****************************************************************************
>C O M P U T E R U N D E R G R O U N D<
>D I G E S T<
*** Volume 1, Issue #1.19 (June 26, 1990) **
** SPECIAL ISSUE: MALICE IN WONDERLAND: THE E911 CHARGES **
****************************************************************************
MODERATORS: Jim Thomas (Sole moderator: Gordon Meyer on vacation)
REPLY TO:
[email protected]
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.
--------------------------------------------------------------------
DISCLAIMER: The views represented herein do not necessarily represent the
views of the moderators. Contributors assume all responsibility
for assuring that articles submitted do not violate copyright
protections.
--------------------------------------------------------------------
This issue is the concept outline of one section of a paper to be submitted
to the Midwest Sociological Society's annual meetings in 1991 and will
ultimately be submitted for publication. The intent of the paper is to
develop a discourse analysis of how "social facts" are given "legal
meanings." The saliency of the current crackdown on alleged "computer
crime" seems an excellent way of tapping the clash between new meanings and
old definitions, and how courts become the battlefield for over these
meanings.
This draft is not copy-protected and may be used as appropriate.
The prose and ideas here remain tentative and incomplete, and will be refined.
It is circulated for conceptual, theoretical, and bibliographic
comments.
********************************************************************
THE SECRET SERVICE, E911, AND LEGAL RHETORIC:
MALICE IN WONDERLAND?
Jim Thomas
Department of Sociology
Northern Illinois University
DeKalb, IL 60115
(28 June, 1990)
________
Concept outline for larger paper to be submitted at the Midwest
Sociological Society annual meetings, 1991.
THE SECRET SERVICE, E911, AND LEGAL RHETORIC:
MALICE IN WONDERLAND?
"When I use a word," Humpty Dumpty said, in rather a scornful
tone, "it means just what I choose it to mean--neither more nor
less."
"The question is," said Alice, "whether you can make words mean
so many different things."
"The question is," said Humpty Dumpty, "which is to be
master--that's all" (Carroll, 1981: 169).
Law is more than simply assuring public order. It is also, as White (1984)
argues, "action with words." The rhetoric of law is played out in the
drama of the courtroom, and the denouement of the play is scripted by the
language of statutory and case law, indictments, and the talk of the
courtroom performers (Nichols, 1990; Thomas, 1983, 1989).
- 1 -
Part of this language game involves a battle over competing definitions,
meanings, and nuances that may be unrelated to "facts," and instead
replaces facts with rhetoric, or a style of persuasion. The language of
indictments and how evidence is presented provides one window through which
to observe this rhetorical battle. Indictments are the means by which a
"bad act" is transformed into a formally sanctionable one by creatively
linking the act to the law that it ostensibly violates. A recent federal
indictment of an alleged computer hacker provides on example (U.S. v. Rigs
and Neidorf, 90-CR-0070, Northern District of Illinois, Eastern Division).
(For a background on the issues involved, see especially Barlow, (1990),
Denning, (1990), Goldstein, (1990), Markoff, (1990), and Schwartz (1990).
This outline is divided into two parts. Section one first presents formal
"indictment talk" and that to which it speaks. The second section, not
included here, will provide a semiotic/deconstructionist analysis.
The indictment begins with a degradation game, one in which the credibility
and character of the defendant is attacked because of a presumed deviant
behavior and association with deviant groups. The goal is to stigmatize
hackers such that prejudicial meanings are imposed. It is a clever
linguistic trick that creates a tautology that defines the guilt of the
defendant by recursing back to the allegation in a manner that produces
linguistic "evidence of guilt." This would be analogous to calling an
alleged murder a "murderer" in court, rather than requiring that the label
must first be demonstrated to be true. In short, the "thing" becomes the
"name:"
- 2 -
5. _Computer Hackers_ - As used here, computer hackers are
individuals involved with the unauthorized access of computer
systems by various means. Computer hackers commonly identify
themselves by aliases or "hacker handles" when communicating with
other hackers.
The rhetoric first attempts to transform the conventional and broader image
of "hacker" into one that is malignant in a way that will allow anyone
associated with the label to be, by definition, stigmatized as a criminal.
Yet, there is considerable evidence that the term does not, in itself,
refer to an illegal activity, and that many who consider themselves
"computer hackers" do not engage in computer trespass, whether unauthorized
or not.
