I thought there was an elegant simplicity in that that has been lost on the United States
Congress.
And I hope to keep repeating those words to people as I go across the country.
Jonathan, let's leave it right there.
I really appreciate that note and we ought to think about that.
Feed my sheep.
You've been listening to We The People.
I want to thank Georgia Keller, Mark Cummings, Tom Whalen, Barbara Fischer, Carol Joe Pape,
Michael Yoshida and Bob Wells at WBAI and all of you who have made this show possible.
Thank you.
We'll be with you tomorrow night.
And We The People with Jerry Brown back with us tomorrow night from 7 to 8 p.m. Monday
through Friday here on WBAI New York 99.5 FM where coming up at 8 o'clock will be Off
The Hook.
Emanuel Goldstein and Company, stay tuned.
The 24th annual WBAI Holiday Crafts Fair, America's oldest and largest winter crafts
event will take place the weekends of December 8th through the 11th and December 15th through
the 17th.
At Columbia University's Ferris Booth Hall located at 115th Street and Broadway in Manhattan.
For additional information, call area code 212-279-0707.
Science Fiction, Movie Soundtracks, Acid Jazz, Astrology, Techno, Life Writing, Trance, New
Age Music, Psychology, Philosophy, Star Trek, UFOs, Music, Talk, Radio Drama, Night Shift,
WBAI, 99.5 FM.
And this is radio station WBAI in New York.
Time's 8 o'clock.
It's Tuesday night.
It's time for Off The Hook.
The telephone keeps ringing, so I ripped it off the wall, I cut myself while shaving,
now I can't make a call, it couldn't get much worse, but if they could they would for Billy
Bond, for the best, expect the worst, I hope that's understood, but Billy Bond!
I hope that's understood.
And a good evening to everybody, this is Off The Hook, Emanuel Goldstein with you tonight
where we're talking about the latest developments in the world of, well I guess high technology
and the internet and the telephone system and whatever else comes to mind.
And you know this last week was kind of a milestone in many ways.
After the program last week we went down to Washington D.C., me, Bernie S., a couple other
people and actually went to this conference that had a lot of, how shall we put it, intelligence
type people lurking around, you know CIA, NSA, FBI, people like that.
And you know I thought it would be a really good opportunity for Bernie S. to present
his case to the public or to another part of the public I guess, to people that may
never have heard his case had we not done this.
And Bernie S., in case you're tuning in for the first time or you have a short memory,
was the person who spent seven months in jail for basically possessing a red box and some
software that he himself had helped to write.
It was a very bizarre case, in fact it's not over yet, this Friday he comes up for sentencing
on probation violation, which happened because he got arrested for possessing a red box.
Long drawn out story, we've been through it countless times here on the radio station,
but this was the first time these people actually heard from him, they actually heard his side
of the story and I think it's good to bridge those gaps occasionally.
A lot of those people you might think are unreachable were rather shocked by this.
So when something happens that you want people to find out about, make sure as many different
kinds of people hear about it as possible.
Might make a difference, might not, who knows, but I just have the feeling that his case
was brought up in many different forums over the last week and maybe if it happens to somebody
else more people will stand up and say something this time and we won't have to go through
the nightmare that this year has been for him.
Next week of course we'll be updating you on what happened this coming Friday, whether
they actually see fit to send him back to prison for probation violation.
Unbelievable story, there's definitely a book involved here somewhere I think.
But tonight we're talking about a different case, totally different case, that's right,
there's more than one case going on, there's many, many cases.
And this doesn't involve really anything in this country actually, this is something taking
place with our neighbors to the north who are still one country, and that would be Canada.
This involves someone named Jesse Hirsch and basically I'll read you the update and then
we'll speak to somebody up there about this particular case and how it affects us, how
it affects them and various other things like that.
On Thursday, September 7th, 1995 at 10am in courtroom 126 of Toronto's Old City Hall,
Jesse Hirsch was scheduled to go on trial.
He was charged with unauthorized use of a computer system contrary to section 342.1
of the Criminal Code of Canada.
Jesse had been caught using his step-brother's university computer account, oh boy, caught
using his step-brother's university computer account as well as the account of another
friend to publish an anarchist newsletter to the internet.
That's it, that's everything, that's the whole thing right there.
Yes, he was using his step-brother's university computer account, a friend's computer account,
and he was publishing an anarchist newsletter.
That's a hardened criminal for you.
Upon his arrest, Jesse assured the police that he had been given permission to use the
accounts.
However, the prosecution adopted the position that since the university had a strict policy
against allowing its users to share computer accounts, Jesse's step-brother and friend
had not been permitted to give Jesse the necessary authorization to make use of their accounts.
In other words, it didn't make any difference that his step-brother and friend knew that
he was using the accounts, all that mattered was that he had actually used them.
Well, Jesse quickly set about hiring himself a good lawyer and prepared to confront the
case against him.
After many months of anxious waiting, Jesse's day in court finally arrived.
On the morning of the trial, mere minutes before the court was called into session,
the prosecution suddenly withdrew the charges.
Jesse agreed to pay to the University of Toronto the sum of $400 as a token in satisfaction
of the cost of using its computers.
At one point, the university had claimed the cost would be $1,600.
After that, he was free to go.
For Jesse, the prosecution's withdrawal signified the end of a long and harrowing journey.
After countless sleepless nights, lying awake and worrying about the possibility of a criminal
record or worse, still a jail sentence, he could finally rest easy.
