
problem, a look at computer security problems in general is
in order. The problems listed below are not meant to be
inclusive, but they are indicative of the myriad types of
dilemmas a typical computer multiuser system might
encounter:
1) Administrators, system programmers, and computer
operators. The very people that (should) worry the most
about security are sometimes the ones that are the least
concerned. Carelessness is one of the main culprits; a mis-
take by a user might cause little or no problem, but when
someone with no restrictions (or almost none) on their com-
puter activity makes a mistake, a security hole can result.
"I can trust my users" is a fine statement to make -- but
can you trust your users' friends? How about the users of
computers that are networked to yours? New software, sys-
tems, or procedures can facilitate extra problems; a comput-
ing staff is often ill or completely non-trained on new
techniques and software. Too often "RTFM" is the only
training that they will ever receive. Programs that are
created for in-house use are often ill-documented and not
debugged thoroughly, and when users other than the author
start to use/abuse the program, problems can result. Espe-
cially misunderstood, even by experienced UNIX system pro-
grammers, is the SUID program or, worse yet, the SUID shell
script ([Bishop 83].) When a user says that his/her password
was forgotten (or any other account/security related prob-
lem), what checks are made to verify that the person is
really the owner of that account? Are users that are secu-
rity problems kept track of, so that repeated abuses of the
system will result in punitive action? Does your site even
have a security policy? And of course, the last straw is
February 19, 1991
- 3 -
that most system administrators simply have too much other
work to do than to constantly check the system for potential
security flaws -- let alone to double-check that any work
done by other system programmers has been done correctly.
These are the actions that often get left unsaid and undone.
A UNIX environment has no special defenses against this
kind of "attack". Fortunately, a number of these potential
problems (unless catastrophic in scope) are not only
correctable, but are easy to detect with a software toolkit
such as COPS. Even the most careful UNIX guru will periodi-
cally make a mistake; COPS has been designed to aid in
her/his never ending battle against the forces of darkness.
2) Physical security. This is perhaps the most frus-
trating of all possible problems because it effects all com-
puter systems and is often the hardest to safeguard against.
Even if the software is secure, even if the system adminis-
trators are alert to potential problems, what happens if a
user walks up to the root console and starts typing? Does
the night janitorial staff let anyone into the machine room
without proper identification? Who has access to the key
that opens up the computing center? Are terminals that are
logged on left unguarded or unlocked? Are passwords written
on or near a users terminal or desk? No software in the
world can help against human nature or carelessness.
Reiterating to your staff and users that terminals should
not be left alone or unguarded and that passwords (espe-
cially root) should not be typed in front of unfriendly (and
in this case, _everyone_ is your enemy) eyes would be a good
start. A simple analogy: since you would never give the
keys to the company car away, why on earth would you give
away the keys to your computer, which is certainly worth a
hell of a lot more time and money (although it may not get
as good mileage on the interstate.) Common sense goes a
long ways to help prevent this kind of risk.
3) Authentication. What is authentication? All
modern computing systems that have capabilities for multiple
users have a means of identifying who is using the computer
at any given time. A common means of identification is by
using a password; and since the inception of this idea, poor
passwords have been a perennial problem. People have a ten-
dency to use their own name, or their social security
number, or some other common word, name, or phrase for a
password. The problem then arises when an unauthorized user
wants to access clandestine information, he/she simply tries
one of these simple passwords until a successful match is
found.
Other problems with authentication? What computer
hosts are "trusted" and allow users to log in from other
machines without any further authentication? Are incorrect
login attempts kept and/or monitored so as to allow
February 19, 1991
- 4 -
administrators to keep track of any unusual activity? What
about "Trojan horses" -- programs that can steal passwords
and the privileges that a user owns -- is there a program or
a administrative method that detects a potential 'horse?
Fortunately UNIX systems again have some fairly good
tools to aid in this fight. Although finding simple pass-
words is indeed a trivial task, forcing the users on a sys-
tem to use passwords that are harder to guess is also
trivial, by either modifying the mechanism that gets/gives
the password to the user, and/or by having the system
administrators run a simple password detector periodically,
and notifying users if their password is deemed too obvious.
The crypt command, although proven to be insecure for a
knowledgeable and resourceful attacker ([Reed and Weinberger
84], [Baldwin 86]), does offer an added shield against most
unauthorized users. Logs can be kept of incorrect login
attempts, but as with most security measures, to be effec-
tive someone (usually the site administrator) must take the
time to examine the evidence.
4) Bugs/Features. Massive software designs (such as
an operating system) are usually the result of a team or of
teams of developers working together. It only takes one
programmer to make a mistake, and it will almost always hap-
pen. "Back doors" that allow unauthorized entrances are
sometimes purposefully coded in -- for debugging, mainte-
nance, or other reasons. And there are always unexpected
side effects when thousands of people using the system start
doing strange (stupid?) things. The best kind of defense
against this is to report the problems to the developer as
they are discovered, and if possible, to also report a way
to fix the problem. Unfortunately, in many cases the source
code is needed to make a bug fix, and especially in non-
academic areas, this is simply not available due to the
prohibitive costs involved. Combining this with the reluc-
tance of a (usually) commercial developer to admit any prob-
lems with their product, and the end result is a security
hole that will not be mended unless some kind of financial
loss or gain is at stake -- for the developer of the pro-
duct, not yours!
5) Ignorance. Users who don't know or care can be a
problem as well. Even if someone doesn't care about their
own security, they can unwittingly compromise the entire
system -- especially if they are a user with high
privileges. Administrators and system operators are not
immune to this either, but hopefully are better informed, or
at least have access to a means of combating this dysfunc-
tion. It may also be due to apathy, an unwillingness to
learn a new system, a lack of time to explore all of the
features of a large system, or simply not enough computer
savvy to learn more about a very complex system, and no one
willing to teach it to the user. This problem is much like
February 19, 1991
- 5 -
illiteracy; it is a never-ending battle that will never go
completely away. And while a software toolkit such as COPS
can help combat this problem by calling attention to
neglected or misunderstood critical areas, by far and away
the best weapon against this is education. An educated user
will simply not make as many mistakes; and while it may seem
impractical to teach _all_ users about (even) the fundamen-
tals of computer security, think of all the time and
resources wasted tracking down the mistakes that keep recur-
ring time and time again.
6) Unauthorized permissions or privileges. Are users
given _too much_ freedom? Do new computer accounts have any
default security at all, or are the new users expected to
know what to do to protect their programs, data, and other
files. System files, programs, and data are sometimes
shipped with minimal or no protection when gotten straight
from the manufacturer; someone at the installation site must
have enough knowledge to "tune" the system to be effective
and safe. Password, memory, and log files especially should
all be carefully monitored, but unfortunately an experienced
user can often still find out any information they want with
perseverance and a little luck. This is where a system such
as COPS can really shine. After a new system is configured,
some basic flaws can be uncovered with just a small amount
of effort. New system problems that somehow slip through
the cracks of the site installers can be caught and modified
before any serious problems result. The key here is to
prevent your system users from getting a denial of computer
service that they need and deserve. Service could mean any-
thing from CPU time, response time, file space, or any other
commodity that a computer has to offer.
7) Crackers/Hackers/Evil twin brothers. Not much is
needed on this subject, save to say that they are often not
the main problem. Professional evil-users are a rarity;
often harmful acts are done by users who "just wanted to see
what would happen" or had no idea of the ramifications of
their acts. Someone who is truly experienced is very diffi-
cult to stop, and is certainly outside the realm of any
software security tool as discussed in this paper. For-
tunately, most evil-doers are fairly inexperienced and
ignorant, and when they make a mistake, a watchful adminis-
trator can deal with a problem before it gets out of hand.
Sometimes they can even reveal security problems that were
previously undiscovered. COPS can help here mostly by
reducing an attacker's options; the less holes to exploit,
the better.
