Path: utzoo!attcan!uunet!husc6!bbn!bbn.com!cosell
From: cosell@bbn.com (Bernie Cosell)
Newsgroups: news.sysadmin
Subject: Re: No RTM trial?
Message-ID: <32219@bbn.COM>
Date: 14 Nov 88 15:39:29 GMT
References: <16953@agate.BERKELEY.EDU> <5424@medusa.cs.purdue.edu>
Sender: news@bbn.COM
Reply-To: cosell@BBN.COM (Bernie Cosell)
Organization: Bolt Beranek and Newman Inc., Cambridge MA
Lines: 32

In article <5424@medusa.cs.purdue.edu> spaf@cs.purdue.edu (Gene Spafford) writes:
}In article <16953@agate.BERKELEY.EDU> weemba@garnet.berkeley.edu (Obnoxious Math Grad Student) writes:
}>Perhaps no charges will even be brought against RTM, on the grounds
}>that NSA and others are more worried about the worm program becoming
}>public knowledge.  Which no doubt could follow from introducing the
}>very program as the main evidence against RTM.
}
}Easily remedied.  There are lots of reverse-engineered versions of
}the code out there, and new versions could be put together with
}a modicum of effort.  All we need to do is post one such version.

Note that there are two possible "trials" here.  I think it would be
*fascinating* to see if the FBI or anyone could manage a *criminal*
trial.  In such a trial, one must adhere to the rather strict rules of
evidence.  Has anyone ever been able to really *prove* that particular
person actually wrote a particular computer file?  Think they could
*prove* that RTMjr actually _released_ the worm [e.g., that it wasn't
one of the sysops who logged in as "root" and su'ed to his account]?
That he didn't have code in the file to render the worm innocuous (say
to ONLY infect other Cornell machines, or only machines from a small
explicit list) and someone ELSE unaccountably removed it?  ll of this
"evidence" seems sufficiently flimsy that I'm not even convinced that
one could recover in a civil action.

On the other hand, it would be an incredible set of legal precedents if it
made it (you'd surely think twice before you pissed off the sysop on your
machine, no?  Considering what he could do, *actionably*, in your name!)

   __
  /  )                              Bernie Cosell
 /--<  _  __  __   o _              BBN Sys & Tech, Cambridge, MA 02238
/___/_(<_/ (_/) )_(_(<_             cosell@bbn.com