And for Canadians everywhere, Jesse's story raises the ominous specter of more cases like
it in the future.
On the phone with us right now from Toronto is Dov Weisbrod.
Dov, are you there?
Good evening.
You're with a group called LOGIC, the Legal Group for the Internet, I believe, is that
what it stands for?
Legal Group for the Internet in Canada, that's correct.
Right.
And tell us first of all something about your organization.
We started work late last winter, early spring, when we realized that there really wasn't
a voice in Canada at the time for legal issues specifically as they relate to the Internet
to be discussed and to be commented on from a perspective of freedom of speech and rights
instead of law enforcement.
I see.
Now, the need for this particular organization was brought about at first when the Jesse
Hirsch case came about or were there other cases before then?
We existed at the time that Jesse Hirsch was brought to our attention.
A member of our group was a system administrator at an Internet service provider here in Toronto
and he was good friends with Jesse Hirsch and told Jesse that he should come to one
of our meetings, describe his case to us, and we'd see if we could help.
I see.
What kind of public response do you get?
Well, since we've had our webpage up, we've been monitoring the accesses to that and it's
been fairly popular.
We have a mailing list over the Internet by which we coordinate announcements and discussion
about issues as they arise and we're in the course of preparing several different submissions
to different levels of the government.
Now, of course, you being in Canada would have slightly different laws and different
rights I suppose as far as freedom of speech, freedom of press.
What do you see as the major differences between the Canadian culture and the American culture
with regards to that?
Well, the major difference legally is that in a piece of our constitution called the
Charter of Rights and Freedoms, we have what's known as Section 1, which provides an exception
for the rights in the Charter and allows for certain breaches of those rights in certain
cases.
Such as?
Well, when there is a justification for the infringement of a right such as freedom of
speech.
In other words, if it's necessary to infringe that right in order to protect a greater public
good, for instance, then a court will allow that infringement.
Okay, is there an example such as hate speech perhaps?
Hate speech has so far been upheld.
The hate laws have been upheld under that section.
Okay.
Now, specifically about the Jesse Hirsch case though, what did you see as significant about
that?
Why was this such an important case?
Well, we thought it was an important case because the section in the criminal code that
makes it a crime to do what Jesse did has absolutely no recognition, no understanding
of what its effects can be.
According to this crime, if you use a computer without any permission in the actual wording,
it's called color of right, then you're liable for the crime.
Now, this can potentially include people who use your bank card without the permission
of the bank, but with your permission.
You would then have the permission of the account holder be given their password or
personal identification number with their permission, but according to the bank and
according to this criminal code provision, you'd be found liable.
I'm just looking at one of my bank cards here and reading what it says on the back of it.
Use of this card is governed by the terms and conditions of the cardholder's agreement
executed by the cardholder and the bank when this card was issued.
It's kind of vague actually.
You're saying the banks as a rule or in general don't allow people to transfer, to transfer
the card to somebody else?
That's right.
It's generally a standard clause in the contract that only the person to whom the card is issued
will use the account.
Therefore, if anyone else uses it, even if they have the permission of the person who
has that account, it wouldn't, they wouldn't have the permission of the bank and according
to the law, they couldn't use the account.
Well, I mean, do you think that's a realistic scenario that people will actually get prosecuted
for something like that?
I suspect that the bank keeps it under wraps.
No major organization like that wants to reveal security breaches.
They want to maintain the confidence of their customers.
Absolutely.
Can you tell us some other cases that might be of interest to us down here as far as things
similar to the Jesse Hirst case?
Well, there really isn't the large number of cases related to computers and crimes in
Canada like there are in the States.
We follow the cases in the States because generally they foretell happenings farther
north in my own country and there's a lot to learn from the American cases, but generally
as yet, there's been very few cases like it.
We talked a little last week about encryption involving cellular phones.
There's some pressure on various entities up there in Canada to make it illegal to encrypt
conversations unless it's with a key that the government can crack.
Are you following those kind of cases?
Yes, we are.
I believe what you're referring to is the document that was put together by the Association
of Chiefs of Police up here in Canada that calls for essentially the equivalent of the
American clipper chip.
Right, except this looks like it actually has a chance of going through, whereas clipper
chip is kind of dead right now for the time being.
We hope.
As far as I'm aware, a mandate by the Chiefs of Police doesn't necessarily lead to government
action.
We don't have a draft law on the table being considered by the government, as far as I'm
aware, and if that did happen, you can be sure that Logic will be following it very
closely.
I see.
How many members do you have in your group, Logic?
Well, it's hard to tell.
On the mailing list, we have roughly 30 or so, and we recently have developed a call
for legal writing, legal commentary across Canada, which we hope will generate significant
interest and enhance our internet presence by providing much legal commentary on laws
such as this one, so that when we confront the government, we'll have the resources available
to make a reasoned argument for change.
We're speaking with Dov Weisbrod of the Legal Group for the Internet in Canada.
If you have any questions you'd like to pose to him, please give us a call now.
If you have general questions about something else, however, we're doing that later on in
the program, so don't call to ask about something unrelated to this case.
212-279-3400 if you want to ask something.
And Jason, you have something for us right here in this video.
Yeah, I was wondering, in addition to the laws that are coming down with this case,
it's my understanding that the Bell Canada is really upping the price on Centrex lines
and things like that to ISPs by about 400%.
What is it like up in Canada?