The COPS system attempts to help protect as many of the
above items as possible for a generic UNIX system. In the
proper UNIX spirit, instead of having a large program that
attempts to solve every possible problem, it is composed of
several small programs that each check one or more potential
February 19, 1991
- 6 -
UNIX security holes. The COPS system uses a variety of
these problems to see if there are any cracks in a given
UNIX security wall. These methods correspond to some of the
problems discussed above; specifically to administrators,
system programmers, and computer operators; authentication;
ignorance; unauthorized permissions or privileges; and
finally crackers/hackers/evil twin brothers (numbers 1,3,5,
and 6.) It is very difficult, almost a practical impossi-
bility to give software assistance to problems in physical
security, and finally bugs or features that are present in a
given UNIX system are possible to detect, but are not
covered in this system (yet). The design of most of the the
programs were at least described if not outlined from the
following sources:
Aho, Kernighan, and Weinberger 88
Baldwin 87
Fiedler and Hunter 86
Grampp and Morris 84
Wood and Kochran 86
Of course with all of the problems listed below, look-
ing at the actual source code of the program is very
instructive -- each numbered section lists the corresponding
program that is used to perform the check:
1) COPS Checks "vital" system directories to see if
they are world-writable. Directories listed as critical are
in a configuration file and are initially:
/ /etc /usr
/bin /Mail /usr/spool
/usr/adm /usr/etc /usr/lib
/usr/bin /usr/etc /usr/spool/mail
/usr/spool/uucp /usr/spool/at
The method COPS uses to detect problems -- read through
a configuration file (dir.chklst) containing all of the
potential danger spots, and then simply comparing each
directory modes with a bit mask to see if it is world writ-
able. The program that performs this task is dir.chk
2) Check "vital" system files to see if they are
world-writable. Files listed as critical are in a confi-
guration file (file.chklst) and are initially:
February 19, 1991
- 7 -
/.*
/etc/*
/bin/*
/usr/etc/yp*
/usr/lib/crontab /usr/lib/aliases /usr/lib/sendmail
The wildcards are used like in UNIX, so these would include
(some of the more important files):
/.login /.profile /.cshrc /.crontab /.rhost
/etc/passwd /etc/group /etc/inittab /etc/rc
/etc/rc.local /etc/rc.boot /etc/hosts.equiv /etc/profile
/etc/syslog.conf /etc/export
As well as the executable command files (among others):
sh,csh, and ls.
Method -- again read through a configuration file list-
ing all of the files to be checked, comparing each in turn
with a write mask. The program that performs this task is
file.chk
3) Check "vital" system files to see if they are
world-readable, plus check for a NFS file system with no
restriction. These critical files are:
/dev/kmem /dev/mem
All file systems found in /etc/fstab
Plus a small number of user selectable files -- initially
set to include /.netrc, /usr/adm/sulog, and /etc/btmp.
Method -- checking each in turn against a read mask for
their read status. The file system names are read from
/etc/fstab, the selectable files are kept in a variable.
The program that performs this task is dev.chk
4) Check all files in system for SUID status, notify-
ing the COPS user of any changes in SUID status.
Method -- Use the "find" command on the root directory (this
must be done by root to avoid missing any files unreadable
but still dangerous.) The previous run will create a file
February 19, 1991
- 8 -
that can be checked against the current run to keep track of
changes in SUID status and any new SUID files. The program
that performs this task is suid.chk and was written by Pren-
tiss Riddle.
5) Check the /etc/passwd file (and the yellow pages
password database, if applicable) for null passwords,
improper # of fields, non-unique user-id's, non-numeric
group id's, blank lines, and non-alphanumeric user-id's.
Method -- Read through password file, flag any differences
with normal password file, as documented in "man 5 passwd".
Fortunately, the syntax of the password file is relatively
simple and rigid. The program that performs this task is
passwd.chk
6) Check the /etc/group file (and the yellow pages
database, if applicable) for groups with passwords, improper
# of fields, duplicate users in groups, blank lines, and
non-unique group-id's.
Method -- Read through group file, flag any differences with
normal group file as documented in "man 5 group". Again,
the syntax of this file is fairly simple. The program that
performs this task is group.chk
7) Check passwords of users on system.
Method -- using the stock "crypt" command, compare the
encrypted password found in the /etc/passwd file against the
following (encrypted) guesses:
The login id (uid), information in the gecos field, and all
single letter passwords.
The program that performs this task is pass.chk and was
written by Craig Leres and was modified by Seth Alford,
Roger Southwick, Steve Dum, and Rick Lindsley.
8) Check the root path, umask, and if root is in
/etc/ftpuser.
Method -- look inside the /.profile and /.cshrc files to
ensure that all of the directories listed are not world
writable, that "." isn't anywhere in the path, and that the
umask is not set to create world writable files. The pro-
gram that performs this task is root.chk
9) Examine the commands in /etc/rc* to ensure that
none of the files or paths used are world-writable.
Method -- grep through the files and examine any strings
that start with "/" for writability. The program that
February 19, 1991
- 9 -
performs this task is rc.chk
10) Examine the commands in /usr/lib/crontab to ensure
that none of the files or paths used are world-writable.
Method -- grep through the crontab file and examine any
strings after field five (first five are not files, but how
crontab is to be run) that start with "/" for writability.
The program that performs this task is cron.chk 11) Check
all of the user home directories to ensure they are not
world writable.
Method -- get all of the home directories using the system
call getpwent() and then for every home directory found,
check the write permissions of of the home directory against
a bit mask. The program that performs this task is home.chk
and it was written by John Owens.
12) Check important user files in user's home direc-
tories to ensure they are not world writable. The files
checked (all in the individual users' home directory, all
with the prefix "."):
rhost profile login cshrc kshrc tcshr crhost
netrc forward dbxinit distfile exrc emacsrc
Method -- using the same system call as #10, determine user
home directory. Then simply check all of the above files
against a bit mask. The program that performs this task is
user.chk
13) Given a goal to compromise, such as user root, and
a list of user and group id's that can be used in an attempt
to achieve the goal, this security tool will search through
the system until it verifies that the goal is compromisible
or not. The program that performs this tricky task is part
of the U-Kuang (rhymes with "twang") system. Robert Baldwin
was kind enough to allow me to include this security checker
(a fine security machine in it's own right) within this dis-
tribution. For more information on this fascinating secu-
rity checker, see kuang.man.ms and [Baldwin 87]. I have
rewritten it in Bourne shell (it was in C-Shell) for further
portability.
None of programs listed above certain cover all of the
possible areas that can harm a system, but if run together
they can aid an overworked administrator to locate some of
the potential trouble spots. The COPS system is not meant
to be a panacea against all UNIX security woes, but an
administrator who examines the security toolbox programs and
this research paper might reduce the danger of their UNIX
system being compromised -- and that's all any security tool
can ever hope to do. The COPS system could never replace a
February 19, 1991
- 10 -
vigilant administration staffed with knowledgeable people,
but hopefully, as administrators look into the package, more
comprehensive programs will come into being, covering more
of the problems that will continue as the latest versions of
UNIX continue to grow.
Design Notes:
The programs that are described here were designed to
address the problems discussed above, but still be usable on
as many UNIX "flavors" as possible. Speed was sacrificed
for simplicity/portability; hopefully the tools here will
either be replaced or modified, as by no means are they the
final word or solution to _any_ of these problems; indeed,
it is my hope that after other programmers/administrators
see this report, they will create newer, better, and more
general tools that can be re-distributed periodically. None
of the programs need to be run by root to be effective, with
the exception of the SUID checker (to ensure that all files
are checked.) Some of the tools were written by myself, the
others were written by other programmers on the network and
(with their permission) presented here. All of the programs
in this report are in the public domain, with the exception
of Robert Baldwin's U-Kuang system; they all exist solely to
be used and modified to fit your needs. If they are re-
distributed, please keep them in their original form unless
it is clearly stated that they were modified. Any improve-
ments (that might not be too hard :-), suggestions, or other
security programs that you would like to see get further
distribution can be sent to:
df@medusa.cs.purdue.edu
(That's me)
or
spaf@uther.cs.purdue.edu
(Dr. Eugene Spafford)
Note that the COPS system is still in an infancy stage
-- although it has been tested on a variety of computers at
Purdue, it has not undergone any serious trials.
