The Information Systems Security Monitor    
    
     _______     /--------\      /--------\     \          /|    
        |        |               |              | \       / |    
        |        |               |              |   \   /   |    
        |         \_______        \_______      |     \     |    
        |                 \               \     |           |    
        |                 |                |    |           |    
        |                 |                |    |           |    
        |        \________/       \________/    |           |    
      -------                                      
Dedicated to the pursuit of security awareness............    
================================================================= 
Volume 2 Number 2                                     April 1992  
=================================================================  
////////////////////// In this Issue \\\\\\\\\\\\\\\\\\\\\\\\\\\  
  
Choosing the Right Password  
  
Comptroller General Decision on EDI  
  
Security Hall of Fame  
  
OAIS Employees Judge Student Contest  
  
Cyberspace: A Hacker's Response 
  
Quick Fix Security  
  
Dear Clyde  
  
Computer Speak  
  
What's New  
---------------------------------------------------------------- 
 
 
Hacker Lists Passwords Hackers Look For  
Choosing the Right Password!  
  
Imagine a hacker entering a system with your id and password  
because you did not take the time to choose a good password,  this 
is something that can be completely prevented if people would take 
a few minutes to choose a good password.  You must be creative when 
choosing a password not lazy.  Since a password is usually the  
first line of defense against unauthorized access to a computer  
system, when the first line is broken the rest only take time.  The 
average user usually has a password that is easy to select and easy 
to remember.  Any word that is easy to select or is contained in 
a dictionary is a poor and insecure selection for a password.  The 
reason this makes a poor selection is because these words are the 
first ones an intruder will try when attempting to compromise your 
system.  For instance, if your name is Tom Smith and your logon id 
is TSMITH your password should not contain any variation of these 
two words (Tom & Smith).  A hacker will try TSMITH, SMITHT, 
TOMSMITH, SMITHTOM, TSMITH1, HTIMST, etc. before anything else.  
As far as the length of a password goes its definitely the longer 
the better.  To demonstrate this point I give you the following 
table:  
  
# of        Possible             Average Time   
Characters  Combinations         To Discover     Example  
  
1            36                   6 min           q  
2            1,300                4 hrs           bt  
3            47,000               5 days          tyu  
4            1,700,000            6 months        insw  
5            60,000,000           19 years        potnb  
etc...  
  
The greater the number of possibilities a hacker must sort through, 
the better the chances of a password remaining undiscovered.  
  
The best passwords are those that contain a combination of letters  
and numbers or are a combination of two or more unrelated words  
i.e. TREEFLOOR, TVBOOK, RADIOSHOE, etc.  Another possibility is to  
select the initials of your two grandmothers combined with the  
number of times you have seen your favorite movie to come up with  
a password that resembles PAWH07, 07WHPA, PA07WH, etc.    
  