I mean, here in the United States, we're pretty much used to freedom on the net, as far as
where to go and what to do and what to say, and it's pretty easy to get access.
What is it like up in Canada trying to get access, and what are the prices like, and
what are the prices going to be like with the new laws, and how is this affecting how
Canada regulates the net?
How much government involvement is there in the net in Canada?
In Canada, we have a government organization called the Canadian Radio, Television, and
Telecommunications Commission, which is a policy body that regulates telecommunications
and broadcasting in Canada.
That's basically UFCC, the CRTC, right?
It's fairly equivalent, yes.
And Bell Canada, when Bell Canada proposed this rate increase, a number of internet service
providers got together, and they're planning to petition the CRTC against the rate hike,
but according to the CRTC, what Bell is planning to do is perfectly legal.
Interesting.
Let's take some phone calls.
212-279-3400.
Good evening.
You're on the air.
Yes, Emmanuel.
I just want to know.
You know, you were talking about digital phones.
When?
You were talking about digital encryption on cellular phones.
Right.
Yes, go ahead.
In the United States, they have this new digital phone that AT&T has.
How does that work?
What does that do?
I mean, does that encrypt your phone calls or something?
Well, you know, that's not really related to what we're talking about right now.
We'll get into the technical discussion of how exactly it works a little later on.
Right now, we're trying to keep the focus on what's happening up in Canada.
Good evening.
You're on the air.
Hello?
Go ahead.
Okay.
Well, that's about the intelligence level that's out there at this moment.
212-279-3400.
We have one more line.
Go ahead.
You're on the air.
Yeah.
Hi.
What kind of reaction has there been in Canada about this issue in the press, I imagine?
Has the press covered the Jesse Hirsch case, is what you're asking?
Yeah.
Yeah.
And also, I mean, I'm a bit disappointed it didn't get to courts.
It could be thrown out of courts that no such charges could be...
Yeah, that's a question.
In fact, I was wondering myself, why did he agree to pay $400?
Was it just to get this over with?
Well, there was some discussion that one of the witnesses who was related to the case
wasn't available at the key time for the prosecution.
And rather than wait and have late disclosure of evidence, which is necessary for the accused
to know the case against him, the prosecution just decided to drop it.
We were actually...
We were very pleased for Jesse that he went free and the charges were withdrawn.
But we also had this nagging feeling that if a court was forced to look at this law
and decide how it applied and whether or not it should apply, then we could have either
a good or a bad precedent up in Canada that we could deal with.
Right now, the law is still up in the air.
That's a very good point.
Okay.
Thank you very much.
Thanks for the call.
Good evening.
You're on the air.
Okay.
Let's just avoid that line for now.
Good evening.
You're on the air.
Hey, I have two questions.
First of all, about exactly what the nature of his trouble was.
Did he crack the system?
Or was he given access by his friends?
I wasn't really clear on that.
He was given access by his friends.
All he did really was use the system the way it was intended to be used.
Is that correct?
And it's just that they weren't authorized to let him use their accounts.
That's right.
They provided him with the passwords to their accounts.
He used their accounts.
But according to the university, he shouldn't have received those passwords.
And if he did, he shouldn't have used them.
Okay.
I see that.
So that's a policy thing.
It's clearly policy.
All right.
And my other question is, what are the laws in America?
Does anybody know what the laws in the United States are surrounding that same sort of thing?
It's kind of a question of the site's policy, the site's access policy.
Well, I think it basically revolves around the site.
The site implements its own policies based on their own rules and regulations.
And they're pretty much responsible for enforcing it.
And I imagine the same really holds true up in Canada.
I mean, are we looking at some sort of a national law that was violated here,
or that they claim was violated, or just a university policy?
Well, the case, as it turned out, involves a contract between the university
and the people whose accounts were used.
There's a contract there that says that the people who have the accounts
cannot give their passwords out to anyone else.
When Jesse got that password and used the account with the permission of those people,
he did so in breach of the contract with the university.
Now, Canadian law says that if you do that, you are liable for a crime.
Now, the problem with that is, it's a contract between two people.
That's all it is.
And the worst that we think Jesse should be liable for is possibly breaching that contract.
Now, I'm curious about that, though. I mean, he never signed the contract, did he?
No, he didn't. Most likely, the contract should affect the people that gave him the password.
As a third party to the contract, as someone who didn't sign it,
he shouldn't have been the first person contacted.
He was, largely because the university didn't know that he was a student,
didn't know that he had permission to use the passwords until it was too late.
And they called in the cops, acting pretty much in total ignorance.
Now, was this real total ignorance, or were they just pretending to be ignorant about this?
Well, they're claiming ignorance.
And I don't know what the system administrator was thinking,
but as far as I've heard from him and from Jesse, he honestly didn't know.
I didn't help Jesse when he was arrested, handcuffed, and strip-searched,
but that's what they're saying.
That's very unfortunate, and I just send my sympathies out to him wherever he is,
because a similar thing happened to me a couple of years ago,
and I'm just glad that the system administrators at that site were a little more understanding.
What happened to you?
A somewhat similar thing.
I was obtaining access through alternative means to the system.
I only sort of cracked it.
Part of the access was legitimate, and perhaps I overstepped the bounds.
And how did they respond?
They reacted by organizing kind of an internal bust thing,
and they grabbed me and freaked the heck out of me and told me
that they could have called the cops on me, and they had decided not to.
And I saw the light.
They got their point across.
