From: "L. Detweiler" <ld231782@longs.lance.colostate.edu>
Date: Sat, 31 Jul 93 19:48:03 PDT
To: cypherpunks@toad.com
Subject: NCIC abuse, electronic leash ideas
Message-ID: <9308010444.AA12537@longs.lance.colostate.edu>
MIME-Version: 1.0
Content-Type: text/plain


This is an `executive summary' from CRA Bulletin (Computing Research
Assoc., contact josuna@cs.umd.edu), followed by more explanation from
an article by L. Knutson for AP, apparently sent to the Telcom Digest
edited by the `Pat' editor who inserted interesting comments at the
end. The AP article is very disturbing.

Short summary: National Crime Information Center is the government
agency that tracks criminal records, used by FBI all the way down to
local law enforcement, and the data continually leaks in serious
abuses. (This is the same government that will find not one but TWO
completely incorruptable Key Escrow houses.) So another black eye for
Big Brother and more ammunition for the Cypherpunks:

>Laurie E. Ekstrand, the GAO's associate director for administration of
>justice issues, said ...
>"Furthermore, all the reported misuse incidents involve insiders,
>while none involved outside [computer] hackers," she said.

And YIKES look at the lead in to that AP article...

* * *

Maybe we need a new Bill of Rights for cyberspace that describes
precisely what data can be accessed, and by whom. Here are a few ideas
that have been rattling around in my brain for a long time:

- If you could put an electronic `leash' on your name or any other
electronic information about you, such that whenever it was relocated
you would feel a `tug' (an email message or whatever), you could track
exactly where your personal data is going, such as when your name
exchanges through copied mailing lists.

- Not only that, but we could set up a system where the leash is
interactive so that the individual can individual veto or allow such requests.

- One should be able to `yank' the leash on the name out of databases
where it should be permitted (e.g. anything involving private
companies, but of course not criminal records).

- In general, imagine that every person has their own personal database
that tracks *exactly* where *all* information in the world is stored about them.

- This could all be accomplished without new legislation (always the
preferrable method!), if a system was developed whereby every
commercial transaction was actually a contract between the two parties
to adhere to the `privacy protocol'. Of course, the presence of a
ubiquitous network that everyone has access to, sort of a new Minitel, is assumed.

- In general, we should begin to recognize that information itself can
be considered private property, and the method to enforce its
exclusivity is a contract between the owner and anyone who wishes to
`lease' it that enforces the owner's desired degrees of exclusivity.
This may involve monetary arrangements, i.e. I get paid to allow my
name to be circulated if I agree.

So, to accomplish all this electronic standards are required. If anyone
wants to start, it now would be great head start prior to the explosion
of commercial networking, and the standard could become available not a
moment too soon and entrenched as a result. It's definitely a first
class Cypherpunk project.

===cut=here===

GAO TELLS HOUSE OF NCIC COMPUTER ABUSE
=============================================================

The General Accounting Office made a statement before a House subcommittee 
July 28 about security holes in the National Crime Information Center computer 
system.

NCIC is the nation's largest computerized criminal justice information system, 
consisting of 24 million records accessible by 500,000 people.

Upon a request from Gary Condit (D-CA), GAO testified on NCIC security before 
a joint meeting between the House Judiciary Subcommittee on Civil and 
Constitutional Rights and the House Government Operations Subcommittee on 
Information Justice, Transportation and Agriculture.

NCIC is not easily penetratable from outside. However, because there is no 
password authentication, NCIC is easily abused by insiders, GAO said. 

Most users of the system simple identify themselves and their agencies using 
codes that are not kept secret.  The GAO reported instances where law 
enforcement agents entered the system using false codes, retrieved information 
and sold it to private investigators.



Subject: NCIC News
From: trader@cellar.org
Date: Fri, 30 Jul 93 21:04:53 EDT
Organization: The Cellar electronic community and public access system


I sent this to CuD, but thought that Telecom readers may also be
interested.
 
{Philadelphia Inquirer} - 07/29/93
 
CRIMINAL RECORDS ARE VULNERABLE TO ABUSE, CONGRESS IS WARNED
 
Sometimes the information is for sale, the GAO said.  It called for
greater security.
 
By Lawrence L. Knutson
ASSOCIATED PRESS
 
WASHINGTON -- In Arizona, a former police officer gained access to
print-outs from the FBI's National Crime Information Center, tracked
down his estranged girlfriend and murdered her.
 