If you think that you have chosen a password that is hard to guess  
or would take too much time to guess keep in mind that hackers have 
automated the process.  There have been programs written for the  
sole purpose of guessing passwords, they take a list similar to the 
one in this article and try each and every one of them  
These are the types of passwords that are hard to guess and will  
most likely not be found in any dictionary or word list.  I am  
enclosing a list of common passwords that most hackers have a  
variation of, under no circumstances should you ever use a word  
contained in this list.  All forms of profanity should also be 
included in this list.100  
666  
6969  
aaa  
abc  
abel  
academia  
academic  
academie  
access  
ada  
adele  
adeline  
adelphe  
admin  
adrian  
aerobic  
aerobics  
agathe  
agnes  
aide  
aime  
aimee  
airplane  
alain  
alban  
albanie  
albany  
albatros  
albatross  
albert  
alex  
alexander  
alexandre  
alf  
algebra  
algebre  
alias  
aliases  
alice  
alida  
alix  
alpha  
alphabet  
alphonse  
ama  
amadeus  
amandine  
ambroise  
amedee  
ami  
amorphe  
amorphous  
amour  
amy  
an  
analog  
analogue  
ananas  
anchor  
ancre  
andre  
andromache  
andy  
angele  
angerine  
anicet  
animals  
animaux  
anne  
annie  
annonciation  
anselme  
answer  
anthelme  
antoine  
antoine-marie  
anvils  
anything  
aout  
apollinaire  
apolline  
apotre  
aquin  
arc  
aria  
ariane  
aristide  
armand  
armel  
arnaud  
arrow  
arsene  
arthur  
ascension  
asd  
asm  
assise  
assomption  
athena  
athenes  
atmosphere  
aubin  
aude  
audrey  
augustin  
automne  
autoroute  
avent  
avila  
avion  
avril  
aymar  
aymard  
aztecs  
aztecs  
azur  
azure  
bacchus  
badass  
bailey  
balance  
banana  
bananas  
banane  
bande  
bandit  
banks  
banque  
baptiste  
barbara  
barber  
barbier  
bariton  
baritone  
barnabe  
barnard  
bart  
barthelemy  
bartman  
basic  
basile  
bass  
basse  
basson  
bassoon  
batch  
batman  
baudouin  
beach  
beater  
beaute  
beauty  
beaver  
beethoven  
belier  
beloved  
benedicte  
benoit  
benz  
beowulf  
berkeley  
berlin  
berline  
berliner  
bernadette  
bernard  
bernardin  
bertille  
bertrand  
beryl  
beta  
everly  
bicameral  
bienheureux  
bienvenue  
bishop  
b****!  
blaise  
bob  
boris  
bradley  
brian  
brice  
brigitte  
broadway  
bruno  
bsd  
bumbling  
burgess  
cad  
cafe  
calude  
camarade  
campanile  
cancer  
cantor  
capricorne  
cardinal  
careme  
carine  
carmel  
carmen  
carole  
carolina  
caroline  
carson  
cartouche  
cascades  
casimir  
cassis  
castle  
castle  
cat  
catherine  
cayuga  
cecile  
celine  
celtics  
cendres  
cerulean  
challenger  
change  
chantal  
charles  
charlotte  
charmant  
charming  
charon  
chat  
chateau  
chem  
chemin  
chemistry  
chess  
chester  
cheval  
chevalier  
chien  
chou  
christ  
christian  
christine  
christophe  
cible  
cigar  
cigare  
citroen  
claire  
clarisse  
class  
classic  
classique  
claude  
clemence  
clement  
clotilde  
cluster  
clusters  
code  
coeur  
coffee  
coke  
colette  
collins  
come  
computer  
comrade  
comrades  
conception  
condo  
condom  
connect  
console  
constant  
constantin  
conversion  
cookie  
cooper  
corinne  
cornelius  
couscous  
create  
creation  
creosote  
crepin  
cretin  
criminal  
croix  
cshrc  
cyrille  
daemon  
dame  
damien  
dancer  
daniel  
danny  
dapper  
data  
dave  
davy  
deb  
debbie  
deborah  
december  
decembre  
default  
defoe  
defunts  
delphine  
deluge  
denis  
denise  
desperate  
develop  
device  
dial  
diane  
didier  
diet  
dieter  
dieu  
digital  
dimanche  
dimitri  
disc  
discovery  
disk  
disney  
dog  
dominique  
donald  
donatien  
dos  
drought  
duncan  
dupond  
dupont  
durand  
dwladys  
eager  
earth  
easier  
easy  
eatme  
eau  
edges  
edinbourg  
edinburgh  
edith  
edmond  
edouard  
edwige  
edwin  
egghead  
eiderdown  
einstein  
elephant  
elisabeth  
elisee  
elizabeth  
ella  
ellen  
email  
emeline  
emerald  
emeraude  
emile  
emilie  
emma  
enclumes  
endeavour  
enemy  
engin  
engine  
engineer  
entreprise  
enzyme  
epiphanie  
erenity  
eric  
ersatz  
establish  
estate  
estelle  
ete  
eternity  
etienne  
euclid  
euclide  
eudes  
eugenie  
evelyn  
evrard  
extension  
eymard  
fabrice  
facile  
fairway  
famille  
felicia  
felicie  
felicite  
fender  
ferdinand  
fermat  
fernand  
ferrari  
fete  
fevrier  
fiacre  
fidele  
fidelite  
fidelity  
field  
file  
filet  
fini  
finite  
firmin  
fishers  
flakes  
fleche  
fleur  
fleurs  
float  
flocon  
flocons  
florent  
florentin  
flower  
flowers  
foolproof  
football  
foresight  
format  
forsythe  
fourier  
fraise  
framboise  
francine  
francois  
francoise  
fred  
frederic  
friend  
frighten  
fulbert  
fun  
function  
fungible  
gabin  
gabriel  
gaetan  
games  
gardner  
garfield  
gaston  
gateau  
gatien  
gatt  
gauss  
gautier  
gemeaux  
genevieve  
geoffroy  
george  
georges  
gerard  
geraud  
germain  
germaine  
gertrude  
ghislain  
gibson  
gilbert  
gildas  
gilles  
ginger  
gisele  
glacier  
gnu  
golf  
golfer  
gontran  
gorgeous  
gorges  
gosling  
gouge  
goutte  
graham  
grahm  
gras  
gregoire  
group  
gryphon  
gucci  
guenole  
guess  
guest  
guillaume  
guitar  
guitare  
gumption  
guntis  
guy  
gwladys  
habib  
hack  
hacker  
hal  
hamlet  
handily  
happening  
harmonie  
harmony  
harold  
harvey  
hawaii  
hebrides  
heinlein  
helene  
hello  
help  
henri  
herbert  
hermann  
hermes  
herve  
hiawatha  
hibernia  
hidden  
hippolyte  
hiver  
homework  
honey  
honore  
honorine  
horse  
horus  
hubert  
hugues  
humbert  
hutchins  