They definitely got their point across,
and I'm very glad that somebody knocked some sense into my head in that way,
rather than actually calling the cops and putting me in this person's situation, Jesse's situation.
Makes sense. Thanks for the call.
Thank you. Good night.
Now, when Jesse was put in prison, you mentioned he was strip-searched.
How long was he actually in jail for?
He was actually in jail for several hours.
His father and a friend of his father's came down to the police station
and made a lot of noise and finally convinced the police officers
to let their friend go and his son go.
He was kept in the police station for that long.
What kinds of things were they accusing him of?
Were they saying he was some sort of a master hacker
that could bring the world to its knees or something?
Well, as Jesse tells the story,
two very large policemen showed up at the door of his family's home,
asked him if he knew what a hacker was, and proceeded to arrest him.
When he reached for a jacket to take along with him,
they used that as an excuse to search the jacket,
at which point they found something that led them to be even more suspicious,
and when they brought him down to the station, they strip-searched him.
You can only imagine what they expected to find.
As far as I know, there's nothing you can carry on your body
that would help you hack with someone else's password.
The whole story just is so absurd as to almost make it unbelievable.
Now, how exactly did he come to their attention in the first place?
Was it because of the Anarchist magazine he was publishing?
Initially, that's what led the system administrator to look into the situation.
Apparently, a user on the internet brought the Anarchist newsletter
to the system administrator's attention,
saying, look, look what's coming out of your computer system,
you better do something about this.
Now, the newsletter in itself is perfectly legal.
There's nothing they can do to stop that from coming out
from a legitimately held account.
But when the system administrator looked into the account,
and saw that the person who was using it wasn't the person
to whom the password had been given,
then he got suspicious and started paying closer attention.
Eventually, he called in the university police,
who called in the Toronto police,
who arrested him after monitoring his use of the account for several months.
Now, does it strike you as a bit odd?
I mean, I hope the irony isn't lost in our listeners,
but we're talking about a university here,
a university where you go to expand your mind, experiment, learn things,
and they're reacting like some sort of a repressive regime someplace.
Does this strike you as unusual?
You'd think it would be unusual,
but unfortunately, there are precedents in Canadian universities
for censorship and similar activity.
For example, the Carla Homolka press band,
which I hope is familiar to your listeners,
we had our own little O.J. Simpson case up in Canada,
and before the husband of the murderous husband and wife team came to trial,
the wife was on trial.
And the judge in her case ordered that no information about the case
could be published anywhere,
because the husband had to have a fair trial later on.
Now, when the judge did this,
I think the universities would immediately see the freedom of speech issue here
and step out against it and allow things to show up on their computer systems.
But what actually happened is that a couple of students here in Toronto
set up a news group on the internet called alt.fan.carlahomolka,
and universities kept banning it right and left.
It was unusual, you would think,
but unfortunately, there's precedent for university activity like this.
What about independent providers? Would they be compelled to ban that too?
Independent service providers were much better about it.
At the time of the event, I had two internet accounts.
One of the systems, which was operated as a simple bulletin board system,
was largely self-contained except for the access to news groups.
That system actually banned the news group.
But another system that I'm on that is much more open
and is directly accessible over the internet left it on,
which is actually the right decision to make in the circumstances.
Absolutely. How hard is internet access to get up there for most people?
Well, in the cities, which is pretty much the only thing
within my realm of experience, it's very easy.
There's significant and often serious competition among service providers.
I can easily think of nine or ten just in the area here.
That's up in Toronto?
Yeah.
And are they flat fees, no time limits?
Generally, you can get access at whatever terms you feel you need.
Like my own access, for instance, I pay a monthly fee for a set number of hours per month.
Other places, you can pay a fee per day or per year.
It depends on what your access needs are.
Do they use the feature of no censorship as a selling point?
Not yet.
One of the things that Logic is going to be looking into
is how to approach internet service providers
and try to convince them that privacy guidelines
and non-censorship guidelines and open access guidelines
could actually be a significant selling point.
Okay, we're talking with Dov Weisbrot of Logic Legal Group for the Internet in Canada.
We'll take a couple more questions for him at 212-279-3400
and then we'll take some more general topics later on in the show.
Good evening, you're on the air.
This time, I'm not going to hang up.
No, they hang up.
You see, they just have one thing to say and then they go away.
Good evening, you're on the air.
Yes, Emmanuel.
Yes, go ahead.
I tuned in a little bit late.
Are you accepting any questions other than the topic at hand?
Later in the show, we will.
Later in the show, in about ten minutes.
Okay, I'll call back.
Okay.
Good evening, you're on the air.
Hey.
Yes, go ahead.
Turn down your radio.
When I was in college, a friend of mine who was at another college
used my account to telnet to his account,
which I guess he had super user access,
and he got in shit loads of trouble for it.
Well, first of all, you don't need super user access to telnet to something.
He was like a student sysadmin kind of guy.
Okay, so I guess he had a lot of access.
He su'd to your account, is that what you mean?
No, it was different colleges.
Okay.
And he used my account to telnet to his account at his college.
Okay, yeah, I see what you're saying.
Right, and then he got in tons of trouble for this,
and nobody said anything to me about it at my college.
Oh, really?
Yeah, and I just thought it was kind of weird.
It's interesting, you know, when you have colleges running systems,
you're really at the mercy of the people who are operating them,
and lots of times the people with the real power
have no idea how the computer systems work,
so because of that, you know,
they just believe whatever they're told by the system administrator.
