Least and most guilty in two parts

By Mark Gibbs
Network World, 02/25/02

Part 1: "I enjoyed your article on Crapscape, I mean Netscape, mail. I'm sending [this] 'Thank you for letting the world know' e-mail via MSN. That way I know for certain it cannot be traced. I'm a [technical position] for Warner [some division]. That's why I know every bit of the article was dead on."

- Anonymous message regarding last week's column about AOL Time Warner's decision to replace Microsoft Outlook with Netscape mail.

I must follow up last week's column with a few notes. Because of space limitations, I couldn't detail all the AOL Time Warner problems in their full glory. Some of you wrote in to say (or in some cases shout) "Netscape 6.2 does autocheck for new mail." The problem is Netscape can't autocheck with AOL Time Warner's internal mail servers. These are AOL Internet Message Access Protocol servers that worked fine with Outlook.

And because space was tight, I left out additional problems, such as the issue that authentication to the AOL mail systems must be done with RSA Security SecureID devices, which, as one staffer wrote, is "not only annoying, but there seems to be a high failure rate."

The problems are far more complex than they might appear on the surface, but the result was exactly as I outlined: The users are not happy.

Your responses were interesting because roughly half said it was AOL Time Warner management's fault for not understanding the scope of its decisions before making them strategic, while the other half favored the train wreck being the fault of the IT guys for not testing and rolling out the new systems in a manner that would prevent such a mess.

I shall leave it as an exercise to the reader to draw their own conclusions, but a word of warning - don't forget that politics can make the least guilty appear to be the most guilty.

Part 2: "2:00 a.m. Feb. 12, 2002 PST WASHINGTON - Some forms of illegal hacking would be punished by life imprisonment under a proposal that Congress will debate on Tuesday. A House Judiciary subcommittee will consider the Cyber Security Enhancement Act (CSEA), which ups the penalties for computer intrusions, funds surveillance research and encourages Internet providers to turn over more information to police."

- "Cybercrime Bill Ups the Ante" by Declan McCullagh on Wired

Crime Subcommittee chairman Rep. Lamar Smith, (R-Texas), sponsored CSEA to "combat cybercrime and cyberterrorism and send the signal that if you engage in cybercrime or cyberterrorism, you will be punished."

On the face of it, such an act sounds reasonable. Cyberterrorism is a real threat and the consequences of an all-out assault on the nation's computing and network resources could be disastrous.

However, should this legislation pass it will become a lot easier for the likes of the FBI to deploy their Carnivore or Magic Lantern systems. Carnivore is a sniffer that is placed inside ISPs to snoop, while Magic Lantern is a worm that, after infecting a suspect's PC, logs and reports keystrokes.

The danger is that the smart bad guys (those who are really hard to catch) will eventually figure out how to subvert the likes of Carnivore and Magic Lantern and consequently become even more dangerous. And will the FBI and CIA be able to tell if the systems are compromised? I doubt it.

What concerns me is that there is a real danger of mistakes being made - of the innocent or foolish becoming "examples" because they can be caught. While we're patting ourselves on our backs for how safe we're making the world, the real bad guys will do as they please.Again, the least guilty will appear to be the most guilty.

Judgments to nwcolumn@gibbs.com.