🚀 go-pugleaf

System Administration as a Criminal Activity
or, the Strange Case of Randal Schwartz

Copyright (c) 1995
John S. Quarterman
jsq@mids.org

	From Matrix News, 5(9), September 1995
	Please redistribute this article.
	mids@mids.org, http://www.mids.org
	+1-512-451-7602, fax: +1-512-452-0127

The other week (16 Aug 1995) I went to our local UNIX User's Group
(CACTUS: Capital Area of Central Texas UNIX system User's Group)
meeting and heard Randal Schwartz tell a strange tale.  I'd heard parts
of it before, but the details were more peculiar than the gist.

The gist is that a few mistakes in judgment can easily make a system
administrator into a convicted felon.

Randal began Intel in early 1988, and worked there continuously (except
for two weeks in late 1988) until the end of 1993.  While working at
Intel iWarp (which later became part of SSD, the Supercomputer System
Division), he had recommended they maintain basic security by following
some standard procedures, such as using good passwords.  (This really
is basic, as any security expert from DIA to NSA to CERT, the
Internet's Computer Emergency Response Team, can tell you.)  He had
started checking their passwords by running crack in mid-1991.

Crack is a program familiar to most system administrators today (and
one distributed by CERT; see ftp://cert.org/pub/tools/crack/).  What
crack does is to attempt to crack a set of passwords, typically as
found in a UNIX /etc/passwd file.  Randal was quite familiar with
crack, having served as a beta tester for crack version 3.  He left
SSD in the middle of 1992 to work for a different Intel division (HF),
and crack was still running in SSD at that time (on autopilot).

While working for Intel, Randal had started giving week-long training
courses for other organizations around the country.  These were about
Perl, a popular programming language invented by Larry Wall.  Since
these courses involved travel, he arranged ways to read his mail at
Intel over the Internet while he was still working for Intel but not
physically present.  This seemed prudent, since, starting in late 1993,
he had become responsible for deploying DNS (Domain Name System)
servers throughout Intel.  Since DNS handles the basic mapping of
symbolic hostnames (such as ssd.intel.com) to IP addresses (such as
137.46.3.5), a broken DNS server can adversely affect almost every
other TCP/IP service.  Thus it was useful to know quickly of any
problems with Intel's DNS servers.  Intel has previously told MIDS that
everyone in their company from the President down uses there enterprise
TCP/IP network, so we can see how they would want it to continue
working.

Randal had co-authored a popular book for O'Reilly and Associates (ORA)
about Perl (*Programming Perl*, published January 1991).  He also took
the obvious next step with his training material, and wrote another
Perl book (*Learning Perl*, published November 1993).  He had an account
on ORA's machines, and figured they wouldn't mind if he did a little
testing there.  Against ORA's password files, crack found one (1)
password out of about 200.  And the ORA system administrator, Tanya Herlick, 
had already discovered that bad password, so it was cleaned up almost
before Randal even found it (not that either of them knew what the other
was doing at the time).  Thus ORA was a good comparison case for
reasonably good security.

In late 1993, while working for Intel, but in a different division (as
a system administrator for HF), Randal ran crack against the password
file of an SGI machine in SSD where he had an account to support prior
work for SSD.  It found one password straight out of the dictionary
(user ronb password deacon).  This is very bad because it is an
ordinary dictionary word, which makes it easy to crack simply by trying
numerous dictionary words; a task that any programmer can accomplish.

Randal decided to see how far the problem extended.  He was no longer
working for SSD, but he was currently a system administrator in a
different division, and he was consulting for corporate on the DNS
project.  Security is traditionally part of a system administrator's
job, and a security problem in one division is a security problem in
the whole company if it's on the corporate network, since a compromised
account on one machine can be used as a base to attack other machines.
This particular user also had an account on the main SSD server
cluster.  Randal guessed that that account would have the same
password.  One might well say the prudent course would have been
to inform the current SSD system administrators of the problem.
But Randal decided to try it himself.  It was the same.

Randal decided to test the password file for the main SSD cluster.
He pulled its passwd file over to a fast machine and ran crack on it,
and similarly for other machines in that division.  Crack broke 48 out
of 600 passwords.

