From kadie Tue Apr 30 11:52:56 1991 To: cafb-mail Subject: Computers and Academic Freedom mailing list (batch edition) Status: R Computers and Academic Freedom mailing list (batch edition) Tue Apr 30 11:52:45 EDT 1991 In this issue: louisgSubject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Date: Mon, 29 Apr 91 2:33:50 CDT From: louisg X-Mailer: ELM [version 2.3 PL4] Hooray! One for us users!!! Now if others would follow the lead..... Louis -- --------------------------------------------------------------------------- ! "As above, so below; as below, so above" -- The Kybalion ! ! "I don't trust him; he has dark hair" -- My girlfriend's mother ! ! "So I'm stupid; what's your point?" -- Me ! +-------------------------------------------------------------------------+ ! Louis J. Giliberto, Jr. ! The above is NOT to be reproduced in part ! ! louisg@vpnet.chi.il.us ! or in whole without PRIOR consent of me ! ! ! (except to flame me in USENET or E-Mail). ! --------------------------------------------------------------------------- ------------------- Message-Id: Subject: Re: exploring new ways of thinking Date: Mon, 29 Apr 91 2:32:11 CDT From: louisg X-Mailer: ELM [version 2.3 PL4] Kevin Smith writes: [part of message deleted] > resources without the consent of those other people. The specific case that > your response came from was a news administrator who returned articles that > were improperly posted to news groups -- each of which is a distinct forum > with a well defined and readily available charter. (the other case, examining > file names seems a breach of privacy but nothing to do with academic freedom). Yes, but the administrator determined that the articles were improper based on *his* understanding of the charter. He did not consult the people involved in the newsgroup. If it were his newsgroup and he were moderator, then it is not only his right to monitor, but his responsibility. These messages did not even make it out the door! As for the charter, how can one person determine what is appropriate for 800+ newsgroups? If I were to post a message to rec.guitar. classical about Yngwie Malmsteen and Marshall amps, how would someone that has no knowledge about classically influenced heavy metal know that it *is* an appropriate topic? Hmm...electric guitars....doesn't seem to have anything to do with classical music...I'll chop it. The fact of the matter is that the sysadmin at any site should not be allowed to reject news postings unless there is a damn good reason for it (such as 1001 complaints every day of the week about one user on his system). I don't see how in any way he should be able to single-handedly determine the appropriateness of *any* posting, nor do I think it is his responsibility. If a user on his system is causing wide-spread problems for the Net, then maybe he should do something, but that was not the case here. > > Upshot of my perspective: You are free to think however you want (even as a > lowly student !-). However, if you want to participate in usage of shared > resources, it is completely your responsibility to learn how to effectively > use those resources. You can not write off irresponsibility under the heading > of academic freedom. > Thank you! "it is completely *YOUR* responsibility" !!!!!! Not the sysadmins!Why is he even involved unless, like I said, there is a continual problem from one user? And to paraphrase you, you can not write off censorship under the heading of effective resource usage. How does the sysadmin of one site determine if others feel that their resources are not being used properly? I agree that there are problems, but I don't think what was done was proper in *any* way. Louis -- --------------------------------------------------------------------------- ! "As above, so below; as below, so above" -- The Kybalion ! ! "I don't trust him; he has dark hair" -- My girlfriend's mother ! ! "So I'm stupid; what's your point?" -- Me ! +-------------------------------------------------------------------------+ ! Louis J. Giliberto, Jr. ! The above is NOT to be reproduced in part ! ! louisg@vpnet.chi.il.us ! or in whole without PRIOR consent of me ! ! ! (except to flame me in USENET or E-Mail). ! --------------------------------------------------------------------------- ------------------- Message-Id: <9104292203.AA18193@pilot.njin.net> Date: Mon, 29 Apr 91 16:30:03 EST From: Tom Limoncelli @ Drew University Subject: Written Policies I would be interested in reading the written policies of other schools for comparison. Could anyone post their policy? (I'd be particularly interested in the policy that Rutgers has.) Could some FTP site administrator collect these and put them all into a directory. It would be useful for other schools that are just looking to write their own. Even if it was only 90% up-to-date it would still be of service to the community. -Tom To start the ball rolling, here is what Drew publishes in their Technology Handbook: (not in this order) 1. A policy statement that says, "don't make prank phone calls or use other people's phone authorization codes". 2. we re-print from EduCom "A Guide To The Ethical And Legal Use of Software For Members of the Academic Community". 3. The policy statement below (reprinted from the Drew University Handbook 1989-1990 Section III: "Administrative Regulations: Misuse of Computer Facilities") It's short, quite "from the 70's", and vague. I'm not looking for critiques, I'm graduating in 3 weeks (anyone want to hire a very technical CS major with good interpersonal skills?) and no body here that could change the policy is on this mailing list. By the way, to put this in context, Drew University is a small (1400 students) liberal arts college with a tiny graduate school and a microscopic theology school. It's in Madison, New Jersey. ------------------------------ cut here ------------------------------ (Typos are mine. -Tom) Computing resources, like other resources of the University, are provided for the use of Drew faculty, students, and staff. The privilege of use by a student is not transferable to another student, to an outside individual, or to an outside organization. The theft or other abuse of computer time or facilities is not different from the theft or abuse of other University property, and violators of the computing privilege will be subject to disciplinary action under the usual procedures for dealing with non-academic discipline. Abuses include but are not limited to: 1. Unauthorized entry into a file, either to read, execute or change. 2. Unauthorized transfer of files (copying). 3. Unauthorized entry into a network. 4. Unauthorized use of another individual's computer account. 5. Use of computing facilties to interfere with the work of another student. 6. Unauthorized divulgence of code words or other means of entry. 