Thank you.
The militarists of Berlin and Tokyo started this war, but the massed, angered forces of common humanity will finish it.
East Wind Rain, the Pacific War, 1897-1945.
On Weaponry, every Tuesday night in November and December, you'll hear a series of programs documenting the road to Pearl Harbor.
Weaponry, Tuesday nights at 1.30.
3rd Rail, the magazine of Asian and Pacific Islander news and views, this month listens in on video maker Richard Fung and cultural critic Bell Hooks.
Join us on December 13th at 1.30 p.m. as they discuss the changing issues of race, sex, and class in the Americas.
That's 3rd Rail on Friday, December 13th at 1.30 p.m. only on listener-supported radio WBAI 99.5 FM.
And it's just about three minutes after nine o'clock.
Time once again for the weekly program, Off the Hook.
The telephone keeps ringing, so I ripped it off the wall.
I cut myself while shaving, now I can't make a cough.
It couldn't get much worse, but if they could, they would.
Bum-diddly-bum for the best, expect the worst.
I hope that's understood.
Bum-diddly-bum!
Bum-diddly-bum for the best, expect the worst.
In all, the program is Off the Hook.
We talk about technology.
We talk about individual privacy, liberty, and what things are going to be like in the
1990s and into the 21st century.
This is Emmanuel Goldstein with you until 10 o'clock, and inviting your phone calls as
always.
We have with us tonight author Wynne Schwartow, who is speaking to us from his home in Tennessee.
And Wynne is the author of the novel Terminal Compromise.
Wynne, are you there?
I am.
How are you?
Oh, I'm pretty good.
A bit hectic tonight.
We just got the latest issue of the magazine out on the press.
I'm waiting for it.
Yeah.
Well, I'm waiting for it, too, actually, to get back from the printer.
But as soon as it does, it's going right out to all the subscribers out there and newsstands
and things like that.
And it's going to be a rather controversial issue.
But then again, they always are.
You're not a stranger to controversy, are you?
I am in the midst of it right now in a lot of areas.
Tell us something about your book, Terminal Compromise.
Well, Terminal Compromise is a novel.
It's a fact-based novel.
And it involves a fictionalized but very plausible attack upon the United States.
Instead of using guns and bullets and bombs, it uses computers and computer technology and
attacks the computers and our communication systems.
And it's an example of what can happen if we continue along the current path we're on,
which is basically going unprotected.
Now, when you say going unprotected, what do you see as the danger signs?
Well, that's kind of two questions.
Unprotected means that over 95% of the computer and communication systems in the United States
currently have little or no effective protection against any sort of, whether it's sabotage,
invasion, or eavesdropping.
There is very, very little protection in any of our systems.
And when we look at more than 50% of the GNP of this country, which is over almost $6 trillion,
is based upon the proper and continued functioning of our computers and communication systems,
that's a big hole in our economic and potentially political national security.
You say that there's no protection.
What exactly do you mean?
Well, for example, we look at the various types of threats that exist to computers.
They range from as simple as viruses to network eavesdropping or invasion of networks,
communications compromised by illegal dialing up, if you will, hacking,
whether it's for casual intellectual applications or for various types of espionage.
Then we've got electromagnetic eavesdropping, which is listening in on computers
as they broadcast their information into the air or onto the power lines.
We have keyboard interception.
We have HEERF guns, which are magnetic guns, which can shut down networks or computers.
Then ultimately we have empty bombs and high-power microwave devices,
which would be used for a larger-scale type of computer warfare.
Now, is anybody using these devices now?
They all exist in one form or another,
and the majority of them, with the exception of the empty bombs,
are available from either catalogs or off-the-shelf hardware from a number of manufacturers.
There's nothing very unique about any of these devices.
Now, you mentioned HEERF gun. What's a HEERF gun?
A HEERF gun is a high-energy radiofrequency transmitter, very simply,
except that it is designed to be portable, perhaps into a briefcase
or larger models would fit into a car or a van.
And they target other communications or computer systems with a high-energy pulse of magnetic energy.
And that energy field would be of sufficient intensity and frequency
to disrupt the proper operations of the communication system or the computer or the network
and force it to crash.
Now, that in itself may not sound too bad,
but if you think that if the right person, one of the bad guys,
was targeting an enemy, a competitor, somebody else,
that he may not want to be able to use their computers,
if he shut them down in this method every hour, every hour, every hour, every hour for days on end,
the company that relies, or organization that relies upon those computers
is going to find it very, very difficult to continue business.
And we're finding that a lot more of these types of crimes, shall we say,
are actually being done by a variety of different groups,
certainly throughout the United States,
and we have a number of cases identified in Europe as well.
Can you decide some specifics on that?
In most cases, I'm not allowed to give away the actual company names themselves for security reasons.
I'm more interested in what kind of people are actually doing this kind of thing.
Okay, for example, in Northern California,
there's a lot of high-tech electronic companies, chemical companies, research companies.
One of those companies that we all know the name of very, very well
has been under intensive surveillance, electromagnetic surveillance,
by the Japanese for the last couple, three years.
As a result of that, that company has invested several million dollars
to properly shield their facilities from people listening in to their computer activities.
And in this case, it is a design firm that has very, very proprietary technology,
and it was their R&D facilities.