The assumption that all computer hackers are intent on committing criminal
trespass or fraud distorts the nature of the activity. Only the most
extreme examples come to the attention of law enforcement officials and the
public, and this obscures the complexity both of hacking and of the CU. In
its broadest sense, hacking is the dual process of obtaining and using
sufficient mastery of computers and programs to allow resolution of a
computer problem for which no previous knowledge or guidance exists. The
Hacker's Dictionary, a text file widely circulated on BBSs, provides this
definition:
- 3 -
HACKER %originally, someone who makes furniture with an axe% n.
1. A person who enjoys learning the details of programming
systems and how to stretch their capabilities, as opposed to most
users who prefer to learn only the minimum necessary. 2. One who
programs enthusiastically, or who enjoys programming rather than
just theorizing about programming. 3. A person capable of
appreciating hack value (q.v.). 4. A person who is good at
programming quickly. Not everything a hacker produces is a hack.
5. An expert at a particular program, or one who frequently does
work using it or on it; example: "A SAIL hacker". (Definitions 1
to 5 are correlated, and people who fit them congregate.) 6. A
malicious or inquisitive meddler who tries to discover
information by poking around. Hence "password hacker", "network
hacker".
A computer programmer's attempt to help a colleague enter a system when a
password has been lost or forgotten, de-bugging a copyright software
program, or testing a system's security are examples for which a benign
form of hacking is both required and considered acceptable. Nonetheless,
this deceptive definition was successful, for it convinced Judge Nicholas
Bua that the prosecutor's definition was the most common, would be unlikely
to confuse a jury, and was not prejudicial (See Memorandum Order in CuD
1.16).
Another rhetorical ploy in this same passage is the attempt to connect the
use of aliases with deviant activity. Pseudonyms are widely used on BBSs,
and their use reflects a cultural practice including, but hardly limited
to, members of the computer underground. Yet, clever rhetorical twists
distort the cultural meaning and impute to it one totally at odds with
reality by playing on the myth that pseudonyms reflect attempts to hide
"bad acts."
- 4 -
A third rhetorical ploy in this section of the indictment associates the
defendant with a loosely connected group known as "Legion of Doom," which
was a small collection of people who shared technical knowledge between
themselves and others. Without presenting any evidence whatsoever, and
without citing an indictment, on-going case, or justifying the claims, the
indictment asserts that the group was "closely knit" and involved in
disrupting telecommunications, bank fraud and other serious felonious
behavior. Because of its amorphous nature and ambiguous boundaries
defining "affiliation," the indictment's language offers little means to
resist the imposition of its "legal meaning:"
6. _Legion of Doom_ - As used here the Legion of Doom
(LOD) was a closely knit group of computer hackers involved in:
a. Disrupting telecommunications by entering
computerized telephone switches and changing
the routing on the circuits of the computerized
switches.
b. Stealing proprietary computerized information
from companies and individuals.
c. Stealing and modifying credit information on
individuals maintained in credit bureau
computers.
d. Fraudulently obtaining money and property from
companies by altering the computerized
information used by the companies.
e. Sharing information with respect to their
methods of attacking computers with other
computer hackers in an effort to avoid law
enforcement agencies and telecommunication
experts from focusing on them, alone.
- 5 -
The indictment itself focuses on the alleged "theft" and dissemination of
an E911 document from Bell South. Although those close to the case indicate
that only a small portion of a training document was at issue, the language
of the indictment attempts to link this document and its possession and
dissemination to severe threats to the commonweal:
22. It was further part of the scheme that on or about
February 24, 1989 defendant NEIDORF disseminated the disguised E911
text file in issue 24 of "PHRACK" newsletter.
23. It was further part of the scheme that the
defendant NEIDORF would disseminate and disclose this information to
others for their own use, including to other computer hackers who
could use it to illegally manipulate the emergency 911 computer
systems in the United States and thereby disrupt or halt 911 service
in portions of the United States.
Such rhetoric raises the spectre of people dying, and one news story
actually wrote that there was no evidence of any deaths as the result of
the behavior, thus re-inforcing the apparent danger to the public. The
rhetoric sounds serious. But, what in fact is the evidence? The PHRACK
file reprinted here is as it appeared in the original issue. The
indictment indictates it *IS NOT* the same as the one that has allegedly
been stolen, because it has been "edited," "retyped," and "disguised."
