Show The Herald Journal Logan Utah Wednesday November 26 2003 — C3 Vagon© ((torcrapotor FtoMdl Asti SAN JOSE Calif ( AP) went out of business in 2(X)2 McDanel discovered that if a user sent a Web address us part of an recipients and other outsiders would be able gain access to the sender's account Everyone agrees that McDanel warned his supervisors and they declined to fix the problem After leaving the company for other reasons McDanel teamed that the problem still had not been fixed and decidto ed to launch his ble of discovering and exploiting Haws that are kept secret from everyone else "Security researchers have to think (hut speaking out is dangerous when they hear about a prosecution like this" said Jennifer Granick the attorney handling McDanefs appeal Ignorance of the intricacies of high tech has led to laws that are easy to misinterpret Lawmakers prosecutors and judges often don't understand the difference between bona fide security research and -C- omputer administrator Brel McDanel discovered a security Haw in his company's soli- ware He wanted his managers They ignored his pleas So he quit and fired off thousands of alerting customers to the problem The' vulnerability at Tornado Development Inc finally got fixed But McDanel was charged and convicted of causing damage under the federal Computer Fraud and Abuse Act McDanel 30 maintains he was merely a whistleblower doing the right thing More remarkable is that prosecutors now agree Earlier this month after McDanel served his sen- -' tence of lb months in a federal lockup they asked an ' appeals court to reverse his It can be very difficult for people who barely underhand to grasp the' difference between ethically sound net- work vulnerability research and the public disclosure of vulnerabilities said Daniel Ingevuldson engineering manager of Internet Security Systems a computet security firm And that Granick says is at the heart of McDanefs case In 1999 and early '2000 McDanel worked at El Segun- do Cal if -- based Tornado which offered a unified messaging service that let cus- voice turners retrieve mail and faxes through a single Web site The company - 56(H) in all sent' in late summer 2(XX) — as a crippling attack that crashed servers and Tornado's Caused more than $5(XX) in damage a threshold in the law In her appeal Granick said the dollar amount was inflated because it included the cost of Tornado's own efforts to hide the problem McDanel was convicted in a nonjury trial on June His sentence of 16 months w'as the maximum at the time the limit is now two ' years: “What's happened here is you have this perfect storm of a vague statute a kind of gen iil have proven to be quite capa : During the trial prosecutors described the barrage —r hacking conviction The case illustrates the dan- ger that vague laws pose in attempting to jgovem the tan- gled complexities of technology And though McDanel's plight is on the verge of resolution his experience has had a chilling effect on open dis- -' cussions of computer security' experts say That can be dangerous ' because malicious hackers eral ignorance about computers and computer security and a system where prosecutors get a lot of press and money1 for pursuing computer crime cases" Granick said For instance the Computer Fraud and Abuse Act bars anyone from sending informa- -' tinn with the intent to cause damage to a protected computer But the law's definition of damage includes “impairment to integrity" of a system or data — a phrase so amhigu- ous that adjudge in an unrelated 2CXX) case resorted to a dictionary for clarification In McDanefs case prosecu-tor- s claimed and the judge agreed that “impairment to integrity" includes the publication of a security vulnerabil-it- y customers ' ’£- to ©mtoir©© DuaiiraO - other words the convic- tion hinged on McDanefs message not just his method "He let people know if was In' techies as "security through obscurity" But now that worms viruses and hackers are repeatedly exploiting phone at McDanefs pareius' house where he has been liv- ing since his release from prisyn in Los Angeles said he was not speaking to reporters 4 Christopher Wolf' an Internet law specialist at I’mskauer Rose a firm in Washington :t DC said the Tornado case is unusual but should make prosecutors think twice "It will likely pin prosecutors bn more notice that you can't assume that somebody doing what this guy did is necessarily a bad actor" he said Would-b- e w histleblowers also need to worry about the Digital Millennium Copyright Aet which restricts discussion of technology used to protect digital content Several (egal rights groups have questioned that Jaw's w ide powers "The role of the law is not ' to protect the 'reputation of companies with insecure products dr to protect their profit stream" Granick said “You want every body to be equal before the law" that had been kept for years many compaquiet nies have had a change of heart The Justice Department's approach to such cases is now apparently ‘evolving as well as evidenced by prosecutors' motion with the 9th US Circuit Court of Appeals in San Francisco to have McDanefs conviction overturned “This case was brought in good faith It was litigated in good faith It resulted in a conviction by a federal judge'' said Thom Mroek US Attorney's spokesmuh in Los Angeles “Our good faith