hyacinthe  
hydrogen  
ibm  
ida  
ignace  
igor  
imbroglio  
imbroglio  
immaculee  
imperial  
include  
inconnue  
ines  
info  
ingres  
ingress  
ingrid  
inna  
innocent  
innocuous  
internet  
invite  
irene  
irenee  
irishman  
irlande  
isabelle  
isidore  
isis  
jacqueline  
jacques  
janvier  
japan  
japon  
jean  
jean-baptiste  
jean-claude  
jean-francois  
jean-michel  
jean-pierre  
jean-yves  
jeanclaude  
jeanfrancois  
jeanmichel  
jeanne  
jeanpierre  
jeanyves  
jerome  
jessica  
jester  
jeudi  
jixian  
joel  
johnny  
joseph  
joshua  
jour  
judas  
judicael  
judith  
juggle  
juillet  
juin  
jules  
julia  
julien  
julienne  
juliette  
jumeaux  
jupiter  
juste  
justin  
justine  
kathleen  
kermit  
kernel  
kevin  
key  
kirkland  
kiwi  
knight  
ladle  
lambda  
lamination  
landry  
lapin  
larissa  
larkin  
larry  
laurent  
lazare  
lazarus  
lea  
lebesgue  
lee  
leger  
leland  
leon  
leonce  
leroy  
lewis  
library  
licorne  
light  
lion  
lisa  
lisp  
loch  
lock  
lockout  
louis  
louise  
lourdes  
love  
luc  
lucie  
lucien  
lumiere  
lundi  
lune  
lydie  
macintosh  
mack  
madeleine  
madelene  
maggot  
magic  
magique  
mai  
mail  
maint  
malcolm  
malcom  
manager  
mangue  
marc  
marcel  
marcelle  
marcellin  
mardi  
marguerite  
marie  
marie-madeleine  
marietta  
mariette  
marina  
marius  
mark  
markus  
mars  
marthe  
martial  
martin  
martine  
martinien  
marty  
marvin  
master  
math  
mathilde  
matthias  
matthieu  
maurice  
maxime  
medard  
melaine  
mellon  
memory  
mercredi  
mercure  
mercury  
meres  
merlin  
metro  
mets  
mgr  
michael  
michel  
michelle  
mike  
minimum  
minsky  
mit  
modem  
modeste  
mogul  
moguls  
monique  
mont  
moose  
morley  
morts  
mouse  
mozart  
mutant  
nadege  
nagel  
naissance  
nancy  
napoleon  
narcisse  
nasa  
natacha  
nathalie  
nationale  
nativite  
navette  
nepenthes  
neptune  
ness  
nestor  
net  
network  
new  
news  
newton  
next  
nicolas  
nina  
ninon  
nobody  
noel  
norbert  
notre  
novembre  
noxious  
nuclear  
nutrition  
nyquist  
oceanography  
ocelot  
october  
octobre  
odette  
odile  
odilon  
office  
olive  
olivetti  
olivia  
olivier  
open  
operator  
oracle  
orca  
orwell  
osiris  
outlaw  
oxford  
pacific  
pacifique  
pad  
padoue  
painless  
pakistan  
pam  
paper  
papers  
papiers  
paques  
parfait  
pascal  
pass  
password  
pat  
paterne  
patrice  
patricia  
patrick  
paul  
paule  
paulin  
peche  
pecheur  
pecheurs  
peggy  
pelagie  
pencil  
penguin  
penis  
pentecote  
peoria  
percolate  
peres  
persimmon  
persona  
pete  
peter  
peugeot  
peur  
philip  
philippe  
phoenix  
phone  
pierre  
pizza  
plane  
playboy  
plover  
pluto  
pluton  
plymouth  
poire  
poisson  
poissons  
polynomial  
pomme  
pondering  
porc  
pork  
porsche  
poster  
power  
praise  
precious  
prelude  
presence  
presto  
prevision  
prince  
princeton  
printemps  
prisca  
priv  
private  
privs  
professor  
profile  
program  
prosper  
protect  
protozoa  
prudence  
pub  
public  
pumpkin  
puppet  
quentin  
qwerty  
rabbit  
rainbow  
raindrop  
raissa  
raleigh  
rameaux  
random  
raoul  
rap  
rascal  
raymond  
reagan  
really  
rebecca  
regional  
reine  
remi  
remote  
renaud  
renault  
rene  
reponse  
requin  
reseau  
richard  
rick  
ripple  
risc  
rje  
robert  
robot  
robotics  
rochester  
rodent  
rodolphe  
rodrigue  
roger  
roi  
roland  
rolande  
rolex  
romain  
romano  
romaric  
romeo  
romuald  
ronald  
root  
rosalie  
rose  
rosebud  
roseline  
rosemary  
roses  
rosine  
ruben  
rules  
ruth  
sabine  
sacre  
sade  
sagittaire  
sainte  
sal  
sales  
salome  
samedi  
samson  
sandrine  
saturn  
saturne  
saturnin  
saxon  
scamper  
scheme  
school  
scorpion  
scott  
scotty  
sebastien  
secret  
security  
seigneur  
sensor  
septembre  
serenity  
serge  
service  
sesame  
severin  
sex  
sharc  
shark  
sharks  
sharon  
sheffield  
sheldon  
shell  
shiva  
shivers  
shuttle  
sidoine  
signature  
silvere  
simon  
simple  
simpsons  
singer  
single  
smile  
smiles  
smooch  
smother  
snatch  
snoopy  
soap  
socrate  
socrates  
solange  
somebody  
sophie  
sossina  
sourire  
souris  
souvenir  
sparrows  
spit  
spring  
springer  
squires  
stanislas  
strangle  
stratford  
student  
stuttgart  
subway  
succes  
success  
summer  
sun  
super  
superuser  
support  
supported  
surfer  
suzanne  
swearer  
sylvain  
sylvere  
sylvestre  
sylvie  
symmetry  
sys  
sysadmin  
system  
tangerine  
tanguy  
tape  
target  
tarragon  
tatiana  
taureau  
taylor  
tech  
telephone  
temptation  
tennis  
tentation  
terminal  
terre  
test  
thailand  
thailande  
thecle  
theodore  
theophile  
therese  
thibault  
thibaut  
thierry  
thomas  
tiger  
tigre  
toggle  
tomate  
tomato  
topography  
tortoise  
tortue  
toussaint  
toxic  
toyota  
trails  
transfer  
transfiguration  
travail  
trivial  
trombone  
tty  
tuba  
tubas  
tuttle  
ulrich  
umesh  
unhappy  
unicorn  
unix  
unknown  
uranus  
urbain  
urchin  
util  
utility  
uucp  
valentin  
vasant  
venceslas  
vendredi  
venus  
ver  
veronique  
verseau  
vertige  
vertigo  
vianney  
vicky  
victoire  
victor  
victorien  
vierge  
village  
vincent  
virgin  
virginia  
virginie  
virus  
visitation  
visitor  
viviane  
vivien  
volvo  
wargames  
warren  
water  
weenie  
whatever  
whatnot  
whiting  
whitney  
wholesale  
wilfried  
will  
william  
willie  
winston  
wisconsin  
wizard  
wombat  
woodwind  
word  
work  
wormwood  
wyoming  
xavier  
xaviere  
xfer  
xmodem  
xyz  
yaco  
yang  
yin  
yosemite  
yves  
yvette  
zap  
zimmerman  
zita  
zmodem  
zzz  
 