And lots of times, you know, the wool is just pulled right over their eyes.
Did you see that in this particular case, Doug?
Well, in a sense, we did.
It sounds like in the callers' case,
there might have been a greater ability
on the part of the system administrator
to monitor the accounts and determine exactly who was accessing it from where.
In Jesse's case, unfortunately,
there wasn't quite that extent of ability.
While Logic feels that it's inexcusable for the system administrator
not to have known that the person he was dealing with
was a student at the university,
the fact remains that he claims that they simply did not know.
And that is one of the main elements
that led to the difficulty Jesse had.
Okay, we've been speaking with Dove Weisbrot
of the Legal Group for the Internet in Canada.
What can people in this country do to reach you guys
and find out more information?
Well, conventionally, over standard phone lines,
they're welcome to call Logic at area code 416-963-9434.
And for those of your listeners who have Internet access,
they can email Logic at logic at io.org.
And we also maintain a web presence at
http://www.io.org
slash squiggle logic.
Okay, and I know there are some people out there
who would be interested in seeing that anarchist newsletter.
Any chance of doing that?
They're welcome to email Logic.
And I can put them in touch with the author and distributor,
Jesse Hirsch himself.
Okay.
Well, I want to thank you for talking with us tonight.
I think we should stay in touch and compare stories
of our respective countries and see just what path we're going down.
Absolutely.
Okay.
Good luck then.
That was Dove Weisbrot of the Legal Group for the Internet in Canada.
Kind of inspiring the things they're doing up there.
And it seems like they're a little bit more focused,
you know, something like this happens to somebody
and right away there's someone there to get the word out
and to defend him.
And hopefully we can have such focus here in this country as well.
This is Off the Hook and it's 25 minutes to 9 o'clock.
And we're taking general phone calls at 212-279-3400.
Is that fiber optic I see?
Yes.
Well, welcome to the show.
Hi.
What's new with you this week?
Well, not extremely too much.
But listening to all the stuff in Canada,
it's made me curious.
How was it that the administration at the university was so quick
to determine that it was in fact this person
who was using the account and not the proper owner?
I guess he had his name attached to the newsletter
or I guess they traced the phone call to actually track down
where the person was coming from.
They went to an awful lot of trouble to do this.
They wasted a lot of time.
They wasted a lot of money.
And it's really for no purpose whatsoever
just because someone else is using an account.
Yeah, but it just seems like there's something else going on
maybe that we're not being told
or possibly that remains unknown on the part of the university.
Well, from what I understand,
they got a complaint from somebody,
saw this anarchist newsletter and said,
hey, look what your users are doing.
They went to determine that this wasn't the person
that was supposed to be using the account.
It was somebody else.
Therefore, that person is in breach of contract.
That person is violating the law.
That person must be prosecuted to the fullest extent.
It was a nightmare for this guy.
Yeah, but obviously, granted,
it was a terrible thing that happened to him.
But I'm trying to figure out
what enabled the university to make such a quick determination
and take such strict legal action so quickly.
I mean, when you consider on the net in general
that there's literally thousands upon thousands of people
running around using all kinds of accounts
that aren't theirs,
and if you consider that people are doing all kinds of things
like trading in copyrighted software or whatever,
I'm not passing judgment on any of that behavior,
but I'm saying that that happens all the time every day
and it's done by thousands of people all over the world.
What was it that caused this one action by this one person
doing something innocuous
like making accessible a newsletter?
Why did that attract so much attention?
Where obviously much more,
what law enforcement people would consider
much more insipid behavior.
Okay, I'm going to read you something
that answers that particular question.
And this actually comes from the system administrator there
whose name is Jack Gorry.
And he says,
When complaints were received in January 1995
about the use of a University of Toronto account
to publish an anarchist newsletter,
the account holder, a female grad student,
and her supervisor, who was paying the bills,
were asked what they knew about this.
The student denied knowing anything
except that when she was alerted,
she tried to log in to see if she had any strange files,
mail, etc., only to discover
that her password had been changed.
Given her story, we assumed someone had hacked the account.
The student knew we were alerted
and when the account continued to be used,
we assumed that she was indeed telling the truth.
At that point, we had someone accessing the account
by modem only, so we started monitoring the account
to try and determine how they had broken in.
Because we presumed someone outside
University of Toronto was stealing resources,
we notified the University of Toronto police,
who in turn notified the Metro Toronto police.
This was the first time
ECF had called in the police,
though other computer centers at University of Toronto
have involved the police
when faced with an external hacker.
Jesse Hirsch presumably was unaware of the monitoring
and in time provided his real name, Jesse,
was mentioned from the beginning,
but it was not clear whether he was the actual user.
The evidence was turned over to the police.
They made an arrest in March.
The trial date was finally set for September 7th.
The day before, the female student came to my office
to tell me that things had gone too far,
that she had in fact given Hirsch the password
and permission to use the account.
I asked if she had informed the police
and they said she had
and the government withdrew the charges the next day
and Hirsch agreed to pay for computer usage.
Well then, what it sounds like to me
is that he let it slip who he was
even if only by first name
and based on that information
the police played on a hunch.
But you know, even if it was the worst case scenario
where somebody was, you know,
breaking into an account,
they broke into someone's account,
they changed their password
and they published an anarchist newsletter,
you close off the access,
you make sure they can't do it again,
you fix whatever damage was done
which doesn't seem like any damage was done
even if it wasn't with the person's permission.
