🚀 go-pugleaf

pdt@mundil.cs.mu.OZ.AU (Peter David THOMPSON) writes:

>MikeC originally wrote:
>Machines XX and YY belong to different departments - each
>machine's maintenance, support and associated staff being  
>paid for by the relevant department. 
This suggests different departments of a single organisation to me!

>Whilst each machine
>is run separately, they do have some users in common.  
This only strengthens that assumption.

>There are no shared filesystems between XX and YY though
>they are on the same network, and it is possible to 
>login to each machine from the other.  

>PdT's Note: This applies to almost any machine on the InterNet, doesn't it?
This alone might suggest any two machines on the Internet but not read with
the above.

>tja@cs.mu.OZ.AU (Tim Arnold) writes:

>>>If this is in fact the case, then:
>>>	1)	What are the legal implications (if any)
>>>		of the XX admin's actions?
>>Probably a breach of some Cth legislation (Criminal) concerning communications.
>>This is pretty precarious and given the prosecution's competence not likely to
>>get to court.
>>Possibly an offence under the Victorian forgery provisions but again I suspect
>>judges will be quite lenient on sys.ops. who have authority to do an awful lot
>>on the system. There may be informal understandings about mutual management of
>>resources. (These are pretty normal at Melbourne)

I refer you to your comments below about what you think I said. Technically
XX has committed a criminal offence absent any informal authority. The 
likelihood of a conviction is extremely low. I made no comment as to whether
that matters or not. I just stated my opinion on the likely outcome.

The Cth legislation is the Crimes Act (Cth) 1974 (I think). I didn't quote
sections because I don't have my personal law library here :-) and because
I was arguing that there would probably be no trial let alone a consideration
of the relevant sections. The offences relate to use of communications and
Cth facilities (the latter assumes University or similar, the former assumes
at least phone,  leased line or satelite  connections).

See Crimes Act (Vic) 1958 as amended in 1988 by the Act I referred to further
down. I think the forgery provisions are around 116, 117. Their content is
as relevant as that of the Cth legislation in this context.
There are a number of cases which consider the pre-statute offence which
I could refer you to if you would like.

>>GIVEN THE FLAMES LET ME EXPAND ON THIS.
>>We are talking about a situation where XX and YY have gotten together
>>and agreed on uids (thankyou Grenville). Now even given that XX admin has no 

>Have they? Really? You don't need to have the same uid to access an account;
>e.g. foo@xx.dec.oz.au & bar@yy.inc.oz.au can access each other's accounts
>freely provided that the .rhosts file is set up correctly. I quote from
>man rhosts under Sun 4.1:

>If the line is in the form:

>   hostname username

>then the named user from the named host can access the  sys-
>     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>tem.   This  form may be used in individual .rhosts files to
>allow remote users to access the system as a different local
>user.   If  this  form is used in the /etc/hosts.equiv file,
>the named remote user will be allowed to access  the  system
>as any local user.

>end quote (^^^^^^ mine)

I'm sorry I was miss informed on this issue. gja has already mailed I see.
If they are departments of the same organization my assumptions are not
unreasonable given my experience of the way sys.admins work together.
Certainly on a University campus where some are more competent than others at
plugging security holes.


>>explicit authority on YY it is highly unlikely (obviously in a court you
>>would have to prove this) that there is not some sort of mutual assistance
					      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>in management of the network and hence an understanding between the two
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>admins. Whether that extends to the conduct of XX admin is debatable but
>Understanding about what?
See the underlining.
>>is probably sufficient to establish that XX admin is not guilty of a crime.
Note the use of the words "unlikely" and the relationship to the context.
>>Ethically of course she should have contacted YY admin and notified her of
>>the breach and requested that she deal with the problem.
>(Nice PC bit there Tim. Try using they... It's even more PC. ;')
Its also wrong :-)

>>>>	2)	If A logs in to YY from XX and uses his
>>>>		program, does this give the XX admin the
>>>>		right to act as he did?
>>The offence of Computer Trespass prohibits a person "entering or accessing a 
>>computer system or part of a computer system" without authority.
>Precisely. XX admin has no authority to access A's accounts on system YY.

Sorry about failing to give a citation. I would have thought substantial
quotation was sufficient. This appears in the Crimes (Computer Amendment) Act
1988 s.9 amending (in this case) the Summary Offences Act (1958?)

>>XX admin has prohibited the use of WIDGET on XX. A runs WIDGET binaries on YY
>>but A is still accessing WIDGET (a part of a computer system) on XX (a 
>>computer system or part of a computer system) to run WIDGET despite an express 
>>prohibition!
>>No court in the land will fail to decide that a Computer Trespass has been
>>committed here.
>Prove it. ;'). I betcha I could find a lawyer to argue that that applies to
>systems over which XX has control. A sure has authority to use WIDGET on YY..

But not via XX.

I'm sorry. I was using an extention of the facts scenario assumed in most of
the flames that A accessed YY via XX. If that is not the case A has probably
not committed an offence unless XX admin speaks for YY as well which may be the
case but is unlikely to be the extent of XX's authority in the scenario as 
given.