Written by "The Butler", a hacker at heart, a Systems Administrator 
in real life who enjoys learning as much as possible about any 
given system including how to circumvent its security measures. He 
has written articles for various hacker magazines that deal with 
computer security. He currently administers a PC Network for a 
medium size business (250 people). He also lectures to various 
groups including Local EDP Auditors Association, User Groups, and 
Private Corporations on how to protect their systems from hackers 
like himself but who use their knowledge for mischievous purposes.  
 
  
========================end of article========================  
  
  
Dear Clyde                          Responses to   
                                    questions for  
                                    those who are  
                                    searching for  
                                    the truth.  
   
Send your comments or questions to Clyde c/o the AIS Security 
Branch in Parkersburg, Room 1011, or leave them in Clyde's mailbox 
located on the Security bulletin boards throughout the Parkersburg 
office.  
  
Dear Clyde,   
What is the proper way to dispose of diskettes which are no longer 
able to be used? Are there security concerns here?  
                       Peggy  
Dear Peggy,   
Yes there are security concerns as the data stored on the diskettes 
may still be readable, if someone wants to take the effort to 
retrieve it. Therefore the diskettes should be disposed of 
properly. Any method of destroying the diskette can be used. 
Cutting it up as you do a credit card that is no longer to be used 
is one method. However the important thing is to make certain the 
disk surface, that is the inner contents of the envelope or plastic 
case, is destroyed.  
  
(Note: I personally prefer giving the disk several good whacks with 
my sword and lance to render it unusable.)   
  
  
Clyde ....... Sir Clyde?  
Rumor has it that Clyde is to be recognized for his continuing 
efforts in the arena of computer security by being knighted. There 
will be more on this in the next issue, stay tuned.  
  
========================end of article========================  
            
...........................................................   
             A Journey Behind (further behind)  .       .       .  
  .   
             .   .         .       .         .           ..       
    .   
              .   The Dark Side of CYBERSPACE  .     .       ..   
.  .   
                  .     .           .      .       .       .      
  .   
             Hackers in Their Illusive World:  .  A Response .   
.    .   
             
...........................................................   
   
             A Response by: Dispater   
             Editor in Chief of Phrack Inc. Magazine   
             InterNet: phracksub@stormking.com   
   
First of all, I would like to thank Kim Clancy for providing me 
with the opportunity to reply to her article in the previous issue 
of the ISSM.  I find myself agreeing with her on more issues than 
not.  I read her piece on Cyberspace... Most of the article was 
good, but I felt unclear about what she was saying in the section 
titled "The Dark Side."  So I have attempted to present a few 
things from this hacker's viewpoint and make a few points where I 
have disagreed with her.  The ">" indicates Kim's previous 
writings.   
   
>...What is scary to me in regard to some of the avenues is   
>the ability for individuals to get to so many different   
>types of information...   
   
What scares me are the kinds of people who have access to   
the most personal parts of our lives compiled into data   
bases (like Information America) that are for sale to anyone   
who wants to pay the money or has the "power" to access it.   
Why does the government need to know my unlisted phone number?  Is 
it really any insurance agency's right to know that I have a son 
or daughter that is about to turn age 16, and will soon need to buy 
auto insurance?  I think I have the right not to be bothered by an 
onslaught of people that think they have something I want to 
purchase from them. If you really enjoy junk mail and computerized 
telephone sales calls you can thank these kinds of databases.   
   
>I am not stating that I think information should be   
>shielded from individuals.   
   
The more diverse sources of information we can all access, the 
better off society will become.  If we look at the past we can see 
how accuracy in books was improved drastically by the creation of 
the printing press.  The scribes of kings and church figures were 
no longer relied upon as authorities of various subject matter.  
Information was made cheap and easily possessed by the common man.  
Therefore if someone disagreed with some book that was printed, he 
and his guild could write their version of what THEY found to be 
true.  This promoted truth, accuracy, a deluge of human 
interaction, and free thought.   
   
>...I once went to a presentation about hackers.  The   
>presenter told a story about a mother who took her child's   
>computer modem out into the driveway and ran over it after   
>her son had been arrested for hacking...   
   
What was the parent doing while her child was hacking?   
Another thing we need to clarify is the use of the word   
"child."  These are not often children.  There is a certain   
level of mental development that must occur first.  I don't   
know much about child psychology, but I'd say that most kids   
under the age of 13 would have a bit of difficult time   
understanding computer networking.  Most people in the   
computer underground are at least 16.  If they are not   
16 years old almost every sysop I know, kicks them off the   
system.  The young person should be allowed to explore in areas the  
parent might not agree with as long as he/she is willing to   
talk about it with the parent afterward. Why are required to   
water down and censor all information so that is safe and   
easily understandable to the "little children?"  If there is   
a 12 year old that has network access and is reading USENET's 
ALT.SEX.BONDAGE, I think there is a greater problem involved than 
the type of information the nets carry!!   
   
>While hackers spend time developing their skills and   
>learning how to master cyberspace they also use cyberspace   
>to share information about what they have learned.   
 
This is the great benefit of getting involved.  Everyone   
should own a computer because of this reason.   
   
>Information has been found on how to steal long distance   
>phone calls from the phone company, how to make a pipe bomb   
>and how to perform satanic rituals before sitting down to   
>hack.   
   
It is not illegal to know how to do any of the previously   
mentioned things.  As you mention later the information can   
also be found in such places like libraries.  We need to   
keep a few things in perspective here.  MOST of the   
information readily available on phone phreaking is so out   
dated, one couldn't hope to implement the use of such   
knowledge without most surely getting caught in an ESS(Electronic  
Switching System environment.  Most of the United State's 
telephones are on such a system.   
   
Secondly, most of the information available on explosives is   
very crude.  Most of it isn't worth the time it took to   
download.  Actually there is more information available in   
the library on that subject than in all the data bases in   
the world.  I personally think this kind of thing is simply   
stupid.  I will not print that kind of thing in Phrack.   
That kind of information is typed in from books, by people   
who don't have anything else to do.   
 