It just seems like a tremendous overreaction
and what about real crimes going on out there?
I'm sure Toronto has real crimes.
Well, I guess where I'm coming from
is that it just really shocks me
that such innocuous behavior
would be zeroed in on so quickly
and dealt with so strictly.
Well, you know, people saying things
without restriction is always a concern
to any government
and I think it's no exception up there in Toronto
and same thing holds true at universities.
You know, universities are supposed to be
bastions of freedom of speech
but we see a lot of hypocrisy in many places
where actually it's all about control.
Yeah.
Our phone number is 212-279-3400.
If you have anything else you want to talk about,
you want to talk about this case, feel free.
Let's go to the rebel line.
Good evening, you're on.
Oh, hello, you there?
Oh, yeah.
Okay, you're on the rebel line, so I guess you're not rebel.
That's good, that's fine, no problem.
The rebel is here.
Oh, can you believe that? He has an accomplice.
Yeah, I have an accomplice.
Oh, my God.
Back at the college I went to,
they had a VAX
and there was a thing called deck notes
and I found out that I could start my own conference on there.
And I just used my regular, you know,
my regular account to do it,
and they eventually kicked me off
for something stupid like
using foul language or something.
But it wasn't really anarchist,
what I was doing,
but, you know, I was doing the same thing,
telling them tricks on how to get around system stuff
and everything.
So what happened?
Well, they ended up taking away my account,
which wasn't really a solution
because one of the things I was doing
was stealing passwords,
so it just shows you how stupid sysadmins are, I guess.
Well, they can overreact,
they can miss what's really going on.
It's all kinds of things.
They're human beings,
but lots of times they have a bit too much power
over a lot of other people.
Emmanuel?
Yes?
I was going to college,
they had a thing where the staff can look up students.
It's called...
I'm not going to say the name of the account,
because...
Well, I guess I could say it.
The username was Infobooth.
Three times!
OK, yeah, we know what the username is now, fine.
So now the password was the same as the username
and they never changed it,
and I went in there,
they never gave students access to the internet,
and I got access to the internet through them.
Uh-huh.
Also, how do you trace a call that's in progress?
I know that in the movie Hackers
they say, oh, I want to trace a call in progress.
Can you do that?
Well, you should look to the movie Hackers
for technical questions.
But, Fiber, I'm sure that maybe you've learned a thing or two
from that film.
You can explain to us what they were doing.
A call can only be traced in progress.
If the call isn't in progress
and you determine who it was that called you,
it's not considered a trace.
Well, what if you get some dilithium crystals
and power your...
Travel back in time.
Yeah, exactly.
You could probably do something like that.
Basically, I have yet to see a movie.
Where there was a phone trace done
that was actually a real trace.
But other than that,
in all these Hollywood movies
that glorify technology
and sort of make things up as they go along,
I've never seen an actual realistic phone trace.
There's always some magical black box
with headphones connected to it
with the little display on it.
I thought the funniest one was the trace in Sneakers.
Yeah.
Where they had this graphical interface going
where you could see how far along in the trace they've come.
If you could see that information,
then you're already connected to them.
You should be able to get the whole thing.
But you could say,
OK, they've traced me up to here,
they traced me up to there,
they're about to trace me back to where I really am,
so I'd better hang up.
How would something like that work in the first place?
It's nuts.
OK, thanks so much for the call there.
Let's go on to another call.
Good evening, you're on the air.
Hi, I have a few comments
about the price.
They charge this guy,
they charge him $400?
Yeah, that's what they said.
Computer time cost.
It's another thing.
It's a very crazy figure
that a lot of these system administrators
come up with, charging people with computer time.
When I was prosecuted
for my particular computer crime
back in the early 80s,
they said that I used something like $200
worth of computer time,
and that seemed fair,
because that or 50 years in prison,
which was the other scenario they were presenting me with,
$200 didn't seem that bad.
But when you look right down at it,
how much does computer time really cost?
It's something that is widely speculative, I think.
Hard to determine, right?
Very.
I don't know if you know,
but there's an 800 number for AMI.
My AMI is?
Yes, it's dead, we know that.
Do you have any information about why that happened?
Well, probably they got their bill
and they realized that tens of thousands of people
around the country were calling to find out
what their phone number was,
and they were footing the bill for it,
and I guess they just didn't feel like doing that anymore.
We gave out another number last week,
but I don't have it on me right now.
But there are other numbers out there.
What you do is you take your phone
and you start dialing 1-800
and start with, like, what, 221-0000?
And then keep going until you reach 999-9999,
and then you will have gotten all the 800 numbers.
And then you will have gotten the 8888 area code
and there will be toll-free numbers there as well.
All right, well, you better get started then.
212-279-3400.
I sensed shock there when I said that to him.
Good evening, you're on the air.
Yes, Emmanuel.
I have a question.
I'm on the HP Unix system here
at the State University of New York at Stony Brook.
You know, I spent many, many frustrating hours
on that very system.
Oh, boy.
Okay, wait, what server are you on?
What, the LIBWS or the...
ENGWS.
ENGWS.
Which one are you on?
LIBS Workstation 1 through 4.
Which one are you on?
Well, you can select which one's available, 1 or 4.
I used to go on something like CSWS 19 or something
because I was the only one that had a decent response.
Well, I'm kind of new on the system.
My question is this.