is demonstrated again by our steps to have this conviction ' reversed" insecure" said Grunick who executive director of Stan- ford Law School's Center for Internet and Society “And that required them to fix it and deal w ith angry 'customers the theory being they didn't have to fix it as long as nobody knew about it": ' - Such no-fi- x practices are disparagingly known among' is McDanel didn't have a clean record before the Toma- do incident He was indicted for allegedly changing the passwords of servers operated by Morristown NJ Internet-servicprovider GTI w here he once worked He allegedly refused to disclose the pass- words until he received pay for his final days at work ' ' On the Net: Center for Internet & Society http:cybeiictwstanfolxledu Thai case is still pending A woman who answered the Great new products premier at DEMOmobile show By The Associated Press Some standout products that debuted last week at DEMQmobile: Zodiac A multimedia handheld computer geared to adults whtvwatif electronic-addresboosts and calendars with their games photos MP3 music and Initially shipping in twosizes 32 megabytes of internal video-viewi- memory for $299 and 128 MB for $399 The maker Tapwave Inc' says ' games have already been licensed from such companies a Activision Atari Id and Sega Details: Cleverly modified Palm operating system run- ning on an ' ng ' With FlashTrax : ' 80-gig- Mid-Octob- er MW140-B- Mprint Micro Printer T A7-siz- ' c- FlashTrax weighs 2 ounces arid measures 56 inches by ' 36 inches so it’s by no means ' a vest pocket device’ y'£' The manufacturer says the —— rechargeable battery last ——7 — — t from Ft Myers yoti can transfer your digital photos clear the cam- era’s memory card and start fresh Better still you can view photos through Flash- - ijCorp Trax’s fulLcolor 35-irtc- h LCD screen ' I took short tour of San ' FranCisco with my 4 megapix- el Canon S400digitalcarnera a 32 itiegabyte flash card and FlashTrax in tow At the camera's highest resolution settings I could snap about 30 shots before I needed FlashTrax Slightly bigger than a personal digital assis- tarit FlashTrax has 30 giga- bytes of storagerCnough for about 30 (XX) photos at that same quality All I had to do was flip the ' f5rW ferred introduced a 1 twtt Review — ! t iicvci ' i cm iciui ' : : ComT'' piictFlash curd for$ 1499 FlashTrax could be an appealing alternative at $500’ : though many people might choose to shell out several' hundred-buck- s niore fora lap- jptop wjtH similar storage ui mi thumbnail : 50-she- et Brother International's $399 pocket thermal printer weighs just 10 e ounces and spits out four through the onboard speaker but even better through quali- ty headphones The audio- - flash memory cards such as Sony's Memory Stick There's a nice four-dire' tional thumb pad to surf the S ? display screen I highlighted the correct pages per minute at 300 dots per inch It's slini andsilver ini a 4- - by' 64:inch ease less than an inch thick Works with Palm and Microsoft's Pocket Pip operating systems as well its Windows' A single charge of (lie rechargeable lithium ion battery is good lor tin advertised two caswttes of printing Cojinects with' computers and handhelds vja Blue- tooth infrared and USB' port tern requires a broadband connection 'and includes UV LOO Ethernet plug Relies oh Mirra servers- for Internet sharing with others byte unit priced at $399 120GB for $499 availahility Billed' as the first truly personal server the compact appliance for Microsoft Window users backs up your data and lets you access information remotely as well as Securely processor aluminum housing : share jt with people (o whom you includes analog controller (joy stick) ‘ stereo speakers plus headphone jack grant permission: Appliance from v two SD memory slots Display is 480 : Ispiri Inc runs Linux operatingsys- - SAN FRANCISCO (AP) — With digital photography enjoying a steady rise now's a good time for a device that can provide loads of portable disk space for storing photos' onthego by 320 pixels Dimensions: 65 inch-es by 3 inches Weighs 63 dunces ‘ capacity theMliand theV with-- ' Wi n'- - file names cameras ly names To view orie I just scrolled down highlighted it and pressed enter There ’s aso a neat slideshow option for v r viewingiitills FlashTrax can also store and play music in MP3 format When FlashTrax connected aJ' of USB 20 the unit appeared as a removable hard drive under ‘My Computer” SweetHl only took 10 seconds to trans-- fer an entire album of MP3s (42 megabytes in this case) The' sound quality is fine - such video is low to begin with ‘ ‘4‘ computer 'rhpme Lexar Mcdialnc I Traxasp recently r :t ? : AP photo With FlashTrax from SmartDisk Corp you can transfer digital photos clear the Camera's mem- - ' piy card and start fresh ’ display panel on FlashTrax power it on and insert the CompactFlash card from the camera in the front slot An adaptor sold separately lets the unit read other types of ' : Logan's20th Annual NoVemberfest Arts & Crafts Fair 19) Seatj) lee West ' Hours: Friday loam - 7pm ik Saturday loam - fipm $i adioissioB charge (cildreo 5 aod under free)' o - t - i to celebrate our JOyear We will be giving away “A nijbt on tbe town for J" to 3 lucKy vL winnera-C- ut out bring it to t miTTiTTiiii Z le coupon below and tbe fair to enter to rin im mmiim1 it |