We know for a fact that the French have been operating a very, very heavy industrial espionage program
against the United States at least since 1980-81 and is probably still underway.
And this has been finally exposed in the last six months.
We know for a fact that a company, well, an organization in Europe
attempted to effect a $5.1 billion transfer out from a California bank,
which would have drained it of every one of its assets.
If it weren't for an error in the calculation of the amount of available assets,
the Swift Clearinghouse out of D.C. would have let those funds transfer into a repository in Europe,
and the money in that bank would have ceased to exist.
These are the kind of things that we're seeing.
We're seeing ATM machines under increasing attack using more advanced type of technology.
We know that the military has been involved in this kind of research
and has been using these types of weapons.
The Army has a weapon system called HERO,
and it is a higher-energy radio ordnance program
where you lob in essentially a magnetic bomb
to disable the enemies of electronic fuse assemblies on explosive types of devices.
So this technology is available and it is being used.
How about the monitoring devices to spy on CRTs, computer screens?
All right, let's go back to a very basic fundamental premise.
All electric currents induce a magnetic field.
And in a computer, we have a lot of electrical currents running around,
the strongest of which is emanating from the keyboard,
because the keyboard cable acts as an antenna,
and from the CRT, the video circuits.
And they broadcast very, very loud magnetic fields.
It's as though all of our computer equipment were miniature radio transmitters.
For those of us that were around 10, 12 years ago in this field,
we recall the early Trash 80 Radio Shack computers and Commodore computers
were radiating into our television sets,
and when we turned the computer off, it went away,
and then the FCC rulings came along to lower the emissions.
However, that data is not totally suppressed.
It is broadcast into the air,
and I am currently showing demonstrations
using an old black-and-white television set
and a set of rabbit-ear antennas from a garage sale
on how simple it is to listen in on that information.
You can also listen in on other computers
by tapping onto the power lines
where all the same data is conducted
throughout a building down the streets,
depending upon what type of transformers they have in the line.
The third place it radiates
is into sprinkler systems,
water pipes, sewer pipes,
and all of the same computer data
is available in all of these sources.
The reason we use an old black-and-white TV
is to show how simple the technology is.
If you're really in that business, however,
you're going to go out and acquire the correct equipment
where you can listen in from up to a mile, mile-and-a-half
fairly effectively,
store that information on videotape,
and then do the video reconstruction
and the cleaning up of the signal
at your leisure at another time.
Is there any kind of, in your opinion,
protection people can take using personal computers?
Say, would a laptop be more secure?
Well, a laptop broadcasts just as well.
We were very surprised at that.
They are using higher voltages in a number of cases
in some of the ultraluminescence screens,
and they broadcast, they're just screamers.
But even the LCD devices
do put out a fair amount of signal,
and we have been very successful
in picking up laptop computers,
especially at trade shows where we demonstrate this.
Where is the signal being broadcast on those?
It's being broadcast in the same way,
and it's coming from the video circuitry.
I see.
Now, the average computer owner,
what is he to do when faced with something like this?
Well, he has to decide, number one, if he cares.
Do you care that any of the information
on your computer system
may be very, very easily detected by anybody?
And currently, there's no laws against this.
So people need to at least be aware
that they are broadcasting everything
that they think is private.
If you determine that you do care
and that you don't want to do that,
there's essentially two routes.
One is called zoning control,
which means placing your computer
in a place within the building
such that there's enough effective shielding
just from the construction of the building itself
to block out anybody trying to listen in.
And this is an art more than a science
in that particular area,
but you certainly can help it along a little bit.
But it's much like what they do in the Pentagon.
There's the five rings of the Pentagon.
In the inner ring, they don't worry quite as much
because of all of the insulation
from the outer rings of the building into the center.
Those computers that are used on the outer ring
are much more susceptible to eavesdropping,
and therefore they would perhaps
put more protection into those.
Same thing applies in an office building
or in an individual's home.
If, however, you don't feel that that's appropriate
or you can't do it,
there are shielded computers
that are now coming on the market
which do shield the computer sufficiently from broadcasting.
I see.
Now, if the whole industry were to start over,
what would you have them do differently?
If we were to start all over again?
Yeah.
Obviously, you're saying that
they didn't take enough precautions.
Well, what could have been done better?
Well, we have a sociological problem there
in that I don't think anybody believed
in 1980 or 81
what 1991 would look like
in terms of 100 million computer terminals
sitting out there.
So I think it was very difficult to predict,
but certainly three or four years ago
we had the means and the knowledge
to say, hey, this is getting out of hand.
Let's do something about it.
There are two basic things
that I certainly would have done
and I've been working on for a number of years.
use an existing architecture,
security architecture,
there's many out there,
that has been approved
by whether it's the proper government agencies
or civilian agencies
and build those types of protection mechanisms
directly into the computers themselves.
You can also develop secure operating systems.
At this point,
Microsoft has shown virtually no interest
in doing it whatsoever.
Digital research is coming on
with bits and pieces
and Novell will be introducing
the first secure network operating system
at the end of 1992.
So we're about four years late
in that particular area,
but it could have been done early on.
