The Secret Service, UUCP,and The Legion of Doom

The Secret Service, UUCP,and The Legion of Doom
by Kevin Mullet, University of North Texas (KEV@VAXB.ACS.UNT.EDU)


UUCP and UNT

Back in 1978, a couple of bright fellows at AT&T's Bell Labs, where the Unix
operating system was developed, wondered if computer files could just be
copied from one computer to another over a cable. State of the art data
transfer back then meant writing data to paper cards or magnetic tape and
reading them in on another computer.

The chaps with the bright idea were M.E. Lesk and A.S. Cohen and the program
they wrote to implement the idea was Unix to Unix Copy, or UUCP. The idea
caught on just about the same time Unix was taking off in popularity.

As the number of computers that could UUCP to each other grew, the first
wide-area network was born. It slowly grew to the size it has today of over
11,000 nodes, or individual computers. The UUCP network, named
after the primary software used for communication across the network in its
early days, now provides much more than simple file copying. The UUCP network
now provides electronic mail, network-based news services
and, of course, file transfer services between each computer on the network.

Electronic mail, or e-mail, is a kind of computer-based postal system where
people can send messages back and forth to each other electronically without
ever having to print them out on paper.

UUCP news is not unlike e-mail. The network of computers where people read,
write and distribute news is called Usenet. Most, although not all, of this
service takes place on UUCP. Because of its popularity, though, the service
is also available from the NSF-Internet and BITNET wide area networks.
Usenet news is comprised of several hundred newsgroups. These newsgroups are
forums for ongoing discussions on an endless variety of topics ranging from
specific computer languages and architectures to cooking, horseback riding,
politics and religion. When a person sends e-mail to a news group, the
message is automatically sent out to every computer on the network that
subscribes to that particular news group. That way, each person who reads and
posts to a news group is literally carrying on a dialogue with hundreds, often
thousands, of other people at the same time.

At NT, the most popular way to be a part of these Usenet news groups is with
the ANU program on the VAX Cluster. Through ANU, anyone with a VAX Cluster
userid can take part in up to 366 different newsgroups.
Messages from all over the world can be read from the user's terminal.

Usually this system works flawlessly, but a few weeks ago something happened.
A computer and UUCP network node partially operated by AT&T called ATTCTC was
seized by the US Secret Service as evidence in an ongoing nation-wide
investigation of data piracy, credit card and long distance dialing abuse, and
computer security violation called Operation Sun Devil. When that happened,
the umbilical cord between NT and UUCP was severed.

An understanding of why this impacted NT requires an understanding of how UUCP
works. The great strength and weakness of many wide area networks is their
reliance on "store and forward" technology. Wide area networks which use
store and forward schemes typically communicate only with computers, or nodes,
that are geographically close to them. If a node on one side of the world has
some e-mail, news or a file to send to a node on the other end of the world,
it simply passes the data to a computer close to it along with instructions
about the eventual destination. That computer, in turn, passes the data on to
a computer close to it until, many nodes later, the e-mail, news or files
reach their intended destination.

The great strength of this scheme lies in its economy. Any particular site
need only pay for connections to a nearby neighbor to access the rest of the
world. This way, a large number of sites can affordably interconnect
in a global wide area network.

The frailty of this technology is its weakness. On a network where the cost
is so low to connect, many sites don't arrange redundant routing in case a
critical node goes down. NT was such a site. When ATTCTC was seized, all the
nodes "downstream" from it, including NT, lost their UUCP access. All these
sites had to scramble to contact other geographically close UUCP nodes that
were "upstream" of ATTCTC to arrange for new UUCP access. Three days later,
thanks to the Computer Science department at the University of Texas at Austin,
NT was back online to UUCP, but for some other sites on the UUCP network, the
story was just beginning.


The rest of the story

This account is based largely on the grand jury indictments
against alleged Legion of Doom members and accounts by actual Legion
of Doom members who posted to the Usenet group comp.dcom.telcom

Sometime in December of 1988, Robert Riggs, a 20 year-old student of DeVry
Technical School, hacked his way into a computer at Bell South telephone
company headquarters in Atlanta. Bell South provides telephone
service for Alabama, Missippi, Georgia, Tennessee, Kentucky, Louisiana, North
Carolina, South Carolina and Florida.

