Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!spool.mu.edu!uunet!europa.asd.contel.com!gatech!prism!vapspcx
From: vapspcx@prism.gatech.EDU (S. Keith Graham)
Newsgroups: comp.org.eff.talk
Subject: Passwords/Intent to Defraud
Message-ID: <31281@hydra.gatech.EDU>
Date: 13 Jun 91 06:12:41 GMT
Article-I.D.: hydra.31281
Organization: Free Agent
Lines: 43


Last I checked, having the ability to gain access to another
users account is not a crime.

Having the ability *with intent to defraud* is a crime.

At one point, I had the ability to gain root access 
on our primary system here at gatech.  Just because I know
the 50 keystrokes doesn't make me a felon (I do hope.  :)
(And I did report this to the system administrators here.)

(Incidentally, this almost certainly would have given me
the ability to break into other systems, as a number of people
have gatech's machines in their ".rhosts", probably including the 
system at UGA.  Because I had the ability to violate their 
security, does this mean they should have had me suspended?.)

In the same vein, possesion of access codes (passwords) is
not a crime.  (Nor is the ability to obtain these codes
from existing information, i.e. COPS, nor is the knowledge of how
to break security to gain access to accounts.)  If it were, all of the
best unix wizards would be in jail now.  :)

However, a friend of mine (who just got out of jail) will be happy
to tell you all about the felony count "Posession of 10 or more
access codes *WITH INTENT TO DEFRAUD*".

In the case at UGA, it seems obvious that the student that was
suspended was assisting someone with intent to defraud, and was
aware of their motives.  He should therefore be treated as harshly
as the adminstrator would like (within the bounds of the law and 
university regulations.)

The sticky question arises when someone is running COPS, and you
have no idea how they intend to use the results.  (Or otherwise
"attempting to break security".)  Then the question becomes
"Are users/students innocent until proven guilty?"

I hope everyone (at least in this country) can answer "yes" to
that question.

Keith Graham
vapspcx@prism.gatech.edu