Computer and Communications Security DAN GLICKMAN Kansas, RAYMOND J
Total Page:16
File Type:pdf, Size:1020Kb
~ ..... ", If you have issues viewing or accessing this file contact us at NCJRS.gov. W' ~", i (( I) <, I I )1 >, \\ [COMMI1;TEE PRINT]' () ~ o • ,,A' ., IJ if \l COMPUTER AND COMMUNICATIONS i) SECURITY AND PRIVACY o "\ R'EPORT " /, f' PREPARE~j;BY 'J,'HE \I o J) ,,~I / SUBCOMMITTEE ON (7 r; " \ c TRANSPORTATION, AVIATION AND MATERIALS TRANSMITTED TO THE ;., ' ,;,0, COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES NINETY-EIGHTH CONGRESS (r' , / 0 (r O o SECOND SESSION ' Serial AA I' Ii () \i .~ o <) \ \ APRIL 1984 c' '" ,\ ~. ,/:'. or the use of the Committee on Science and Technology \ In ~ \ U.S. GOVERNMENT PRINTING OFFICE " WASHINGTON: 1984 '- -~ ;~ ./.\ ..... \1 i I I ':,\ LETTER OF SUBMITTAL " HOUSE OF REPRESENTATIVES, 1/ COMMITl'EE ON SCIENCE AND TECHNOLOGY COMMITTEE ON SCIENCE AND TECHNOLOGY, DON FUQUA; ~1.orida, Cha.irman Washington, D.C., April 198.4. ROBERT A. ROE, N6w Jersey LARRY WINN, JR., Kansas Hon. DON FUQUA, GEORGE E. BROWN, JR., California MANUEL LUJAN, JR., New Mexico JAMES H. SCHEUER, New York ROBERT S. WALKER, Pennsylvania Chairman, Committee on Science and Technology, RICHARD,L. OTTINGER, New York . WILLIAM CARNEY, New York U.S. House ol Representatives. TOM 'HARKIN, Iowa i F.JAMES SENSENBRENNER, JR., DEAR MR. CHAIRMAN: It is my pleasure to present to you the MARILYN LLOYD, Tennessee Wisconsin DOUG WALGREN, PennsylVahia JUDD GREGG, New Hampshire SubcommitteE;';s report on Computer and Communications Security DAN GLICKMAN Kansas, RAYMOND J. McGRATH, NewYor}l; and Privacy. It is based on hearings before the SlJ.bcommittee last '-~) . \ '":' ALBERT GORE, JR., Tennessee ·t·", JOE SKEEN, New MeXICO September 26 and October 17 and 24. ROBERT A. YOUNG, Missouri CLAUDINE SCHNEIDER, Rhode Island HAROLD L. VOLKMER, Missouri BILL LOWERY, California The report centers on the immense growth of computer usage by t BILL NELSON, Florida ROD CHANDLER". Washington government, business, private organizations and individuals; the STAN LUNDINE, New York HERBERT H. BATEMAN, Virginia ramifications of that growth; and ways to cope with the potential R.ALPH M. HALL Texas SHERWOOD L. BOEHLERT, New York dangers of those l'amifications. DAVE McCURDY: Oklahoma ALFRED A. (AL) McCANDLESS, California , , MERVYN M !'JYMALLY, California TOM LEWIS, Florida The problems and potential problems range from hackers who ,PAUL SIMON, TIlinois have outwitted)arge corporations and government agencies by tap NORMAN Y. MINETA, California ping into their computers, to cdminals who can master the capabil .~ if RICHARD J. DURBIN,lllinois MICHAEL A. ANDREWS, Texas ity of making illegal international bank transfers. Electronic intru BUDDY MAcKAY, Florida sion can give private meqical information to total strangers, dis TIM VALENTINE, North CaroMa rupt air traffic control systems, and endanger national security. HARRY M. REID, Nevada 'I The potential for abuse and misuse pf computers is very serious ROBERT G.TORRlCELLI, New Jersey FREDERICK C. BOUCHER, Virginia indeed. .. HAROLD P. HANSON, Executive Director The Subcommittee recommendations call for a national commis ROBERT C. KETcHAM, General Counsel sion to examine comprehensively a vast array of multi-jurisdiction REGINA A. DAVIS, Chief Clerk al issues that arise from consideration of this subject. These.. in DAVID S. JEFFERY, Minority Staff Director . () clude the vulnerability of critical national computer systems, com puter crim.e, the' effect of new technologies on personal privacy and SUBCOMMI'lTEE ON TRANSPO~TATION, AVIATION Am> MATERIALS the Federal role in protecting information on citizens. I would especially like to thank Mrs. Louise Becker of the Con (". DAN GLICKMAN,' Kansas, Chairman gressional Research Service for her many valuable contributions to ALBERT GORE, JR., Tennessee WILLIAM CARNEY, New York MERVYN M. DYMALLY, California SHERWOOD L. BOEHLERT, New York both the hearings and the preparation of this report. nICHARD L. OTTINGER, New York ALFRED A. (AL) McCANDLESS, California With best regards, TOM HARKIN, Iowa Sincerely, MICHAEL A. ANDREWS, Texas o DAN GLICKMAN, \./ r Cq/tirman, Subcommittee on Transportation, .. Aviation and Materials . .. 1/< II (III) o ;,,1 If tf .' i) Ii,' 'f t '\ 9 i I I i I ,) iJ : ,j I o D CONTENTS ii Page 1. FINDINGS AND RECOMMENDATIONS ......................................................... .. 1 II. BACKGROUND ......... ;............................................................................................ .. 7 , " !) A. Understanding the Issues ................................................................................. 7 B. National Concerns ........................................................................... c••••••••••••••••••• 10 C. Scope of the Hearings .................... :................................................................... 