In regards to "satanic rituals", it is difficult to make any   
comments about this because in all my years of calling BBS's   
and talking to other hackers, I have never seen such an   
animal.  I have seen *THREE* articles on the Wiccan religion   
which is similar to white witchcraft, but it's not even   
close to anything satanic.  However, other than this   
minuscule tidbit in cyberspace, the only things I've seen   
were things that were written as pranks and for joke   
purposes.  It amazes me that if one person has written   
something or done something it is representative of the   
whole community.  This is definitely not a responsible   
conclusion.  If some people would just open their eyes to   
reality, they would not see a computer underground filled   
with "satanic, child molesting anarchists".   
  
>I hesitate to write the above because I don't want people   
>to avoid the technology.  Everything I have found is in   
>most libraries, but the accessibility of it through   
>computers makes it much easier to obtain.   
   
You hesitate with good reason and you are correct about all   
that information being already in your local library.  The   
problem boils down to "digital censorship."  Some people are   
saying it's OK for a library to have the aforementioned   
information, but it's NOT OK for it to be on my computer's   
hard drive.   
   
In regards to that argument I say it is much easier to get   
the information from a library than the computer.  Let's   
take a look at they facts. First of all, most libraries are   
FREE.  On the other hand the average computer system   
(386/33) costs around $1500.  Your typical 8th grader   
doesn't usually have that kind of cash.   
   
The problem is that reality and virtual reality is the same   
for some of us.  We will promptly ignore silly rules like   
"it's ok for some people to know certain things, but it's   
not ok for me to know the same bit of information."   
In the information age we are all becoming much more aware   
of each other's presence.  We are finding out that we are   
all very different.  We each have some ideas that can   
easily shock others.  These ideas can and are being   
challenged by the other people we interact with.  Therefore,   
we should NEVER take the step back into the "electronic dark   
age."   
   
The really funny thing about all this is, everyone in the   
United States IS a part of cyberspace, even though most of   
them don't want to recognize this fact.  If your name is on   
a computer somewhere, you are in cyberspace!  So you'd   
better become aware of your existence.  Use it to learn and   
question why its there!   
========================end of article========================    
 
OAIS Employees Volunteer to Judge Student Contest  
  
Every October, the Computer Learning Foundation, a non-profit 
educational foundation serving the United States and Canada, hosts 
Computer Learning Month. During that month, among other numerous 
activities, the foundation hosts numerous contests designed to 
encourage students, educators, and community members to explore new 
areas of using technology and to share their knowledge with others. 
These contests for students provide parents and teachers with an 
activity children can do today to begin thinking and learning about 
what it means to be a responsible user of technology. One of this 
year's contests was a student writing contest focusing on Adult 
Attitudes on the Value of Technology and Ethical Issues. Students 
were to interview one parent and one other adult, write a summary 
of their opinions on the value of technology in our lives and the 
ethical issues involved with using technology, then the students 
evaluated what they thought of the comments and opinions expressed 
by the adults they interviewed.   
  The Bureau of the Public Debt participated in this program with 
several OAIS employees, Gretchen Bergmann, Kim Clancy, Bill Dobson, 
Zephery Ellerson, Joe Kordella, Gary Smith, and Ed Alesius, 
volunteering their time to judge the students entries.  
  While the use of a computer was not required to create the 
critique many submissions showed an adept usage of various word 
processing, desktop publishing and graphics software.  
  This interchange between the professional environment and schools 
proved to be very enlightening.  It is refreshing to see a group 
dedicate its effort to a much needed task, keeping schools up with 
technology and its responsible use.  
 
========================end of article========================   
QUICK FIX SECURITY 
 
The following is a listing of some easy to do security controls 
that help a lot....  
  
 1. Set modem to answer after 4-5 rings.  
 2. Select a dial-up number from a different prefix or out of order 
    from the rest of your office.  
 3. Use call back features.  
 4. Use proprietary software for your communications e.g.,  
    PC Anywhere IV.  
 5. Use special modems for encryption and access control e.g.,  
    Leemah Datacom.  
 6. Disconnect after a certain period of inactivity.  
 7. Do not allow certain userids' to have dial-up access.  
 8. Use caller id and call tracking.  
 9. Display a blank screen when a connection is made so the user 
    has no clue what they have connected to.   
  
 ========================end of article========================   
  
COMPUTER SPEAK  
COMPUTER TERMS AND THEIR MEANINGS  
access  n.  The ability of a subject to view, change, or 
communicate with an object in a computer system. Typically, access 
involves a flow of information between the subject and the object 
(for example, a user reads a file, a program creates a directory). 
cyberspace  n.  The world that is created by the connection of 
computers. Travels thru this environment can be vast and undefined 
just as space travel can be. This is the environment Cyberpunks 
call home.  
database  n.  A collection of data items processible by one or more 
programs.  
 phreaking  v.  The art and science of cracking the phone network 
(so as, for example, to make free long-distance calls). By 
extension, security-cracking in any other context (especially, but 
not exclusively, on communications networks).  
virtual reality  n.  1. Computer simulations that use 3-D graphics 
and devices such as the Dataglove to allow the user to interact 
with the simulation. 2. A form of network interaction incorporating 
aspects of role-playing games, interactive theater, improvisational 
comedy, and "true confessions' magazines. In a virtual reality 
session, interaction between the participants is written like a 
shared novel.   
Phrack Inc. Magazine  n.  An electronically published and 
distributed magazine that focuses on technical issues.  
 
========================end of article========================   
  
Comptroller General Decision on EDI   
  
The Comptroller General of the United States has issued a decision 
that electronic data interchange (EDI) technologies, with 
enhancements such as message authentication and digital signatures, 
can create valid legal contractual obligations between the U.S. 
Government and the party with whom the agency contracts.  