7. Any intentional action to alter or destroy a diskette, other recording media, or its content. Use of the computing privilege to interfere with normal operation of University computing systems or any other systems accessible throught the University is prohibited and is subjected to severe disciplinary action. Users of computing facilities should be sensitive to the possible abuses of those facilities and should not act in ways to encouarge misuse by others. ------------------------------ cut here ------------------------------ From kadie Wed May 1 09:46:53 1991 To: cafb-mail Subject: Computers and Academic Freedom mailing list (batch edition) Status: R Computers and Academic Freedom mailing list (batch edition) Wed May 1 09:46:39 EDT 1991 In this issue: ahlevy@ux1.cso.uiu : Re: New NCSA e-mail policy inconsistent with Academic Fre Sanjay Kapur From: ahlevy@ux1.cso.uiuc.edu Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom It is important to note that NCSA has not suspended its policy by which its grants to its director the right to monitor email. It has only requested suggestions from a University committee concerned with computers and networking as to how it could establish procedures for revising its policy. This committee has not yet met to consider the issue. I do not consider that warning one that one's mail may be opened is sufficient to permit the carrier of that mail to open it. ------------------- Date: Tue, 30 Apr 1991 14:20 EDT From: Sanjay Kapur Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Message-Id: <7EEEABAE9800A959@ccmail.sunysb.edu> X-Organization: State University of New York, Stony Brook X-Vms-Cc: SKAPUR >Sender: ahlevy@ux1.cso.uiuc.edu >>It is important to note that NCSA has not suspended its policy by which >its grants to its director the right to monitor email. It has only >requested suggestions from a University committee concerned with computers >and networking as to how it could establish procedures for revising its >policy. This committee has not yet met to consider the issue. >I do not consider that warning one that one's mail may be opened is >sufficient to permit the carrier of that mail to open it. > The assumption that NCSA is a carrier is a BIG assumption. Common carriers (e.g. U.S. Mail, AT&T etc) should not monitor anything except to keep the network running. But NCSA is not, by any known definition of the word, a common carrier. I do not assume that NCSA would refer to itself as a carrier at all. Even common carriers, including your friendly local telephone company, have linemen (or linepersons if you prefer) that monitor lines to check on "line quality". Of course because they are employees of a common carrier, they are limited by law from revealing what they hear, but they still do monitor. There do exist "common carrier" usenet sites which you can subscribe to for a small fee and are open to the public. I am not sure, but I very much doubt if the "public" can get an NCSA account. Sanjay Kapur |Internet: Sanjay.Kapur@sunysb.edu VAX Systems Staff, Computing Services, |Bitnet: SKAPUR@SBCCMAIL State University of New York, |SPAN/HEPnet: 44132::SKAPUR Stony Brook, NY 11794-2400 |Phone:(516)632-8029, FAX:(516)632-8046 ------------------- Date: Tue, 30 Apr 1991 16:37 EDT From: Sanjay Kapur Subject: Policy requirements to prevent chaos. Message-Id: <922ADE512800A959@ccmail.sunysb.edu> X-Organization: State University of New York, Stony Brook X-Vms-Cc: SKAPUR I am one of those beings most disliked in this mailing list, yes, I am The System Administrator of a Campuswide Multiuser System. Yes, I am a human being and yes, I do believe very strongly in the freedom of the press. I also believe that academic freedom has limits which exist to prevent chaos and anarchy. Recently, there has been a lot of discussion in the media about what a University's policy on Privacy and Academic Freedom should be in so far as Multi-user Computing and Computer networks are concerned. In fact discussing this issue is the purpose of this mailing list. I believe the points stated below should be part of any such policy. Otherewise it just will not work. I will welcome comments and even flames. I would very much like to know "Why I Am Wrong" if you disagree with me on the following. I just have one request: If you do flame me, please read the whole message twice before flaming me. I suspect that everyone on this list will be interested in the comments you make to the following, so please reply to the list. Sanjay Kapur |Internet: Sanjay.Kapur@sunysb.edu VAX Systems Staff, Computing Services, |Bitnet: SKAPUR@SBCCMAIL State University of New York, |SPAN/HEPnet: 44132::SKAPUR Stony Brook, NY 11794-2400 |Phone:(516)632-8029, FAX:(516)632-8046 ------------------------------------------------- 1) In any policy, the following should be explicitly stated: "Computing Services staff, especially the Systems support office will not be liable for the contents of any message on the system or any message sent or received on the system under ANY circumstance." Rationale: If the Systems staff is to be held liable for the contents, then they have the obligation to censor. Also it should be made clear that anyone who gives their password knowingly and willingly to someone else is effectively giving them the power of attorney in that the user is responsible for any action taken by the person to whom the password is given. 2) The policy should very clearly state that: The sole purpose of the user's account is for University purposes which includes academic discussion and personal development. It is not meant for personal use just like University Stationary is not meant to be taken home and used to write grocery lists or the office phone to make personal calls without reimbursing the university. 3) The academic freedom on computing services computers should be discussed in the much wider context of the campus and other services and facilities provided by the campus. If a message can be posted electronically, the University policy should somehow state that the exact same message can be posted on any public Bulletin board on campus without fear of it being removed by "offended" parties. Academic freedom on Computers should be the same as on other places. Computer resources cost money. Disk space, CPU, and I/O are all "scarce" resources which cost money just as real as paper duplication charges. If the university will pay for duplicating the message on paper, there should be no problem with also duplicating a similar or same message on the computer. If the University is willing to pay mailing charges for the message to be mailed through U.S. Mail in paper envelopes to the far corners of the globe, the university should have no problems with doing the same for electronic mail. Electronic mail should not be treated as a "free" resource. 