Riggs was a member of a group called the Legion of Doom. Members of this
organization are hackers who illegally compromise the security of various
computer and telecommunications installations on a regular basis in
order to enhance their reputation within the computer underground.

Once he gained access to the Bell South computer, Riggs stole a document
describing some of the workings of the emergency 911 service. On 23 January,
1989 Riggs copied the file through the UUCP network to Jolnet, a public access
Unix system in Lockport, Illinois and made it available to Craig Neidorf, an
editor of an underground on-line magazine for hackers and phreakers
(hackers who specialize in compromising telecommunications security).

Phrack, the magazine edited by Neidorf, is published electronically through
the UUCP and NSF-Internet networks and on numerous BBS's across the country
which specialize in disseminating information about hacking and
phreaking. The magazine, a mainstream publication in the computer underground,
is generally considered required reading for hackers and phreakers. The
content of Phrack ranges from actual and fictional accounts of breaking into
computer systems to technical details of computer security and
telecommunications systems. Sources close to the Phrack publishers assert
that the magazine has always been careful to avoid publishing anything that
was overtly illegal.

Neidorf, a 19 year old political science major at the University of Missouri,
used his userid on a school unix system to retrieve the Bell South 911 file
from Jolnet. Once he got the file, he edited it, as advised by Riggs,
to conceal its source. Neidorf and Riggs intended to eventually write an
article about the 911 system in Phrack.

The actual 911 file in question is a six page, 20 kilobyte document describing
some technical and administrative details of the emergency 911 system that
Bell South uses for its nine state service area.

Through the 911 system, Bell South customers can dial 911 and be instantly
connected with a Public Safety Answering Point (PSAP). Computers called
Electronic Switching Systems (ESS's) are critical to telephone routing. Once
someone in the Bell South service area calls 911, an ESS ensures they are
connected with an appropriate PSAP. The 911 system then allows an emergency
operator to determine automatically what number and address the caller is
calling from and alert the appropriate emergency service dispatchers.

Obviously, the details of security around such a system should be very closely
guarded. The potential for loss of life and property if such a system were
maliciously compromised is enormous.

The Plot Thickens

Unknown to Riggs and Neidorf, Richard Andrews, the system administrator of
Jolnet discovered the Bell South 911 file on his computer soon after it was
transferred there. Andrews sent a copy of the file through the UUCP network
to another computer system called "Killer" that was owned and operated by an
AT&T employee, Charles Boykin. Andrews requested that Boykin forward the
file to the appropriate authorities. Andrews didn't prevent further access to
the file, delete it or frustrate the efforts of Riggs and Neidorf. He also
kept a copy of the file for himself.

Several months later, Andrews received a call from someone at AT&T who asked
for another copy of the file. Not soon after that, the United States Secret
Service came paid him a visit. Andrews has been cooperating with the
authorities ever since. It is largely through his cooperation that federal
indictments have been returned against five alleged members of the Legion of
Doom: Robert Riggs, Craig Neidorf, Adam Grant, Franklin Darden, Jr., and
Leonard Rose.

On February 3rd, 1990, after receiving Andrews' cooperation for over a year,
the Secret Service raided Jolnet and seized it as evidence.

Killer Falls

In 1989, the privately-owned UUCP node known as Killer, through which Richard
Andrews alerted AT&T of the stolen 911 file, was moved to the Dallas Infomart.
It was used by its owner, Charles Boykin and AT&T as a public demonstration
system. It was given a new name, AT&T Customer Technology Center, or ATTCTC.
In the years since 1985, when it began operation, Killer/ATTCTC became a
critical node on the national UUCP backbone. Computers throughout the
southwest, and people who used them, depended on ATTCTC for Usenet news,
electronic mail and UUCP file transfer services. On the 20th of February,
1990, without any advance notice, ATTCTC was permanently shut down, leaving NT
with no UUCP access.