Digest
   Contracts formed using Electronic Data Interchange technologies may
constitute valid obligations of the government for purposes of 31 U.S.C.
1501, so long as the technology used provides the same degree of
assurance and certainty as traditional "paper and ink" methods of
contract formation.

Decision
   By letter dated September 13, 1991, the Director, Computer Systems
Laboratory, National Institute of Standards and Technology (NIST), asked
whether federal agencies can use Electronic Data Interchange (EDI)
technologies, such as message authentication codes and digital
signatures, to create valid contractual obligations that can be recorded
consistent with 31 U.S.C.  1501.  For the reasons stated below, we
conclude that agencies can create valid obligations using properly
secured EDI systems.
 
Background  
  EDI is the electronic exchange of business information between 
parties, usually via a computer, using an agreed upon format.  EDI 
is being used to transmit shipping notices, invoices, bid requests, bid 
quotes and other messages.  Electronic contracting is the use of 
EDI technologies to create contractual obligations.  EDI allows the 
parties to examine the contract, usually on video monitors, but 
sometimes on paper facsimiles, store it electronically (for example on
magnetic tapes, on discs or in special memory chips), and recall 
it from storage to review it on video monitors, reproduce it on paper or
even mail it via electronic means.  Using EDI technologies, it is
possible for an agency to contract in a fraction of the time that
traditional practices take. 
  As NIST pointed out in its request, the "paperless" nature of the
technology has raised the question of whether electronic contracts
constitute obligations which may be recorded against the government. 
NIST is in the process of developing standards for electronic signatures
to be used in various applications,*1 including the formation of
contracts, but has been advised that section 1501 imposes a barrier to
the use of electronic technologies by federal agencies in this regard.

Discussion
   Section 1501 establishes the criteria for recording obligations
against the government.  The statute provides, in pertinent part, as
follows:
       "(a) An amount shall be recorded as an obligation of the United
        States Government only when supported by documentary evidence of-

             (1) a binding agreement between an agency and another person
             (including an agency) that is--

                  (A) in writing, in a way and form, and for a purpose
                  authorized by law. . . ."

31 U.S.C. 1501(a) (1) (A).

   Under this provision, two requirements must be satisfied:  first, the
agreement must bind both the agency and the party with whom the agency
contracts; second, the agreement must be in writing.

Binding Agreement
   The primary purpose of section 1501 (a) (1) is "to require that there
be an offer and an acceptance imposing liability on both parties."  39
Comp. Gen. 829, 831 (1960) (emphasis in original).  Hence the government
may record an obligation under section 1501 only upon evidence that both
parties to the contract willfully express the intent to be bound.  As
explained below, EDI technology provides both the agency and the
contractor the means to electronically "sign" a contract.
   A signature traditionally has provided such evidence.  See generally
65 Comp. Gen. 806, 810 (1986).  Because of its uniqueness, the
handwritten signature is probably the most universally accepted evidence
of an agreement to be bound by the terms of a contract.  See 65 Comp.
Gen. at 810.  Courts, however, have demonstrated a willingness to accept
other notations, not necessarily written by hand.  See, e.g., Ohl & Co.
v. Smith Iron Works, 288 U.S. 170, 176 (1932) (initials); Zacharie v.
Franklin, 37 U.S. (12 Pet.) 151, 161-62 (1838) (a mark);Benedict v.
Lebowitz, 346 F. 2d 120 (2nd Cir. 1965) (typed name); Tabas v. Emergency
Fleet Corporation, 9 F.2d 648, 649 (E.D. Penn. 1926) (typed, printed or
stamped signatures); Berryman v. Childs, 98 Neb. 450, 153 N.W. 486, 488
(1915) (a real estate brokerage used personalized listing contracts which
had the names of its brokers printed on the bottom of the contract in the
space where a handwritten signature usually appears).
   As early as 1951, we recognized that a signature does not have to be
handwritten and that "any symbol adopted as one's signature when affixed
with his knowledge and consent is a binding and legal signature.  B-
104590, Sept. 12, 1951.  Under this theory, we approved the use of
various signature machines ranging from rubber stamps to electronic
encryption devices.  See 33 Comp. Gen. 297 (1954); B-216035, Sept. 20,
1984.  For example, we held that a certifying officer may adopt and use
an electronic symbol generated by an electronic encryption device to sign
vouchers certifying payments.  B-216035, supra.  The electronic symbol
proposed for use by certifying officers, we concluded, embodied all of
the attributes of a valid, acceptable signature:  it was unique to the
certifying officer, capable of verification, and under his sole control
such that one might presume from its use that the certifying officer,
just as if he had written his name in his own hand, intended to be bound.
  EDI technology offers other evidence of an intent to be bound with the
same attributes as a handwritten signature.  We conclude that EDI systems
using message authentication codes which follow NIST's Computer Data
Authentication Standard (Federal Information Processing Standard (FIPS)
113*2 or digital signatures following NIST's Digital Signature Standard,
as currently proposed, can produce a form of evidence that is acceptable
under section 1501.
   Both the message authentication code and the digital signature are
designed to ensure the authenticity of the data transmitted.  They
consist of a series of characters that are cryptographically linked to
the message being transmitted and correspond to no other message.  There
are various ways in which a message authentication code or digital
signature might be generated.  For example, either could be generated
when the sender inserts something known as a "smart card"*3 into a system
and inputs the data he wants to transmit.  Encoded on a circuit chip
located on the smart card is the sender's private key.  The sender's
private key is a sequence of numbers or characters which identifies the
sender, and is constant regardless of the transmission.  The message
authentication code and the digital signature are functions of the
sender's private key and the data just loaded into the system.  The two
differ primarily in the cryptographic methodology used in their
generation and verification.
   After loading his data into the system, the sender notifies the system
that he wants to "sign" his transmission.  Systems using message
authentication codes send a copy of the data to the chip on the smart
card; the chip then generates the message authentication code by applying
a mathematical procedure known a cryptographic algorithm.  Systems using
digital signatures will send a condensed version of the data to the smart
card, which generates the digital signature by applying another
algorithm, as identified in NIST's proposed standard.  The card returns
the just-generated message authentication code or digital signature to
the system, which will transmit it and the data to the recipient.
   Under either approach, when an offeror or a contracting officer
notifies the system that he wants to "sign" a contract being transmitted,
he is initiating the procedure for generating a message authentication
code or digital signature with the intention of binding his company or 
agency, respectively, to the terms of the contract.*4 The code or the
digital signature evidences that intention, as would a handwritten or
other form of signature.  Both, generated using the sender's private key,
are unique to the sender; and, the sender controls access to and use of
his "smart card," where his key is stored.
   They are also verifiable.  When the recipient receives the contract,
either on his computer monitor or in paper facsimile, it will carry,
depending on which approach is used, a notation which constitutes the
message authentication code or the digital signature of the sender,
necessary information to validate the code or the signature and, usually,
the sender's name.  The recipient can confirm the authenticity of the
contract by entering the data that he just received and asking his system
to verify the code or the digital signature.  The system will then use
the information provided by the sender and either verify or reject it.*5
Both approaches use a key to verify the message just received; however,
the digital signature requires application of a different key from that
used to verify a message authentication code.  The change of any data
included in the message as transmitted will result in an unpredictable
change to the message authentication code or the digital signature. 
Therefore, when they are verified, the recipient is virtually certain to
detect any alteration.