- 6 -
--------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 24, File 6 of 13
E911 - Enhanced 911: Features available include selective routing,
selective transfer, fixed transfer, alternate routing, default
routing, Automatic Number Display, Automatic Location
Identification, night service, default routing, call detail
record.
End Office - Telephone central office which provides dial tone to the
subscriber calling 911. The "end office" provides ANI
(Automatic Number Identification) to the tandem office.
Tandem Office - Telephone central office which serves as a tandem (or
hub) for all 911 calls. Must be a 1AESS type of
central office. The tandem office translations
contain the TN/ESN relationships which route the 911
call to the proper SAP. The tandem office looks up
the ANI (TN) that it receives from the end office and
finds the ESN (routing information) which corresponds
to a seven digit number ringing in at a PSAP.
PSAP - Public Safety Answering Point, usually the police, fire and/or
rescue groups as determined by the local municipalities. A
"ringing" will not have ANI or ALI capabilities, but just
receives calls or transferred calls from another PSAP.
ESN - Emergency Service Number (XXX) that is assigned to the
subscriber's telephone number in the tandem office translations
The ESN represents a seven digit number by which the tandem
office routes the call to the proper PSAP. PSAPs with ALI
capabilities also receive a display of the ESN information which
shows which police, fire and rescue agency serves the telephone
number calling 911. An ESN is a unique combination of police,
fire, and rescue service for purposes of routing the E911 call.
ANI - Automatic Number Identification corresponds to the subscriber's
seven digit telephone number. The ANI displays at the PSAP on
the digital ANI display console.
ALI - Automatic Location Identification provides for an address
display of the subscriber calling 911. With ALI, the PSAP
receives the ANI display and an ALI display on a screen. The
ALI display includes the subscriber's address, community, state,
type of service and if a business, the name o the business. The
PSAP will also get a display of the associated ESN information
(police, fire, rescue).
Selective Routing - The capability to route a call to the particular
PSAP serving the address associated with the TN
making the 911 call. Selective routing is
achieved by building TN/ESN translations in the
tandem central office. These translations are
driven by the E911 data base which assign the ESN
to each telephone number based on the customer's
address. Service order activity keeps the E911
data base updated. The E911 data base, in turn,
generates recent change to the tandem office
(through the SCC or RCMAC) to update the TN/ESN
translations in the tandem data base.
Selective Transfer - Provides the PSAP with the ability to transfer
the incoming 911 call to a fire or rescue service
for the particular number calling 911 by pushing
one button for fire or rescue. For example, if
an incoming 911 call was reporting a fire, the
PSAP operator would push the fire button on the
ANI console; the call would go back to the tandem
office, do a lookup for the seven digit number
associated with fire department, for the ESN
assigned to the calling TN, and automatically
route the call to that fire department. This
differs from "fixed" transfer which routes every
call to the same fire or rescue number whenever
the fire or rescue button is pushed. The PSAP
equipment is optioned to provide either fixed or
selective transfer capabilities.
Alternate Routing - Alternate routing provides for a predetermined
routing for 911 calls when the tandem office is
unable to route the calls over the 911 trunks for
a particular PSAP due to troubles or all trunks
busy.
Default Routing - Provides for routing of 911 calls when there is an
ANI failure. The call will be routed to the
"default" ESN associated with the he NNX the caller
is calling from. Default ESNs are preassigned in
translations and are usually the predominant ESN for
a given wire center.
Night Service - Night service works the same as alternate routing in
that the calls coming into a given PSAP will
automatically be routed to another preset PSAP when
all trunks are made busy due to the PSAP closing down
for the night.
Call Detail Record - When the 911 call is terminated by the PSAP
operator, the ANI will automatically print-out on
the teletypewriter located at the PSAP. The
printout will contain the time the call came into
the PSAP, the time it was picked up by an
operator, the operator number, the time the call
was transferred, if applicable, the time the call
was terminated and the trunk group number
associated with the call. Printouts of the ALI
display are now also available, if the PSAP has
purchased the required equipment.
ANI Failure - Failure of the end office to identify the call and
provide the ANI (telephone number) to the tandem office;
or, an ANI failure between the tandem office and the
PSAP.
Misroute - Any condition that results in the 911 call going to the
wrong PSAP. A call can be misrouted if the ESN and
associated routing information are incorrect in the E911
data base and/or tandem data base. A call can also be
misrouted if the call is an ANI failure, which
automatically default routes.