So, it was clear that Intel's security was not very good.  Crack had
found about 50 likely ways an outsider might break in.  Randal thought
he was doing his employer a big favor by discovering these weak spots
in the company fence.  One of them was particularly bad, since it was a
vice-president's account, and the password was pre$ident, which is an
ordinary dictionary word with one letter (the most obvious letter, S)
replaced with a dollar sign.

Unfortunately, Randal was waiting until he had relatively final results
before informing regular SSD staff of what he was doing.  Meanwhile,
one of them noticed that he was running crack, and told his manager.
The manager, rather than approaching Randal about it, reported it up
the hierarchy.  Evidently many of the powers that be at Intel thought
they had discovered a corporate spy.

Three days later, Randal discovered something was amiss when police
arrived at his house on 1 November 1993.  About half a dozen of them
took all his computer equipment.  Having watched too many episodes of
Dragnet, he figured it was some sort of mistake, and the police would
clear it up if he just cooperated with them and told them anything they
wanted to know.  Unfortunately, real police are paid to find things to
charge people with, and they also kept his computers for 40 days,
including the one with his checkbook on it.  He was also terminated
from Intel within the same two hour period as the raid.

He did have the consolation of learning that his new book, just
released on the same day, was selling like hotcakes.

What Randal didn't know was that the report up the Intel hierarchy had
resulted in criminal charges being filed against him.  Oregon has a
vague law against ``altering'' or ``transporting'' computerized
information, with the distinction between the two not being clear.  The
D.A. considered moving a password file between two Intel machines to be
at least transporting.  So Randal stood accused of stealing information
from Intel, even though even the D.A. never alleged that anything left
Intel's premises.  Stood accused on three (3) criminal felony counts.

The indictment was handed down 14 March 1994.  The three felony counts
of Computer Crime according to Oregon State Law are:

  Count 1: altering without authorization two computer systems.

  Counts 2 and 3: accessing a computer with intent to commit theft.

The first count has to do with the remote mail access.  It seems
Intel's interpretation was that Randal had ``altered'' their systems
by, for example, putting a .forward file in his login directory to
cause his mail to be forwarded elsewhere.  The defense attorney apparently
also wanted to show use of Intel accounts for non-Intel business.

The other two counts have to do with the passwords he discovered on
other people's accounts by running crack.  What he was accused of
stealing (theft) was password files.

Meanwhile, the system administrator at ORA, Tanya Herlick, was informed
by the FBI that someone had allegedly broken into her systems.  She was
at a systems administration conference at the time.  As chance would
have it, a security session was scheduled for the same afternoon, so
she asked the assembled administrators what they would do in her
situation.  Their advice was to do the standard things (run tcpwrapper,
install COPS, reinstall old binaries, etc.).  She says:

  What noone knew at the time was that this was not a typical hacker
  breakin.  It wasn't a breakin at all in fact.  This did not keep me
  from having a heart attack at the conference however.  I mean, someone
  comes up to you and says "The FBI called and said someone hacked your
  main server."  And you were 2,000 miles away and afraid to log on (and
  definitely not as root)? What would you do?

She didn't know that the alleged perpetrator was Randal, which would
have been interesting, since he was known to her audience through his
books and tutorials and through USENET and the Internet.  She says:

  If I had known it was Randal, I possibly wouldn't have even brought it up!
  ... Not because Randal is any kind of white knight or anything, but
  because I knew he had an account on our system so it couldn't have
  been a breakin.  I found out early the next morning that it was him.
  I ran into Tim (O'Reilly) after I found out and it turned out that he
  already knew cause Randal had called him.

What she actually did was to disable Randal's account for a couple of days
and then reinstate it after talking to him.

The case went to a jury trial.  Some of the jury members apparently did
own computers, but of course anybody who might do anything remotely
resembling system administration was rejected.  This is evidently
common practice these days; a jury of your peers means nobody that does
what you do.

The ORA systems administrator testified (by telephone) for the defense
at the trial, saying that Randal still had his account at ORA and they
had no intention of taking any legal action against him.  Tim O'Reilly
(founder and President of ORA) even spoke up for Randal when asked by
the press.