Enhancements I envision include:
i) Improved speed and portability without sacrificing func-
tionality (pretty obvious, I guess....)
ii) A level of severity assigned to each warning; anything
that could compromise root instantly (root having no pass-
word, for example) might have a level 0 priority, while sim-
ply having a user with a writable home directory might only
February 19, 1991
- 11 -
be level 3. This way the system could be run at a certain
threshold level, or simply have the set of warnings priori-
tized for a less sophisticated administrator.
iii) Better handling of SUID programs. The current program
needs more work to be done on it to be run effectively by
most people; many will not be willing to put the time needed
to go through the list of SUID files by hand to decide if
they are needed or not. Perhaps also an alarm would sound
if a shell script is SUID; doubly so if root owned.
iv) A CRC checker that would check a file system (possibly
just the most important programs (such as this :-)) and
report if any of the executable files were changed -- possi-
bly signalling a viral infection.
v) The eradication of any design flaws or coding errors that
are in the COPS system.
The main purpose of creating the COPS system was two-
fold; the first was to foster an understanding of the secu-
rity problems common to most UNIX systems, and the second
was to try to create and apply software tools that, when
run, will inform system administrators of potential problems
present in their system. No attempt is made by the tools to
correct any problems because a potential security problem at
one site may be standard policy/practice at another. An
emphasis on furthering education and knowledge about UNIX in
general is the key to good security practices, not following
blindly what an unintelligent tool might say.
Some of the advantages to using a system such as COPS
are:
i) Nearly Continuous monitoring of traditional problem
areas.
ii) A new system can be checked before being put into pro-
duction.
iii) New or inexperienced administrators can not only stop
some of their problems in security they may have, but can
also raise their consciousness about the potential for secu-
rity dilemmas.
And a couple of disadvantages:
i) An administrator could get a false sense of security from
running these programs. Caveat emptor (ok, they are free,
but still beware.)
ii) A specific path to the elimination of the problem is not
presented. This could also be construed as an advantage,
when considering the third point.
Windows XP Professional supports two types of disk storage: basic and dynamic. Basic disk storage uses partition-oriented disks. A basic disk contains basic volumes (primary partitions, extended partitions, and logical drives).
Dynamic disk storage uses volume-oriented disks, and includes features that basic disks do not, such as the ability to create volumes that span multiple disks (spanned and striped volumes).
General Notes
Before you change a basic disk to a dynamic disk, note these items:
You must have at least 1 megabyte (MB) of free space on any master boot record (MBR) disk that you want to convert. This space is automatically reserved when the partition or volume is created in Microsoft Windows 2000 or Windows XP Professional. However, it may not be available on partitions or volumes that are created in other operating systems.
When you convert to a dynamic disk, the existing partitions or logical drives on the basic disk are converted to simple volumes on the dynamic disk.
After you convert to a dynamic disk, the dynamic volumes cannot be changed back to partitions. You must first delete all dynamic volumes on the disk, and then convert the dynamic disk back to a basic disk. If you want to keep your data, you must first back up or move the data to another volume.
After you convert to a dynamic disk, local access to the dynamic disk is limited to Windows XP Professional and Windows 2000.
If your disk contains multiple installations of Windows XP Professional or Windows 2000, do not convert to a dynamic disk. The conversion operation removes partition entries for all partitions on the disk with the exception of the system and boot volumes for the current operating system.
Dynamic disks are not supported on portable computers or Microsoft Windows XP Home Edition.
Before you change a dynamic disk back to a basic disk, note that all existing volumes must be deleted from the disk before you can convert it back to a basic disk. If you want to keep your data, back up the data, or move your data to another volume.
How to Convert a Basic Disk to a Dynamic Disk
To convert a basic disk to a dynamic disk:
1) Log on as Administrator or as a member of the Administrators group.
2) Click Start, and then click Control Panel.
3) Click Performance and Maintenance, click Administrative Tools, and then double-click Computer Management.
4) In the left pane, click Disk Management.
5) In the lower-right pane, right-click the basic disk that you want to convert, and then click Convert to Dynamic Disk.
NOTE:You must right-click the gray area that contains the disk title on the left side of the Details pane. For example, right-click Disk 0.
6) Select the check box that is next to the disk that you want to convert (if it is not already selected), and then clickOK.
7) Click Details if you want to view the list of volumes in the disk.
8) Click Convert.
9) Click Yes when you are prompted to convert, and then click OK.
How to Convert a Dynamic Disk to a Basic Disk
To change a dynamic disk back to a basic disk:
1) Back up all the data on all the volumes on the disk you want to convert to a basic disk.
2) Log on as Administrator or as a member of the Administrators group.
3) Click Start, and then click Control Panel.
4) Click Performance and Maintenance, click Administrative Tools, and then double-click Computer Management.
5) In the left pane, click Disk Management.
6) Right-click a volume on the dynamic disk that you want to change to a basic disk, and then click Delete Volume.
7) Click Yes when you are prompted to delete the volume.
8) Repeat steps 4 and 5 for each volume on the dynamic disk.
9) After you have deleted all the volumes on the dynamic disk, right-click the dynamic disk that you want to change to a basic disk, and then click Convert to Basic Disk.
NOTE:You must right-click the gray area that contains the disk title on the left side of the Details pane. For example, right-click Disk 1.
copy what's in the code area to notepad and save as cmd here.reg
CODE
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\Drive\shell\cmd]
@="Command Prompt"
[HKEY_CLASSES_ROOT\Drive\shell\cmd\command]
@="cmd.exe /k \"cd %L\""
[HKEY_CLASSES_ROOT\Directory\shell\cmd]
@="Command Prompt"
[HKEY_CLASSES_ROOT\Directory\shell\cmd\command]
@="cmd.exe /k \"cd %L\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\cmd]
@="Command Prompt"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\cmd\command]
@="cmd.exe /k \"cd %L\""
Cant See Secure Sites?
dJeron
0
comments
Fix the problem with seeing them secrue sites (banks or online stores) i found this very usefull to me at my work (isp backbone support lol, at the time i was regular support )
Any way... what u need to do is make a new notepad file and write in it the followng DLL's.. just copy-paste these
regsvr32 SOFTPUB.DLL
regsvr32 WINTRUST.DLL
regsvr32 INITPKI.DLL
regsvr32 dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 Cryptdlg.dll
and save it as > all file types, and make it something like securefix.bat.
then just run the file and ur problem shuld be gone.
How to Close a network
dJeron
0
comments
Back in early February, newspapers across the country reported that
computer hackers were interfering with emergency calls over the 911
communications network. The reports said the hackers had penetrated the
system using information from a secret computer document.
The scare grew out of an indictment by a grand jury in Lockport,
Illinois. On February 7, Craig Neidorf and Robert Riggs were indicted on
seven counts of wire fraud, violation of the Computer Fraud and Abuse Act
of 1986, and interstate transportation of stolen goods.
Prosecutors alleged that Neidorf and Riggs had conspired to steal,
using fraudulent methods, a confidential and proprietary document from the
Bell South telephone company. This document, it was claimed, could allow
computer hackers to disrupt the 911 emergency network.
The arrest of Neidorf and Riggs was only the beginning. The Secret
Service, which has authority over crimes involving government computers,
had embarked on a vast, nationwide investigation of hacker activity:
Operation Sun Devil.
Imagine the night face of North America, shining not with cities but
with lines of light showing the transmission of data. Brightest are New
York City, the financial capital, and California, the technological
capital, with Washington, D.C., a close third. The lines that crisscross
the country are telephone wires and cables, microwave transmissions, and
packet-switching networks designed for computer communication. Here and
there, beams dart into space to reflect off satellites and back to earth.
The computer networks in this country are huge. The largest are
entities like UseNet and InterNet, which link every academic computing
center of any size and are accessible to every scientist, university
student, and faculty member in the nation. The networks also include
government-operated systems, such as MilNet, which links military computers
that do not carry confidential information. And there are the commercial
services, such as Dow Jones News/Retrieval, SportsNet, CompuServe, GEnie,
and Prodigy. CompuServe is the largest of these, with half a million
subscribers.