4) Systems staff have to intervene for the following reasons and also refer the matter to an appropriate Disciplinary Body: a) there is obvious abuse of resources, e.g. a user (say Joe's brother) prints a thousand copies of the menu or advertisements for Joe's Restaurant. b) there is imminent danger: A user discovers an operating system bug and exploits it to either crash the system or otherwise damage or examine another user's files without permission. c) The user releases a worm/virus knowingly on the system. d) A destructive program which either damages a resource or denies other users the use of the resource: an example is printing certain patterns on a line printer to deliberately wear out a printer ribbon. e) A user guesses or otherwise discovers another user's password and breaks into the account and starts abusing it. The account may have to be disabled without the true owner knowing anything about it. e) A user knowingly and illegally breaks in or attempts to break into another computer system. May be covered by the next clause. f) any other action which may be in gross contravention of University policy or in gross violation of local, state or federal law or International treaty. 5) Other Problems that require the systems staff to intervene but do not require any disciplinary action: a) Misdirected mail has to be forwarded to the correct addressee. b) The system runs out of a resource (e.g. disk space) and some users have to be arbitrarily locked out till the problem can be corrected. c) A user releases a worm/virus unwittingly. d) A runaway program. For example a program fills up the spool or a program sends a very large number of the same message to the same address thus blocking the network and denying access to other users for a long period of time. e) A user signs on to a large number of active mailing lists and goes right away on vacation for (say) more than three months. f) Other "denial of service" security violations. An example is a user who submits hundreds of batch jobs at the same time on all the batch queues. This can result in other users having to wait a long time (maybe days) before their job can run. Comments: Scholars of the "Freedom of the Press" know that freedom of the press is the freedom of the Owner of the press to publish what the Owner wants, not the freedom of the Op-Ed page writers, not the freedom of the letter writers or the freedom of the correspondents or reporters. It is also the freedom of the distributor (e.g. newspaper seller) to not distribute or sell a particular issue. Freedom of the press does not mean that the use of the press is free, only that if you own a press or can find someone willing to rent you the use of one, you can publish what you want. ------------------- Subject: telnet and rlogin Date: Wed, 1 May 91 0:06:47 CDT From: Mike Ezrine X-Mailer: ELM [version 2.4dev PL19] Message-Id: <9105010006.aa21786@maria.wustl.edu> I do not wish to create a lot of mail over this topic I would just like to take an informal poll and if other are interested I will post the resuts. The situtation is that the adminisatration here does not let stduents telnet or rlogin to mechines on the net. I am wondering if other scchol allow students access to these commands. If your scool allows telnet please drop me a brief note and if they do please let me know that also. Thanks for your help chicken@maria.wustl.edu From kadie Thu May 2 01:00:06 1991 To: cafb-mail Subject: Computers and Academic Freedom mailing list (batch edition) Status: R Computers and Academic Freedom mailing list (batch edition) Thu May 2 00:59:37 EDT 1991 In this issue: John McCarthy Message-Id: <9105011453.AA22372@DEC-Lite.Stanford.EDU> Subject: Computers and Academic Freedom mailing list (batch edition) What university (and other organization) policies should be. 1. Personal non-commercial use should be tolerated to the extent that it doesn't increase costs substantially. The cost of having segregated facilities is too high. We allow people to write personal letters on university desks, and we don't monitor internal calls to see if they are business related. As computing gets cheaper, this tolerance should increase. 2. Whether universities have legal obligations or not, they should grant the right to privacy of email. Indeed Congress should eventually establish a legal right to privacy of email corresponding to the privacy laws for telephone conversations. It may take a while to formulate such a law precisely. 3. Universities shouldn't worry about whether they will be held responsible for what someone says on email or usenet postings. There have been no suits so far, and the use of company desks to right letters hasn't led to suits either. Whatever hypothetical risk there might be should be tolerated. 4. Computers offer the opportunity to extend freedom of the press far beyond what exists with print media, and this opportunity should be taken. In fact, it has been taken with usenet and with mailing lists. The reason is that the cost of providing universal access to electronic publication is one that society can readily afford. The limitation is and will remain the ability of readers to select what they will pay attention to with the aid of moderators (who should really be called editors by analogy with print media). ------------------- Date: Wed, 1 May 91 10:56:25 EDT From: rsk@gynko.circ.upenn.edu (Rich Kulawiec) Posted-Date: Wed, 1 May 91 10:56:25 EDT Message-Id: <9105011456.AA24798@gynko.circ.upenn.edu> Subject: Replies to "Well, was I a censor?" Cc: rsk@juniper.circ.upenn.edu Louis J. Giliberto, Jr. writes: >Yes, but the administrator determined that the articles were improper based on >*his* understanding of the charter. [...] As for the charter, how can one >person determine what is appropriate for 800+ newsgroups? [ Example deleted] I never tried to cut with so fine a blade - your example article would have gone out without comment from me. You're quite right -- one person can't keep track of all the newsgroups, and couldn't back then even were there were half as many as today. But since I was not trying to make judgements that required intimate knowledge of the workings of all the groups, this wasn't a problem. Let me give you two examples that might clarify the sort of things that I did look for and act on: 1. An article which contains 300+ lines of a previous article (i.e. quoted in its entirety) and then contains the single additional line "Right on, dude.". This is clearly inappropriate for *any* Usenet group - see the netiquette articles in news.announce.newusers. 