Tanya Herlick says:

  If Randal had come to me and asked if he could run crack I would have
  said no.  It was presumptuous of him to think we wouldn't mind.  If 
  anything, a system admin should know this better than other users.
  However, it is not a crime.  Just inappropriate (I wish I could have
  had the chance to say this at the trial, but I didn't).

Nonetheless, Randal was found guilty on all counts, on 25 July 1995.

The deciding factor may have been the prosecutor's final summary, in
which he made the analogy of letting a carpenter into your house to fix
the garage and finding him upstairs rifling your personal papers.
Nevermind that the analogy is not apt, if for not other reason because
Randal *was* fixing the garage, to the best of his abilities and of his
understanding of his job description.  The jury didn't know that.

Randal is now a convicted felon, unable to vote, hold public office,
serve on a jury, or fulfill government contracts.  And he's already spent
$112,000 in legal fees, with an expection of a total of $140,000 just
for the first trial.  All for helping his employer.

Why did this happen?

It wasn't because of the regular Intel staff.  Apparently they tried to
get their bosses to talk to Randal directly, and were told that that would
not be possible.

It was of course partly because Randal made mistakes.  For example, one
might count not keeping both Intel and ORA informed, and trying the
account with the deacon password.  He readily admits he made mistakes,
and has apologized to Intel more than once in public for doing so.

But if Intel thought he had exceeded his authority as a systems
administrator or had shown poor judgment, they had plenty of recourse
available to them by traditional methods, ranging from a talk in his
supervisor's office to a cut in pay to being summarily fired and walked
out the gate.  Instead they brought criminal charges.

Randal also made mistakes during the legal proceedings.
The police did read him his Miranda rights, and he now knows
that ``you have the right to remain silent'' is a very good
phrase to consider without speaking.

And he made at least one bad mistake during the trial.  When asked by
the prosecutor whether he had done what he had done for personal gain,
he thought about it and considered that helping his employer would make
him look good, bring in more consulting, maybe increase his pay, etc.,
and said (one may well say foolishly), ``yes.'' The prosecutor, no
dummy, brought this up during his summation.

It may be relevant that that the prosecutor apparently remarked, in a
news conference after the verdict, that it would send a message that
Oregon was "safe for business".  It may also be relevant that Intel is
the largest employer in the state.  Not that this case (or the problem
it represents, anyway) is specifically about Intel; it could have
happened at any largish company or university.

System adminstrators almost always work in very vague job descriptions,
with little or no demarcation of the scope of their activities or when
or to whom they should report them.  Consultants work under even more
vague job descriptions, because they can't even be required to work at
specific hours or told when to work on specific tasks or the IRS won't
consider them to be consultants.  Intel is not alone or even unusual in
having no clear usage guidelines about their systems.  The risk of the
hierarchy at any large organization getting incensed at some (to them)
clerical worker running something called ``crack'' and finding out
that, for example, high level executives have bad (not to mention
embarrassing) passwords, is always with us.

The nature of system administration leads to all sorts of possibilities
of civil or criminal charges.  If not crack, how about illegal
transportation of company property off the premises (taking source
listings home to study)?  Or illegal use of university communications
facilities for political purposes (sending an electronic mail message
to your Congress member)?  Or illegal export of controlled processes
(such as PGP, in the Phil Zimmermann case)?  Or, if the U.S. Senate has
its way, ``making available'' files that some D.A. chooses to consider
``indecent''?  The possibilities are numerous.  They aren't limited to
system administrators, either.  The nature of, oh, library work has
become so involved with computers and networks these days that
librarians, or professors, or schoolteachers, or, yes, secretaries
could be subject to the same difficulties.

Once again, Randal made mistakes.  The nature of Randal's mistakes was
such that you or I could easily have made them or others quite like them.

The response to Randal's mistakes was out of all proportion to what he
did, under any reasonable interpretation by people knowledgable of the
nature of his work.  We're not talking Kevin Mitnich here; this is not
about a KGB-funded malicious cracker.  For that matter, the liberties
Randal took were small compared to those certain well-known trackers of
wiley hackers have taken in their self-appointed detective work.  We're
not even talking Robert Morris Jr., where the alleged perpetrator
clearly was, for whatever reason, at least using lots of computers in
organizations that had not given him any permission.  We're talking a
system administrator trying to do his job and being branded a felon for
simple mistakes in who he informed and when.