In addition to these massive entities are thousands of tiny bulletin
board services, or BBSes. Anyone with a computer and a modem can start a
BBS; others can then call it up and use it. BBSes offer, in miniature,
essentially the same services that the commercial nets offer: the ability
to chat with others by posting messages to an electronic bulletin board and
the ability to upload and download software and text files. There are more
than 5,000 BBSes in the United States, most of them operated for fun. Few
charge their users. In my local calling area alone, I know of BBSes for
writers, gamers, Macintosh enthusiasts, gays, and the disabled -- and I'm
sure there are others.
The vast majority of BBSes deal with unexceptional topics. But some
boards deal with questions of computer security. These attract hackers.
Naturally, hackers discuss their hobby: breaking into computers.
Usually, however, bulletin board discussions are general in nature.
Hackers are not stupid, and they know that posting credit card numbers or
the like is evidence of criminal activity. By and large, BBS discussions
rarely, if ever, contain information that would be illegal if published in
print form. It's not illegal, after all, to tell your readers how to
commit illegal acts. If it were, books like _The_Anarchist's_Cookbook_ and
_Scarne_on_Cards_ (and half the murder mysteries in print) would be banned.
The laws dealing with electronic transmissions, however, are far
from clear. And the methods used to enforce these vague laws set a
dangerous precedent for abridging freedom of speech.
In the future, the Net -- the combination of all the computer
networks -- will be the primary means of information transmission, with
print publication merely its adjunct. The Net will replace the press, and
users of the Net must enjoy precisely the freedoms enjoyed by the press.
If users of the Net have to worry about police surveillance, if censorship
is rife, if the state forbids mere discussion of certain topics -- then the
liberty for which the Founders fought will have been destroyed, not by war
or tyranny, but by mere technological change.
From the government's point of view, the arrest of Neidorf and Riggs
did not end the threat to the 911 network. The document they had stolen
was not a single piece of paper that could be returned to its rightful
owner. It was an electronic document that Riggs had downloaded from a Bell
South computer.
Riggs belonged to a hacker group called the Legion of Doom, whose
members shared information. It was likely that others in the group had
copies of the 911 document. Worse, Riggs had uploaded the 911 document to
a bulletin board service in Lockport, Illinois. Neidorf had downloaded the
file from the Lockport BBS. Anyone else who used the same BBS could have
downloaded it, too, meaning that dozens of people might have this dangerous
information. Worse yet, Neidorf had published an edited version of the
Bell South document in an issue of his underground computer magazine,
_Phrack_.
Unlike conventional magazines, _Phrack_ never saw a printing press;
it was distributed electronically. After preparing an issue, Neidorf would
dispatch it, via various computer networks, to his address list of 1,300
names. Any recipient could then upload the magazine to a bulletin board or
to one of the academic or commercial nets. That meant thousands, perhaps
millions, of people had access to the information in the Bell South
document.
We may imagine that the Secret Service was gravely concerned about
the potential threat to emergency services. If not, then their subsequent
actions are hard to fathom.
On March 1, 1990, employees of Steve Jackson Games, a small game
company in Austin, Texas, arrived at their place of business to find that
they were barred from the premises. The Secret Service had a warrant, and
the agents conducting the search wouldn't let anyone in until they were
done.
The agents ransacked the company's offices, broke a few locks, and
damaged some filing cabinets. They searched the warehouse so thoroughly,
says company founder Steve Jackson, that afterward it "looked like a
snowstorm," with papers strewn randomly. The agents confiscated three
computers, a laser printer, several pieces of electronic equipment
(including some broken equipment from a storeroom), several hard drives,
and many floppy disks. They told Jackson they were seizing the equipment
"as evidence" in connection with a national investigation.
Among the equipment seized was the computer through which S.J. Games
ran a BBS to communicate with customers and freelancers. It had never been
a congregating point for hackers and was about as much a threat to the
public order as a Nintendo game.
The loss of the equipment was bad enough. Worse, the Secret Service
seized all existing copies -- on hard drives, floppy disks, and paper -- of
S.J. Games' next product, a game supplement called GURPS Cyberpunk. The
loss of that data shot Jackson's publication schedule to hell. Like many
small publishers, S.J. Games runs on tight cash flow. No new products, no
income. No income, no way to pay the bills.
Over the next several weeks, Jackson was forced to lay off about
half of his 17 employees. By dint of hard work, he and his staff managed
to reproduce the data they'd lost, mostly from memory. S.J. Games finally
published GURPS Cyberpunk as "The Book Seized by the Secret Service." It
has sold well by the (low) standards of the field.
Jackson estimates the raid has cost him more than $125,000, a sum a
small company like his can ill afford. (The company's annual revenue is
less than $2 million.) He was nearly put out of business by the Secret
Service.
What justified the raid and the seizures? Apparently, this: The
managing editor of Steve Jackson Games is Loyd Blankenship. Blankenship
ran The Phoenix Project, a BBS of his own in the Austin area. Blankenship
consorted with hackers. He was fascinated by the computer underground and
planned to write a book about it. He may or may not have once been a
hacker himself. He certainly knew and corresponded electronically with
admitted members of the Legion of Doom.
But perhaps Blankenship's worst luck was this: An issue of
Neidorf's _Phrack_ magazine included an article titled "The Phoenix
Project." As it happens, that article had nothing to do with Blankenship's
BBS of the same name. But the Secret Service was well aware of the
contents of _Phrack_. Indeed, the revised indictment of Neidorf and Riggs,
issued in July, cited the article by title. The same morning that the
Secret Service raided Steve Jackson Games, agents awakened Blankenship and
held him at gunpoint as they searched his house. They seized his computer
and laser printer as "evidence."
Consider the chain of logic here. Robert Riggs is accused of a
crime. Riggs belongs to a group. Loyd Blankenship is friends with other
members of the group, though not with Riggs himself. Steve Jackson Games
employs Blankenship. Therefore, the Secret Service does grievous financial
injury to Steve Jackson Games. This is guilt by association taken to an
extreme.
Neither Blankenship, nor Steve Jackson Games, nor any company
employee, has ever been charged with so much as spitting in a public place.
The Secret Service refuses to comment, saying only that S.J. Games was not
a target of the investigation.
The company is now receiving legal help from the Electronic Frontier
Foundation, an organization devoted to promoting civil liberties in
electronic media. The Secret Service has returned most -- but not all --
of the company's seized equipment. Some of it is broken and irreparable.
The government has made no offer of restitution or replacement.
On May 8, 1990, the Secret Service executed 28 or more search
warrants in at least 14 cities across the country. The raids involved more
than 150 agents, plus state and local law enforcement personnel.
According to a press release from the U.S. Attorney's office in
Phoenix, the operation targeted "computer hackers who were alleged to have
trafficked in and abused stolen credit card numbers [and] unauthorized
long-distance dialing codes, and who conduct unauthorized access and damage
to computers." The agency claimed the losses might amount to millions of
dollars. In later releases and news reports, that figure was inflated to
tens of millions of dollars.
Nationwide, the government seized at least 40 computers and 23,000
disks of computer information. In most cases, the subjects of these
searches have remained anonymous. Presumably, they have either been
advised by counsel to remain silent or have been so intimidated that they
wish to attract no further attention.
John Perry Barlow reports in _Whole_Earth_Review_ that the Secret
Service held families at gunpoint while agents charged into the bedrooms of
teenage hacker suspects. He adds that some equipment seizures deprived
self-employed mothers of their means of support. These reports remain
unconfirmed. It's clear, however, that the Secret Service closed down a
number of BBSes by the simple expedient of seizing "as evidence" the
computers on which those BBSes operated.
Bulletin board services are venues for speech. They are used mainly
to exchange information and ideas. Nothing in the nature of the technology
prevents the exchange of illegal ideas. But in a free society, the
presumption must be that, in absence of proof to the contrary, the use of a
medium is legitimate. The Secret Service has not indicted, let alone
convicted, the operators of any of the BBSes closed down on May 8.