10 III\\SUMMARY..AND ANALYSIS OF THE HEARINGS ...................................... 12 G A .. IntroductlQP- .............................. ;.............................. ;...................................... "? .. 12 B. Some General Problems and Possible Remedies ...................................... : .. .. 12 1. Privacy ........................................................................................................ 14 2. Vulnerabilities and Threats ......................., .................. , ................ :........ 16 c) a. Pers·onnel ...... ,.......... .11 •••••••••••••••••••••••• : • ••• :r ••••••••••••••••• ~' •••••••••••••••••••••• 16 b. Computer Hackers .............................................. " ....................... 17 c. Computer Crimes ..................... ;....................................... :'........... 19 d. Poor Password l\1anagement ... :; .... :: ......................................... .. 20 e. Implications of Techn~logical rnnovati~~.............................. 21 3. "Countermeasures ................... ;'~: ............ :; ...... d ........ ,.. .......................... 22 a. Better Management Controls ................ p ................................... 22 b. Raising_Public Awareness ............................ ;'............................. 23 c. Technological Protective Measures .......... :................................ 23 , (1 d. Legal Countermeasures .................................. :.. .'....................... .. 24 C. LegaIrA.spects and Legislative Direction ......... :........... :'.................................. 25 1: ~mputerCrime Legislatjon ................................................................ .. 25 < u ""a. Call for Clearer Definitions ........... :; .......... '................................ ';'. 26 D l De arlment of Jusil~e : , b. Intrusion and Unintentional Trespass ............... :.... ;............... 27 \ . U.~. .' fInstitute of JustIce . J~\ 2. Respolisibility, Own~rship, and Liability ................ \, .......................... :. .' , Natlona . d from the r ' 28 tl'/ as receIVe d \ a. Electronic Mail Systems ................................................ " .......... .. 28 b n reproduced exac. pinions state' ',"'-., . ..b. Vendors Responsibilities .................................. "" ..... ;........... \)' .... .. 28 "This document l~~~i6ri~riginating it. points of vl~wd~r ~ot necessarily . \. D. Leadership Issues ........................................................ ;.......................... " ......... .. 28 pers?n or organ t are those of the ~~thor~ ~n National Institute of , 1. Lack of Strong National Leadership .................. (l............................... in ttllS docun:)en. I. sition or policies 0 e '. () 28 ref?resent the officI a po . .0 2. Federal Leadership and Initiatives ....................? ............... 'r ............... .. 29 ' a. The Role of the Office of Management and Budget.. ........... .. 30 Justice. " .. ,. '!' hied material has been . ,b. Criticisms of the OMB Approach ........................ ,.... : .............. .. 31 . 'to reproduce this 99~.(rl9 ~ /! ".. Permission ./ 3. Balancing Natjonal Security and Civilian Needs .... ~~ ........................ 32 4. Research 'and Development .............. "' .... , .................... ;... ., ...................... " granted by • I 0 C,, 33 a,; f ........... .............. : ............... ,- " . :oana l..U . ' " DOD Computer Security Center ... r 34 _ pnb~c-'. .'. ,...osen1-atbteS b. National Bureau of Standards Activities, .. ,........................... .. 35 c S· Honse of Bet4~ . c."'Other R.esearch Approaches .......................' ................................ 36 ll. ". J fce Reference Service (NCJRS). d.' Private Sector Research Initiatives......................................... .. 37 II the National Criminal us I , I E. Oth~r Initiatives and Approaches .......................................... i ........ ~ ............... to . .. perm s" 37 . NCJRS system requires 1., Establis¥?ent of a ~ational.Com~ission ................. ~ ........ ~ ............... .. outside of the 37 Further reproduction ~ 2. Non-NatIonal Securlty ClaSSIficatIOn Schemes ........!; ............... "" .... ... 38' . sion of the ~~pi~flt,own.~r. 3. Enhancement of Law Enforcement Capabilities ............................... 40 APPENDIX Pil List of Witnesses .........................................., .... ;................................... 40 APPENDIX B: List of Federal Statutes and Executive Orders Pertinent to Security and Privacy Aspects of Computer Related Crime ..... i ......... :~ .......... , ... .. 41 (\7) iJ 'j (', t' (;'J' () n I) " Q ,) .: " ,. .0 - \) • • • ~ ~,J Pi 11'