2. A resume posted to misc.jobs.offered, comp.unix-wizards, and, say, comp.os.mach. Clearly, resumes belong in misc.jobs.resumes, and only there -- again, this is a pretty easy call, given the netiquette articles in news.announce.newusers. Incidentally, these are both real examples. As a rough guess, I'd say that over about a five-year period, I probably bounced about 50 articles, most of which went right back out within a day or so with the problems fixed. Louis continues: >The fact of the matter is that the sysadmin at any site should not be allowed >to reject news postings unless there is a damn good reason for it (such as >1001 complaints every day of the week about one user on his system). Would "a damn good reason" include "news will go away, completely, unless something is done"? That very solution to the problem was recommended by some people and considered seriously for quite a long time. Carl Kadies writes: >q: Is it OK to inspect all notes and to censor out notes that are not >of a moderate tone? I would like to refer you back to my original article: please note carefully that none of what I did had any relation to the "tone" or "phrasing" of any article. At no time did I ever cancel an article, or request that a user revise an article, because of what it said or how it said it. I limited my intervention to dealing with the *form* of articles only. In other words, I really didn't care what people wanted to say, as long as they said it in the right place (newsgroup) and did so with the appropriate form (i.e. observing basic netiquette by not including hundreds of lines of a previous article, etc.). >q: Is it OK to inspect all notes and to censor out notes that may >be libelous? > >a: Inspecting all notes before they go out is inconsistent with >academic freedom. It is prior restraint. Again, please read my original article carefully -- I did not inspect notes before they went out. I inspected them *after* they had already been posted and were on their way out onto Usenet; those which I removed were deleted by means of a news "cancel" message, which more-or-less chases down articles and removes them. I also did not inspect notes for libelous content. Joe Wells writes: >Even if you didn't abuse the mechanism, and we have only your word on >this, the mechanism you set up is very easy to abuse. I was going to rebutt your comments point-by-point, but frankly, I don't see that it would do any good at this point -- if you're going to question my word, how can I persuade you of anything? How can you and I (and everyone else) hold a dialogue that has meaning if we do not believe each other, and, at a minimum, credit each other with good intentions, regardless of our disagreements? I don't see what I would have to gain by lying about what I said or did; if it was my intent to do so, I might have been better served by simply remaining out of the discussion. If you check back, you'll note that Stan didn't actually name me -- I named myself, explained what I did and why, and indicated that I had an open mind and was ready to be persuaded to change my viewpoint. But I won't be persuaded by having my integrity questioned. George Rickerson writes: >I suppose technically you were a censor, but only in the least offensive (to >me) sense of the above-quoted definition. The rules are reasonable, and it >sounds like you enforced the rules in a reasonable manner. Academic freedom >is not a synonym for anarchy, in my opinion. However, the basis of my >opinion gets somewhat wobbly after thinking about the following definition >from the same dictionary: George, I think you've hit on something here. Yes, it sure does appear that according to the Random House definition that I was technically acting as a censor. I'm not very comfortable with that idea; and I must admit that if I were in the same situation again, I'm not sure that I could come with a better solution to the problem. I'm also not sure how to square this with the definition of academic freedom that you cited... which, of course, is why we're having this discussion. I'm going to mull this over for a while and see if there is a way to reconcile the use of shared computer resources (news, mail, disk space, etc.) with the traditional concept of academic freedom. I'd like to note something in passing -- according to the Random House definition that George cited, everyone moderates a Usenet newsgroup is a censor. So is everyone who moderates a Usenet, Internet or Bitnet mailing list...including the person who produces the "moderated/edited" version of *this*, the computers-and-academic-freedom discussion list. Cheers, Rich ------------------- From: U15289@UICVM.uic.edu Message-Id: <9105011927.AA13111@eff.org> Date: 1 May 1991 14:17:12 CDT Subject: Why Kapur may be wrong on at least one count In his posting on a suggested e-mail policy, Sanjay Kapur writes that accounts should be specified as being exclusively for "university" as opposed to "personal" purposes, the former including "academic discussion and personal development." How can personal "development" be effectively segregated from personal "purposes?" Most of the newsgroups on NETNEWS, as it is called at this installation, appear to be replete with items which are not, in the narrow sense, "academic discussion." A number of the other postings to comp-academic-freedom-talk the last couple of days have, I think, responded quite cogently to this issue; the consensus among them is that a strict lim- itation to "academic" purposes is unworkable, unnecessary, and undesirable, while recognizing that abuses could occur, and should be dealt with when and only when they do. I applaud their defense of the maximum feasible latitude for the individual in these matters. Mitchell A. Pravatiner University of Illinois Chicago ------------------- Message-Id: <9105020033.AA05780@cwns6.INS.CWRU.Edu> Date: Wed, 1 May 91 20:33:03 -0400 From: cjs@po.CWRU.Edu (Christopher J. Seline) Subject: Electronic Communications Privacy Act I'm pleased NCSA had changed its policy (if only our local hired hands were are gracious). Had NCSA carried out their policy then they were in violation of the Electronic Communication Privacy Act (ECPA) which criminalizes any access to someone's E-mail without that person's permission. If the did search anyone's mail then I suggest that person immediately contact an attorney. ECPA includes both civil and criminal sections. ------------------- From: Aydin Edguer Message-Id: <9105020123.AA16992@charlie.CES.CWRU.Edu> Subject: Re: Electronic Communications Privacy Act Date: Wed, 1 May 91 21:23:18 EDT X-Mailer: ELM [version 2.3 PL6] > Had NCSA carried out their policy then they were in violation of the > Electronic Communication Privacy Act (ECPA) which criminalizes any access to > someone's E-mail without that person's permission. I would suggest you re-read the Electronic Communications Privacy Act of 1986. Specifically in Title 18 Section 2511 Subsection 2 Paragraph (a)(i) it states: (2)(a)(i) It shall not be unlawful under this chapter for an operator of a switchboard, or an officer, employee, or agent of a provider of wire or electronic communication service, whose facilities are used in the transmission of a wire communication, to intercept, disclose, or use that communication in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service, except that a provider of wire communication service to the public shall not utilize service observing or random monitor- ing except for mechanical or service quality control checks. Thus it is NOT illegal for an employee of NCSA to search electronic mail when it is to protect the rights and