If law enforcement officials suspect that a magazine, newspaper, or
book publisher may be transmitting illegal information, they get a warrant
to search its files and perhaps a restraining order to prevent publication.
They don't, however, seize its printing presses to prevent it from
operating. A clearer violation of freedom of the press could hardly be
imagined. Yet that is precisely what the Secret Service has done to these
BBSes.
One of the BBSes closed down was the JolNet BBS in Lockport,
Illinois, which Neidorf and Riggs had used to exchange the 911 document.
Ironically, JolNet's owner, Richard Andrews, had triggered the
investigation by noticing the document, deciding it was suspicious, and
notifying the authorities. He had cooperated fully with the investigators,
and they rewarded him by seizing his equipment.
The Ripco BBS in Chicago was among those raided by the Secret
Service. Operated by Bruce Esquibel under the handle of "Dr. Ripco," it
was a freewheeling, wide-ranging board, one of the best known BBSes in the
Chicago area. Speech was extraordinarily free on the Ripco board.
"I felt that any specific information that could lead to direct
fraud was not welcome and would be removed, and persons who repeated
violating this themselves would be removed from the system also," Esquibel
writes. But just about anything else was open for discussion. Hackers did
indeed discuss ways of breaking into computers. And the Ripco board
contained extensive text files, available for downloading, on a variety of
subjects to which some might take exception. For instance, there was a
series of articles on bomb construction -- material publicly available from
books such as _The_Anarchist's_Cookbook_.
Along with the computer on which Ripco operated, the Secret Service
seized two other computers, a laser printer, and a 940-megabyte WORM drive,
an expensive piece of equipment. The additional seizures mystify Esquibel.
"My guess is that after examining the rat's nest of wires around the three
computers, they figured anything plugged into the power strip must have
been tied in with [the rest] in some way," he says.
The Secret Service has yet to return any of Esquibel's equipment.
He has yet to be charged with any crime, other than failure to register a
firearm. (He had three unlicensed guns at his office; he informed the
Secret Service agents of this before they began their search.) Says
Esquibel, "The government came in, took my personal property to determine
if there was any wrongdoing somewhere. It seems like a case of being
guilty until proven innocent...It's just not right...I am not a hacker; [I
don't] have anything to do with credit cards or manufactured explosives.
Until the weapons charge I never had been arrested, and even my driving
record has been clean since 1978."
It appears that the Secret Service has already achieved its goal.
The Ripco board was a place where "dangerous" speech took place, and the
agency closed it down. Why bother charging Esquibel with a crime?
Especially since he might be acquitted.
Secret Service agents searched the home of Len Rose, a computer
consultant from Baltimore, on May 8. The agents not only seized his
computers but confiscated every piece of electronic equipment in the house,
including his fax machine, along with some family pictures, several boxes
of technical books, and a box containing his U.S. Army medals.
On May 15, Rose was indicted on four counts of wire fraud, aiding
and abetting wire fraud, and interstate transportation of stolen goods.
Among other things, the indictment alleged that Rose is a member of the
Legion of Doom, a claim both he and admitted Doomsters vociferously deny.
The interstate-transportation charge is based on the fact that Rose
was in possession of source code for Unix, an operating system used by a
wide variety of minicomputers and computer workstations. (Source code is
the original text of a program.) In theory, Unix is the property of AT&T,
which developed the system. AT&T maintains that Unix is protected as a
confidential, unpublished work. In fact, AT&T has sold thousands of copies
across the country, and every systems programmer who works with Unix is
likely to have some of the source code lying around.
The wire-fraud counts are based on the fact that Rose sent a copy of
a "Trojan horse" program by electronic mail. Trojan horse programs are
sometimes used by hackers to break into computers; they are also sometimes
used by systems managers to monitor hackers who try to break in. In other
words, a Trojan horse program is like a crowbar: You can use it to break
into someone's house, or you can use it to help renovate your own house.
It has both legitimate and illegitimate uses.
Rose is a computer consultant and has dealt with security issues
from time to time. He maintains that his Trojan horse program was used
solely for legitimate purposes -- and, in any case, would no longer work,
because of changes AT&T has made to Unix since Rose wrote the program.
Rose is not charged with actually attempting to break into computers,
merely with possessing a tool that someone could use to break in. In
essence, the Secret Service found Len Rose in possession of a crowbar and
is accusing him of burglary.
By seizing Rose's equipment, the Secret Service has effectively
denied him his livelihood. Without his equipment, he cannot work. Rose
says he has lost his home, his credit rating and credit cards, his
business, and some of his friends. He can no longer afford to retain his
original attorney and is now represented by a public defender.
Rose's difficulties are compounded by a theft conviction arising
from a dispute with a former client regarding the ownership of computer
equipment. Nevertheless, it seems brutal for the Secret Service to deny
him the means to support his family and to pay for an effective defense.
Investigators must long ago have gleaned whatever evidence his equipment
may have contained.
Ultimately, the case against Neidorf and Riggs fell apart. In June,
the grand jury issued a revised indictment. It dropped the charges of
violating the Computer Fraud and Abuse Act and added seven new counts of
wire fraud, some involving electronic mail between Neidorf and Riggs.
Neidorf was charges with two counts of wire fraud for uploading issues of
_Phrack_ to JolNet. In other words, mere distribution of his publication
was deemed to be "fraud" because _Phrack_ contained material the Secret
Service claimed had been obtained by fraudulent means. The new indictment
also reduced the "value" of the document Riggs allegedly stole from more
than $70,000 to $20,000.
On July 9, Riggs pleaded guilty in a separate indictment to one
count of conspiracy in breaking into Bell South's computer. Sentencing was
set for September 14 -- after Neidorf's trial was to begin. Riggs agreed
to be a witness for the prosecution of Neidorf.
On July 28, Neidorf's trial began in Chicago. Within four days, it
was over. The prosecution's case had collapsed.
Under cross-examination, a Bell South employee admitted that the
stolen document was far from confidential. Indeed, any member of the
public could purchase a copy by calling an 800 number, requesting the
document, and paying $13 -- far less than the $20,000 claimed value or the
$5,000 minimum required to support a charge of transporting stolen goods
across state lines.
Testimony also revealed that the contents of the document could not
possibly allow someone to enter and disrupt the 911 network. The document
merely defined a set of terms used in telecommunications and described the
procedures used by Bell personnel in setting up a 911 system.
Riggs, testifying for the prosecution, admitted that he had no
direct knowledge that Neidorf ever gained illegal access to anything; that
Neidorf was not himself a member of the Legion of Doom; and that Neidorf
had not been involved in the initial downloading of the document in any
way.
In short, Neidorf and Riggs had not conspired; therefore, Neidorf
should not have been charged with the fraud counts. The only value of
which Bell South was "deprived" by Riggs's downloading was $13; therefore,
he was, at worst, guilty of petty theft. The interstate-transportation
counts were moot, since the "stolen goods" in question were worth less than
the $5,000 minimum.
Not only was there no case against Neidorf -- there also was no case
against Riggs. The government dropped the case against Neidorf. Riggs,
however, had already pleaded guilty.
The computer nets do need policing. Computer crooks can steal and
have stolen millions of dollars. But a balance must be struck between
civil liberties and the legitimate needs of law enforcement. The laws as
currently constituted are inadequate from both perspectives, and the Secret
Service seems determined to interpret them with a callous disregard for
civil liberties.
To attack computer crime, prosecutors primarily use the statutes
dealing with wire fraud and interstate transportation of stolen goods, the
Computer Fraud and Abuse Act of 1986, and the Electronic Communication
Privacy Act of 1986. The wire fraud statute prohibits the use of the
telephone, wire services, radio, and television in the commission of fraud.
The courts have, logically, interpreted it to apply to electronic
communications as well.
The interstate transportation statute prohibits transportation of
stolen goods valued at $5,000 or more across state lines. Neidorf's lawyer
moved to dismiss those counts, claiming that nothing tangible is
transported when a document is uploaded or downloaded. The judge ruled
that tangibility was not a requirement and that electronic transmission
could constitute transportation. The Computer Fraud and Abuse Act
prohibits knowingly, and with intent to defraud, trafficking in information
that can be used to gain unauthorized access to a computer.
