Computer Fraud & Security Bulletin
concern is the perceived threat to individual privacy and corporate security. Public confidence in the chipsets has been difficult to achieve because the underlying technology remains classified. The NSA’s refusal to declassify the Skipjack algorithm has fostered doubts about the strength of the algorithm, rumours of the existence of hidden trapdoors, and fears that the chips could be reverse-engineered in time. Questions have been raised about the impact of this technology on business. Of immediate concern is the public’s forced reliance upon a single, Government-approved supplier for the certified Mykotronx Inc, a chips. NSA-communications security vendor, currently maintains exclusive rights to manufacture and market chipsets. Because the Clipper Chip and Capstone algorithms do not comply with existing international standards, there are concerns that the added investment in hardware and personnel could make the technology unduly expensive to implement. There are worries that foreign companies may not be able to get the chips, and that foreign reaction to the US Government holding the decryption keys may be unfavourable. These worries are compounded by other security fears: the keys could be compromised during manufacturing, while being transported to the Government-approved agencies, or while stored in escrow. Despite these concerns, NIST has been authorized to develop standards for the procurement and use of the key escrow chips. Summary The Federal Government, through the NSA, has guided the design and use of non-military cryptographictechnologyfrom its inception. From the DES to the DSS and the newly proposed Capstone and Clipper Chips, advances in technology have blended with increased Government regulation. The result - a gradual shading of the rights to individual privacy and corporate security should be a matter of international concern.
September
1993
THE INSLAW AFFAIR US Justice Department itself of wrongdoing
absolves
Wayne Madsen The Department of Justice (DOJ) has released the long-awaited report of its internal investigation of the lnslaw Affair. In November 1992, then-Attorney General, William Barr, appointed
retired federal judge, Nicholas J. Bua,
as a DOJ Special Counsel to investigate whether officials of the Justice Department had conspired to wrongfully appropriate copies of the case-tracking Prosecutors’ Management Information System (PROMIS) from lnslaw Inc, a contractor. Many journalists and other parties that have followed the lnslaw Affair since it surfaced in 1985 condemned the Justice report as a “whitewash”. Some congressional officials pointed to the need for an independent counsel to investigate the lnslaw Affair, however, the Independent Counsel Law lapsed in December 1992. Consequently, there are no current statutory provisions for an independent counsel to investigate either the lnslaw matter or any other matters requiring such impartial investigations. Mr. Bua was assisted in his investigation six Assistant
US Attorneys.
them had connections
by
It is possible some of
with the lnslaw affair while
serving as members of the DOJ bureaucracy. A significant amount of critical information in the Justice report was omitted pursuant
to Federal
Rules for Criminal Procedures because, the report stated, “Several third party witnesses (were required) to appear before a grand jury in the Northern District of Illinois”. There was no explanation
of why the grand jury was conducted
in Judge Bua’s former federal judicial seat in Chicago. This was an unusual choice considering that Inslaw’s
complaints
were originally
district courts in Washington, criminal
activity
conducted
filed in
DC and the alleged
on the part of the DOJ was
mainly
in Washington.
The alleged
initial theft of PROMIS occurred at the main DOJ
-12
01993
Elsevier Science Publishers
Ltd
September
Computer Fraud & Security Bulletin
1993
headquarters
in Washington
Additionally,
Inslaw’s
beginning
lawsuit
in 1983.
resulting
in its
The report states that the death of Casolaro was outside the normal jurisdiction
award of $6.8 million was held in the District of
Government
Columbia’s
involved in the investigation
bankruptcy
Government
appeals
court
and subsequent
of this decision
heard before Washington
were also
and therefore, the DOJ could not get of Casolaro’s
The report fails to mention repeated
courts.
of the Federal
conversations
death.
that Casolaro
with FBI special
had
agent,
Thomas Gates, who, according to a 1992 House The DOJ report contains which seem intended of Inslaw’s
witnesses.
lnslaw
John Otto, a former Acting was told by an unnamed Department Information
official’ form
investigators
passages
the veracity
had claimed
Director
that
of the FBI,
‘senior career Justice
that the FBI’s Field Office
Management
a pirated
several
to undermine
System (FOIMS) was
of PROMIS.
Otto
told
DOJ
be able to discuss such a subject. The report also states that Terry D. Miller, the Governmental Sales Consultants have complete information
President of Inc, did not
when he wrote a letter
to then-FBI Director, William Sessions in January 1991, stating that he had, “reason to believe that the software that your agency uses throughout FOIMS -
is stolen.” lnslaw contended
that this meant that the FBI was using a disguised version of PROMIS as FOIMS. The Justice investigators requested Professor Dorothy Denning source
of Georgetown code
Professor
of both
Denning
University PROMIS
concluded
to study the and
FOIMS.
that
the two
programs were totally different as PROMIS was written in COBOL and FOIMS was written in a NATURAVADABASE
environment.