Anonymous Call - If a subscriber misdials and dials the seven digit
number associated with the PSAP position, they will
come in direct and ANI display as 911-0000 which will
ALI as an anonymous call. The seven digit numbers
associated with the PSAP positions are not published
even to the PSAPs.
Spurious 911 Call - Occasionally, the PSAP will get a call that is not
associated with a subscriber dialing 911 for an
emergency. It could be a subscriber who has not
dialed 911, but is dialing another number, or has
just picked up their phone and was connected with
the PSAP. These problems are equipment related,
particularly when the calls originate from
electromechanical or step by step offices, and are
reported by the E911 Center to Network Operations
upon receipt of the PSAP inquiry reporting the
trouble. The PSAP may get a call and no one is
there; if they call the number back, the number
may be disconnected or no one home Again these are
network troubles and must be investigated.
Cordless telephones can also generate "spurious"
calls in to the PSAPs. Generally, the PSAP will
hear conversation on the line, but the subscribers
are not calling 911. The PSAP may report spurious
calls to to repair if they become bothersome, for
example, the same number ringing in continually.
No Displays - A condition where the PSAP ALI display screen is blank.
This type of trouble should be reported immediately to
the SSC/MAC. If all screens at the PSAP are blank, it
is an indication that the problem is in the circuits
from the PSAP to the E911 computer. If more than one
PSAP is experiencing no display, it may be a problem
with the Node computer or the E911 computer. The
SSC/MAC should contact the MMOC to determine the health
of the HOST computer.
Record Not Found - If the host computer is unable to do a look up on a
given ANI request from the PSAP, it will forward a
Record Not Found message to the PSA ALI screen.
This is caused by service order activity for a
given subscriber not being processed into the E911
data base, or HOST computer system problems whereby
the record cannot be accessed at that point in time.
No ANI - This condition means the PSAP received a call, but no
telephone number displayed on the ANI console. The PSAP
should report this condition immediately to the SSC/MAC.
PSAP Not Receiving Calls - If a PSAP cannot receive calls or request
retrieval from the E911 host computer,
i.e., cable cut, the calls into that PSAP
must be rerouted to another PSAP. The
Switching Control Center must be notified
to reroute the calls in the tandem office
E911 translations.
MSAG - Master Street Address Guide. The MSAG ledgers are controlled
by the municipality which has purchased the E911 ALI service,
in that they assign which police, fire or rescue agency will
serve a given street an number range. They do this by
assigning an ESN to each street range, odd, even, community
that is populated in the county or municipality served. These
MSAGs are then used as a filter for service order activity into
the E911 computer data base to assign ESNs to individual TN
records. This insures that each customer will be routed to the
correct agency for their particular address. In a non-ALI
County, TAR codes are used by the Telephone company to assign
ESNs to service conductivity and the County does not control
the ESN assignment. TAR codes represent the taxing authority
for the given subscriber which should correspond to their
police, fire and rescue agencies. The MG method, of course, is
more accurate because it is using the actual service address of
the customer to route the call and provides the county with
more flexibility in assigning fire and rescue district, etc The
Customer Services E911 Group maintains the E911 computer data
base and interfaces with the County (customer) on all MSAG or
data base activity.
___________________________________________________________________________
What in fact is this document? It is simply a partial glossary available
from other sources, and hardly of any technical value. It presents 22
terms, six of which are found in at least one public book (e.g., Ambrosch,
Maher and Sasscer, 1989), and the rest found either in the text of that
work (see esp. Chapter 9) or readily found elsewhere. Further, if this
document can be deciphered as potentially dangerous, then what is one to
make of the Amborsch, Maher and Sasscer volume itself, which not only
provides several hundred definitions, but also includes detailed technical
information and diagrams about the operation, administration, and
functioning of Bell systems? There is nothing in the PHRACK document, or in
any of the so-called "phreak/hacker" magazines that is not available in
more detail from any work found in the classroom or library.