The Electronic Communications Privacy Act makes it a crime to
examine private communications transmitted electronically. Among other
things, it requires law enforcement agencies to obtain search warrants
before opening electronic mail. It is unclear whether electronic mail
files on a BBS's hard drive are covered by a warrant that permits seizure
of the hard drive, or whether separate warrants are needed for each
recipient's mail.
The reliance on fraud statutes to fight computer crime presents
problems. Fraud is the use of chicanery, tricks, or other forms of
deception in a scheme to deprive the victim of property. Most attempts by
hackers to gain illegal access to a computer do involve chicanery or
tricks, in some sense -- the use of other people's passwords, the use of
known bugs in systems software, and so on. Much of the time, however, a
hacker does not deprive anyone of property.
If the hacker merely signs on and looks around, he deprives the
computer operators of a few dollars of computer time at worst. If he
downloads a file, the owner still has access to the original file. If the
file's confidentiality has value in itself -- as with a trade secret --
downloading it does deprive the owner of something of value, but this is
rarely the case.
We need a "computer trespass" statute, with a sliding scale of
punishments corresponding to the severity of the violation. Just as
burglary is punished more severely than trespass, so a hacker who steals
and uses credit card numbers ought to be punished more severely than one
who does nothing more than break into a computer and examine a few public
files. In the absence of such a scheme, law enforcement personnel
naturally try to cram all computer violations into the category of fraud,
since the fraud statutes are the only laws that currently permit
prosecution of computer crimes. As a result, petty crimes are charged as
felonies -- as with Neidorf and Riggs.
Legitimate users and operators of computer networks need to be
protected from arbitrary seizures and guilt by electronic association. The
criminal code permits law enforcement personnel to seize equipment used in
a crime or that might provide criminal evidence, even when the owner has no
knowledge of the crime. But the purpose of such seizures is to allow the
authorities access to evidence of criminal activity, not to shut down
businesses. Searchers need not remove computer equipment to inspect the
files it contains. They can sit down and make copies of whatever files
they want on the spot. Even if they expect some piece of incriminating
material to be hidden particularly well -- for example, in a specially
protected file or in a ROM chip -- it is unreasonable to hold onto the
seized equipment indefinitely.
And it's clearly wrong to seize equipment that cannot, by any
stretch of the imagination, contain incriminating data. In both the Steve
Jackson and Ripco cases, the Secret Service seized laser printers along
with other equipment. Laser printers have no permanent memory (other than
the factory-supplied ROM chips that tell them how to operate). They print
words on paper, that's all. They cannot contain incriminating information.
Even computers themselves cannot possibly constitute evidence. When
you turn off a computer, its memory dies. Permanent data exist only on
storage media -- hard drives, floppy disks, tape drives, and the like.
Even if law enforcement personnel have some compelling reason to take
storage media away to complete a search, they have no reason to take the
computers that use those media.
Just as a computer is not evidence because it once carried
incriminating information, a network is not a criminal enterprise because
it once carried data used in or derived from fraudulent activity. Yet
under current law, it seems that the operator of a bulletin board is liable
if someone posts an illegal message on it. Say I run a BBS called Mojo.
You dial Mojo up and leave Mario Cuomo's MasterCard number on the board,
inviting anyone to use it. Six people sign on, read the message, and fly
to Rio courtesy of the governor before I notice the message and purge it.
Apparently, I'm liable -- even though I had nothing to do with obtaining
Cuomo's credit card number, never used it, and strenuously object to this
misuse of my board.
Such an interpretation threatens the very existence of the academic
and commercial nets. A user of UseNet, for instance, can send a message to
any other user of UseNet. The network routes messages in a complex fashion
-- from Computer A to Computer B to Computer C, and so on, depending on
what computers are currently live, the volume of data transmitted among
them, and the topography of the net itself. The message could pass through
dozens of computers before reaching its destination. If someone uses the
message to commit fraud, the system operators of every computer along its
path may be criminally liable, even though they would have no way of
knowing the contents of the message.
Computer networks and BBSes need the same kind of "common carrier"
protection that applies to the mails, telephone companies, and wire
services. Posting an illegal message ought to be illegal for the person
who posts it -- but not for the operator of the board on which the message
appears.
The main function of the Net is to promote communication. People
use it to buy goods, research topics, download software, and a myriad of
other things as well, but most of their computing time is spent
communicating: by posting messages to bulletin boards, by "chatting" in
real time, by sending electronic mail, by uploading and downloading files.
It makes no sense to say that discussion of a topic in print is OK, but
discussion of the same topic via an electronic network is a crime.
Yet as currently interpreted, the law says that mere transmission of
information that someone _could_ use to gain access to computers for
fraudulent purposes is itself fraud -- even if no fraudulent access takes
place. The Secret Service, for instance, was willing to indict Neidorf for
publishing information it thought could be used to disrupt the 911 network
-- even though neither Neidorf nor anyone else actually disrupted it. We
must clearly establish that electronic communications are speech, and enjoy
the same protections as other forms of speech.
The prospects for such legal reform are not bright. Three times in
this century, technological developments have created new venues for
speech: with radio, with television, and with cable. On the grounds of
scarcity, government restricts freedom of speech on radio and television;
on the grounds of natural monopoly, government regulates speech on cable.
Recent events, such as the conviction of former Cornell graduate student
Robert T. Morris for introducing a virus into the nationwide ARPANet, have
aroused worry about hacker crimes. But concern for the rights of
legitimate users of computer nets has not received that same level of
publicity. If anything, recent trends lean toward the adoption of more
draconian laws -- like the Computer Fraud and Abuse Act, which may make it
illegal even for computer security professionals to transmit information
about breaches of security.
The Net is vast -- and growing fast. It has already changed the
lives of thousands, from scientists who learn of new breakthroughs far more
quickly than if they had to wait for journal publication, to stay-at-home
writers who find in computer networks the personal contact they miss
without office jobs. But the technology is still in its infancy. The Net
has the capacity to improve all our lives.
A user of the Net can already find a wide variety of information,
from encyclopedia entries to restaurant reviews. Someday the Net will be
the first place citizens turn to when they need information. The morning
paper will be a printout, tailored to our interests and specifications, of
articles posted worldwide; job hunters will look first to the Net; millions
will use it to telecommute to work; and serious discussion will be given to
the abolition of representative government and the adoption of direct
democracy via network voting.
Today, we are farmers standing by our country lanes and marveling as
the first primitive automobiles backfire down the road. The shape of the
future is murky. We cannot know what the Net will bring, just as a farmer
seeing a car for the first time couldn't possibly have predicted six-lane
highways, urban sprawl, the sexual revolution, and photochemical smog.
Nonetheless, we can see that something remarkable is happening, something
that will change the world, something that has the potential to transform
our lives. To ensure that our lives are enriched and not diminished, we
must ensure that the Net is free.
As the size of hardrives increase, more people are using partitions to seperate and store groups of files.
XP uses the C:\Program Files directory as the default base directory into which new programs are installed. However, you can change the default installation drive and/ or directory by using a Registry hack.
Run the Registry Editor (regedit)and go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
Look for the value named ProgramFilesDir. by default,this value will be C:\Program Files. Edit the value to any valid drive or folder and XP will use that new location as the default installation directory for new programs.
So one of your friends, “not you of course”, has managed to nuke Internet Explorer and they are unsure how they did it. You’ve eliminated the possibility of viruses and adware, so this just leaves you and a broken IE. Before you begin to even consider running a repair install of the OS, let’s try to do a repair on IE instead.
THE REPAIR PROCESS
Start the Registry Editor by typing regedit from the Run box. Go to HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Active Setup \ Installed Components \ {89820200-ECBD-11cf-8B85-00AA005B4383} and then right-click the “IsInstalled value.” Click Modify. From there, you will change the value from 1 to 0. All right, go ahead and close the editor and reinstall IE from this location. /http://www.microsoft.com/windows/ie/default.mspx
IF SOMETHING GOES WRONG
If messing with the registry and something goes horribly wrong, you can use “Last Known Good Configuration (F8 Safe Mode)” or a Restore Point to get back to where you were before, with your settings. Then you can try again, this time taking care to watch the portion of the registry you are changing. Most people who have troubles with this end up changing the wrong registry key.
