CERT vs. Net Mafia?

[catalyst-remailer@netcom.com]

NEWSWEEK, February 21, 1994, p.73

Technology: How to fight crime on the Internet

A SWAT Team in Cyberspace

Joshua Cooper Ramo

The First Hint of trouble came at 3 a.m. one night last December.  A
panicky New York computer bulletin board operator called the Computer
Emergency Response Team center at Carnegie Mellon University in
Pittsburgh to report discovering an unauthorized program that could
surreptitiously record users' secret passwords.  CERT is the SWAT team
of the electronic frontier; the call sent these cybercops scrambling
to their keyboards to try and figure out who was behind the break-in -
- and whether it had spread.  "It's like finding rats in your
apartment," says CERT manager Dain Gary.  "When you see one, there are
probably a hundred.  In this case, there are probably 10,000."

The New York bulletin board is hooked up to the Internet, an
international web of computers that links 20 million users.  If one
system is compromised, many more are vulnerable.  The December break-
in turned out to be the first of hundreds of similar reports: earlier
this month Gary's team concluded there was an organized effort to
infiltrate the Internet.  Although the culprits were still loose and
their motives were unclear last week, CERT's detective work has won
the team respect and new attention on the net.  A typical Internet
message: "It's nice to know that somebody out there is helping keep us
techno-peons in the loop."

Created by the Defense Department five years ago after the last
widespread Internet break-in, the CERT team operates out of a sleek
granite building.  CERT has no legal power to arrest or prosecute;
instead, the team of about 15 programmers pokes through violated
systems using their only weapons: dozens of computers.  Like the
hackers they track, CERT team members often work round the clock,
subsisting on takeout Chinese food.  Gary, 52, CERT's manager, is a
decorated army attack- helicopter pilot and an expert in computer
security.  Hackers are "the adversary," he says.  "We try to help the
victim" by posting warnings of "holes" -- vulnerabilities -- and fixes
on the net.  "But as the net grows, the incidents are climbing," he
says.  "The motives are changing."

Net Mafia? Ten years ago hackers were usually youthful pranksters,
mostly interested in demonstrating technical ingenuity.  Now there's a
growing feeling that more sinister forces may be loose, perhaps a kind
of net mafia intent on outright theft through use of credit-card
numbers or other data.

Last year CERT responded to almost 1,500 calls, a 75 percent increase
from 1992's.  CERT won't disclose its budget, but clearly a lot of
help comes from volunteers interested in preserving the integrity of
the net.  Particularly complicated security breaches are farmed out
around the country to an unofficial brain trust of specialists in
specific operating systems.  The rest of the detective work is on line
in Pittsburgh.   Rich Pethia, 47, CERT's coordinator, has spent 25
years working on the net; he says his job gets tougher every year. 
The team must deal with increasingly sophisticated hackers and
criticism from netters who think that providing hole data is like
giving cybercrooks keys to computers.

Unfortunately, finding holes is often easier than fixing them.  CERT
still doesn't have a long-term solution to the current break-in
problem.  Last week, in response to the CERT alarm, network operators
around the world booted and rebooted their systems, looking for signs
of trouble.   Back in Pittsburgh, the CERT team members were hunched
over their keyboards, ready for the next call.