Path: utzoo!attcan!uunet!husc6!rutgers!cmcl2!adm!xadmx!mchinni@ardec.arpa
From: mchinni@ardec.arpa (Michael J. Chinni, SMCAR-CCS-E)
Newsgroups: comp.unix.wizards
Subject: Re:  The Internet Virus--A Commentary
Message-ID: <17556@adm.BRL.MIL>
Date: 16 Nov 88 15:38:19 GMT
Sender: news@adm.BRL.MIL
Lines: 51


Dennis Rears writes:
> John F. Haugh II  writes:
> 
> >Henry - [ and others ]
> >
> >I suspect the complaint was that not only were individuals involved [ and
> >hence 'man-hours' ] but entire EDP staffs where tied up with the Internet
> >virus.
> >
> >I will be very seriously pissed of if Wormer gets off with no jail time.
> >
>   These is no question that what the "wormer" did is wrong.  The
> question is was it illegal?  I don't think so.  Most laws on the
> books (federal & state) talk about destruction of data or
> unauthorized access.  
	What about theft of services?


> He did not (to my knowledge) destroy any data. He access was authorized,
> implied maybe but still authorized.
	There are two points to be considered as far as was the access
authorized  or not.  
Point 1 - was wormer's use of sendmail authorized? 
Point 2 - was wormer's use of other systems, in this manner, to execute his code
	authorized? 

> 
> 	o)  sendmail -  The sendmail daemon accepted the
> transmission and processed it.  Sendmail by definition allows anyone
> to talk to it. How can this be considered unauthorized access?
	In my opinion, the use of sendmail was authorized, BUT the use of the
other system to execute code was UNauthorized.  Saying that point 2 was
authorized is like saying that because I left my car doors unlocked, the
person who takes my car was allowed to do so with my consent.


> 
>    The laws need to be rewritten concerning stuff like this and I
> pity the people who have to do it.  
I agree completely, although I think that this might be covered under "theft of
services".


-------------------------------------------------------------------------------
Michael J. Chinni					AUTOVON: 880-4140
US Army Armament Research, Development, 
	and Engineering Center 				ARPANET: <mchinni@ardec>
Picatinny Arsenal, New Jersey 				AT&T:    (201) 724-4140

#include <std.disclaimer>