Internetworkers: http://www.ibiblio.org/internetworkers/

["Shea Tisdale" <shea AT sheatisdale.com>]

See below

----- Original Message -----
From: <childers.paula AT epamail.epa.gov>
To: "Internetworkers: http://www.ibiblio.org/internetworkers/";
<internetworkers AT lists.ibiblio.org>
Sent: Monday, June 02, 2003 6:32 PM
Subject: Re: [internetworkers] thought police in chapel hill


>
> OK, gang, sensationalism and overkill aside, let's look at the facts:
>
> 1. A Citrix server stops working correctly, disallowing administrative
> logins.
> 2. The school officials decide that it may have been hacked (not HAS
> been, only MAY have been), and tell their "campus cop."
> 3. The campus cop calls the local Police Department to get a "computer
> crime specialist" assigned to the case.
> 4. Since that cop was on vacation, two other cops were assigned the
> case.
> 5. Those two other guys were training with an "FBI High Tech Crime Task
> Force," but were not officially members of this force.
> 6. A student tipster tells a faculty member of a "hacking" mention in
> another student's blog.
> 7. The faculty member pases this information to the not-FBI-agents.
> 8. The two not-FBI agents show up to interrogate the student, with FBI
> clothing, business cards, etc., passing themselves off as FBI agents.
> 9. the student is freaked out but informed and willing to stand up for
> her Constitutional rights.
> 10. the Citrix server is found to be busted, not hacked.
> 11. The cops are suspended for passing themselves off as FBI agents when
> they weren't yet.
>
> Now, let's look at the places this whole process got fucked at:
> 1. Citrix? On Microsoft? now there's a problem ;-)

I totally agree with you on this one.

> 3. Why did the campus cop feel s/he had to call in a "computer crime
> specialist" before there had even been a firm determination of any
> illicit activity actually occuring?  What - was this a "pre-emptive
> strike"??

Because most school systems do not have the computer personnel or technical
expertise to make such a determination as they are totally underfunded,
especially in the technology area, and frequently employ talent that is far
from knowledgable on technology.  As proof, I submit point 1 above - Citrix
on Microsoft...I rest my case.

> 4. how does a maybe, possibly, we-don't-know-for-sure-it-might-be-or-not
> hacked server at a high school warrant the assignment of TWO veteran
> police officers?

I am guessing because most crimes, even routine traffic stops generally
merit one officer and a backup.

> 6. did anyone question why one student might be "ratting" on another?
> isn't this sort of stupid/malicious tipstering why we didn't want
> Operation TIPS?

I would guess that the student felt like he or she was doing the right thing
by alerting the school administration to someone who might have knowledge of
what happened.

> 7. Did the faculty member even bother to READ the blog before calling
> the cops?

Would any faculty members understand that the blog entry was a reference to
a movie?  The age difference and differences in language, references, etc.
would make that blog almost incomprehensible to most faculty members and
perhaps even us...I mean, I'm not up on my 17 year old lingo.

Would your teachers or even parents understand it if you told them you
needed some more 'dead presidents' or benjamins?

> 8. If these two cops were being trained by an FBI Task Force to
> understand computer crime, why didn't they do a little more actual
> technical investigating before interrogating a student? Like, say,
> looking over the server with the sysadmin? Discovering if a hack/crime
> had actually taken place or not? The cop in the article says it was a
> "no-brainer" to interrogate the student, and that about describes it :
> no brain was used to think up that plan.   What if the student HAD
> actually been part of something much bigger? These morons could have
> completely screwed up a real case with their "we're FBI, fear us and
> grovel" fake dog and pony show, not to mention they actually HAVE made
> the Chapel Hill Police Dept look like a bunch of fascist idiots.

Let's look at the situation.  A:  A computer system that was perhaps
compromised.  B:  You have never seen it before or used it before and have
no idea how it was configured.  C:  The people who called you to help tell
you that this person might know what happened or have information on what
happened.  Given those facts would you first stumble around the system
trying to figure things out or interview the person.

And 'Interrogate' is Jon Elliston's word.  Officer Anson clearly stated:
"So it was kind of a no-brainer to just go talk to this girl and say, OK,
you mentioned this was a hack, why did you think it was a hack?"

> 9. The student rightfully deserves to be scared, upset, and feel that
> her privacy has been invaded. There is such a thing as "security through
> obscurity," in that (regardless of POTENTIAL reach) it is highly
> unlikely that many people would ever have even known this student's blog
> existed were it not for these events. It also has to be pretty chilling
> as a 17 yr old to think that The Government is Monitoring What You
> Write, regardless of where you wrote it. Perhaps she did get
> overdramatic, but hell, all 17 yr olds are overdramatic. I am pretty
> damn proud of her for standing up to these morons and asserting her
> Constitutional rights. That took a lot of guts. I wonder how many of us
> would have such guts if two (supposed) FBI guys showed up at our
> workplace?

The idea that anyone can claim a right to privacy on something posted in the
public domain is absurd to me.  That web blog was posted where anyone can
get to it.  So she had no right to privacy on it.  To be upset that someone
might be monitoring or reading it is almost equally as absurd - isn't that
why she posted it?  If you don't want people reading your ideas or thoughts,
don't post them in public.

I too, am glad she stood up for her rights.  More people should know their
rights and stand up for them.


> 11. I'm just sad they didn't suspend them WITHOUT pay, they bungled the
> whole thing so badly. They are, in essence, getting a vacation on our
> tax dollars. Boy, I'd like to get time off with pay every time I screwed
> something to hell. Not exactly incentive to do better next time, now is
> it?

 John and Brian's actions deserve to be investigated and based on the
results of that investigation, they should receive a punishment appropriate
for whatever policies/rules/laws they are found to have violated.

But why do you feel my friend Steve Anson, who wasn't even in the state,
should be suspended?  And without pay?
What did he do to deserve it?


> If this is an example of the fine quality high tech policework our law
> enforcement officers are being trained in as part of Homeland Security,
> then I for one am disgusted. I just don't know who to be more disgusted
> with, CHPD, CHHS, or the FBI group supposedly training these petty
> thugs.

I just love the reaction of people to law enforcement.  When something bad
happens it's always they should have done more.  When they make a mistake,
they are thugs or fascists or nazis.

Law enforcement is a thankless job that puts good people in harms way.  I
know many officers and I can tell you that most of them are just like you or
me.  Most of them are good people, who care about their jobs and do their
utmost to uphold the law and uphold their oath to serve and protect.  If 95%
of the people at your company are good people, then I'd venture that about
95% of law enforcement is as well.  The difference between them and you or I
is that we don't do our jobs under the continual scrutiny of the press and
by individuals with an axe to grind.  And we aren't met by hostility and
resentment each time we attempt to do our job.

And I'm the first to admit that there is a delicate balance between liberty
and security - and I'd be the first to argue that we should error on the
side of liberty.  But I get really tired of people labeling the police and
law enforcement as thugs or worse based on heresay and news stories by
people with axes to grind.

Perhaps, next time you screw up at your job we should let some outsiders
determine your fate based on heresay.

>
> YMMV,
> Paula
>
> disclaimer: these comments are all my own, not those of anyone I work
> for, or who they work for. I have volunteered at NC indymedia, but do
> not know the student involved in these events and have no knowledge of
> the events beyond that noted in the posted articles.
>
> ---
> Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers
>