Writing
   To constitute a valid obligation under section 1501(a)(1)(A), a
contract must be supported by documentary evidence "in writing."  As NIST
pointed out, some have questioned whether EDI, because of the paperless
nature of the technology, fulfills this requirement.  We conclude that it
does.
   Prior to the enactment of section 1501, originally section 1311 of the
Supplemental Appropriations Act of 1955, *6 there was no "clean cut
definition of obligations."  H.R. Rep. No. 2266, 83rd Cong., 2d Sess. 50
(1954).  Some agencies had recorded questionable obligations, including
obligations based on oral contracts, in order to avoid withdrawal and
reversion of appropriated funds.  See 51 Comp. Gen. 631, 633 (1972). 
Section 1501 was enacted not to restrict agencies to paper and ink in the
formation of contracts, but because, as one court noted, "Congress was
concerned that the executive might avoid spending restrictions by
asserting oral contracts."  United States v. American Renaissance Lines,
494 F.2d 1059, 1062 (D.C. Cir. 1974), cert, denied, 419 U.S. 1020 (1974). 
The purpose of section 1501 was to require that agencies submit evidence
that affords a high degree of certainty and lessens the possibility of
abuse.  See H.R. Rep. No. 2266 at 50.
   While "paper and ink" offers a substantial degree of integrity, it is
not the only such evidence.  Some courts, applying commercial law (and
the Uniform Commercial Code in particular), have recognized audio tape
recordings, for example, as sufficient to create contracts.  See e.g.,
Ellis Canning Company v. Bernstein, 348 F. Supp. 1212 (D. Colo. 1972). 
The court, citing a Colorado statute, stated that the tape recording of
the terms of a contract is acceptable because it is a "reduction to
tangible form." *7  Id. at 1228.  In a subsequent case, a federal Court
of Appeals held that an audio tape recording of an agreement between the
Gainesville City Commission and a real estate developer was sufficient to
bind the Commission.  Londono v. City of Gainesville, 768 F.2d 1223 (11th
Cir. 1985).  The court held that the tape recording constituted a "signed
writing."  Id. at 1228.
   In our opinion, EDI technology, which allows the contract terms to be
examined in human readable form, as on a monitor, stored on electronic
media, recalled from storage and reviewed in human readable form, has an
integrity that is greater than an audio tape recording and equal to that
of a paper and ink contract.  Just as with paper and ink, EDI technology
provides a recitation of the precise terms of the contract and avoids the
risk of error inherent in oral testimony which is based on human
memory.*8  Indeed, courts, under an implied-in-fact contract theory, have
enforced contracts on far less documentation than would be available for
electronic contracts.  See Clark v. United States, 95 U.S. 539 (1877). 
See also Narva Harris Construction Corp. v. United States, 574 F.2d 508
(Ct. Cl. 1978).
   For the purpose of interpreting federal statutes, "writing" is defined
to include "printing and typewriting and reproductions of visual symbols
by photographing, multigraphing, mimeographing, manifolding, or
otherwise."  1 U.S.C. 1 (emphasis added).  Although the terms of
contracts formed using EDI are stored in a different manner than those of
paper and ink contracts, they ultimately take the form of visual symbols. 
We believe that it is sensible to interpret federal law in a manner to
accommodate technological advancements unless the law by its own terms
expressly precludes such an interpretation, or sound policy reasons exist
to do otherwise.  It is evident that EDI technology had not been
conceived nor, probably, was even anticipated at the times section 1501
and the statutory definition of "writing" were enacted.  Nevertheless, we
conclude that, given the legislative history of section 1501 and the
expansive definition of writing, section 1501 and 1 U.S.C. 1 encompass
EDI technology.
   Accordingly, agencies may create valid obligations using EDI systems
which meet NIST standards for security and privacy.



