SRI International December 20, 1979 Prepared Statement of SRI International Ms. Kathy Zebrowski U.S. Senate Subcommittee on Criminal Justice Washington, D.C. 20510 Dear Kathy: Here are my comments and concerns as you requested on S240 as reported out of the U.S. Senate Subcommittee on Criminal Justice on November 6, 1979. These comments are based on my 30 years of experience in research, programming, operating and managing computers and for the past 9 years doing research on computer abuse as a National Science Foundation grantee at SRI International. The exclusions in the definition of a computer, part (c) are not effective, correct or practical and should be stricken. The text of concern is: "...but does not include an automated typewriter or typesetter, or any computer designed and manufactured for and which is used exclusively for routine personal, family, or household purposes including a portable hand-held electronic calculator". Whatever The terms "automated typewriter or typesetter" and "portable hand-held electronic calculator" are not precisely defined, have many changing meanings and include many computers for which the bill was originally meant to and should include. Don't try to exclude devices when the real purpose may be to exclude certain uses. Devices change rapidly as technology advances. an automated typewriter is today will be different tomorrow. Today it could mean a typewriter with ribbon cartridge, automatic erasure, interconnection to a computer (a computer terminal) or a computer output printer incapable of use as an input device or as a typewriter. Tomorrow it could mean a voice-actuated typewriter. Concerning calculators, the adjectives "portable" and "hand-held" are redundant. In addition, a calculator today can be programmable and be as powerful as a minicomputer with limited storage. Tomorrow it could be equivalent to some of the largest computers in use today and be able to store millions and billions of bits of data. Don't try to exclude them. The exclusion of "...any computer designed and manufactured for, and which is used exclusively for routine personal, family, or household purposes..." might be a reasonable exclusion under "use" with one exception. The word "routine" is not appropriate, because its use means that new or innovative non-routine personal, family or household purposes would not be excluded and should be. Therefore, maintenance of a Christmas card mailing list would be excluded but SRI International 333 Ravenswood Ave. Menlo Park, CA 94025 • (415) 326-6200 Cable: SRI INTL MNP TWX: 910-373-1246 how routine would a new mathematical method of calculating female menstrual periods be? That would probably not be routine at first but after coming into common use, it would become routine. Don't exclude devices; only exclude uses if necessary. Leave it to the courts to decide what is a computer and a significant violation within the technology of the times. If the intent is to exclude letter, report, literary, news or educational writing by computer, then exclude those uses under the "use" definition but don't try to exclude devices or uses that could also be involved in henious crimes. The phrase, Other, more minor definition problems should also be corrected. "... by electronic manipulation" in defining a computer technologically is ambigious and dated. Future computers may not be electronic, and manipulation may not adequately describe the functioning of electronic circuits and execution of compute programs. The definition is adequate without this phrase. Finally, in the definition of "use" use "storage functions", not "memory functions" to be consistent with the rest of the text. I hope that these ideas will be helpful to you and lead to a stronger and better bill. Prepared Statement of H. Stuart Knight On behalf of the Secret Service I would like to take this opportunity to comment on the Federal Computer Systems Protection Act of 1979 (S.240) and the role of the Secret Service regarding this bill. The Secret Service has spent more than two years in the research and preparation of programs to meet the challenges of computer crime. statement reflects the Secret Service's long standing interest in this area. This Computer related crime is a growing and serious problem for the federal government as criminals are presently stealing with impunity millions of dollars annually. The Secret Service takes a serious view of the problem, and hopes to increasingly play a deterrent role in this area. 240 can prove to be a valuable medium for the Service which has both the requisite will and training to employ if Congress so provides. S. The investigative responsibilities of the U.S. Secret Service are defined in Section 3056, title 18, United States Code. These responsibilities include detecting and arresting persons committing any offense against the laws of the United States relating to coins, obligations, and securities of the United States and of foreign governments; and detecting and arresting persons violating certain laws relating to the Federal Deposit Insurance Corporation, Federal land banks, jointstock land banks, and Federal land bank associations. For the past 114 years, the Secret Service has been the guardian of our nation's currency and has maintained the integrity of the federal payment system which issues government financial instruments such as U.S. Treasury checks, bonds, and securities by enforcing the laws relating to counterfeit and forgery. However, in the near future, we may live in a world where paper money is a rarity. The Bureau of Government Financial Operations, Fiscal Service, Department of Treasury, in its January, 1980 statistical summary of the Direct Deposit Program, indicates that approximately 26% of the federal payment system is now electronically transferred and directly deposited. Projections made by Treasury officials estimate that by 1985 approximately 80% of the federal payment system will be processed electronically. The current monthly percentage represents over 11 million transactions involving five billion dollars in government funds. It becomes clear that while the Secret Service continues to investigate crimes historically within our purview, this agency can expect to find itself involved in a significant number of computer related cases. The Treasury Department's. direct deposit system of payments to check recipients represents only the beginning of a national electronic fund transfer system. Currency, and stock certificates will take on a less significant role in our financial market places. The Secret Service has already observed a shifting pattern of criminal activity in forgery related investigations. Our agency is uncovering individuals who are forging stolen government checks and using the proceeds to open an account in the payees' name. Simultaneously, the forger executes a request for direct deposit of future benefits. Consequently, the proceeds for that payee are electronically deposited to the fictitious account for ready withdrawal by the forger. What initially was a routine check forgery has now expanded into a computer related crime. In the area of direct fraudulent computer manipulation, the Secret Service has successfully investigated and prosecuted these activities utilizing our current jurisdictional authority. One such investigation by Agents of this Service has resulted in the recent indictment of an employee of the Social Security Administration who allegedly manipulated a computer at a disbursement center in order to pay herself and two accomplices more than $500,000 in monthly disability benefit checks. The same computer sends out 1.1 billion dollars in disability checks to 4.8 million workers and their dependents each month. Another case which the Secret Service recently investigated involved a civilian pay clerk for the District of Columbia who developed a scheme to manipulate a computer which resulted in the fraudulent issuance of $45,000 in checks to nondeserving recipients. The suspects involved were charged with forgery, uttering, and embezzlement. In 1977, the Secret Service, enforcing the forgery statute, successfully investigated and prosecuted William C. Siebert, an employee of the Department of Transportation who falsified vouchers and caused a computer to issue over $850,000 in government checks which he converted to his own personal use. In investigating computer related crimes involving sophisticated schemes, we are finding that the potential for computer abuse is limited only by the perpetrator's imagination. The cases investigated to date indicate that the law enforcement community has only scratched the surface. The National Chamber of Commerce estimates the yearly loss due to computer fraud at over $100 million and experts have testified that only one out of a hundred instances of computer crimes are detected. The potential for lone felons, conspirators, organized crime, terrorist groups and even disgruntled employees is massive, and the accessibility is great. The risks are minimal and the payoffs are huge by historical standards averaging over $450,000 per investigation. The workload facing the law enforcement community is enormous. The Secret Service in meeting this challenge initiated and implemented a training program which introduces our agents to the computer environment and problems inherent in investigating and prosecuting computer related crimes. Our staff is currently working closely with Treasury Department officials involved with the direct deposit payment system in order to refine our investigative approach in the area of computer related transfers of government financial instruments. Conclusion The Secret Service has already begun to play a role in this area as it relates to crimes involving government financial instruments. Our experience in investigating computer related crimes, as defined in S. 240, dictates that the Secret Service can and should make a significant contribution to the overall enforcement effort in the field. Passage of this bill will insure that the law enforcement community |