Number two,
the FCC shielding efforts
that everybody fought
as manufacturers
back in the early 1980s
could have been made
sufficiently more stringent
to avoid the majority of the problem
except for the very, very high-end
sophisticated eavesdropping devices.
in additional cost factor,
which people worry about,
if the security had been put into each CPU
and each computer
starting several years ago
in the quantities
that we're talking about
in manufacture now,
it would perhaps add another $25 or $30
to the cost of each machine.
For shielding of the machines
in the volumes
that the industry currently builds,
we'd be looking at
between $50 and $75 increase in cost.
It's minimal.
Now, for those people
that don't have computers,
does your concern spread
to telephones, say?
Well, telephones obviously
have very, very little security.
There's certainly no encryption
on them whatsoever.
Currently, there are some devices
coming out in the next few months
that will affect that
for the average man on the street
or the average business.
But telephones can be listened into
by virtually anybody,
whether it's somebody
that knows how to get into
the telephone switching networks,
reprogram and put a tap on them.
There's a number of ways to do that.
The government can certainly do it,
and we know for a fact
that virtually every call
that is made in the United States,
including those calls
that one makes to an 800 number,
are logged, are tracked,
and certainly the ability
to listen in on them is there.
And there's been sufficient evidence
in the last 40 years
that this has been a regular practice,
certainly done by our government.
Do you find a lot of people
share your concern?
A lot of people are beginning
to finally realize
that while I am speaking
about extreme situations
in order to make it
a little bit more dramatic
and catch their attention,
that some of them say
I'm taking it a bit far,
and perhaps I am,
but the possibility
is certainly there.
So we are getting the attention.
We have been able
to get the ear of Congress.
We've been doing
congressional testimony.
A lot of major magazines
are getting involved
in the story right now
as to how bad
the situation can get.
And when we talk about
a potential electronic
Pearl Harbor,
I think we have
an opportunity now,
a breathing space,
a window, if you will,
to really begin a program
of properly defining
what is information,
deciding who owns information,
and affecting the proper
privacy methods,
and if we do that,
we'll automatically
beget the security
that we require.
How do you look
on the computer hackers
in light of all this?
Are they a threat
or are they just
a natural circumstance?
Well, there's two breeds
of hackers from the,
well, actually,
there's three breeds
if you want to take
into account the professionals.
One group is
the professional hacker,
those that work
for either foreign governments,
domestic governments,
or corporations,
and use the hacking techniques
as a form of espionage
or competitive research
investigation, if you will.
Within the conventional
hacking community,
there's two breeds
I've noticed.
One is the person
who's doing it
for the intellectual curiosity,
exploring the limits
of the system
and what have you.
The second has been emerging
over the last couple,
three years,
which is a hacker
who is more intent
on leaving a mark,
and unfortunately,
that mark tends
to be negative,
whether it is
the destruction of data,
the theft of programs
or data,
somehow interfering
with the target
of his attacks.
I don't think
that hackers
have been getting
a fair play
by and large.
And the one thing
that I can say
certainly in their favor,
if it weren't for them,
I don't think
that we would be
as far forewarned
as we are right now
as to how bad
the situation can get.
And once again,
I think this has helped
create some of the
breathing room.
Are you aware, though,
of any cases
of those hackers
you mentioned
that leave their mark,
do negative things?
Oh, I'm aware
of a great many of them
through a lot
of the criminal prosecutions
that are occurring
around the country
or those cases
where arrests
have been made
and prosecution
has been hindered
for any of a number
of reasons.
There's a lot
of cases going on.
The current estimates
that are coming through
is that this year
there will be 22 cases
successfully prosecuted
with some sort
of a penalty
imposed upon
the perpetrators.
The FBI
extrapolates those numbers
out about how many
they know about,
how many they can
arrest, etc., etc.
And when you blow
the numbers up,
it looks like in 1991
there will have been
over 1 million
computer crimes committed.
But by computer crimes
I'm referring to things
where there's actual
damage of some sort
and that's something
that to this day
I really have not
seen a significant
number of.
Well, an awful lot
of it you just
don't even hear about.
For example,
I had a meeting
that was off the record
with a bank.
It was in Atlanta, Georgia.
And we got to talking
and I said,
have you ever been hit?
And they said,
we were hit recently
for almost a million dollars.
Was it by a former employee?
It was from an insider job,
somebody who had left
the company and then
been able to get back
into the system.
Right.
Now that's what I always
find to be the case,
that if it's an employee
or somebody that is
connected to the company
in some way,
obviously they're going
to have ulterior motors
and a much better method
of carrying out
those ulterior motors.
What I'm referring to
though are young hackers,
people who are exploring
systems for perhaps
the first time
and then get government
agents kicking in
their door
and taking all
their equipment.
In most of those cases
that I see,
there is no damage
that has been done
except, of course,
after they kick in the door
and all that kind of thing.
I don't know of any
hacker cases
where these kids
are going out there
destroying systems.
It seems to me
if they did,
it would be.
And in this particular case,
I just want to step back
to it,
the bank in no way,
shape or form,
wants any publicity
about it.
So what we're finding
is that the crimes,
much like rape,
are not being reported
officially.
So the numbers
in the cases
are very, very few
and far between
that we're able
to take a hard look at
and whether they're
even prosecutable
because the proof,
once again,
the burden of proof
is on the prosecution,
to say that,
okay, XYZ kid,
if you will,
broke in here
and did something wrong.