Sentencing in Randal's case is scheduled for 11 September.
The sentence could involve any or all of jail time,
a hefty fine, damages, and a requirement not to leave the state.

It is possible to request leniency from the judge.  Letters of support
for Randal Schwartz to be put before the judge should be sent to his
lawyer's office so they can be presented to the judge as a package.
Randal's lawyer's address is:

	Marc Sussman
	503-221-0520
	135 SW Ash
	Suite 600
	Portland OR 97204
	
	Re: Randal Schwartz

Or send mail to fund@stonehenge.com to find out how else you can
assist Randal, for example financially.  That electronic mail address
goes to an autoresponder which will also send you Randal's short version
of the story.

On a personal note, I'd like to say that I actually had never met
Randal until he came to Austin recently.  However, when he sent me a
note in advance asking for a guest account on our Internet Service
Provider (Zilker Internet Park) so he could read his mail, read news,
look at web pages, etc., without having to call long distance back to
Portland, I had no hesitation in providing him one.  Yes, I knew he was
a convicted felon.  I also knew he was the co-author of *Learning Perl*
and *Programming Perl*, which are two of the most useful books about
one of the most useful programming languages I've ever encountered.  I
also knew a number of people he had taught Perl in his classes.  And I
had heard a version of his story before.  This man should not be
labeled a criminal.  He is, in fact, a pillar of the UNIX and Internet
communities (see his web page, http://www.teleport.com/~merlyn).  The
World Wide Web, for example, would not have grown as quickly and as
easily as it did without Perl, nor without Randal's efforts to
promulgate Perl.

Does being a pillar of the community make one immune from criminal
activity?  No (just ask Ivan Boesky).  However, I do not see how simple
timing mistakes while attempting to do one's job in the generally
accepted manner constitute felonious behavior.

Randal is taking this whole thing rather philosophically.  He thinks
the main benefit that could come out of it would be to prevent future
erroneous felony charges of this kind.

Much of the above account does come from Randal.  I have no reason
to doubt that he is telling the truth, but of course there may always
be more to the story.

If anyone has reports that cast a different light on the matter, do
send them in.  So far, the worst I've heard has been someone claiming
to know that Randal had ``broken into at least one system previously.''
This turned out to be an allusion to him running crack on ORA's
systems, which is something that he not only readily admits but
discussed at some length at the CACTUS meeting.  If he really did find
that crack could break no (zero) passwords on ORA's machines, it would
seem that ``broken into'' would be a rather inaccurate description.
Not to mention he already had accounts on ORA's machines.

Could it be that once someone is charged with criminal activity the
networked community considers that they must have done something to
deserve it?  If so, the networked world is much like the rest of the
world, indeed.  Actually, the discussion online has been mostly in
favor of Randal.  Incidentally, we have not yet received input from
Intel, but we would be happy to print some when we get it.

The discussion in the mainstream press has been mostly nonexistant.
Except for the local Portland newspaper and television station,
apparently no major news medium has carried the story.
So, it appears that *Matrix News* is the first national and
international publication to break the story.



Return-Path: <merlyn@teleport.com>
Date: Fri, 15 Sep 1995 03:41:02 -0700
Message-Id: <199509151041.DAA19363@desiree.teleport.com>
To: jsq@tic.com (John Quarterman)
Subject: Re: test
Precedence: bulk
From: The Fund Daemon <fund@stonehenge.com>
X-Filter: mailagent [version 3.0 PL42] for merlyn@stonehenge.com

[This message was generated automatically because you sent me mail
 containing @FUND on a line by itself, or sent mail to fund@stonehenge.com.
 I did not read the rest of your note -- merlyn]

On March 14th, 1994, I was indicted on three felony counts of Computer
Crime according to Oregon State Law.  The "victim" and accuser is
Intel Corporation (yes, the multinational microchip manufacturer), a
client of mine for five years running, and possessor of vastly greater
financial, time, and legal resources than I could ever muster up.