property of the NCSA as was stated in the NCSA policy: 3.) In order to protect NCSA's e-mail facilities from flagrant abuse of the above mentioned purpose of the system, as well as protect NCSA staff from threats to their personal safety and well being, protect NCSA against fraud, attempts to disadvantage NCSA, prevent and/or ensure NCSA against inappropriate information disclosures, it might be necessary for authorized system administration and/or security staff to monitor or examine and individual employee's and/or user's e-mail. This type of activity is only performed for legitimate security reasons; only when there is cause for such activity and only at the discretion of the NCSA's Director. While the ethics or morality of NCSA's policy can be debated, the NCSA policy, as stated, is not a violation of the ECPA. Aydin Edguer Resident ------------------- Date: Wed, 1 May 1991 22:43 EDT From: Sanjay Kapur Subject: Re: Why Kapur may be wrong on at least one count Message-Id: <8E75F7AFA400C18A@ccmail.sunysb.edu> X-Organization: State University of New York, Stony Brook X-Vms-Cc: SKAPUR Mitchell, Thank you for your comments. One of the better parts of this mailing list is that nearly all articles have been well thought out and present points of view which some may disagree with but can not dismiss as nonsense. > > In his posting on a suggested e-mail policy, Sanjay Kapur writes that >accounts should be specified as being exclusively for "university" as opposed >to "personal" purposes, the former including "academic discussion and personal >development." How can personal "development" be effectively segregated from >personal "purposes?" I agree that development may sometimes be difficult to separate from personal purpose. But, I am more concerned with theft of resources rather than simple misuse. A simple example: printing out a 10000 copies of an advertisement on a University's high speed laser printer for your brother's restaurant is personal "purpose" and not personal "development". Personal development should have a very broad definition but there should be some reasonable limits. >Most of the newsgroups on NETNEWS, as it is called at >this installation, appear to be replete with items which are not, in the >narrow sense, "academic discussion." A number of the other postings to >comp-academic-freedom-talk the last couple of days have, I think, responded >quite cogently to this issue; the consensus among them is that a strict lim- >itation to "academic" purposes is unworkable, unnecessary, and undesirable, >while recognizing that abuses could occur, and should be dealt with when and >only when they do. I applaud their defense of the maximum feasible latitude >for the individual in these matters. The distinction between academic discussion and Usenet can be made and should be made. I propose that just as there are public libraries which carry a different sort of collection than University libraries, it is the responsibility of the local community and not the University to carry and make accesible Usenet news. Usenet news grew out of a mix of commercial organizations and Universities. It was never a purely academic network. Giving it the protection of academic freedom is unjustified both by its history and its contents. Please, let us keep the "freedom of the press" and "academic freedom" separate issues. > > > Mitchell A. Pravatiner > University of Illinois > Chicago Sanjay Kapur |Internet: Sanjay.Kapur@sunysb.edu VAX Systems Staff, Computing Services, |Bitnet: SKAPUR@SBCCMAIL State University of New York, |SPAN/HEPnet: 44132::SKAPUR Stony Brook, NY 11794-2400 |Phone:(516)632-8029, FAX:(516)632-8046 From kadie Fri May 3 10:35:57 1991 To: cafb-mail Subject: Computers and Academic Freedom mailing list (batch edition) Status: R Computers and Academic Freedom mailing list (batch edition) Fri May 3 10:35:25 EDT 1991 In this issue: Craig Partridge Subject: re: New NCSA e-mail policy inconsistent with Academic Freedom From: Craig Partridge Date: Thu, 02 May 91 13:14:58 +0200 I'd just like to add my two cents to this discussion, having spent a few years as one of the staff of CSNET, which runs a large network much of which was e-mail only when I was on the staff. Much of the NCSA policy statement was reasonable (though I would have liked a less difficult tone). It is true that network admins cannot assure that mail is confidential due to the need to monitor lines, and yep, every so often, mail gets misdelivered (but so does postal mail). Careful effort by postmasters can minimize privacy risks. Programs exist to allow postmasters to read mailboxes of "dead" letters (letters that were undeliverable) in such a way that the postmaster only sees the headers not the contents of the messages, and can makes disposition decisions (such as who to forward the mail to) just by reading the header (much as the post office returns mail based on what's on the outside of the envelope whenever possible). [Don't ask me for this software -- I don't have it -- I just recall that some sites used it]. Packet printers that only print protocol headers also exist. The point here is that yes there is a privacy risk, but a good administrative system can minimize them, at least within an organization (obviously, once the mail gets out on the network, you're at the mercy of the network operators of the systems your mail goes through). The final issue is about the director's ability to read other's mail. I personally view that as unreasonable. NCSA may have an interest in identifying abuse of mail systems, but that doesn't require reading mail. For example, just tracking sizes and number messages and where messages are going (outside/within NCSA -- no need to keep actual user addresses) is sufficient to identify most abuses -- there's no good reason to be reading the messages. (I confess that tracking people's mailing habits probably feels like a modest privacy invasion too -- it turns out to be a level I personally can deal with -- I know of corporate and organization mail rooms that called to ask why someone was sending so much mail or making so many long phone calls -- I've felt that was a not intolerable exercise of a corporation's right to control its spending). Craig Partridge (craig@sics.se) (on sabbatical at) Swedish Institute of Computer Science Box 1263 S-164 28 Kista SWEDEN ------------------- Message-Id: <9105021919.AA07653@cwns6.INS.CWRU.Edu> Date: Thu, 2 May 91 15:19:18 -0400 From: cjs@po.CWRU.Edu (Christopher J. Seline) Subject: Re: email policy >NCSA has not changed its email policy. Their announced policy is still in >effect. They have only instituted a request to a University committee for >suggestions as to how they might go about revising this policy. A number >of us here belive the policy is dead wrong and are considering how to have >them suspend it. I have no knowledge of any individual whose mail they have >monitored; accordingly I know no one who has been wronged. I am not sure >if