The second problem
from a legal standpoint
is the domain,
the jurisdiction,
who has control.
And there is
a huge conflict
right now
going on
within the criminal system
because of that.
And these are all
poor pieces
of the reasons
why we're not
hearing about it more.
The number of cases
that I said
that are going to reach
successful prosecution
in this year
are estimated
at only 22.
And that's not a lot
to deal with.
That's not a big sample.
That's a nationwide figure.
Nationwide figure.
Do you sense
that law enforcement
has a working understanding
of the technology
they're dealing with?
Bits and pieces
of them have
some understanding.
The Justice Department
has created a task force
and they will be attempting
to do more,
well, they're doing research
into it
and they would obviously
like to catch more people,
at people that are doing
really illegal things.
The FBI has a group
that is operating
fairly secretively.
They won't talk
too much about it.
The Secret Service
obviously has a group.
We've seen enough
of what they've been doing.
I guess it was down in Arizona
that they had their fun one day.
And then the Treasury Department
has one as well.
On a local level,
I think the United States
is fairly well behind
what is going on
in other countries
where there are
specifically computer fraud
divisions of many major
metropolitan police departments.
Here in the United States,
we're seeing bits and pieces
of people that have
some amount of knowledge
but not a whole lot.
Is it not possible
to say that existing laws
could be enough
to cover computer crimes?
You know,
if a crime is a crime.
Not at all.
Why is that?
Well, a classic example
is a case that was
attempted to be prosecuted
by the Justice Department
several months back
and the perpetrators
went in,
stole some software,
some source code
from somebody else,
from another company.
They were caught.
They were prosecuted
under U.S. Code 2134,
which is the
Interstate Transport of Goods,
designed back in the 1930s
to prosecute people
who stole cars
so the FBI could get involved.
When these cases
have been tried,
it turns out
that between
the main court hearing
and ultimately
those cases
that are brought to appeal,
there is a 50-50 split
in the judiciary
as to whether
information,
data that is moving
along wires,
constitutes goods.
And so,
without a full understanding
of what I said earlier,
what is information?
How do we define information?
And how do we deal with it?
The current laws
are definitely inadequate.
Well, information is,
different things
to different people.
I mean, you said
that the source code
was stolen,
but it was probably
simply copied.
It wasn't taken.
That's correct.
Now, we have the case,
I don't know if you're familiar
with the case
of Shadowhawk in Chicago,
who was a kid
that downloaded
some AT&T proprietary software
that was sitting wide open
on a computer system.
And what AT&T was able
to succeed in doing
was convincing a judge
that he had stolen
something worth
a million dollars,
and hence the kid
went to jail
for almost a year.
It's precisely
that kind of thing
that I'm very wary about
when people say
that, you know,
this information
is property.
It is to a degree,
but if you treat it
in exactly the same form,
obviously there's going
to be miscarriages
of justice.
Well, certainly,
that brings up
what this whole debate
is hopefully going
to be about
that we're trying
to get started,
is to come up
with a coherent
common sense standard
by which everybody
can relate to information
and the ownership
of information
so that it can make,
we can get rid of
a lot of the gray areas
that currently exist
and turn it into
more of a black
and white area.
And then there needs
to be a consensus,
and unfortunately,
the discussion
has not really begun
because without
a fundamental understanding
of what we're dealing
with to create laws,
we're going to be
creating them
into a void.
Now, you've talked
to Congress.
What's the mood
on Capitol Hill?
Once again,
like it is throughout
the country,
it's very, very split.
The committees
that I dealt with,
there was a very
high degree of interest,
and I was very astounded
that the congressmen,
especially even the chairman
of that committee,
was as knowledgeable
as he was
about the issues.
Now, they weren't
all like that,
but I was very impressed
at their level
of understanding.
Then again,
we have another case
with Senator Gore
who just had his highway
put through
and has neglected
any form of consideration
for security
when we're talking
about tying together
virtually all of the nation's
major computers
and replacing Internet
with a one gigabit
superhighway,
yet they have not dealt
with a security issue
even though we've been
through on Internet already.
So, it's split
like it is everywhere else.
Ultimately, though,
I think that there is
a general malaise about it.
I see.
We're talking with
Wynne Shwartau,
author in Memphis,
is it?
I'm sorry?
Are you in Memphis?
No, I'm in Nashville.
Nashville, Tennessee,
author of
Terminal Compromise.
We'll be taking phone calls.
If you have any
particular questions,
give us a call now,
212-279-3400
here at WBAI New York.
The program is
off the hook
and will be on
until 10 o'clock.
Tell us,
Wynne,
what is your perception
of the Dutch hackers?
Are they a massive threat
to world security
or are they just
a bunch of kids
having fun
and being a bit
rambunctious?
I don't know
who they are
specifically.
I've seen the bits
on TV about them.
I've heard some stories
about them.
I don't think
whether one small group
like that
is really the danger.
I think that they
epitomize
and highlight
what a real danger
really potentially is.
I find it difficult
to criticize hackers
just for exploring systems.
Of course,
there's a right
and there's a wrong
and what have you,
but I don't think
that's really the issue
that I'm addressing
is that if a group
of hackers
like the Dutch hackers
are able
to penetrate
the systems
that they can penetrate
and have demonstrably
done so far
that our enemies,
people that are really out,
that don't like us,
the United States
or portions
of the United States
or any of the radical groups,
they have the same capabilities
and may not be
so nice about it.