I've been sending email.
I've been using Netscape.
You know, I've been on the alternative,
news groups.
Right, Alt.whatever.
Yeah, I've been on yours, too, Alt.2600.
My question is this.
Can anyone somewhere in the university
know what system I'm on while I'm on it?
Sure.
I mean, what specifically are you asking?
Give us a scenario.
Well, all right, let's say I'm on Alt.2600
and I'm looking around.
Can somebody in some remote office
or wherever they are pull up a screen
and see exactly what I'm looking at?
Sure they can.
Well, I mean, not graphically nicely,
like I think he, you know,
watching his screen flipping by as he's doing.
How would that work?
Actually, they could.
Yeah, that they couldn't do, but...
No, they could do.
They could?
Yeah.
All right, how?
Well, somebody could do...
It will be a kernel-level modification,
not something extremely common,
but they could look at his .newsrc file
and see what newsgroups he's subscribed to
and know that he's an Alt.2600 reader.
Yeah, that particular file,
you should look at that file.
It tells you which messages you have read,
which newsgroups you've looked at at any time.
It's really quite revealing, I think.
So is there a way to erase the hard drive
of the computer that I'm working at
after I'm done with a session?
Well, what I would suggest doing
is encrypting that .newsrc as you log out,
and then when you log in,
have it unencrypt so that
if you decide to read news while you're logged in,
they don't know what to look at.
I don't know how to do that.
I've only been on the system for a week.
Right, well, it's not something that's very common.
We're trying to spread things like that around
so people use encryption a lot.
But that's really, I think,
the only thing that will prevent
that particular type of snooping.
But as far as live, real-time spying,
I mean, what can people do about that?
Really nothing.
I mean, there's a modification
to the operating system
to allow what could be called
auditing of Internet services
on the socket level.
I just didn't want to get kicked off
because this is my only way
to get on the Internet at the moment.
Wait, you're afraid you'll get kicked off
because you're reading something?
Well, the alternative, you know,
they're pretty controversial.
Yes, so? You're the university.
I mean, that's what universities are for,
but the worst kind of censorship is self-censorship.
Don't think that they're out to cut you off
if you do something bad.
Experiment. That's what it's for.
Experiment. Read whatever you want.
Post whatever you want. Communicate with whoever you want.
And I think if you carry the values
that you use in your day-to-day life
and carry that over to the Internet,
you won't be violating anyone else's rights.
Yeah, because I tried to post something,
but since I'm new, I didn't know what screen to go to.
I didn't find out how to post a message or anything.
That's pretty easy, actually.
What news reader are you using?
Okay, first I got on Windows,
then I got on Netscape,
and then I went to the alternative news groups.
Oh, so you're using the Netscape news reader.
Yeah, Netscape.
What's the command to post there?
Off the top of my head, I don't remember.
Well, there must be a help key somewhere, right?
Well, I'll try to find out.
And I just have one last comment.
I called the 1-800 number directory
to find out what the status on the 1-800 ANI was
about a month ago.
That was an unlisted number, I think, wasn't it?
Well, what I did, I asked who's the server,
like who services this number,
and they said it was MCI.
So I called MCI,
and I got transferred to about 10 different people.
And finally, one person told me
that it's a company out in California
which pays for this number,
but they wouldn't tell me the company name.
And one guy was trying to lie to me.
I think he was trying to cover up something.
He said, oh, it's a fax number.
There's no way it's a fax number
because you get a low tone, you know, humming noise.
And when you punch in, like,
about three or four numbers,
it says, you know,
you have entered a false or incorrect password.
So there's got to be a correct password to this.
Oh, yeah, I'm sure there is.
But you know what?
When you enter that password,
I'll bet they get your phone number
because that's what the number's for.
So you might want to be careful about that
because once you start entering a password,
it's, you know, you're saying you're somebody you're not.
Yeah, I got to watch that.
All right, thanks a lot, guys.
All right.
One thing people do have to look forward to
is Nationwide ANI.
And then you won't even need an 800 number like that
to test out your number.
You can call Perfect Stranger in Toledo
and say, hey, what number is showing up
on your caller ID box?
And they'll be more than happy to tell you.
And that supposedly is going to go into effect
as of December 1st.
Are you ready, Fiber?
That's right.
Actually, that's ANI.
I meant caller ID.
Yeah, you meant caller ID.
Yeah, I'm all confused.
But let's try the 1-800-MY-ANI-IS number.
See just what it is that people get.
Do you have a dial tone?
Okay.
This used to tell you your phone number.
Now it does something different.
Oh, it's a tone.
Is that you or them?
We don't give tones on 800s.
Are you giving me a code?
I can't enter that.
This one has a code.
I don't believe this.
The code you have dialed is invalid.
2BK.
The authorization code or ID code
you have dialed is invalid.
2BK.
Okay.
You have a three-digit code.
Okay, hold on.
Let's see if this actually still works.
Okay.
What do you got?
Whoops.
I'm going to not enter this out.
Okay.
Let's see if this actually works.
Wow.
How about that?
Okay.
Well, it does work.
How about that?
Three-digit codes are what it takes.
So the number is still there.
If you have a three-digit code, you'll get it.
And I guess if they get upset by that,
I'll pay them the 10 cents I just spent
to find out what the number is.
I already know.
All right.
I might suggest if they want to keep this
a little more secure,
they use something longer than three digits.
There's only 1,000 possibilities.
I'm sure there's more than one code.