In Pennsylvania, a computer operator used the system to conduct
background searches for her drug-dealer boyfriend, who wanted to learn
if new clients were undercover agents.
 
In Colorado, Connecticut, Florida, Maryland and other states, private
investigators bought data from insiders with authorized access to the
criminal-record system.
 
These examples were presented to the House Judiciary and Government
Operations Committeess yesterday by the General Accounting Office,
which concluded that the criminal-records system is vulnerable to
widespread misuse.
 
The GAO recommended that Congress enact legislation with "strong
criminal sanctions" barring the misuse of the criminal record files
and that the FBI encourage state users to enhance security.
 
Laurie E. Ekstrand, the GAO's associate director for administration of
justice issues, said that while the FBI and the states do not keep
adequate records, "we did obtain sufficient examples of misuse to
indicate that such misuse occurred throughout the system."
 
"Furthermore, all the reported misuse incidents involve insiders,
while none involved outside [computer] hackers," she said.
 
"It appears that there are employers, insurers, lawyers or
investigators who are willing to pay for illegal access to personal
information, and there are insiders who are willing to supply the
data," said Rep. Gary Condit (D., Calif.) summing up the GAO's
findings.
 
The National Crime Information Center, with 24 million records, is the
nation's largest computerized criminal justice information system.
Its 14 separate files contain an extensive range of data, including
information about fugitives, stolen vehicles and missing persons.
 
The largest single file, known as "the III file" gives users access to
17 million criminal-history information records maintained in separate
state systems.
 
The GAO said more than 19,000 federal, state and local law enforcement
agencies in the U.S. and Canada, using 97,000 terminals, have direct
access to the system.
 
The GAO called the Arizona case the most extreme example of misuse it
uncovered.
 
The agency said investigators learned that the former police officer
was able to locate his estranged girlfriend using data provided from
the national records system by three people working in different law
enforcement agencies.
 
"After an investigation, the printouts provided by the three
individuals were discovered and they were identified, prosecuted and
convicted," the GAO said.
 
Other examples provided by the GAO:
 
    - In Maine, a police officer used the system to conduct a background
      check on one of his wife's employees who was then fired for not
      disclosing his criminal record
 
    - In Iowa, a dozen cases of misuse were reported over the last two
      years.  All involved computer operators conducting background
      searches on friends or relatives.
 
    - In New York state, an employee of a law enforcement agency provided
      criminal history information to be used by a local politician against
      political opponents.
 
    - In Pennsylvania, a police officer "accessed and widely disseminated"
      a fellow officer's criminal history record.
 
    - In South Carolina, a law enforcement agency conducted background
      searches on members of the City Council.
 
                          -------------

[Moderator's Note: Be aware however that much information people don't
like having released is considered public record, and that includes
criminal histories. There are perhaps right ways and wrong ways to go
about getting the information, but criminal background information on
any person can be obtained quite legally, and you don't have to be a
law enforcement officer to get it. Here is why: In the United States,
our constitution calls for *open, public trials*. To wit, anyone can
walk into a courtroom, sit down and observe a trial in progress.
Records are kept of trials (we call them transcripts) and the same
rules which provide that trials are open to the public say that by
extension, transcripts can be read by anyone who wants to get it and
read it later. The court may charge a fee for its expense in making
the copy, but pay the fee and you get the record. 

Now no one is going to traipse around the country, state by state and
county by county looking to see if you are a criminal, a deadbeat or
whatever. What happens is that nearly every community has at least one
practioner of records research. Send them a note plus their fee and
*they* will walk over to the courthouse, pull the file and fax it to
you. Many researchers have cooperative arrangements with other
researchers. You pull files in your community that I need and I'll
pull files here for you. This then lead to computerized databases of
perfectly open, legally obtained information on criminal records
(among other things) in much the same credit bureaus work with each
other. 

So you don't have to get into confidential records illegally to get
what you want to find out, you just have to know where to go for
*legal, public* files which say the same thing or the essence thereof.
If your record in the Podunk Circuit Court says Judge Greene sent you
away for ten years for refusing to select a default one plus carrier,
I don't have to have an illicit contact in the NCIC or law enforcement
to tell me the same thing at some risk to my own freedom if I get
caught snooping!  Remember, you can have all the information you want
on anyone quite legally. Public records abound. Learn to use them. PAT]