>>A is in a lot of hot water if A goes to court so I suggest that A should cut
>>their losses. :-) 1/2
>>If XX sys.op. is employed to maintain the system and the use on the machine
>>is provided for course purposes then the sysop has every right to ensure that
>>the system operates the way he authorizes it. If there is some implied
>>authority but no other way for him to remove the file then why not?
> Because it's an act of computer tresspass on XX's part.
Only if there is no implied authority. Read carefully esp. if you are going to 
be so critical of other people's reading.
> Suppose I am a gardener, working for both XX and YY. XX has forbidden
> me to use any electric power tools, on pain of having them smashed. XX
> and YY are adjacent, and I keep keys handy to get between XX and YY.
> Suppose someday I run an extension cord from XX's property to YY's, and use
> power tools there. Is XX entitled to come into YY's property and smash the
> offending tool? No. Is XX entitled to pull the plug and fire me? Yes.
This is not quite analogous. XX would never have the authority to smash power
tools owned by A in any situation (he'd always have atleast an action in 
damages although some circumstances would not be criminal - Destruction of
property belongin to another, Theft c.f. Crimes Act 1958 (Vic) I forget the 
sections.
Nice emotive  aside though :-)

>>Obviously a mail message to YY admin would be more courteous but if there is an
>>understanding between the two then this is quite reasonable.
>   Who said there was any? 
I justified this quite extensively (all be it with some errors) and qualified my
comments with the all important word IF! Go through and see how often I used 
that and words like "likely", "unlikely" "debatable" etc.

>>>>	3)	What would you do in the XX admin's place?
>>Alert the YY admin of the breach and suggest they delete the binary and suspend
>>the students account indefinitely.
>   Yup. Fair enough. I'd watch out for the student's rights bodies, though...
The students rights bodies would have no comeback. The student is given
use of facilities for limited purposes (most sign or are alerted to a statement
of this nature both here in other Unis) and breach of a clear prohibition in 
this context is completely analogous to breach of a prohibition in say a library
which might lead to access being denied to the library (or prosecution if the
behaviour involved is criminal).
>   Besides, nothing in the original problem said it was a student, just
>   an "non-administrative user". Suppose XX and YY are DECR & CITRI?
A sys.admin should be a little more careful about dealing with an employee as
the extent of their authority is slightly different. Prohibition is also
quite unlikely in such blatant terms as is the run around.

Prohibition usually occurs where the program either creates unacceptable
network traffic (=> XX admin will want to avoid it running on the network not
just XX) or unaccaptable CPU time or storage (or both) (=> XX admin will want
to help YY admin avoid problems of the shifting load common when such 
prohibitions take place).

If I'm not mistaken this situation is less than hypothetical and did involve
access using X from XX to YY of a program which created large amounts of 
net traffic but you will have to confirm that with mikec.

>>>>	4)	What would you do in A's place?
>>I wouldn't be in A's place. I'm not that stupid.
>>FLAME ALL YOU LIKE. I intend to practice law in the near future and I am not
>>stupid enough to risk committing a criminal offence.
>   Assuming that A actually did log on to YY from XX AND USED THE PROGRAM.
>   In the original posting, A had not used the program forbidden by XX via
>   the systems and services provided by XX (at least the way I read it).
Acknowledged but c.f. above.
>>>>	5)	What would you do in the YY admin's place?
>>Remove access to the binary and suspend the student's account pending an 
>>explanation.  After making the student sweat a little I'd restore the account. 
>>If it happened again I'd refer the student to the Head of Department XX after
>>suspending the account recommending disciplinary action or prosecution.
>  Why? What rules has A voilated? 
>>I changed the subject because I was concerned about amatuer lawyers conjecture
>>about what is or is not criminal behaviour. 

>>A few closing remarks:
>> - if you are going to suggest certain behaviour is criminal refer to 
>>   legislation not to wanky ideas about what is or isn't ethical
>  Ok. Give us some Act/Section/Subsection references then.
Sorry I thought quotations were sufficient. My original post referred to Acts.
>> - judges always take informal understandings into consideration in a case,
>>   users are rarely told about such arrangements
>  Yeah, but whether XX and YY have any such arrangements is something else.
Did I comment here in that respect?
>> - what appears to be criminal on the face of the legislation is not always
>>   what the courts will find to be criminal! 
>> - judges in Australia (unlike those on LA Law) are not petty legalists and 
>>   quite rightly take a simplistic approach. XX admin is acting to ensure her 
>>   directions are complied with and A is trying to circumvent them.
>>   XX wins, A loses.
>How was A acting to circumvent them? 
Oh come on!
>does XX have power over all accounts 
>that A has? 
You need to look up the meaning of "if"
>If I have an account on a system that forbids FTP can I never
>use FTP on any system I have an account on?
It would be unwise to access it via that account, yes. If you don't then go 
for it.

>To summarise:
>  tja believes that A has broken the law, and even if XX has, it doesn't
>  matter.
This has already been dealt with.
>  I believe that A has not broken the law, but XX has.
I outlined some situations where A definitely could be convicted. A is not
necessarily guilty of an offence without further information. However, given
the role of A with respect to XX admin (XX is a machine :-) XX admin is less
likely to be convicted of an offence than A so unless A's behaviour is spotless
(in the court's eyes not vague ethical terms) A should not pursue the matter.
>  that a fair summary?
Not quite.

>>AS TO FLAMES ABOUT MY DISCLAIMER
>>I know enough about law to know that most of you are up for awfully big law 
>>suits if somebody relies on your advice. Until I am practicing and can provide 
>>indemnity insurance I'm not giving advice carte blanche.
>>This does not illustrate lack of confidence in my advice, just realistic
>>expectations that I am human (as the mix-up illustrates) and so are judges.
>>You want indemnity come and see me when I charge you by the hour.
>  No thanks. So far, I think that you haven't even grapsed the problem.
Or maybe you haven't read my answer very carefully to see what information was
added or assumed.
>># This is not legal advice. If you intend to act on these statements you should
>>obtain appropriate legal advice from a qualified solicitor. I am not
>>responsible for damages arising from reliance on these  statements.
>  Don't worry. You're safe with me.
I know. I included the disclaimer.

Tim.
-- 
-----------------------------------------------------------------------------
Tim Arnold        | Law/Science (Computer Science)   |  simul iustus
tja@cs.mu.oz.AU   | The University of Melbourne      |  et peccator
=============================================================================