I think you and I
say the same thing
as far as that goes.
My question,
though,
is what should be done
with those people
when they are caught
getting into those systems.
Should they be asked
how they did it
or should they be punished
as if they were
one of those enemies?
I don't think
we have the means
right now
to really define
a lot of the crimes.
The closest that I've seen
to a definition
are some of the laws
in England
where it very specifically says
thou shalt not enter
into anybody else's computer.
There's some very clear
definitions
of what is right
and what is wrong.
We don't have those
here yet.
And we're prosecuting
in gray areas.
We're prosecuting
in almost capricious
types of manners
saying,
let's try this law,
let's try this one,
let's try this one
and piece together something.
I think in some cases
the people that have
entered systems
have done some things
that are wrong
and probably should not
be in there.
on the other hand
some of the exploratory
stuff that has been done
which is harmless
elucidates a concern
but it's difficult
to try and prosecute
a bunch of 16-year-olds
for expanding their mind.
I think we're into
a moral and a legal conundrum
until we straighten
that mess out.
Yeah, I think what a lot
of people are losing sight of
is that these 16-year-olds
exploring systems
are basically doing
the same thing
16-year-olds have been doing
for a long time
which is exploring
and not obeying
all the rules
and of course
when something like that happens
you want to deal
with it somehow
but if you deal with it
in the way that I see
some people
wanting to deal with it here
actually sending people
to prison for long periods
of time
just for being
where they're not
supposed to be
obviously we don't
really have a grip
on that technology
if that's the way
we feel we have
to deal with it.
I certainly don't feel
that sending
whether it's a 16-year-old
or a 22-year-old
college student
who's hacked into a system
and not done
any real damage
or he was on an exploratory mission
I certainly don't see the point
in sending him to a prison
for any number of years
or any time period
because the prison system
is its own discussion
but they are not
even what one would consider
a white-collar criminal
it's an entirely different realm
in conversations
with some people
I've even suggested
that we have
a parallel court system
with an alternate set
of guidelines
for punishment
that deal with
information crime
the likelihood of that occurring
I realize
is very very low
but we certainly need
to look at it
with a different viewpoint
than somebody
that is an armed robber
who may have
the adjoining cell
to somebody
that knew how to use
a computer
and I don't think
that in that case
the punishment
fits the crime
we're going to go
to the phones
right after this
there was a case
recently
I recall
where a hacker
was convicted
and one of the
terms of his punishment
was that he had to
or perhaps this was
something that the company
was asking for
I'm not 100% certain
if they got it
but they wanted
to be paid
tens of thousands
of dollars
the cost of implementing
a security program
as if this hacker
breaking in
was the reason
they needed a security program
which they should have had
in the beginning
do you agree with that?
I don't know that case
it's difficult to comment
without knowing
any specifics
I'm sorry
I can't on that one
okay let's
go to the phones
good evening
you're on the air
yes
trying
once you get
into a position
where
a nation
is
giving
or
trying to
appear
benevolent
to
to its
other
to its allies
say
and you get
into the
position
of
avoiding
terrorist
activities
it's
often
like
trying
to explain
the
Iliad
to
the
Flintstones
it doesn't
often
come across
in
the manner
that
was intended
in the first place
well could you
perhaps
focus that
a little
bit
into
the
discussion
here
is there
a question
yeah
is there
a question
here
not
really
okay
well thanks
very much
for sharing
that with
us
good evening
you're on
the air
okay
is it
true that
a cradled
phone
can be
used as
a listening
device
hmm
ah
this in
phil agey's
book
i know
i know
um
by the
company
right
perhaps
for the rest
of our
listeners
if you
could
explain
what that
is
yeah
what he's
asking
is
can a
phone
that you
have
just
sitting
in your
home
or your
office
that is
on the
hook
does
that phone
can that
phone still
be tapped
and perhaps
listen into
what is
going on
in the
room
we're talking
about the
old infinity
transmitter
here
and the
there's two
major
one
one major
thing that
you need
to uh
find out
in a
particular
phone
system
is there
a hard
relay
contact
disconnect
if the
relay
actually
disconnects
the red
green
connections
from the
receiver
to the
lines
then no
it cannot
be done
if however
as is much
more popular
nowadays
with the
newer phone
systems
that there
is only
an electronic
switching between
them
yes it is
possible
one thing
to keep
in mind
is that
back when
the uh
government's
tempest
program
was first
put into
effect
in the
mid-70s
for military
and uh
national security
oriented
computers
one of
the specifications
was to keep
computer terminals
at some
distance away
from all
telephones
for the
reason
that
enough of
the information
that is
broadcast from
the computer
actually went
down the
telephone wires
and was
potentially
detectable
as well
so yes
depending upon
the type
of switching
mechanisms
you have
yes it is
possible
any phone
can be a
bug
I'm sorry
any phone
can potentially
be a bug
not any
phone
there's a
technical
caveat in
there as
to what
type of
switching
mechanism
it has
whether
there's a
hard
disconnect
on the
red green
how can
you tell
that
you've got
to get
into your
phone
or know
a little
bit about
phones
to be able
to tell
okay thank
you very
much
sure
okay we're
taking phone
calls
speaking with
author
win
short
now
212-279-3400
good evening
you're on
the air
thanks so
much for
that
good evening
hi
emmanuel
yeah on
the topic
of communication
security
i want to
relate an
experience that
happened to
me
i have
just
okay speak
up because
you got
some hum
on your
line
sorry
yeah i
have a
just a
panasonic
answering
machine
someone was
leaving me
a message
and in the
background i
hear like
sounds like
cops like
monitoring it
and at the
same time
mockingly
making fun of
the person's
voice and
whatnot is that
possible or
how else could
that possibly
have happened
well wait
a panasonic
answering machine
i'm sorry go
over this one
more time
yes okay and
i get a message
from someone
right and i
can actually
hear people