Comptroller General
of the United States
Sept. 13, 1990

General Counsel
U.S. General Accounting Office
441 G. Street, N.W.
Washington, D.C.  20548

Dear Sir:

As you know, National Institute of Standards and Technology (NIST) has
cooperated with the Department of Treasury and the General Accounting
Office to develop an electronic certification system wherein a
cryptographic Message Authentication Code (MAC) is used in place of a
written signature to bind a certifying officer to a payment order. 
Several other agencies have expressed their interest in using this or a
similar system as a substitute for a written signature.  In fulfillment
of our responsibilities under the Computer Security Act of 1987, NIST is
now in the process of developing a public key based Digital Signature
Standard (DSS) which is specifically designed for electronic signature
applications and will provide at least the same degree of security as the
MAC approach.  We have attached the DSS Federal Register Announcement and
draft DSS which is now issued for public comment.

We have often been told that legal impairments exist which prevent
agencies from implementing electronic signatures to bind the federal
government.  The specific statute cited is 31 U.S.C. 1501.  Before
formally recommending these standards for contracting and financial
management applications, I would like to request a General Accounting
Office decision as to whether NIST standards such as Federal Information
Processing Standard (FIPS) 113 and a finalized DSS may be used throughout
the federal government to record obligations under 31 U.S.C. 1501.  If
you need any further information in order to make your decision please
feel free to contact Miles Smid, (301) 975-2938, of my staff.

Sincerely,

James H. Burrows
Director, Computer Systems Laboratory

Enclosures
    
*1 The Congress has mandated that NIST (formally the National Bureau of
Standards) establish minimum acceptable practices for the security and
privacy of sensitive information in federal computer systems.  Computer
Security Act of 1987, Pub. L. No. 100-235, section 2, 101 Stat. 1724
(1988).

*2 FIPS 113 adopts American National Standards Institute (ANSI) standard
X9.9 for message authentication.  It outlines the criteria for the
cryptographic authentication of electronically transmitted data and for
the detection of inadvertent and/or intentional modifications of the
data.  By adopting the ANSI standard, FIPS 113 encourages private sector
applications of cryptographic authentication; the same standard is being
adopted by many financial institutions for authenticating financial
transactions.

*3 A smart card is the size of a credit card.  It contains one or more
integrated circuit chips which function as a computer.

*4 NIST officials advise us that technology using message authentication
codes and digital signatures will be available to both contractors and
contracting officers for use in government contracting.

*5 For the sake of simplicity, this example does not describe the
complicated system of controls used to ensure that (1) no human knows the
sender's private key and (2) the information received from the sender for
validating the message authentication code or digital signature is
correct and accurate.

*6 Pub. L. No. 663, 68 Stat. 800, 830 (1954).

*7 Other courts, interpreting the laws of other states, have held that a
tape recording is not acceptable.  See Sonders v. Roosevelt, 102 A.D.2d
701, 476 N.Y.S.2d 331 (1984); Roos v. Aloi, 127 Misc.2d 864, 487 N.Y.S.2d
637 (N.Y. Sup. Ct. 1985).

*8 Of course, just as with any contract or other official document, an
agency must take appropriate steps to ensure the security of the
document, for example, to prevent fraudulent modification of the terms. 
Agencies should refer to NIST standards in this regard.  See, e.g., FIPS
113 (regarding message authentication codes).  In addition, agencies
should refer to the GSA regulations regarding the maintenance of
electronic records, see 41 C.F.R. 201-45.2, and to the Federal Rules of
Evidence with regard to managing electronic records to ensure
admissibility, see generally Department of Justice Report, "Admissibility
of Electronically Filed Federal Records as Evidence," Systems Policy
Staff, Justice Management Division (October 1990).

   

========================end of article========================    
  
Security Hall of Fame Established  
 
Clyde's Computer Security Hall of Fame is being established to 
recognize those who contribute above and beyond the normal call of 
duty in their performance of contributing to the advancement and 
enhancement of Public Debt's computer security program.  
  The first inductee to this much sought honor is Bob Settles. Bob 
came to Public Debt immediately upon his graduation from college 
in 1964. Apart from a two year stint in Vietnam, his first 18 years 
were spent with the Internal Audit Staff. Then, in 1982, he was 
selected to manage the AIS Security Branch and has served in that 
capacity ever since. During his tenure as manager, the Branch's 
responsibilities have grown steadily to keep pace with the emphasis 
placed on information systems security throughout the Government. 
Public Debt's security program is now among the most highly 
regarded in the Treasury Department.  
  Bob has recently accepted a Computer Specialist position with the 
Treasury Department at its main office in Washington, D.C.  
  Bob epitomized the best in seasoned management and his departure 
will be keenly felt. We wish him the best in his new position!   
 
========================end of article========================    
  
What's New?  
 
ISSM's gain recognition in international publication  
The Public Debt Computer Security Program and the ISSM's received 
international recognition when an article written by Kim Clancy and 
Joe Kordella was published in ISPNews in the Jan/Feb 1992 edition.  
The article presented the role computer security plays in the 
protection of critical information assets of Public Debt in an 
environment of rapid technological change.  It stressed that the 
ISSM's are key players in the implementation of the security 
program.  
  
New Security Branch Manager Selected  
The selection of Kim Clancy as the Security Branch Manager 
completes the consolidation of the Branch in Parkersburg.  Kim was 
previously a security analyst in the AIS Security Branch.  Prior 
to that, she was a computer security analyst for the State of 
Arizona, for over three years.  She was also a computer systems 
security officer in the United States Air Force.  
 
========================end of article========================    
 
The AIS Security Branch runs an Electronic BBS. Give us a call at  
(304) 420-6083.  An electronic version of the ISSM is posted on the 
board and can be downloaded.  Articles in the electronic version 
may include more detail in that we are not limited by space 
constraints as we are in the paper copy.    
 
The ISSM is a quarterly publication of the Department of Treasury, 
Bureau of the Public Debt, AIS Security Branch, 200 3rd Street, 
Parkersburg, WV 26101  (304) 420-6368  
  
Editors:     Kim Clancy  
             Joe Kordella  
             Ed Alesius  
             Mary Clark


Downloaded From P-80 International Information Systems 304-744-2253