AT&T claims that the closure was due to lack of funds, although the system was
privately owned and operated by Charles Boykin. Sources close to the Texas
Unix community assert that ATTCTC was shut down and seized by the US Secret
Service because two of its userids belonged to suspected members of the Legion
of Doom. Various credit card numbers and long distance dialing codes were
allegedly found in files owned by these userids.

The Next Dominoes to Fall

In Austin, there's a small company called Steve Jackson Games that makes role
playing games (a kind of grown-up make believe). In their offices, SJG ran a
computer called Illuminati. This system was used by staff and customers to
develop new game ideas. SJG ran a BBS on Illuminati though which customers
could provide feedback based on testing of potential new games. One of these
games was called GURPS Cyberpunk, named after the Cyberpunk genre of science
fiction in which the plot often involves extensive penetration of computer
security.

The author of GURPS Cyberpunk, Loyd Blankenship, researched ways in which to
lend a realistic "look and feel" to his game. In his research, he developed
extensive contacts with the hacker and phreaker underground, and acquired a
comprehensive library of Phrack magazines, which he stored on Illuminati.

On the morning of March 1st, 1990, the staff of Steve Jackson Games arrived
at work to find that the Secret Service had forced their way into the
building and were searching and seizing "computer hardware and software
and records relating to computer hardware and software" for evidence in a
"nationwide data piracy case" which Steve Jackson later learned was the Bell
South 911 case.

When all was said and done that day, the Secret Service had taken the
Illuminati computer, all staff personal computers and printers, modems,
software, spare hardware, all material related to GURPS Cyberpunk, a laser
printer, a bag of nuts and bolts and some candy off the desk of Creede Lambard,
who ran the Illuminati BBS.

On the 20th of February, a member of the Legion of Doom who identified himself
as "Erik Bloodaxe" posted an anonymous electronic mail message to the Usenet
news group Comp.dcom.telcom saying, among other things, that:

"Frank [Darden, Jr.], Rob [Riggs] and Adam [Grant] were all definately
[sic] into very hairy systems. The had basically total control of a
packet-switched network owned by Southern Bell (SBDN) ... through this
network they had access to every computer Southern Bell owned [...]"

On April 1st, in New York Newsday, a story appeared saying:

"A government affidavit alleged that in June hackers believed to be Legion
of Doom members planted software ""time bombs"" in AT&T's 5 ESS switching
computers in Denver, Atlanta and New Jersey. These programs . . . were
defused by AT&T security personnel before they could disrupt phone service."


Elsewhere, Leonard Rose, sysop of a computer system called Netsys, was out
driving his car one day when federal authorities pulled him over and arrested
him. On the 15th of May, he was indicted with five felony counts and charged
with various violations of interstate transportation laws and the federal
Computer Fraud and Abuse act. Federal prosecutors allege that Rose hacked his
way into an AT&T computer and stole some of the source code for version 3.2 of
the Unix operating system. He is also charged with distributing two "trojan
horse" programs that would infiltrate a Unix computer and replace the
legitimate login program. Once in place, the trojan horses acquired a valid
userid and password each time a new person logged into the system. Rose,
it is alleged, would later retrieve the list of stolen userids and passwords
and gain any degree of access to a system that he wanted.

So far, during the course of their investigation, the US Secret Service and
the FBI have raided 27 computer sites across the US and have seized the
equivalent of 23,000 computer disks from suspects accused of contributing to
over $50 million in system thefts and damages. The investigation continues
into people who have violated the security of federal research centers,
schools and private businesses, and extends far beyond the theft of a single
six page text file from Bell South headquarters.

Craig Neidorf, the 19 year old University of Missouri student who allegedly
received the 911 file from Robert Riggs, has pleaded not guilty to charges of
violating the federal Computer Fraud and Abuse Act of 1986.

Charlie Boykin, the AT&T employee who ran Killer/ATTCTC and was initially
alerted by Richard Andrews about the 911 file theft was previously an active
member of the Texas Unix community. He hasn't been seen at any Unix function
since the closure of ATTCTC.