On July 25th, 1995, I was convicted of those same counts.

On September 11th, 1995, the sentencing went as follows (counts are
described later):

Count 1, reduced to a misdemeanor, 5 years probation, 90 days jail to
begin september 1, *1998*.  However, 60 days before this date I can
petition the court to demonstrate excellent behavior and
rehabilitation, and they may dismiss the jailtime.  Disclosure
required (see below).

Count 2, 2 years probation, 480 hours of community service, disclosure
required (see below).

Count 3, 2 years probation, 480 hours of community service (hours
count for both counts 2 and 3, so it's 480 total, not 960).
Disclosure required (see below).

Restitution hearing still to be set. Intel is asking for an additional
$9,000 over the original $63,000.

Disclosure: I must not become either a contract employee or employee
without my potential employer becoming fully aware of my conviction.

I attend my "probation induction" meeting on September 20th.  More
details then.

The charges are as follows:

Count 1: altering without authorization two computer systems.

Counts 2 and 3: accessing a computer with intent to commit theft.

First, let me say that I am sorry that I caused Intel any grief or
hardship, and that in hindsight, I should have been clearer about my
intention and actions.  I'll never get to work at Intel again, and my
mistakes may even make it nearly impossible to get any work at any
location that respects Intel's beliefs about me.

However, my actions were motivated by my desire to give Intel the best
possible value for the money they were paying me.  At no time did I
*intend* to have any harm come to Intel, and any damage they may claim
resulted from their mopping up on things that I *might* have done but
they couldn't tell I hadn't.

In short, count 1 comes from me having installed two different methods
of accessing my Intel e-mail through the Internet while I was away but
still working for Intel.  I was responsible for the timely deployment
of the DNS servers for the entire corporation, and a system
administrator on some network support machines, and I wanted to keep
on top of developing situations.  I believed at the time that I was
complying with the intent of every rule I was aware of regarding the
setup of these access methods, but it became clear at the trial that
my understanding was very different from their understanding.

Count 1 is also based on a law about which we have raised
constitutional questions of overbreadth and vagueness.  We always
thought these issues would require appellate examination.

Counts 2 and 3, as I understand it, result from their claim that I
committed "theft" of a password file from the SSD division by
copying it to a machine in the HF division where I was working and
that by running crack (the password guesser) on the file, I also
committed "theft" of the passwords.  I was a sysadm for SSD about a
year and a half previous, and I still had an active account on a lab
machine at SSD.  I had discovered that a user at SSD had picked a
dictionary word ("deacon") for a password on the lab machine.
Fearing that the SSD folks had stopped running crack regularly, I
copied the SSD password file (using the cracked password from the lab
machine) and found that my fears were justified.  (The vice
president's password was "pre$ident", for example.) However, I now
had vital information that I had obtained through the use of a cracked
password, and I was in an awkward situation.  Before I reported the
findings to SSD, a co-worker noticed the crack runs (they were 6-8
days long!) running under my own userID on the systems that we shared
at HF, and feared the worst: that I had turned into a spy and was
actually stealing secrets.

Yes, as you can see, I made a number of bone-headed mistakes (not
getting the rules about internet access clear, not reporting the
single bad cracked password, and not immediately reporting the results
of the crack run), and I probably should have been terminated for
those mistakes, but NONE OF THE ACTS WERE BASED ON MALICIOUS INTENT.

I have fought the charges using money out of my pocket and
borrowed on credit cards, and the goodwill of many special Net
Citizens such as the folks at the Electronic Frontier Foundation.

If you'd like to help, you may choose to *pay* me for "services
rendered" by me to you which you had formerly received for free.  Any
such money will be disclosed as income, and thus not tax-deductable
unless you're a business and want to file a 1099 on me.  If you wish
to contribute in blind faith that this David vs. Goliath story might
make sense when the smoke clears, send a check made out to
"Stonehenge" to:

    Stonehenge Consulting Services
    attn: Legal Defense Fund
    4470 SW Hall Suite 107
    Beaverton, Oregon 97005-2122

I regret that I cannot accept credit-card payments.  If you cannot
send a check, please buy a copy of the Llama book for a friend or the
library (or for yourself)!