A cursory reading of Ambrosch, Maher, and Sasscer (1989) provides
references to many of these definitions, and we have seen others in the
"chat" section of public BBSs. Below we provide a sample of terms readily
available to the public. Those without a reference are either common terms
or are readily deducible from the referenced items:
Alternate Routing
Anonymous Call
- 14 -
ALI (Glossary, 285; pp 173-175; throughout)
ANI (Glossary, p. 285 and throughout)
ANI Failure
Call Detail Record
Default Routing (referenced on p. 166)
End Office (Standard communications term)
ESN
E911 (Standard definition, ubiquitous)
Misroute
MSAG (Definition found on BBSs)
Night Service
No ANI
No Displays
PSAP (Glossary, p. 287)
PSAP Not Receiving Calls
Record Not Found
Selective Routing (reference on p. 166)
Selective Transfer
Spurious 911
Tandem Office
Despite the banality of these terms, the indictment's discourse was
sufficiently clever to convince Judge Bua that the information was indeed
"valuable," and "confidential," and despite its public availability, is
"property" that deprives Bell South of "something of value." However, the
judge seems taken in by the chicanery of the prosecutor's linguistic
- 15 -
distortion that manipulates the symbols of PHRACK's style to create an
alternative reality that is, at best, questionable. Consider, for example,
the following passage. First assume it appears in a scholarly article
explaining the basic service of E911:
With the non-IN Emergency Response Service (ERS), the caller
dials a special emergency number (very short, usually three
digits) which is uniform within a country, (for example, 911 in
the USA, and in West Germany 110/0110 for police and 112/0112 for
fire or ambulance) (Ambrosch, Maher and Sasscer, 1989: 162).
Now, re-frame the same passage, but preface it with a sentence like: "At
the last hackers' convention, Holly Hackwood described the E911 basic
service like this: (and now re-read the passage)." Is the E911 document
illegal when published in PHRACK (for that is what the indictment charges),
but legal when published in a library book or a research paper? The point
is that it is not only possession of public information that is being
prosecuted, but the manner in which the symbols are packaged.
In CuD 1.17, we cited a California law that makes it a felony to merely
POSSESS certain types of information, whether that information is used or
communicated to others or not. The "crime" of the "hacker" seems to be not
only possession of information freely available to the public, but also of
presenting relatively innocuous information in the discourse of an
anti-establishment ethos. More simply, the "crime" is that of speaking a
different language than law enforcement officials who seem willing to
distort that language with rhetorical ploys of their own.
- 16 -
White (1984) suggests that, in legal discourse, "words lose their meaning"
and that law is as much a language game as it is the application of
statutes and cases to behavior. The resulting danger is that language
becomes a weapon to subvert freedom of speech. In an era when most people
are not "culturally literate" in the nuances of techno-speak, the ease of
distortion puts defendants at risk in bench or jury trials where a common
framework of meaning is intentionally obscured in the battle over symbolic
terrain. In the next section the language of law as reflected in the
indictment will be "deconstructed," and the logic and imagery made more
apparent.
(End this section)
BIBLIOGRAPHY
Ambrosch, W.D., A. Maher and B. Sasscer (Eds.). 1989. The Intelligent
Network: A Joint Study by Bell Atlantic, IBM and Siemens. Berlin:
Springer-Verlag.
Barlow, John Perry. 1990 (forthcoming). "Crime and Puzzlement." The
Whole Earth Review.
Denning, Dorothy. 1990. "Concerning Hackers Who Break into Computer
Systems." Paper presented at the 13th National Computer Security
Conference, Washington, D.C., Oct. 1-4.
- 17 -
Goldstein, Emmanuel. 1990. Editorial Commentary on "Operation Sun Devil."
2600 Magazine, /Spring.
Markoff, John. 1990. "Drive to Counter Computer Crime Aims at Invaders."
The New York Times, /June 3: 1, 21.
Nichols, Lawrence T. 1990 (forthcoming). "Discovering Hutton: Expression
Gaming and Congressional Definitions of Deviance." Pp. *-* in N. Denzin
(ed.), Studies in Symbolic Interaction, Vol. 11. Greenwich (Conn.): JAI
Press.
Thomas, Jim. 1989. Prisoner Litigation: The Paradox of the Jailhouse
Lawyer. Totowa (N.J.), Aldine.
_____. 1983. "Justice as Interaction:: Loose Coupling and Mediations in
the Adversary Process." Symbolic Interaction, 6(Fall): 243-260.
White, James Boyd. 1984. When Words Lose their Meaning: Constitutions and
Reconstructions of Language, Character, and Community. Chicago: University
of Chicago Press.
!