the Federal law covers this University, because it may not (or it may?) >serve the public at large. >Does your university have a defined policy re privacy of email? ECPA applices in all cases without regard to federal funding. You should phone up the FBI and tell them you'd like to report a violation of the Electronic Communications Privacy Act. Violations of ECPA are criminal (although victims may sue to get $$). I am not a lawyer and this is not legal advice (merely legal research). If you need to contact an attorney I will help you find one. (My compatriot suggests you go talk to your university omsbudsman immediately). cjs ------------------- Date: Thu, 2 May 91 15:07:13 -0500 From: "Carl M. Kadie" Message-Id: <9105022007.AA28870@herodotus.cs.uiuc.edu> Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Summary: NCSA asks a committee to review the policy (but doesn't detail the complaints) [I received a "cc" of this letter - Carl] University of Illinois at Urbana Champaign National Center for Supercomputer Applications 152 Computing Applications Building 605 East Springfield Avenue Champaign, IL 61820 217 244-0072 Date: April 29, 1991 Dr. Leigh S. Estabrook Chairman, Campus-wide Committee on Computing and Networking 410 DKH, MC-707 Dear Dr. Leigh Estabrook: Enclosed is a copy of NCSA's current "Policy on the Use and Security of E-mail Facilites," which has generated a complaint from a member of the UIUC faculty. At Vice Chancellor Liebman's suggestion, I ask that your committee either review the document or suggest an appropriate review mechanism. Please feel free to contact me if you need further information. Thank you for your assistance. I shall look forward to receiving the committee's input. Sincerely yours, James R. Bottum Deputy Director JRB/bp Enclosure cc: G. Badger C. Kadie J. Liebman M. Smith L. Smarr [The enclosure is a copy of the policy (available via anonymous ftp from eff.org in file academic/ncsa.email). My critique is not included. I have, however, contacted Dr. Estabrook on my own and given her a copy of the critique. (Also, I'm a mere student; but there are faculty members (like Dr. Levy) who object to the policy. - Carl.] ------------------- Date: Thu, 2 May 91 15:50:49 -0500 From: "Carl M. Kadie" Message-Id: <9105022050.AA29260@herodotus.cs.uiuc.edu> Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom Summary: More evidence that the NCSA forgot that they are a University department Recall that when I asked Michael Smith if the NCSA had considered general University privacy policies, he referred me to an article in IEEE Software and asserted that the NCSA email policy is consistent with the trend among Fortune 500 companies. (Notes from this conversation are available via anonymous ftp from eff.org in file academic/ncsa.email.) Today I read the article I think he was referring to. It is in the March 1991 issue of IEEE Software. It is a new column called "Law Review" written by George B. Trubow of the John Marshell Law School in Chicago. The column contains useful information about the email privacy and the law. The column tells private corporations how they can eliminate their employee's privacy without violating the law. In my opinion, the column has no relevance to a University. Here is some of the interesting info: The Epson e-mail case is not based on the ECPA, but rather on the California Constitution and a California law. In Trubow's opinion, the case of a Colorado city major who read the email of city council members violates the ECPA and tort law (whatever that is). Trubow suggests that private corporations: 1) make their email policy explicit 2) allow personal email (because it is inevitable) 3) monitor email - Carl ------------------- Resent-Message-Id: <9105022053.AA00142@eff.org> Message-Id: <9105022053.AA00142@eff.org> Resent-Date: Thu, 02 May 91 16:46:10 EST Resent-From: kate McCain From: "Edward G Looney " Subject: Prodigy Another attempt to mail. FYI privary and prodigy ----------------------------Original message---------------------------- Joel Furr, Graduate Assistant Office of Program Review and Outcomes Assessment Virginia Polytechnic Institute and State University *** Forwarding note from BITNET B-- 05/02/91 13:40 *** Received: by VTVM1 (Mailer R2.08 Be) id 6444; Thu, 02 May 91 13:40:10 EDT Date: Thu, 2 May 91 12:31:52 CST Sender: Bitnet Baseball League and Sports Discussion Comments: Resent-From: Edward G Looney Comments: Originally-From: Suzana Lisanti Wilson Snodgrass , Oragene Addis , Roger Loyd , Travis Jordan , Michael Stephens , David Farmer , Thelma Elkins , Clare Lattimore , Sherilyn Bird , Carol Anderson , Kris Murphy , Edward G Looney , Dev Bickston , Maureen Pastine , Robin Gruner , Linda Sellers , William Walker , Jeanne Byrom , Page Thomas , Linda Umoh , Bill Dworwkczyk , Judy Chiles , James Powell , Carolyn Kacena , Will Stuivenga , Beverly Carver , Nancy Rubenstein , Chris Milazzo , Arline L Moore , Gail Daly , Sue Wright , Winston Tubb , Kurt Adamson , Bruce Muck , Greg Ivey , Merideth Shedd-Driskel , Dolores Stewart , Robert Skinner , Lawrence Schwartz , Dennis Bowers , Bill Howie , Allen Gwinn , David T Kastor , Robert Maloy , David Lawrence , Roberta Cox , "Larry Smith, Doug Wilde & Janis Ekanem" , Michael Fritsche , Peggy Sudborough , Mike Novak , Tim Richard , Joe Delamore , Henry Urick , Robin Cover , Bob Bates , Margaret Morris , Lynn Remejko , Bitnet Baseball League and Sports Discussion , ROOTS-L Genealogy List , Writers Discussion List This song is for all of you out there who currently have, have had, or are considering purchase of the product "Prodigy", a product of the fertile minds at Sears and IBM. THIS IS NO JOKE. I think, even if you don't have access to bulletin board systems, you should look at this. If you thought Lotus' "MarketPlace" was an invasion of privacy . . . ----------------------------Original message---------------------------- I'm forwarding this message regarding Prodigy... I have no idea if it's true or not... ------------------ Beginning of forwarded message ----------------- The L. A. County District Attorney is formally investigating PRODIGY for deceptive trade practices. I have spoken with the investigator assigned (who called me just this morning, February 22, 1991). We are free to announce the fact of the investigation. Anyone can file a complaint. From anywhere. The address is: District Attorney's Office Department of Consumer Protection Attn: RICH GOLDSTEIN, Investigator Hall of Records Room 540 320 West Temple Street Los Angeles, CA 90012 Rich doesn't want phone calls, he wants simple written statements and copies (no originals) of any relevant documents attached. He will call the individuals as needed, he doesn't want his phone ringing off the hook, but you may call him if it is urgent at 1-213-974-3981. PLEASE READ THIS SECTION EXTRA CAREFULLY. YOU NEED NOT BE IN CALIFORNIA TO FILE!! If any of us "locals" want to discuss this, call me at the Office Numbers: (818) 989-2434; (213) 874-4044. Remember, the next time you pay your property taxes, this is what you are supposed to be getting ... service. Flat rate? [laugh] BTW, THE COUNTY IS REPRESENTING THE STATE OF CALIFORNIA. This ISN'T limited to L. A. County and complaints are welcome from ANYWHERE in the Country or the world. The idea is investigation of specific Code Sections and if a Nationwide Pattern is shown, all the better. LARRY ROSENBERG, ATTY Prodigy: More of a Prodigy Than We Think? By: Linda Houser Rohbough The stigma that haunts child prodigies is that they are difficult to get along with, mischievous and occasionally, just flat dangerous, using innocence to trick us. I wonder if that label fits Prodigy, Sears and IBM's telecommunications network? Those of you who read my December article know that I was tipped off at COMDEX to look at a Prodigy file, created when Prodigy is loaded STAGE.DAT. I was told I would find in that file personal information form my hard disk unrelated to Prodigy. As you know, I did find copies of the source code to our product FastTrack, in STAGE.DAT. The fact that they were there at all gave me the same feeling of violation as the last time my home was broken into by burglars. I invited you to look at your own STAGE.DAT file, if you're a Prodigy user, and see if you found anything suspect. Since then I have had numerous calls with reports of similar finds, everything from private patient medical information to classified government information. The danger is Prodigy is uploading STAGE.DAT and taking a look at your private business. Why? My guess is marketing research, which is expensive through legitimate channels, and unwelcomed by you and I. The question now is: Is it on purpose, or a mistake? One caller theorizes that it is a bug. He looked at STAGE.DAT with a piece of software he wrote to look at the physical location of data on the hard disk, and found that his STAGE.DAT file allocated 950,272 bytes of disk space for storage. Prodigy stored information about the sections viewed frequently and the data needed to draw those screens in STAGE.DAT. Service would be faster with information stored on the PC rather then the same information being downloaded from Prodigy each time. That's a viable theory because ASCII evidence of those screens shots can be found in STAGE.DAT, along with AUTOEXEC.BAT and path information. I am led to belive that the path and system configuration (in RAM) are diddled with and then restored to previous settings upon exit. So the theory goes, in allocating that disk space, Prodigy accidently includes data left after an erasure (As you know, DOS does not wipe clean the space that deleted files took on the hard disk, but merely marked the space as vacant in the File Allocation Table.) There are a couple of problems with this theory. One is that it assumes that the space was all allocated at once, meaning all 950,272 bytes were absorbed at one time. That simply isn't true. My STAGE.DAT was 250,000+ bytes after the first time I used Prodigy. The second assumption is that Prodigy didn't want the personal information; it was getting it accidently in uploading and downloading to and from STAGE.DAT. The E-mail controversy with Prodigy throws doubt upon that. The E-mail controversy started because people were finding mail they sent with comments about Prodigy or the E-mail, especially negative ones, didn't ever arrive. Now Prodigy is saying they don't actually read the mail, they just have the computer scan it for key terms, and delete those messages because they are responsible for what happens on Prodigy. I received a call from someone from another user group who read our newsletter and is very involved in telecommunications. He installed and ran Prodigy on a freshly formatted 3.5 inch 1.44 meg disk. Sure enough, upon checking STAGE.DAT he discovered personal data from his hard disk that could not have been left there after an erasure. He had a very difficult time trying to get someone at Prodigy to talk to about this. -------------- Excerpt of email on the above subject: THERE'S A FILE ON THIS BOARD CALLED 'FRAUDIGY.ZIP' THAT I SUGGEST ALL WHO USE THE PRODIGY SERVICE TAKE ***VERY*** SERIOUSLY. THE FILE DESCRIBES HOW THE PRODIGY SERVICE SEEMS TO SCAN YOUR HARD DRIVE FOR PERSONAL INFORMATION, DUMPS IT INTO A FILE IN THE PRODIGY SUB-DIRECTORY CALLED 'STAGE.DAT' AND WHILE YOU'RE WAITING AND WAITING FOR THAT NEXT MENU COME UP, THEY'RE UPLOADING YOUR STUFF AND LOOKING AT IT. TODAY I WAS IN BABBAGES'S, ECHELON TALKING TO TIM WHEN A GENTLEMAN WALKED IN, HEARD OUR DISCUSSION, AND PIPED IN THAT HE WAS A COLUMNIST ON PRODIGY. HE SAID THAT THE INFO FOUND IN 'FRAUDIGY.ZIP' WAS INDEED TRUE AND THAT IF YOU READ YOUR ON-LINE AGREEMENT CLOSELY, IT SAYS THAT YOU SIGN ALL RIGHTS TO YOUR COMPUTER AND ITS CONTENTS TO PRODIGY, IBM & SEARS WHEN YOU AGREE TO THE SERVICE. I TRIED THE TESTS SUGGESTED IN 'FRAUDIGY.ZIP' WITH A VIRGIN 'PRODIGY' KIT. I DID TWO INSTALLATIONS, ONE TO MY OFT USED HARD DRIVE PARTITION, AND ONE ONTO A 1.2MB FLOPPY. ON THE FLOPPY VERSION, UPON INSTALLATION (WITHOUT LOGGING ON), I FOUND THAT THE FILE 'STAGE.DAT' CONTAINED A LISTING OF EVERY .BAT AND SETUP FILE CONTAINED IN MY 'C:' DRIVE BOOT DIRECTORY. USING THE HARD DRIVE DIRECTORY OF PRODIGY THAT WAS SET UP, I PROCEDED TO LOG ON. I LOGGED ON, CONSENTED TO THE AGREEMENT, AND LOGGED OFF. REMEMBER, THIS WAS A VIRGIN SETUP KIT. AFTER LOGGING OFF I LOOKED AT 'STAGE.DAT' AND 'CACHE.DAT' FOUND IN THE PRODIGY SUBDIRECTORY. IN THOSE FILES, I FOUND POINTERS TO PERSONAL NOTES THAT WERE BURIED THREE SUB-DIRECTORIES DOWN ON MY DRIVE, AND AT THE END OF 'STAGE.DAT' WAS AN EXACT IMAGE COPY OF MY PC-DESKTOP APPOINTMENTS CALENDER. CHECK IT OUT FOR YOURSELF. ### END OF BBS FILE ### I had my lawyer check his STAGE.DAT file and he found none other than CONFIDENTIAL CLIENT INFO in it. Needless to say he is no longer a Prodigy user. Mark A. Emanuele V.P. Engineering Overleaf, Inc. 218 Summit Ave Fords, NJ 08863 (908) 738-8486 emanuele@overlf.UUCP ------------------- Message-Id: <9105022221.AA26908@po.CWRU.Edu> Date: 2 May 91 17:17:47 EST From: Stephen Trier Subject: Re: Prodigy Thu, 2 May 91 13:53:04 EDT Summary: More rigorous testing of the Prodigy software is necessary. I read this message with interest the first time I saw it on the Cleveland Free-Net, a local public-access BBS system. I was dismayed by the lack of technical knowledge shown in the message, both by the author and by the Prodigy representatives quoted. I was also dismayed by the absence of rigorous tests of the Prodigy software. I would like to propose a hypothesis explaining the contents of the STAGE.DAT file and two experiments that can be used to test the hypothesis. Although I would be happy to discuss this topic here, I doubt that Prodigy is an appropriate topic for a mailing list devoted to freedom in academic communications. I will be happy to correspond, via private e-mail, with any readers of this list interested