🚀 go-pugleaf

In article <1992Jul31.180107.2263@midway.uchicago.edu>, h309@ellis.uchicago.edu (Unknown Author) writes:
|> If root suspected a user of some foul play, such as a trojan horse login
|> program, etc. Does root have the right to look through the user's 
|> directory without the user's permission? It would kinda be like rummaging
|> through a person's house without a search warrant....
|> 

The purpose of a search warrant, as I understand it, is to demonstrate
to someone outside the group making the search that there is
sufficient reason to justify looking for more evidence of a crime.
I also understand, although I may be wrong on this one, that the
search warrant allows for a search for evidence of a particular crime,
and no others unless they are listed on the warrant.  Thus, if a
search warrant is for evidence of counterfeiting, and the searchers
also find evidence of credit card fraud, they cannot charge the
suspect with counterfeiting and credit card fraud.  They have to get a
separate indictment and/or search warrant for the fraud.

So the question arises, how did root come to suspect that user of foul
play?  Presumably because they found some evidence somewhere that
pointed at that user.  In the search warrant model, the system
administrator has the initial condition for initiating a search
without the user's permission.  All that is needed is an outside body,
meaning one that does not look for evidence of "crimes", to agree that
there is sufficient reason to look further.  That outside body could be
the sysadmin's manager or some other judicial organization in the
enterprise.  In a business setting, it would almost always be the
sysadmin's manager, if anyone.  A university setting may have the
luxury of another entity.  Given the permission or agreement of that
outside body, the system administrator then has the right to look for
more evidence without the user's permission.  This process need not be
formal or bureaucratic.  Verbal assent from the manager or director or
judicial entity should be sufficient in most cases.  However, this puts
a concomitant duty on the sysadmin's manager or the judicial entity to
take responsibility if the user raises a ruckus.  The system
administrator should rightly be shielded from any adverse consequence
of a properly executed search.  Once in the user's files, the system
administrator shouldn't look for evidence of other things, and
shouldn't really be able to simultaneously act on any evidence of other
rule breaking that they may find.

Users should be made aware, when they first get an account, that there
is someone who can authorize inspection of their data without their
prior consent, and that there are situations where this can be
done.  This should be part of the user's consent agreement to obtain
the account.  I think this addresses the issue of "can you search the
user's files without their prior permission."

I think you are asking the question, "Is it right for the system
administrator to be both the the search entity and the entity that can
determine that there is sufficient reason for a search?"  I don't see
any a priori reason why a system administrator cannot be, if they are
sufficiently able to maintain objectivity and respect for the
principle that is in force here (balancing privacy vs. system security).
But if they are both entities in one, then they also must take
responsibility for any adverse consequences.  If the sysadmin is
unwilling to take that kind of responsibility, then they should find
someone else to hold assent authority and responsibility.  And
obviously, if there is evidence that the system administrator is
cynically abusing the power of determine search/conduct search, then a
greater separation is called for.


-- 
Joseph A. Watters, Jr.		jaw@owlnet.rice.edu
Deputy Director, Owlnet
Rice University
Houston, Texas