##  Computer Security 

Security | Hackers | Information Warfare | Laws

### Security

  * John D. Howard, An Analysis Of Security Incidents On The Internet: 1989 - 1995, April 7, 1997. An analysis of attacks reported to CERT: "With the exception of denial-of-service attacks, security incidents were generally found to be decreasing relative to the size of the Internet."
  * "Shall We Dust Moscow?: Security Survey of Key Internet Hosts & Various Semi-Relevant Reflections" by Dan Farmer. The survey found that 2/3 of "interesting" sites such as banks, newspapers and government systems has serious security flaws.
  * Director Louis Freeh's speech before the International Computer Crime Conference in New York City (March 4, 1997).
  * The General Accounting Office's September 1996 report on government-wide information security issues finding that security at most government agencies is poor.
  * The General Accounting Office's May 1996 report on the lax security of Defense Department systems.
  * CERFNet pages on SATAN
  * COAST Hotlist of computer security link.
  * Computer Emergency Response Team.
  * Security Digest newsletter
  * EPIC Bookstore Computer Security Books.



### Hackers

  * "Computer Hacker's Sentence Spotlights High-Tech Crime Prosecutions" by EPIC Senior Fellow David Banisar. Details the prosecution of Kevin Mitnick as a case-study of the increasing crackdown on cyber-crimes.
  * The 2600 Case. The US Secret Service asked mall police at Pentagon City Mall in Arlington, Virginia to break up an informal gathering sponsored by 2600 magazine. Legal Times article on the court ruling in EPIC's FOIA case.
  * Hackers Defense Fund.
  * 2600's page on the Bernie S. case. 

#### Books

    * Sci-Fi author Bruce Sterling's book "The Hacker Crackdown" on Operation Sun Devil.
    * Takedown. Great reading for those interested in the eating and sexual habits of computer security expert Tsutomu Shimomura. Occasionally it talks about noted hacker Kevin Mitnick.
  * Phrack Magazine's Home Page.
  * Digicrime Inc.'s parody page. 

#### Hacking Incidents

    * Air Force Web Page Hacked. Hackers broke into the US Air Force's web pages on December 29, 1996.
    * UK Labor Party Hacked. Hackers broke into and replaced the web pages of the UK Labor Party on December 10, 1996.
    * Singapore govt hacked.  Hackers broke into the main web page of the Singapore government on December 9, 1996 and replaced it with a list of government users.
    * Hackers broke into the US Justice Department's web page and replaced it with criticism of the Communications Decency Act. C|Net story on the incident. A month later, another group broke into the CIA's pages.



### Information Warfare

  * EPIC's Critical Infrastructure Protection Resources Page
  * EPIC Report -- "Critical Infrastructure Protection and the Endangerment of Civil Liberties" (PDF Format)
  * President Clinton announced on May 22, 1998, that the U.S. will "take all necessary measures to swiftly eliminate any significant vulnerability to both physical and cyber attacks on our critical infrastructures, including especially our cyber systems." An Administration white paper describes this new initiative. And an interesting critique of the plan.
  * The President's Commission on Critical Infrastructure Protection
    * Critical Foundations: Protecting America's Infrastructures
  * The Defense Science Board Task Force on Information Warfare-Defense (IW-D) issued a report in November 1996 calling for Defense Department to have legal authority over non-government computers in the name of protecting "the common defense." See the Federal Computer Week story on the report.
  * The Joint Chiefs of Staff issued a report on "Information Warfare Legal, Regulatory, Policy and Organizational Considerations for Assurance"
  * President Clinton issued an Executive Order on July 15 calling for a new panel to examine the security of the "critical information infrastructure" and recommend changes to current law.
  * Attorney General Janet Reno issued a memorandum titled "Critical Infrastructure Security" on March 14.
  * The Security Policy Board. In 1994, President Clinton signed Presidential Decision Directive 29 which created the Security Policy Board. The Board released a report on Information Infrastructure Assurance in December 1995. An internal memo of the SPB describes some of its activities.
  * The 1996 Rand Corporation report "Strategic Information Warfare: A New Face of War".
  * The Office of the Secretary of Defense report "Strategic Assessment: The Internet" which was obtained by the Federation of American Scientists.



### Laws

  * Computer Fraud and Abuse Act \-- Prohibits unauthorized access to computer systems. It was amended by the "Information Infrastrucure Protection Act of 1996" signed into law on October 11, 1996. Thomas links to legislative background and report.
    * NCSA's US Computer Crime Law Web Pages
  * Computer Security Act of 1987 \-- Designates the National Institute of Standards and Technology (NIST) as the lead government agency for computer security standards.
  * OMB Circular A-130 \-- Appendix III deals with security of federal information systems.
  * Electronic Communications Privacy Act of 1986 \-- Prohibits interception of private email without a court order.
  * US DOJ Computer Search and Seizure Guidelines. EPIC obtained a copy of the guidelines under the Freedom of Information Act. EPIC's overview of the guidelines.
  * Law Enforcement Bulletin article titled "Downloading: Using Computer Software as an Investigative Tool".
  * 1992 Guidelines on Computer Security issued by the Organization for Economic Cooperation and Development.
  * Loi Godfrain, la loi n. 88-19 du 5 janvier 1988, French law on computer crime.



* * *

EPIC Home Page