in my hypothesis and the proposed experiments. -- <=> Stephen Trier "I am tired of that thing called science....We have sct@po.cwru.edu spent millions in that sort of thing for the last sct@seldon.clv.oh.us few years, and it is time it should be stopped." -- Senator Simon Cameron, Pennsylvania, 1861 ------------------- Message-Id: <9104292203.AA18193@pilot.njin.net> Date: Mon, 29 Apr 91 16:30:03 EST From: Tom Limoncelli @ Drew University Subject: Written Policies I would be interested in reading the written policies of other schools for comparison. Could anyone post their policy? (I'd be particularly interested in the policy that Rutgers has.) Could some FTP site administrator collect these and put them all into a directory. It would be useful for other schools that are just looking to write their own. Even if it was only 90% up-to-date it would still be of service to the community. -Tom To start the ball rolling, here is what Drew publishes in their Technology Handbook: (not in this order) 1. A policy statement that says, "don't make prank phone calls or use other people's phone authorization codes". 2. we re-print from EduCom "A Guide To The Ethical And Legal Use of Software For Members of the Academic Community". 3. The policy statement below (reprinted from the Drew University Handbook 1989-1990 Section III: "Administrative Regulations: Misuse of Computer Facilities") It's short, quite "from the 70's", and vague. I'm not looking for critiques, I'm graduating in 3 weeks (anyone want to hire a very technical CS major with good interpersonal skills?) and no body here that could change the policy is on this mailing list. By the way, to put this in context, Drew University is a small (1400 students) liberal arts college with a tiny graduate school and a microscopic theology school. It's in Madison, New Jersey. ------------------------------ cut here ------------------------------ (Typos are mine. -Tom) Computing resources, like other resources of the University, are provided for the use of Drew faculty, students, and staff. The privilege of use by a student is not transferable to another student, to an outside individual, or to an outside organization. The theft or other abuse of computer time or facilities is not different from the theft or abuse of other University property, and violators of the computing privilege will be subject to disciplinary action under the usual procedures for dealing with non-academic discipline. Abuses include but are not limited to: 1. Unauthorized entry into a file, either to read, execute or change. 2. Unauthorized transfer of files (copying). 3. Unauthorized entry into a network. 4. Unauthorized use of another individual's computer account. 5. Use of computing facilties to interfere with the work of another student. 6. Unauthorized divulgence of code words or other means of entry. 7. Any intentional action to alter or destroy a diskette, other recording media, or its content. Use of the computing privilege to interfere with normal operation of University computing systems or any other systems accessible throught the University is prohibited and is subjected to severe disciplinary action. Users of computing facilities should be sensitive to the possible abuses of those facilities and should not act in ways to encouarge misuse by others. ------------------------------ cut here ------------------------------ From kadie Sat May 4 11:48:12 1991 To: cafb-mail Subject: Computers and Academic Freedom mailing list (batch edition) Status: R Computers and Academic Freedom mailing list (batch edition) Sat May 4 11:47:59 EDT 1991 In this issue: kadie (Carl Kadie) : Questions about E-mail censor "Carl M. Kadie" Subject: Questions about E-mail censor [I'm reposting this for Cristiano Verondini - Carl] Just yesterday, I join the batch service, becouse a friend of mine told me there were interesting topics into these messages, concerning the freedom of E-mail. I'm involved in problems relating this topic on another amatorial net, but I would like to ask here a question (I used request mail address because I don't know if I'm off-topic, so please decide if it's the case to add my message to others). I would simply know how these organizations treates messages written in other languages. As I know, Internet is a world-wide net, so people using it are of many different nations. Of course, these people will often use english for exchanging their messages, and so the censor can read the message. Put the case in which a student, attending a stage in, as an example, America, obtains an account on a machine capable of doing E-mail with all the world. He now likes send messages with his friends at home, say Italy. Of course, language he will use is italian. How can, in this case, censor read and understand the message? Will the message be deleted anyway, or posted ? This is a simple question that I had when I read the message coming from your site, so I decided to put it here. Fell free to include it, if you think it is appropriate, into the conference, or, if you can, please send me a few line of answer. Regards Cristiano Verondini Facolta' di Ingegneria - Universita' di Bologna (Italy) ------------------- Date: Fri, 3 May 91 12:46:00 -0500 From: "Carl M. Kadie" Message-Id: <9105031746.AA04308@herodotus.cs.uiuc.edu> Subject: Re: New NCSA e-mail policy inconsistent with Academic Freedom G. David Frye of the the U. of I.'s Computer and Networking Committee has sent me a note correcting the information given to me by NCSA's security officer. According to Mr. Frye, NCSA is *not* a department of the Graduate College. It is an independent unit (i.e. not part of any college) which reports to the Vice Chancellor for Research. It just so happens that Vice Chancellor of Research, Dr. Judith Liebman, is also the Dean of the Graduate College. Other independent units include the Computer Services Office (CSO) and the Computer-Based Educational Research Lab (CERL). ------------------- Date: Fri, 3 May 91 22:43:09 CST Message-Id: <9105040443.AA01261@austral.UUCP> From: austral!rrezaian (Russell Rezaian) Subject: Re: The NCSA and ECPA Aydin Edguer in <9105020123.AA16992@charlie.CES.CWRU.Edu> writes: >Specifically in Title 18 Section 2511 Subsection 2 Paragraph (a)(i) it {the ECPA} states: > > (2)(a)(i) It shall not be unlawful under this chapter for an > operator of a switchboard, or an officer, employee, or agent of a > provider of wire or electronic communication service, whose > facilities are used in the transmission of a wire communication, > to intercept, disclose, or use that communication in the normal > course of his employment while engaged in any activity which is a > necessary incident to the rendition of his service or to the > protection of the rights or property of the provider of that > service, except that a provider of wire communication service to > the public shall not uti (sp y, x re t ted! med sayt thf e. ely! seb surf minf , og ot b izau one! der- hen! spoo