Hope this tut helps some members.
Cyberspace, the "digital world", is emerging as a global arena of
social, commercial and political relations. By "Cyberspace", I mean
the sum total of all electronic messaging and information systems,
including BBS's, commercial data services, research data networks,
electronic publishing, networks and network nodes, e-mail systems,
electronic data interchange systems, and electronic funds transfer
systems.
Many like to view life in the electronic networks as a "new frontier",
and in certain ways that remains true. Nonetheless, people remain
people, even behind the high tech shimmer. Not surprisingly, a vast
matrix of laws and regulations has trailed people right into
cyberspace.
Most of these laws are still under construction for the new electronic
environment. Nobody is quite sure of exactly how they actually apply
to electronic network situations.
Nonetheless, the major subjects of
legal concern can now be mapped out fairly well, which we will do in
this section of the article. In the second section, we will look at
some of the ways in which the old laws have trouble fitting together
in cyberspace, and suggest general directions for improvement.
LAWS ON PARADE
- Privacy laws. These include the federal Electronic Communications
Privacy Act ("ECPA"), originally enacted in response to Watergate, and
which now prohibits many electronic variations on wiretapping by both
government and private parties. There are also many other federal and
state privacy laws and, of course, Constitutional protections against
unreasonable search and seizure.
- 1st Amendment. The Constitutional rights to freedom of speech and
freedom of the press apply fully to electronic messaging operations of
all kinds.
- Criminal laws. There are two major kinds of criminal laws. First,
the "substantive" laws that define and outlaw certain activities.
These include computer-specific laws, like the Computer Fraud and
Abuse Act and Counterfeit Access Device Act on the federal level, and
many computer crime laws on the state level. Many criminal laws not
specific to "computer crime" can also apply in a network context,
including laws against stealing credit card codes, laws against
obscenity, wire fraud laws, RICO, drug laws, gambling laws, etc.
The other major set of legal rules, "procedural" rules, puts limits on
law enforcement activities. These are found both in statutes, and in
rulings of the Supreme Court and other high courts on the permissible
conduct of government agents. Such rules include the ECPA, which
prohibits wiretapping without a proper warrant; and federal and state
rules and laws spelling out warrant requirements, arrest requirements,
and evidence seizure and retention requirements.
- Copyrights. Much of the material found in on-line systems and in
networks is copyrightable, including text files, image files, audio
files, and software.
- Moral Rights. Closely related to copyrights, they include the
rights of paternity (choosing to have your name associated or not
associated with your "work") and integrity (the right not to have your
"work" altered or mutilated). These rights are brand new in U.S. law
(they originated in Europe), and their shape in electronic networks
will not be settled for quite a while.
- Trademarks. Anything used as a "brand name" in a network context
can be a trademark. This includes all BBS names, and names for
on-line services of all kinds. Materials other than names might also
be protected under trademark law as "trade dress": distinctive sign-on
screen displays for BBS's, the recurring visual motifs used throughout
videotext services, etc.
- Right of Publicity. Similar to trademarks, it gives people the
right to stop others from using their name to make money. Someone
with a famous on-line name or handle has a property right in that
name.
- Confidential Information. Information that is held in secrecy by
the owner, transferred only under non-disclosure agreements, and
preferably handled only in encrypted form, can be owned as a trade
secret or other confidential property. This type of legal protection
is used as a means of asserting ownership in confidential databases,
>from mailing lists to industrial research.
- Contracts. Contracts account for as much of the regulation of
network operations as all of the other laws put together.
The contract between an on-line service user and the service provider
is the basic source of rights between them. You can use contracts to
create new rights, and to alter or surrender your existing rights
under state and federal laws.
For example, if a bulletin board system operator "censors" a user by
removing a public posting, that user will have a hard time showing his
freedom of speech was violated. Private system operators are not
subject to the First Amendment (which is focused on government, not
private, action). However, the user may have rights to prevent
censorship under his direct contract with the BBS or system operators.
You can use contracts to create entire on-line legal regimes. For
example, banks use contracts to create private electronic funds
transfer networks, with sets of rules that apply only within those
networks. These rules specify on a global level which activities are
permitted and which are not, the terms of access to nearby systems and
(sometimes) to remote systems, and how to resolve problems between
network members.
Beyond the basic contract between system and user, there are many
other contracts made on-line. These include the services you find in
a CompuServe, GEnie or Prodigy, such as stock quote services, airline
reservation services, trademark search services, and on-line stores.
They also include user-to-user contracts formed through e-mail. In
fact, there is a billion-dollar "industry" referred to as "EDI" (for
Electronic Data Interchange), in which companies exchange purchase
orders for goods and services directly via computers and computer
networks.
- Peoples' Rights Not to be Injured. People have the right not to be
injured when they venture into cyberspace. These rights include the
right not to be libelled or defamed by others on-line, rights against
having your on-line materials stolen or damaged, rights against having
your computer damaged by intentionally harmful files that you have
downloaded (such as files containing computer "viruses"), and so on.
There is no question these rights exist and can be enforced against
other users who cause such injuries. Currently, it is uncertain
whether system operators who oversee the systems can also be held
responsible for such user injuries.
- Financial Laws. These include laws like Regulations E & Z of the
Federal Reserve Board, which are consumer protection laws that apply
to credit cards, cash cards, and all other forms of electronic
banking.
- Securities Laws. The federal and state securities laws apply to
various kinds of on-line investment related activities, such as
trading in securities and other investment vehicles, investment
advisory services, market information services and investment
management services.
- Education Laws. Some organizations are starting to offer on-line
degree programs. State education laws and regulations come into play
on all aspects of such services.
The list goes on, but we have to end it somewhere. As it stands, this
list should give the reader a good idea of just how regulated
cyberspace already is.
LAWS OR CONFUSION?
The legal picture in cyberspace is very confused, for several reasons.
First, the sheer number of laws in cyberspace, in itself, can create a
great deal of confusion. Second, there can be several different kinds
of laws relating to a single activity, with each law pointing to a
different result.
Third, conflicts can arise in networks between different laws on the
same subject. These include conflicts between federal and state laws,
as in the areas of criminal laws and the right to privacy; conflicts
between the laws of two or more states, which will inevitably arise
for networks whose user base crosses state lines; and even conflicts
between laws from the same governmental authority where two or more
different laws overlap. The last is very common, especially in laws
relating to networks and computer law.
Some examples of the interactions between conflicting laws are
considered below, from the viewpoint of an on-line system operator.
1. System operators Liability for "Criminal" Activities.
Many different activities can create criminal liabilities for service
providers, including:
- distributing viruses and other dangerous program code;
- publishing "obscene" materials;
- trafficking in stolen credit card numbers and other unauthorized
access data;
- trafficking in pirated software;
- and acting as an accomplice, accessory or conspirator in these and
other activities.
The acts comprising these different violations are separately defined
in statutes and court cases on both the state and federal levels.
For prosecutors and law enforcers, this is a vast array of options for
pursuing wrongdoers. For service providers, it's a roulette wheel of
risk.
Faced with such a huge diversity of criminal possibilities, few
service providers will carefully analyze the exact laws that may
apply, nor the latest case law developments for each type of criminal
activity. Who has the time? For system operators who just want to
"play it safe", there is a strong incentive to do something much
simpler: Figure out ways to restrict user conduct on their systems
that will minimize their risk under *any* criminal law.
The system operator that chooses this highly restrictive route may not
allow any e-mail, for fear that he might be liable for the activities
of some secret drug ring, kiddie porn ring or stolen credit card code
ring. The system operator may ban all sexually suggestive materials,
for fear that the extreme anti-obscenity laws of some user's home town
might apply to his system. The system operator may not permit
transfer of program files through his system, except for files he
personally checks out, for fear that he could be accused of assisting
in distributing viruses, trojans or pirated software; and so on.