According to the Associated Press, U.S. Attorney William Cook was granted a
motion to prevent the 911 text file from becoming part of the public record
during the trial. The trial of Riggs and Neidorf began on April 16, 1990.

The Austin-based company Steve Jackson Games has been devastated by this
affair. In the days since the Secret Service seizure, SJG has suffered a
monetary loss of $100,000, had to lay off 8 of their 17 staffers, and cancel
sixty percent of their 1990 product releases. Jackson has approached the
American Civil Liberties Union for assistance.


The Real Issues: What's the big deal?

That depends on who you ask.

The Secret Service would probably tell you that any violation of computer
security is a serious affair. Unfortunately, the current criminal justice
system evaluates all property crime in monetary terms: if it doesn't
cost a lot of money, then there's not a big crime involved.

The Chicago indictment against Riggs and Neidorf charges them with the theft
and interstate transport of something valued over $5,000, namely the 911 file.
In other words, the crime lies in stealing something worth a lot of money, not
potentially endangering the safety of people in nine states. Typically,
computer crime is only investigated if a large monetary loss can be proven.

Some users and system operators of networked large multi-user systems would
probably tell you that the big deal is that such computer systems aren't
traditionally covered by common carrier statutes. Common Carrier laws are
the laws that say if someone plots a crime over the telephone or through the
US mail, the telephone company and the US Postal System cannot be held
accountable for what was plotted over their common carrier.

This is not the case with computer bulletin boards and network nodes, however.
Federal authorities are placing a burden of responsibility on owners and
operators of such computers to know the legality of everything stored on their
computer system. On a system such as the NT VAX Cluster, that means knowing
completely what's on 4.3 gigabytes of disk storage, and reading over 100
megabytes of wide area network traffic each week. In other words, someone
would have to read up to sixty four thousand pages of text each week in order
to be completely appraised just on new information that is either stored on
the VAX cluster or passes through it on their way to another computer each
week. If the NT Computing Center employed five people who could read
100 words a second to do this, and they worked twenty four hours a day without
stopping, it would still take them twenty three days to read a week's worth
of wide-area network traffic.

And to make matters worse, NT is, for all practical purposes, an end node on
the wide area network circuit. Most traffic that passes through here is
eventually bound for someone at NT. For most wide area network nodes, this is
not the case. A site like UT at Austin, or Rice University has traffic
passing through it, briefly being stored before being forwarded, for many
national as well as international sites. For those sites, not only would they
need to hire many more people, but they would need to be foreign language
interpreters as well.

Imagine a company that owns a telecommunications satellite being held
responsible for all the conversations in all the languages that are going
through it at all times. It's a ridiculous thought and no legal authority would
expect that of RCA or NASA. However, the equivalent is expected of every BBS
in the country and every wide area network node at this moment.

Unless lawmakers grant the same legal protection to computer bulletin boards
and network nodes as the US Mail and telephone carriers, computer users in
the not-to-distant future will only be able to look back at the age of
electronic mail and Usenet news.

People like the Legion of Doom have forced federal authorities to make apply
existing laws to computers before they have sufficient technical preparation
to do so. Unfortunately, it looks like the only solution to inappropriate
seizures of computers by the Secret Service and FBI is the education that
lawmakers and law enforcers will receive through the courts. Once more
phreakers and hackers are arrested and tried will it become apparent that
seizing the computers they use as conduits makes as much practical sense as
seizing the laser printer at Steve Jackson Games not to mention the candy on
Creede Lambard's desk.

In the case of computer security, the best and only effective offense is a
good defense. No computer system is impregnable, but there is a point at
which every hacker will decide that penetrating a system is more trouble than
it's worth. It is especially important that all managers and system
administrators of computer BBS's and network nodes be mindful of this.

Just as barbed wire spawned a burgeoning wire cutter market, the popularity
and usefulness of computer-based communication will ensure that there are
always going to be hackers and phreakers. There is a fine line between
making a computer secure enough to avoid compromise by a hacker, and
accessible enough not to discourage legitimate use. The best managers of
computer systems will continue to walk that line without disturbing the
network of trust that makes such systems the powerful tools they are.