Further, the DOJ report concentrated
on the
late Danny Casolaro, a journalist who was writing an expose of the lnslaw Affair, and who died in August 1991 while planning to meet a confidential informant in Martinsburg,
West Virginia. The DOJ
contends
committed
that Casolaro
lists several motives including
suicide,
and
several months of
unemployment, an inability to pay for a ballooning mortgage and difficulties with his publisher. Furthermore, no problems suicide.
Committee
investigating
report,
the activities
had
been
of one of Casolaro’s
sources, a Robert Booth Nichols, for alleged ties to organized
crime in the entertainment
Gates was concerned
yet the DOJ felt it unnecessary death of a journalist
industry.
about Casolaro’s
safety
to investigate
contact with an agent of the FBI.
the DOJ contends that there were with the police investigation of the
The
DOJ
contends
that
the
forensic
investigation of the suicide was satisfactory. There is controversy concerning information which may not support this conclusion. Casolaro was found dead in his hotel bathtub, both wrists deeply slashed several times with a razor blade. The report states that there was no sign of a forced entry to the hotel room, but the existence of a master or duplicate key is not mentioned. The DOJ unequivocally declares that a struggle did not occur, although enough controversy existed to warrant a second autopsy, during which the pathologists and Casolaro’s own brother, a medical doctor, noted that three fingernails on Casolaro’s right hand were missing and there was a bruise on Casolaro’s head that indicated some bleeding had occurred. The DOJ is adamant that the autopsy (it does not state which one the first or the second) revealed no contusions or trauma of the kind that one might expect if Casolaro were involved in a struggle. The report contends that although extensive pools of blood and stains were found in the hotel bathroom where Casolaro’s body was discovered, there was no evidence such as footprints indicating that other persons were present. The Sheraton Hotel quickly contracted a professional cleaning crew to clean the hotel room after the police concluded their investigation, thus annihilating any option for further investigation. The DOJ has no doubts over the validity
01993
the
who had been in periodic
that he never made this statement
and was so ‘computer illiterate’ he would not even
the US -
Judiciary
Elsevier Science Publishers
Ltd
of
13
Computer Fraud & Security Bulletin
September
1993
Chronology of the lnslaw Affair 1981
lnslaw (Institute for Law and Social Research) becomes a for-profit corporation, develops PROMIS
1982
lnslaw awarded $10 million, three-year version of PROMIS DOJ decides to terminate
April 1982 December
1982
contract to implement
public domain
contract with lnslaw for convenience
Earl Brian and Robert McFarlane Unit of the Israeli Defence Force
allegedly
of the Government
pass PROMIS to the Signals Intelligence
1983
DOJ recognizes Inslaw’s proprietary a 32 bit VAX system
rights to enhanced
PROMIS, designed to run on
1983
Enhanced PROMIS allegedly passed by DOJ to Hadron Inc, a firm owned by Reagan associate Earl Brian, Hadron allegedly sells regular PROMIS to Jordanian military intelligence
1983184
Enhanced PROMIS allegedly modified at the Cabazon Indian Reservations, by Wackenhut/Cabazon joint venture company, Cabazon Security Corp
1983184
Earl Brian allegedly sells enhanced PROMIS to Royal Canadian and the Canadian Security and Intelligence Service (CSIS)
February 1985
DOJ withholds $1.6 million in payments to Inslaw, lnslaw files for bankruptcy Chapter 11 of Bankruptcy Code
1985
DOJ plans to petition bankruptcy court to force lnslaw into Chapter 7, forced bankruptcy with liquidation of all assets including PROMIS
1986
DOJ attorneys advise Deputy Attorney General, Arnold Burns, that Inslaw’s proprietary rights to enhanced PROMIS are legitimate
Indio, California
Mounted Police (RCMP) under
June 1986
lnslaw files adversary
1986
Systems and Computer Technology
1987
Israel allegedly
1987
Federal bankruptcy judge, George Bason, rules that DOJ converted enhanced PROMIS by, “trickery, fraud and deceit”. Hadron allegedly sells a version of PROMIS to the Iraq Intelligence Service
December
1987
complaint against DOJ (SCT) attempts a hostile takeover
of lnslaw
sells PROMIS to USSR
Judge Bason is not reappointed
to his bench
January 1988
Judge Bason awards damages and attorney fees of $6.8 million and $1.2 million respectively to lnslaw a week before his departure from the bench
May 1988
Former DEA agent claims that DEA proprietary firm was selling PROMIS to drug control agencies in Cyprus, Pakistan, Syria, Kuwait and Turkey
1988
Attorney General, Thornburgh, install PROMIS
March 1989
DOJ Office of Professional Responsibility DOJ malfeasance were erroneous
November
US District Judge, William Bryant, upholds Bankruptcy Court rulings for lnslaw stating that, “The Government acted wilfully and fraudulently to obtain property that it was not entitled to under the contract”. Upholds attorney fees, but reduces damages to $655 200
1989
orders Drug Enforcement
Administration