In this way, the most restrictive criminal laws that might apply to a
given on-line service (which could emanate, for instance, from one
very conservative state within the system's service area) could end up
restricting the activities of system operators all over the nation, if
they happen to have a significant user base in that state. This
results in less freedom for everyone in the network environment.
2. Federal vs. State Rights of Privacy.
Few words have been spoken in the press about network privacy laws in
each of the fifty states (as opposed to federal laws). However, what
the privacy protection of the federal Electronic Communications
Privacy Act ("ECPA") does not give you, state laws may.
This was the theory of the recent Epson e-mail case. An ex-employee
claimed that Epson acted illegally in requiring her to monitor e-mail
conversations of other employees. She did not sue under the ECPA, but
under the California Penal Code section prohibiting employee
surveillance of employee conversations.
The trial judge denied her claim. In his view, the California law
only applied to interceptions of oral telephone discussions, and not
to visual communication on video display monitors. Essentially, he
held that the California law had not caught up to modern technology -
making this law apply to e-mail communications was a job for the state
legislature, not local judges.
Beyond acknowledging that the California law was archaic and not
applicable to e-mail, we should understand that the Epson case takes
place in a special legal context - the workplace. E-mail user rights
against workplace surveillance are undeniably important, but in our
legal and political system they always must be "balanced" (ie.,
weakened) against the right of the employer to run his shop his own
way. Employers' rights may end up weighing more heavily against
workers' rights for company e-mail systems than for voice telephone
conversations, at least for employers who use intra-company e-mail
systems as an essential backbone of their business. Fortunately, this
particular skewing factor does not apply to *public* communications
systems.
I believe that many more attempts to establish e-mail privacy under
state laws are possible, and will be made in the future. This is good
news for privacy advocates, a growing and increasingly vocal group
these days.
It is mixed news, however, for operators of BBS's and other on-line
services. Most on-line service providers operate on an interstate
basis - all it takes to gain this status is a few calls from other
states every now and then. If state privacy laws apply to on-line
systems, then every BBS operator will be subject to the privacy laws
of every state in which one or more of his users are located! This
can lead to confusion, and inability to set reasonable or predictable
system privacy standards.
It can also lead to the effect described above in the discussion of
criminal liability. On-line systems might be set up "defensively", to
cope with the most restrictive privacy laws that might apply to them.
This could result in declarations of *absolutely no privacy* on some
systems, and highly secure setups on others, depending on the
individual system operator's inclinations.
3. Pressure on Privacy Rights Created by Risks to Service Providers.
There are two main kinds of legal risks faced by a system operator.
First, the risk that the system operator himself will be found
criminally guilty or civilly liable for being involved in illegal
activities on his system, leading to fines, jail, money damages,
confiscation of system, criminal record, etc.
Second, the risk of having his system confiscated, not because he did
anything wrong, but because someone else did something suspicious on
his system. As discussed above, a lot of criminal activity can take
place on a system when the system operator isn't looking. In
addition, certain non-criminal activities on the system could lead to
system confiscation, such copyright or trade secret infringement.
This second kind of risk is very real. It is exactly what happened to
Steve Jackson Games last year. Law enforcement agents seized Steve's
computer (which ran a BBS), not because they thought he did anything
wrong, but because they were tracking an allegedly evil computer
hacker group called the "Legion of Doom". Apparently, they thought
the group "met" and conspired on his BBS. A year later, much of the
dust has cleared, and the Electronic Frontier Foundation is funding a
lawsuit against the federal agents who seized the system.
Unfortunately, even if he wins the case Steve can't get back the
business he lost. To this day, he still has not regained all of his
possessions that were seized by the authorities.
For now, system operators do not have a great deal of control over
government or legal interference with their systems. You can be a
solid citizen and report every crime you suspect may be happening
using your system. Yet the chance remains that tonight, the feds will
be knocking on *your* door looking for an "evil hacker group" hiding
in your BBS.
This Keystone Kops style of "law enforcement" can turn system
operators into surrogate law enforcement agents. System operators who
fear random system confiscation will be tempted to monitor private
activities on their systems, intruding on the privacy of their users.
Such intrusion can take different forms. Some system operators may
declare that there will be no private discussions, so they can review
and inspect everything. More hauntingly, system operators may indulge
in surreptitious sampling of private e-mail, just to make sure no
one's doing anything that will make the cops come in and haul away
their BBS computer systems (By the way, I personally don't advocate
either of these things).
This situation can be viewed as a way for law enforcement agents to do
an end run around the ECPA's bar on government interception of
electronic messages. What the agents can't intercept directly, they
might get through fearful system operators. Even if you don't go for
such conspiracy theories, the random risk of system confiscation puts
great pressure on the privacy rights of on-line system users.
4. Contracts Versus Other Rights.
Most, perhaps all, of the rights between system operators and system
users can be modified by the basic service contract between them. For
instance, the federal ECPA gives on-line service users certain privacy
rights. It conspicuously falls short, however, by not protecting
users from privacy intrusions by the system operator himself.
Through contract, the system operator and the user can in effect
override the ECPA exception, and agree that the system operator will
not read private e-mail. Some system operators may go the opposite
direction, and impose a contractual rule that users should not expect
any privacy in their e-mail.
Another example of the power of contracts in the on-line environment
occurred recently on the Well, a national system based in San
Francisco (and highly recommended to all those interested in
discussing on-line legal issues). A Well user complained that a
message he had posted in one Well conference area had been
cross-posted by other users to a different conference area without his
permission.
A lengthy, lively discussion among Well users followed, debating the
problem. One of the major benchmarks for this discussion was the
basic service agreement between the Well and its users. And a
proposed resolution of the issue was to clarify the wording of that
fundamental agreement. Although "copyrights" were discussed, the
agreement between the Well and its users was viewed as a more
important source of the legitimate rights and expectations of Well
users.
Your state and federal "rights" against other on-line players may not
be worth fighting over if you can get a contract giving you the rights
you want. In the long run, the contractual solution may be the best
way to set up a decent networked on-line system environment, except
for the old bogeyman of government intrusion (against whom we will all
still need our "rights", Constitutional and otherwise).
CONCLUSION
There are many different laws that system operators must heed in
running their on-line services. This can lead to restricting system
activities under the most oppressive legal standards, and to
unpredictable, system-wide interactions between the effects of the
different laws.
The "net" result of this problem can be undue restrictions on the
activities of system operators and users alike.
The answers to this problem are simple in concept, but not easy to
execute. First, enact (or re-enact) all laws regarding electronic
services on a national level only, overriding individual state control
of system operators activities in cyberspace. It's time to realize
that provincial state laws only hinder proper development of
interstate electronic systems.
As yet, there is little movement in enacting nationally effective
laws. Isolated instances include the Electronic Communications
Privacy Act and the Computer Fraud and Abuse Act, which place federal
"floors" beneath privacy protection and certain types of computer
crime, respectively. On the commercial side, the new Article 4A of
the Uniform Commercial Code, which normalizes on-line commercial
transactions, is ready for adoption by the fifty states.
Second, all laws regulating on-line systems must be carefully designed
to interact well with other such laws. The goal is to create a
well-defined, reasonable legal environment for system operators and
users.
The EFF is fighting hard on this front, especially in the areas of
freedom of the press, rights of privacy, and rights against search and
seizure for on-line systems. Reducing government intrusion in these
areas will help free up cyberspace for bigger and better things.
However, the fight is just beginning today.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Lance Rose is an attorney who works primarily in the fields of
computer and high technology law and intellectual property. His
clients include on-line publishers, electronic funds transfer
networks, data transmission services, individual system operators, and
shareware authors and vendors. He is currently revising SYSLAW, The
Sysop's Legal Manual. Lance is a partner in the New York City firm of
Greenspoon, Srager, Gaynin, Daichman & Marino, and can be reached by
voice at (212)888-6880, on the Well as "elrose", and on CompuServe at
72230,2044.
Copyright 1991 Lance Rose
The above article was originally published in Boardwatch, June, 1991
