October 12, 2001, 12:27 pm
USA ACT (PDF):
SEC. 217. INTERCEPTION OF COMPUTER TRESPASSER COM-
MUNICATIONS.
Chapter 119 of title 18, United States Code, is
amended—
(1) in section 2510—
(A) in paragraph (17), by striking ‘‘and’’
at the end;
(B) in paragraph (18), by striking the pe-
riod and inserting a semicolon; and
(C) by inserting after paragraph (18) the
following:
‘‘(19) ‘protected computer’ has the meaning set
forth in section 1030; and
‘‘(20) ‘computer trespasser’—
‘‘(A) means a person who accesses a pro-
tected computer without authorization and thus
has no reasonable expectation of privacy in any
communication transmitted to, through, or from
the protected computer; and
‘‘(B) does not include a person known by
the owner or operator of the protected computer
to have an existing contractual relationship with
the owner or operator of the protected computer
for access to all or part of the protected com-
puter.’’; and
(2) in section 2511(2), by inserting at the end
the following:
‘‘(i) It shall not be unlawful under this chapter for
a person acting under color of law to intercept the wire
or electronic communications of a computer trespasser,
if—
‘‘(i) the owner or operator of the protected com-
puter authorizes the interception of the computer
trespasser’s communications on the protected com-
puter;
‘‘(ii) the person acting under color of law is
lawfully engaged in an investigation;
‘‘(iii) the person acting under color of law has
reasonable grounds to believe that the contents of
the computer trespasser’s communications will be
relevant to the investigation; and
‘‘(iv) such interception does not acquire commu-
nications other than those transmitted to or from
the computer trespasser.’’.
October 11, 2001, 9:26 am
TechRepublic:
Groups vie for superiority in security standards competition
Oct 8, 2001
Judith N. Mottl
- The National Information Assurance Partnership (NIAP)
The NIAP was created in 1997 to join the efforts of the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) to meet the security testing, evaluation, and assessment needs of both IT producers and consumers. Its long-term goal is to boost consumer confidence in their information systems and networks. Agencies such as the Federal Aviation Administration are starting to work with NIAP to better define their security requirements, and NIAP is looking for other target communities where the organization can serve as a catalyst to spur security requirements and standardization of rules.
- Generally Accepted System Security Principles (GASSP)
The GASSP effort began in mid-1992 in response to a 1990 recommendation from the National Research Council. The effort is sponsored by the International Information Systems Security Certification Consortium ((ISC)2), an international common criteria effort to develop IT product-related information security principles. Its objectives include promoting good practices and providing an authoritative point of reference for IT professionals and a legal reference for the rest of the world for information security principles, practices, and opinions. The GASSP Pervasive Principles have been developed, and work has begun on defining and mapping the GASSP Broad Functional Principles.
- The Center for Internet Security
The Center, founded in October 2000, is focused on helping organizations worldwide efficiently manage information-security risk. The group, which is vendor neutral, provides tools to measure, monitor, improve, and compare the security status of Internet-connected appliances and systems. Nearly 200 members help identify the top security threats and participate in creating practical methods to reduce those threats.
- British Standard (BS) 7799
This enterprise security policy standard is popular in several European countries. BS 7799 has two main parts: a code of practice for information security management and a specification for information security management systems. It prescribes a specific process to determine what policies should be in place, how to document them, and how to develop those that are not specifically identified in the model. It hasn’t been widely adopted within the U.S. IT community, as the International Organization for Standardization (ISO) community considers it incomplete and too restrictive. The ISO, established in 1947, is a non-government, worldwide federation of national standards bodies from some 140 countries.
- Commonly Accepted Security Practices & Recommendations (CASPR)
The CASPR project, launched in August 2001, focuses on distilling expert information through a series of free papers available via the Internet. With the open source movement as a guide, CASPR has nearly 100 certified security professionals involved and is actively recruiting subject matter experts in all areas of information security.
October 9, 2001, 12:24 pm
October 6, 2001, 3:22 pm
Clay Shirky: Web Services: It’s So Crazy, It Just Might Not Work
That high-pitched sound you hear is the Web Services hype machine revving up, as words like “revolution’ and “paradigm” begin making their regularly scheduled appearance in the press and white papers, where we are promised a Shiny New World of on-the-fly software creation.
The hype is happening just as practical applications for XML-structured data beginning to appear. Web Services can reduce the effort and quicken the process of creating standards between developers or businesses which want to work together, an important if somewhat modest improvement in the Internet’s plumbing.
Unfortunately, though, Web Services are being sold not only as improved plumbing but also as a way to create fantastic new software, seamlessly and automatically connecting any two business processes or applications anywhere on the network as if by magic.
[Scripting News]
October 3, 2001, 11:13 am
October 2, 2001, 6:57 pm
Carnivore substitute keeps Feds honest. NetWitness, a commercial alternative to Carnivore. [The Register]
