InfoSec Spin

6-6-96. UST: 
 
   "Businesses bypass law to fend off hackers." 
 
      In cyberspace, where hackers are finding commercial 
      computer systems easy prey, businesses are choosing to 
      hire free-lance security teams rather than involve the 
      law. A Senate subcommittee heard Wednesday from experts 
      who described how businesses, concerned over negative 
      publicity, avoid reporting hacker assaults on their 
      networked computer system. "You stop the bad guy and 
      send him to your competitor," said Dan Gelber, the 
      committee's chief counsel. 
 
      Senator Nunn asked the subcommittee staff to comment on 
      an article in this week's Sunday Times of London that 
      reported, "Cyberterrorists have amassed up to L400 
      million worldwide by threatening to wipe out computer 
      systems" belonging to banks and brokerage houses if they 
      refuse to pay a ransom. "While we can't confirm the 
      entire story," said Gelber, "it is extremely consistent 
      with what industry insiders tell us." 
 
   http://pwp.usa.pipeline.com/~jya/fendof.txt 
 
---------- 
 
   UST had two editorials June 5 on encryption: one 
   criticizing the administration's position, and another 
   defending GAK by Sally Katzen with OMB. 
 
   http://pwp.usa.pipeline.com/~jya/yeanay.txt

John Young writes:
>       In cyberspace, where hackers are finding commercial 
>       computer systems easy prey, businesses are choosing to 
>       hire free-lance security teams rather than involve the 
>       law. A Senate subcommittee heard Wednesday from experts 
>       who described how businesses, concerned over negative 
>       publicity, avoid reporting hacker assaults on their 
>       networked computer system.

Shocking, that.

Of course this happens. I mean, its part of my bread and
butter. However, this shouldn't be surprising -- businesses have
ALWAYS operated this way, whether on shoplifting or catching employees
with their hands in the kitty or hacking. It is not only a question of
avoiding embarassment, but also a question of having different
interests from law enforcement. The company wants safety, not
convictions. They don't have to worry about warrants or absolute proof
-- they only have to worry about their actions being defensible in a
civil suit. This makes their operations in such cases very different indeed.

Perry