monitoring and
making fun of
actually like
mocking the
person's message
as he leaves it
how is uh
you can hear
them as if they
were listening in
on an extension
or something
is that possible
there's three
possible ways
that that could
happen
one is yes
they were really
doing it and
trying to make
their presence
known and be
annoying that's
a possibility
unlikely though
the second is
that you have
there was a
crossed wire
down on the
switching and
you just ended
up on a
party line
somehow
and the
third possibility
is that your
answering machine
or some of
the wiring in
your house was
picking up
local police
channels
it's uh
radio in other
words over
the police
radio
it's possible
it's happened
before
i think the
crossed wire
scenario is
probably the
most common
but it's very
unusual for
one party to
be able to
hear a second
party and the
third party be
able to hear the
first party
it doesn't
usually work like
that
one other
thing i do
notice when i
pick up the
phone i hear
like a humming
or a buzzing
yeah we hear
it too
yeah this is
the line i'm
calling you from
right now that's
what i'm talking
about yeah
that's normal when
you do connect
connections like
that
well i don't know
he shouldn't be
getting this all
the time though
yeah but on that
thing i have that
on my tape actually
so what i did was i
flipped it over to
preserve it i'm
wondering if there's
anywhere i could
bring that to have
that listened to to
have it you know
audio analysis and
that kind of depth
to look for a
signal between
below the noise it
can be done but it's
an expensive process
i'm not doing
anything illegal you
don't believe me
no no it doesn't
matter to me
i don't know it's a
funny thing it
i just was curious
if that was possible
how that could
happen
oh it can happen
but i think as
emmanuel says more
than likely it's just
a crossed wire
yeah thank you very
much
all right thanks for
calling and especially
with a connection like
that i would imagine
quite a few crossed
wires someplace
279-3400 we have
some open phone lines
so if you have any
questions for author
win shortow or
myself emmanuel
goldstein give us a
call before 10 o'clock
212-279-3400 good
evening you're on the
radio i'm having a lot
of trouble keeping it
in my pants i don't
know where to go what
to do or who to speak
to well speak to
somebody else good
evening okay we got a
dial tone there good
evening yeah uh is this
um uh radio station
yes it is okay i want
to speak with arthur and
the guys about uh
arthur okay uh uh who's
arthur oh that's the
uh on the 2600 uh program
uh emmanuel yeah yeah
okay close enough
sorry is the gentleman's
name emmanuel uh yes
last i checked okay
all right emmanuel what's
the other gentleman's
name uh this is win
shortow on on the
telephone uh by the you're
on the air right now by
the way oh gee okay
great um couple questions
uh where do where does
one find out more
information um like what
books to look at uh bbs's
uh user groups or
societies that will help
uh the the consumer of
technology know or find
out some of the hazards
of uh of uh that are out
there that exist i'm
familiar with 2600 and
uh some of their work so
can you answer that
uh when you want to take
that one yeah there's a lot
of places to get
information uh unfortunately
to date there's not any one
place
it's a moving target uh i
would uh get in touch with
organizations like the
computer security institute
uh the issa which is a
security organization uh you
have isp which is a security
organization up in uh the
boston area there's a number
of these around and through
them uh you can find out
then your resource list
starts spreading very very
quickly because they
publish so much information
on various types of uh of
these uh crimes or
activities what have you
it doesn't seem like a real
easy thing to do i mean i
went to the library myself
and researched like uh
switching circuits and
things like that and it's
not a uh it's a complicated
subject you know i don't
think that uh the
very very complicated
subject and the library is
going to have very very
little on it other than
some of the base
technology of what's
involved with switching
networks and technology as
a whole what you're
looking for is how is the
technology applied and
they've been uh from a
security standpoint and
then you have to go to the
security people and talk to
them and get their
brochures you can learn an
awful lot of it by even just
getting product brochures from
a number of companies to find
out what types of threats
they're dealing with is there
any suggestions you would make
of someone who's considering
computer security as a
profession uh for example ways
of breaking into that as a
profession not as a malicious
way but you know it's a you
know career career once again
getting hooked up with the
associations that deal with
computer security professionals
all across the country you
also have the adp auditors
association which is
nationwide adp adp auditors
association they deal with
computer security uh there's
dozens of organizations that
are all involved with it and to
start there to find out what the
field's about who the players are
and start making a few contacts
would be the best place the
only other way to do it is
uh working for a an
organization a company that
has enough concern about
security as to create hat or
have a security department
within their mis or dp
department great okay thank you
sure thanks for calling and uh
yeah the best way to uh to get
into the uh the field i guess
just to go down to a bookstore
that has a uh a section that
deals with these kind of things
and some bookstores do i think
tower books has a section like
that um and just read read and
occasionally buy things too i
guess yeah it's very
interesting that uh i do most
find most of the books on the
subject not here in the united
states but over in europe
that's interesting too and when i
go over there i start especially
in england there are literally
walls full of books on security
and why are they not here well
you know you can get into the
arguments uh that we don't care
uh you can get into the argument
that the government keeps some of
them out uh there's a lot of
potential arguments but overall
there is a heightened awareness of
security in europe than there is
here after all they have the
amalgamation of a number of
companies the countries and they've
got had certainly a lot more
terrorist and uh problems than we've
had and we've just got had been a
very laissez-faire about the entire