(DEA) to
(OPR) rules that Judge Bason’s findings on
March 1990
British journalist, Jonathan Moyle, investigating hanging in his hotel wardrobe in Santiago
May 1990
US Court of Appeal reverses Bankruptcy Inslaw’s complaint against DOJ
July 1991
Lawrence Ng, a Financial Times reporter investigating BCCI and its intelligence in Guatemala, is found shot to death in his hotel bathtub in Guatemala City
August 1991
Investigative journalist, hotel bathtub
November
Attorney General, William Barr, appoints retired federal judge, Nicholas J. Bua as an internal DOJ special counsel to investigate lnslaw Affair
September June 1993
14
1991 1992
an lnslaw Affair figure in Chile is found
and District court decisions and dismisses
Danny Casolaro found dead in his Martinsburg,
House Judiciary Committee issues its investigative appointment of an independent Special Counsel
links
West Virginia
report on Inslaw. Recommends
Judge Bua issues DOJ report, DOJ absolved of any wrongdoing
01993
Elsevier
Science Publishers Ltc
September
Computer
1993
Casolaro’s suicide note, stating that it was found to be in Casolaro’s handwriting. The DOJ report states, “Fingerprint analysis of the bathroom and the pad of paper in which the suicide note was found revealed the prints of Casolaro and no others except for a sing/e print on the bottom of an ash tray’. The existence of Casolaro’s prints, and the absence of others’, supports the conclusion that Casolaro was alone and tend to negate the possibility that someone ‘wiped-down’ the premises.” The presence of another print on an object (ashtray), so close to the hotel memo pad from which the suicide note was supposedly written, is possibly an indication that further investigation should have been carried out. The report also states that, “Subsequent police interviews of those with knowledge of Casolaro’s activities during the two days preceding his death failed to develop any substantial evidence that any other person had the means or opportunity to murder Casolaro”. However, FBI Special Agent Gates knew that Casolaro was in contact with at least one shady underworld figure who also had some kind of connection with the CIA. Casolaro himself had related death threats he had received to his brother just days before his death. The DOJ report also states that, “There were no indications that the personal effects found in the hotel room had been disturbed”. But there remains the mystery of the whereabouts of Casolaro’s briefcase, containing many of his notes, which was missing from the room. The DOJ report is scathing about Judge George Bason, the bankruptcy judge who ruled in Inslaw’s favour and who was fired from his position shortly thereafter. It also questions the ethical motives of lnslaw in suing the DOJ. The report pays scant attention to one of the most serious charges levelled by Inslaw, that the DOJ gave PROMIS to US intelligence agencies and quasi-intelligence companies like Wackenhut, Inc who made an enhanced version of the program (complete with trap door access) available to the national intelligence agencies of other countries. The report concentrates on the somewhat irregular testimony of Michael ’ Author’s
Fraud & Security Bulletin
Riconosciuto, who claims to have had knowledge of illegal PROMIS transfers to Israel while he was doing some contract computer programming work for Wackenhut and the CIA. The DOJ report does not mention how PROMIS allegedly fell into the hands of the intelligence services of some 80 other countries including Syria, Iraq, Iran, China, Chile, Singapore, South Korea and Cyprus. The Bua team deliberately chose not to “conduct an international search of foreign governments and intelligence operatives” based on the testimony of a former Israeli intelligence officer. It is quite possible that PROMIS fell into the hands of other nations’ espionage agencies in much the same way that US arms were sent to Iran by the Reagan administration: a byzantine network of pass-throughs, proprietary firms and intelligence assets that would expose American intelligence links not only with its allies, but unsavoury governments around the world. This was the subject of Casolaro’s planned book which, appropriately, was to be titled, ‘The Octopus File’. Based on the results of the DOJ’s lnslaw investigations, one must wonder how far the ‘Octopus’ tentacles reach into the DOJ and the Federal judiciary.
EVENTS VIRUS BULLETIN CONFERENCE September 9-10, 1993. Location: Amsterdam, The Netherlands. Contact: Petra Diffield, Virus Bulletin, 21 The Quadrant, Abingdon, Oxfordshire, OX1 4 3YS, UK: tel: +44 (0)235 531889; fax: +44 (0)235 559935. 16TH NATIONAL COMPUTER SECURITY CONFERENCE September 20-23, 1993. Location: Baltimore, MD, USA. Contact: Tammie Grice, NCSC Conference Registrar, NIST/PAD, Gaithersburg, MD 20899, USA; tel: +I 301 975 2775; fax: +l 301 948 2067. XVTH INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS September 28-30, 1993. Location: Manchester, UK. Contact: John Woulds, Wycliffe House, Water Lane, Wilmslow, SK9 5AF; tel +44 (0)625 535711; fax: +44 (0)625 524510.
italics.
al 993 Elsevier
Science Publishers
Ltd
15