212-279-3400.
Good evening.
I never thought I'd be able to answer
something that you could catch
in a technical mistake,
but I think that someone could monitor
you live without much modification
to the operating system
just by...
There's a way to call up your window
and to look at basically
everything that's going on
in the window.
So if you were using Netscape,
somebody like a superuser
could just...
look at exactly what you're looking at.
Well, how would they do that?
I don't know.
I don't have technical knowledge.
You're talking about an X-Windows?
Yeah.
Well, if somebody's using X-Windows
and the superuser does an X-Windows dump,
XWD,
then they'd be able to take
a graphical snapshot of your screen,
if that's what you're saying.
But that's just a snapshot.
It's not live action.
It's a trivial matter to write something
that would do that.
Yeah, well, just what I'm saying.
It's something that certainly is possible,
but there is no trivial built-in method
to do something like that.
OK, does that answer your question?
Yeah.
OK, thanks very much.
Good evening, you're on the air.
Hi, Emanuel.
No, you've been on too many times.
In fact, we may have to have
a monthly curfew for that particular call.
You know, I don't know
which one I would prefer to hear more.
That one, or...
Oh, never mind, never mind.
Good evening, you're on the air.
And I'm relatively certain
this one is neither of the other two.
Yeah?
Yeah, OK, see, I knew that.
In regards to your caller ID,
I'm getting numbers showing up
from 804, 601, 213.
Yeah, it is in place.
A lot of long-distance carriers
are going to be in place everywhere
by every carrier by December 1st.
And also, 9X offers a free block,
automatic block on your line.
That's right.
I've heard that's showing up
out of state on me.
Well, the thing is,
it's not supposed to,
but originally the call blocking
that 9X offered was only for 9X areas.
The initial version of the nationwide caller ID
didn't allow for blocking
to cross state lines.
The nationwide caller ID that takes effect
on December 1st has to respect
whatever blocking you have in place.
So it should not be doing that.
It certainly shouldn't be doing that
after December 1st.
Dial star 67 beforehand
and see if it still does that.
And if you're continuing to get your number
being shown across state lines,
you may very well have a good case
to complain about to the FCC.
I'm already complaining about it.
OK, you should, definitely,
OK, one last question.
In regards to the national ANI,
which one was that you called?
MyANI is?
Yeah, that's right.
What's the code?
We can't tell you the code.
We can't do that.
It's bad enough we dialed it ourselves.
But just suffice to say there are codes
and they do work.
The second 800 number that did the same?
We had that last week.
I didn't write it down.
In regards to 900 crisscross directly
that type you called,
like the cold directory online,
are they getting this off like a CD-ROM?
They could be.
It probably is a CD-ROM,
but as to what their actual sources are,
there's a number of those products floating around.
But most likely it's a commercial
something anyone could just purchase?
Yes.
OK, thanks.
As far as people wanting to find out
what their phone numbers are,
those are pretty commonplace.
Most of our listening area, 958,
will get you your phone number
and it's not charged for that.
It's a local thing.
And some other areas, 511,
some places both of them work.
And other places, who knows?
There might be different ones.
311 works in some places
and there's all kinds of bizarre versions of that.
So you don't have to call an 800 number,
but sometimes that is an option.
Good evening, you're on.
You made reference before
to a company in the area
that is advertising
that they are uncensored
to internet access?
We didn't make reference
to a company in the area.
I've seen ads for IDT.
That's them.
And I'd like people to know
that it's a company
that is offering internet access
at a good price,
but they're definitely not uncensored.
Well, Vic, I had a Shell account
on Friday,
got initiated,
and did some checking
of the alternate news groups
that were available
and found that a lot of them were not.
And when I called them on it,
they said, well, that's not us,
that's the news server
in the New York area.
And, you know, it's sort of like
putting a rope around your neck
and saying, well, gee, it's not me,
it's the people providing the news feed
that's censoring it.
That's right.
You're right, that's passing the buck.
They really shouldn't be doing that.
They were aware of it
because when I first spoke to them,
they gave me a couple of ways
of changing it in Netscape,
changing my news server,
and gave me one that would
give me full access.
And then, of course,
I have to tell them I don't have
I'm using Netscape, I'm Shell.
It's just a Shell account, right.
I'm basically out of luck,
and they said that they had no intention
of changing the situation
for the foreseeable future.
Give us the name of one of the news groups,
assuming that's a name
you can say over the air.
Well, not sex hierarchy.
I have a set of four
that I used to check,
but I will say that
one that was very innocuous
that was not showing up
was Alt.Binaries Pictures Children.
Okay.
Now that's pictures of
people's kids.
Okay, well, basically we will look into that.
There's been nothing untoward.
If the news group is available in other places
and IDC is saying that
they don't censor,
then they certainly should live up to that.
We'll check into that and we'll get back to you.
We're out of time.
We want to thank everybody for calling in
and we'll see you next week
with another show, I guess.
Updates as to what's going on
and we'll let you know
how the Bernie S. hearing goes this Friday.
Stay tuned next Tuesday night,
8 to 9 o'clock,
and we'll see you then.
This is Emanuel Goldstein for Off The Hook.
Good night.
This is Emanuel Goldstein for Off The Hook.
And you're tuned to listener-sponsored WBAIFM in New York City.
The time is 9 o'clock.
Coming up now, Housing Notebook.
The time is 9 o'clock.
Coming up now, Housing Notebook.