issue are there people that don't
want you to get your message out
or organizations uh nobody at this
point to this point has uh said to me
shut up uh i know there's a lot of
talks going on a lot of places about
the messages that we are trying to get
across and what we're saying uh but the
reactions thus far have been by and
large positive receptive and i keep
getting invited back okay let's go back
to the phones 279-3400 good evening
hi i don't even know if this is the
right show to ask this question but
somebody told me the other day that if
you have a certain phone number you can
dial it and tell if your own phone is
bugged you know about that that's one of
the oldest uh myths going around uh there
is no number to call to find out if
your if your number is bugged unless
it's the number of the person that's
bugging your phone and you simply ask
them uh some people claim that uh by
calling the anac number which in new
york is 958 and that'll give you your
phone number back uh if you hear a
reorder fast busy afterwards that means
your phone is not tapped and if you
don't that means it is and since
everybody in new york doesn't really
hear a fast busy after uh after that a
lot of people assume that phone is
tapped believe me there there is nothing
that simple that will tell you what do
you have to do to tell you have to uh
win perhaps you like this one the only
way you can tell tell if you're tapped
is if somebody has a uh radiating tap
or a low impedance tap really close to
your phones your house if it is tapped
professionally forget it you'll never
know okay thank you okay thanks for
calling you know there's a lot of people
out there that that think they're being
tapped what do you attribute that to
back from the old technologies of the
50s when uh the types of taps that
were used were uh direct inductive loads
on the lines and there was a way to
measure them but with the new
techniques that have come out in the
last 10 years there's no way why are
so many people so concerned do you
think there's there's overwhelming
paranoia in this country or or do people
not trust uh the technology i think it's a
combination of the two that we are
taught in one way uh trust computers
trust them they'll give you the right
answer all the time yet we're always
running into computers not working as the
brick wall to making a hotel reservation
or getting on a plane or your car
reservations i think there's a definitely
a schizophrenic attitude towards how
good and necessary computers are and we
haven't really molded into it yet and
that can certainly help breathe a little
bit of paranoia and then there's
certainly whatever distrust levels of
the government and what's capable of
being done and that paranoia is not left
do you run into a lot of uh blind faith
people believing whatever the computer
says no matter how absurd
very very unfortunately i do and i i find
it more often than not occurring with
spreadsheets and people just accepting
them and not even bothering to check
them uh people trusting their calculators
when they multiply seven times six and
end up with 412 they accept it as the
answer and i have a real problem with
that i'd love to be able to market a
gag calculator that uh maybe this gets
one out of three things completely wrong
i love it see how far it goes
that's a great idea let's go back to the
phones good evening you're on the radio
okay how you guys doing we're doing
fine how are you okay i've been
listening to the conversation for a
while and i happen to work in business
telecommunications industry and some of
the conversations you would hear in those
co's just checking lines out uh are
hilarious uh for the average subscriber
uh i think the main worry is for like
multiple dwellings where they have lines
running into all varying floors of
buildings and so forth and just cables
running up alongside buildings or outside
backyards and all that kind of thing
people can just basically stick their heads
out the window and tap into a line and
call poland for the weather off your
line as far as uh the tools of the trade
are concerned you can tap into a line
with uh an inductive pickup otherwise what
they call a sniffer okay uh and you can
hear any number of conversations going on
uh with data communications the uh signals that are being emitted from those
systems are so numerous and so complex
uh that for you to discern i'm talking about through the airwaves for you to discern one signal from another that's being radiated from that system with every amount of metal and cable power system that's involved there it would be pretty uh pretty rare uh with regard to uh the you know hackers as such nowadays they're employing these redial systems where they where they have to you dial the computer system up
uh it goes ahead and redials you hang up and then it dials you back okay uh your guest said earlier with the you know like ibm with their main communication systems with their secured lines they use encryptors okay uh which requires you to have an encryption device they change it on a weekly basis from one location to another okay and they change their uh encryption sequences uh on a weekly basis okay for their secured lines uh there was uh
uh communication uh communication company here in manhattan uh these uh occs for example the common carriers like uh mci and sprint and uh gte and so forth they operate in commercial spaces okay which is not like a phone building where they have uh very you know they have a 24-hour security guard operating you know all day and night and their doors are really you know tight really uh well secured uh as opposed to a commercial space like
uh top of the top of the sixes for example or the jc penny building or something where anybody can you know walk in there they typically have people there 24 hours a day but they might have like one person on the shift and the facilities are huge and anybody can just walk in off the street and with a screwdriver gain access to the entire uh facility okay they don't necessarily in order to disrupt service they don't have to get onto that floor necessarily they can
go in there and go in there and throw a knife switch and knock the whole place off the air so basically you're saying that security measures uh in the computer industry are adequate well uh i would say as far as uh communications there's a number of ways in which uh you can you know stave off you know i would say most of the hackers but uh for the sophisticated uh clandestine type