I am deeply grateful and honored for having received the following
contributions thus far:

    $30 from Minneapolis, MN 55401
    $25 from Newfield, NY 14867
    $100 from Gloucester Point, VA 23062
    $50 from San Francisco, CA 94107
    $30 from Alexandria, VA 22310
    $50 from Seattle, WA 98115
    $30 from Boxboro, MA 01719
    $200 from New York, NY 10008
    $50 from Wauconda, IL 60084
    $25 from Cincinnati, OH 45236
    $130 from Corpus Christi, TX 78412
    $50 from London (United Kingdom)
    $50 from 70437 Stuttgart (Germany)
    $25 from Jackson, MS 39209
    $100 from Tucson, AZ 85718
    $162.57 from Albuquerque, NM 87110
    $75 from London (United Kingdom)
    $40 from Austin, TX 78750
    $25 from Evanston, IL 60201
    $107.46 from Sheffield (United Kingdom)
    $1000 from London (United Kingdom)
    $200 from Albuquerque, NM 87110
    $25 from Chicago, IL 60608
    $100 from Palo Alto, CA 94036
    $100 from Centreville, AL 35042
    $100 from Herndon, VA 22070
    $100 from Hamden, CT 06517
    $25 from Fairhaven, MD 20574
    $100 from Ridgewood Queens, NY 11385
    $20 from Palo Alto, CA 94306
    $30 from Ithaca, NY 14850
    $100 from San Diego, CA 92127
    $-3 from Lawrenceville, GA 30244 [bad check]
    $139.62 from Germany
    $25 from Waldorf, MD 20602
    $208.77 from London (United Kingdom)
    $500 from Portland, OR 97201
    $50 from Mountain View, CA 94043
    $200 from Portland, OR 97207
    $100 from Madison, WI 53706
    $10 from Rockville, MD 20851
    $50 from Tucson, AZ 85719
    $25 from Seattle, WA 98109
    $80 from Copenhagen, Denmark
    $25 from Pasadena, CA 91101
    $75 from Ithaca, NY 14850
    $50 from Glen Head, NY 11545
    $100 from Aloha, OR 97006
    $75 from Beaverton, OR 97008
    $3.14 from Eugene, OR 97043
    $50 from Cambridge, MA 02139
    $100 from Austin, TX 78758
    $100 from Columbus, OH 43213
    $10 from Austin, TX 78748
    $60 from Mountain View, CA 94040
    $75 from Aloha, OR 97007
    $50 from Edmonds, WA 98206
    $100 from San Jose, CA 95112
    $20 from Southfield, MI 48034
    $25 from Holland
    $20 from Northfield, NJ 08225
    $50 from Cambridge, MA 02139

for a total contribution of $5628.56.  I've spent $112379.50 so far on
my defense, and I'm told the cost will be approximately $140,000.00
before I'm through paying for the first trial, let alone the continuing
legal costs.

Thank you for your inquiry.  Yes, letters of encouragement are *most*
welcome!

This message will be updated from time to time as the money comes and
goes and I have time to update the message.  My Perl daemon
reply-agent will not mind when you ask for updated information.  Feel
free to check back again later.

If you are interested in participating in an ongoing discussion, or
just being kept up to date, please join the appropriate "Friends of
Randal Schwartz" lists at teleport.com.

To subscribe, send email to majordomo@teleport.com with

  subscribe fors-announce [your email address if different from headers]

for the announce only list (1-2 messages a week), or

  subscribe fors-discuss [your email address if different from headers]

for the discussion group.  Write me back if you have questions.

If you have access to the World Wide Web, you may also examine the
Friends of Randal Schwartz archive at:

  http://www.usa1.com/fors/

I am represented by Marc Sussman, with offices in Portland Oregon.
He can be reached at +1 503 221 0520.

print "Just another Perl hacker," # ...but not what the media calls hacker!
-- 
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <merlyn@stonehenge.com> Snail: (Call) PGP-Key: (finger merlyn@ora.com)
Web: <A HREF="http://www.teleport.com/~merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me