Subject: [NEXTEL-1] PRIVACY- Court Opinion Raises Questions About Honeypots

From: [email-masked]
Date: Wed, 30 Jul 2003 04:09:15 -0400

PRIVACY- Court Opinion Raises Questions About Honeypots

HONEYPOTS—decoy systems companies set up to trap network intruders—are fast
becoming one of the most common and useful information security devices. Easy to
deploy, these phony routers or databases can be configured to capture data about
anyone trying to access a network illegally. There's only one catch: using
honeypots—and possibly any other system that collects IP addresses, file headers
or even search terms—may be illegal.

Judge Sandra Lynch, writing for the U.S. First Circuit Court of Appeals, recently
ruled on an appeal in a suit by seven private citizens against Pharmatrak and said
that information such as URLs and file headers is protected under the 17-year-old
Electronic Communications Privacy Act (ECPA)—a federal wiretapping law.
Pharmatrak, which analyzes for the pharmaceutical industry how visitors use drug
makers' websites, collects URLs and other evidence of online activity. In the
process of collecting this data, the company also picks up terms entered into
online forms that are rendered in the URL, much like the URL of a Google search
results page will contain the search term. The court ruled that any unauthorized
interception of this data is a violation of ECPA.

The case, Blumofe v. Pharmatrak, was remanded to the lower court for further
action.
The implications of this decision—one of the first to apply the wiretapping law to
the Internet—are potentially far reaching, says Orin Kerr, an associate professor
at George Washington University Law School. Future litigation is likely to
determine whether, say, matching click-stream information to individual users is
also illegal.  In the meantime, however, there's no doubt honeypots are a legal
land mine for companies.

While there's no need to tear down honeypots just yet, it is time
to find out how your IT department is using them and come up
with a strategy that keeps the new legal precedent in mind. One
obvious first step, says Kerr, is to alert all website users—good guys and bad
guys—that
you are monitoring their activity. "That generates consent," says Kerr, and makes
it
harder for a hacker to argue that his privacy was violated.             —Ben
Worthen

http://www.cio.com/archive/071503/tl_washington.html
--
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for Your HP, Epson, Canon or Lexmark
Printer at Myinks.com. Free s/h on orders $50 or more to the US & Canada. http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/sO0ANB/LIdGAA/ySSFAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

---

From: Rick Parrish <[email-masked]>
Date: Wed, 30 Jul 2003 11:24:26 -0500

[email-masked] wrote:

>There's only one catch: using honeypots—and possibly any other system that collects IP addresses, file headers or even search terms—may be illegal.
>
This is stupid, alarmist copy. Collecting IP addresses "may be illegal." 
Does that make my caller-id box also illegal?

File headers? What file headers? (No, an HTTP header is NOT a file header).

>Pharmatrak, which analyzes for the pharmaceutical industry how visitors use drug makers' websites, collects URLs and other evidence of online activity. In the process of collecting this data, the company also picks up terms entered into online forms that are rendered in the URL, much like the URL of a Google search results page will contain the search term. The court ruled that any unauthorized interception of this data is a violation of ECPA.
>
This is a feature of HTTP. Your browser, when following a link to 
request a URL from a web server, informs the web server of the referring 
URL (the page containing the link on which the user clicked).

This is not an "interception" of data. The user's browser is voluntarily 
supplying this extra information to the web server. Persons genuinely 
concerned with privacy could configure their browser to not send the 
referring URL when following a hyperlink. [ Note: persons genuinely 
concerned with their privacy might want to request the addition of such 
a feature to their browser - IE and Mozilla don't. ] If their browser 
does not have this feature, they can open an empty browser window and 
type the URL into the location bar.

[ and to think that a judge was actually asked to rule on this - 
aaahhhhh !!! ]

-rick