uh spent enormous sums of money into doing that specific thing uh as far as you know getting the general hacker off that's that's a you know that would be a pretty simple matter of just employing uh you know uh redial and they have the a and i devices which uh you can the guy you know you dial up somebody and they they can see you know who exactly called them who exactly called you up but you're making a good point but the key operative word is what you said in there is can
what you said in there is can and yes all the technology all the defensive measures are available there's no question about that the point is that they are not being used by and large and oft times when they are used they're being used incorrectly
let me let me tell you something when i was working uh with a company here in manhattan uh they changed my shift they put me i was working midnight i've worked all three shifts uh at these uh communication companies and uh you know just as a matter of course you know as i said earlier you can go ahead and test the circuit you might just get so bored sitting around the ceo and plug up on the circuit you know just you know playing around there or or i shouldn't say so much in so far as playing around but
uh testing the circuit out and plug into a conversation that is uh kind of spicy and you sit there and looking at the guy next to you and everybody's cracking up because it's uh sounds like one of these uh 900 numbers and the guy on the other side you know it sounds pretty heated and you're cracking up you might put this thing over the loudspeaker and the whole co and have everybody on the floor rolling
uh you know uh but but my original point was that uh i remember working for for an outfit and you come in there and the whole place is uh disrupted uh you come in in the morning that is and the whole place has more or less been burglarized in a commercial building in manhattan uh as opposed to say like an at&t office or uh you know one of these other major carriers for example
okay where they would rent a floor or two floors out of a building they don't employ that type of security in those buildings they might have an employee working there on the circuits
well the whole point of a lot of what i'm saying is that in distinction to those types of crimes it's easier to listen in than it is to break in
and most of these techniques that i'm i talk about in my book and i speak about are by and large invisible and done by remote control so you eliminate to a great
large extent the uh chance of getting caught or identified if you're good at what you do
right well you you're referring more to the more towards the professional and this would be more
oh i'm not talking professional i'm talking this equipment is available you can go out and buy it off a catalog from the street
i'm not talking anything terribly sophisticated here the only thing that's sophisticated really is the empty bomb
everything else is available standard catalog issue type of equipment and it's knowing how to use it that's all it is
well there's a place right here in manhattan that sells all kinds of goodies over the counter
yeah the computer spy shop the spy shop
what's the name of the spy shop yeah yeah it's a nationwide firm that sells defensive measures and eavesdropping products yes
yeah and uh i know that you know for certain applications i you know what i mean to say is sophisticated for the average Joe Blow
who happens to you know spot something and say oh this is an interesting phenomenon okay let me see how far i can go with this
there's not much in the way of uh you know i do know of an instance with one of these comic carriers uh where they had a dial-up modem
and somebody knew you know the protocol of the system and they got into the system okay and uh jimmy jimmied up a patch in the machine
and at a certain time of the day man this thing it blew the system away the company the downtime was a couple hours
a couple hours because this was this particular system and a download all kinds of software to all kinds of uh controllers and so forth within the machine
in the meantime while the system is down they're losing a thousand bucks a minute in the interim uh conceivably more than that nowadays
and uh blew away their entire software i mean i'm talking about not just the software but their their uh call and call information on the machine as well
all because they didn't have a redial system that dialed you back out
well redial is certainly one of them of the mechanisms that is available there's a lot of methods that can be used
simple switch on the outside on the outgoing line of the you know on the uh incoming line of the modem
the defensive technology is available yes
and lots of times the most uh uh secure system is the simplest as well
listen sir thanks for your call we're out of time so we're gonna have to leave it at that
win short towel uh closing words from you and information how people can get your book
and uh perhaps get more information about what you're up to
uh if people are interested in what i do and uh what what i'm involved with where i'm speaking etc
they can certainly call me or write me at my offices
um you want me to give the number sure that's uh the phone number is 615-883-6741
or you can write me at 3108 knob view and that's in nashville tennessee
uh for terminal compromise it's available at all the major bookstores walden books crown uh
barnes and noble what have you it's called terminal compromise it's 1995 and it's a heck of a good read
okay i want to thank you for uh being with us tonight on off the hook and uh well
it's my pleasure
we'll be talking with you again in the future i'm sure
i'll be happy to help
okay
good talking to you emmanuel bye-bye
thanks
uh that's the uh the show for tonight
we'll be back again next week at uh nine o'clock for another edition of off the hook talking about all kinds of uh technological issues
so until then uh stay uh safe in the uh in the world of technology
stay tuned for the personal computer show next on wbai new york
the telephone keeps ringing
so i ripped it off the wall
i cut myself while shaving
now i can't make a call
it couldn't get much worse
but if they could they would
bum dilly bum
for the best expect the worst
i hope that's understood
bum dilly bum
fucking six
we can't let you know
stop
we're trying to put it on
really
that's it
and there you go
okay
your
you
you
where
documents
it
Third Rail, the magazine of Asian and Pacific Island.