than the better flat screens will eventually be, and although scientists
haven’t proved that CRTs are a radiation threat, the small possibility
remains.
These bulky antiques, however, have been to the computer establishment
what gas guzzlers were to Detroit. The CRT isn’t the most promising kind
of computer screen—just the most entrenched.[47]
Footnote 47:
Information on flat-screen displays comes from _InfoWorld_, May 7,
1984, and other micro magazine articles; the _Washington Post_ of
April 29, 1984; George Weiss, director of computer systems studies
with Quantum Science Corp., New York; and Kenneth Bosomworth,
president of International Resource Development, Inc., a
market-research firm in Norwalk, Conn.
Admittedly, CRTs have improved to the point where some pocket-sized TVs
can use them. But in compactness and low-power consumption, CRTs will
never rival the flat-screen displays.
“People will begin using flat-screen portables as regular desktops,” a
New York researcher correctly says.[48] Flat-screen computers may not be
as viewable now as the best CRT displays, but this may quickly change.
What’s more, flat-screen machines don’t hog desks as the Kaypro II-style
portables can. After all, the flat screens are essentially—flat. They
don’t need hefty transformers, moreover, and don’t burn out like old
vacuum tubes. CRTs _are_ vacuum tubes. Low voltage is still another plus
of most flat screens. Not that CRTs are normally a shock hazard, but
you’ll presumably feel safer if you didn’t sit near a 20,000-volt gizmo
flinging electrons around inside some glass.
Footnote 48:
The “people will begin using” quote is from a Weiss interview with
_USA Today_.
Also, as David LaGrande, an official with the Communications Workers of
America notes, flat screens may “eliminate the radiation danger, reduce
the risks for pregnant women.” And unless you spray a flat display with
radioactive material, it just won’t give you cancer.
Again, no one’s proved that CRTs will turn people’s bodies into tumor
farms. But why gamble? Your caution won’t hurt labor relations.
Flat screens, also, don’t flicker tiresomely as many CRTs do, and
someday they may boast more fully formed images than those from the
CRTs. So you might make fewer errors reading material from the screen.
The word “might” is important. Many =liquid-crystal displays=—=LCD=s,
like the wristwatch kind—showed much cruder images in 1984 than did
typical CRTs. The broken-up letters might bother you just like those
from the cheap dot-matrix printers.
Also, some LCDs offered horrid contrast between the screen background
and your typing.
That was as of late 1984. Even cheap LCDs in the future could do away
with the breakup and contrast problems. Already the Japanese are selling
color TVs with LCDs.
Perfected, LCDs could make computerized offices brighter and cheerier.
They don’t glow. Rather, they reflect light, just like paper, so you
needn’t darken the office. In fact, light helps.[49]
Footnote 49:
For a reminder of the advantages of LCDs in avoiding a dark office,
I’m grateful to Bert Vorchheimer, a corporate communications
specialist, who, as a sideline, wrote some farsighted articles on
office ergonomics.
And if LCDs don’t fully pan out? There’s yet another
choice—=electropheretic= screens, which may offer decent contrast and
even beat CRTs’ sharpness. Here’s the theory. A magnetic charge pushes
tiny particles to the surface of the screens, and patterns of particles
form images.
These gizmos will tax your battery less than some other flat-screen
displays do. And listen to this: when you turn an electropheretic off,
it _remembers_. The images on your screen don’t vanish.
Now, combine that wrinkle with memory chips that use next to no power
and can be running all the time. And what do you have? A computer that
will automatically shut off without harm if you didn’t tap a key after a
certain stretch of time. Just like a calculator. So—battery makers,
beware!
There are still other alternatives to CRTs. One is the
=electroluminescent= screen—used on the Grid Compass portable—which
glows and is sharper than the LCD. Electroluminescents in 1984, however,
were far too expensive for the average computer buyer; the Grid was
selling for $4,250, and much of that was the cost of the display. A
second failing of electroluminescent screens is that they’re electricity
hungry. You can’t operate them with miniature batteries.
Another LCD alternative is the =plasma panel=, which glows with a gas
mixture consisting mainly of neon. Plasmas don’t flicker. The characters
are sharp; the contrast, excellent. But backup circuitry has been
expensive; and even small plasmas, with the accompanying electronics,
cost several thousand dollars in 1984—a far cry from a $150 CRT monitor.
To sum up, the main advantages of flat screens are their lightness, low
power consumption in most cases, safety, lack of flicker, and very
likely a better view in the long run. As of late 1984 the trade-offs (at
least in the case of LCDs) were:
▪ The broken-up, somewhat fuzzy letters and the low contrast between
them and the background.
▪ The need to have the display at just the right angle from you to get
the sharpest picture. This could get in the way if you were moving the
LCD to reduce glare.
▪ The comparatively slow speed with which letters or numbers appeared on
an LCD after you’ve typed.
▪ The general lack of full-sized 24-line screens with 80 columns. The
Data General portable debuted with 24 lines and a screen measuring 11
inches diagonally—a welcome exception, even if the quality of the
characters still wasn’t good enough for heavy use.
Since many flat screens were on portables, there were other ergonomic
problems not related to the display technology per se. In late 1984,
most flat-screen portables lacked detachable keyboards. But the
limitations of LCDs were the main problems.
A reporter friend, banging out stories for his paper at times in the
field, told me he’s survived the 40-column, 8-line screen of the Radio
Shack Model 100 very well. But I’m not surprised. He’s also brooked that
clunky Select software, which gets in the way of corrections and
insertions. Gene, you see, apparently knows what he’s going to write—he
needn’t watch the screen as much. I wish I were as decisive. At any
rate, what was right for Gene wouldn’t necessarily be right for a clerk
who’ll be at the keyboard seven or eight hours a day.
No matter what hardware and software you end up with, don’t lose sight
of three goals, among others:
1. Getting the most work out of your people
2. Keeping them happy
3. Guarding your electronic files
Sometimes, alas, the easiest-to-use computers may be the ones most
vulnerable to computer crime and loss of important information—the
subjects of the next chapter.
Backups:
◼ IX, Window Shopping, page 343.
◼ X, Of Mice and Men—and Touch Pads, Touch Screens Etc., page 346.
10 ❑ Jewels that Blip
The words have a nasty metallic ring, as if to suggest helmeted
policemen with black jackets and billy clubs. Watch out: the “data
security” troopers are at the front door.
But a small business on the East Coast nowadays wishes it had enjoyed
more “data security.”
A fire melted its computer disks into plastic globs. The firm just
missed bankruptcy after losing several hundred thousand dollars’ worth
of information—everything from accounts receivable to tax records.
Scrambling to recover, salesmen leaned on customers for copies of old
bills.
Arson? Maybe. A disgruntled worker _may_ have short-circuited some
tangled wiring. Proof never came.
Either way, however, the incident was a powerful argument for “data
security”—the right kind.
It’s nothing more than trying to make sure that your computer and its
information are safe. This isn’t to advocate overkill. Don’t overprotect
nonsecrets or facts that you can easily duplicate; for instance, instead
of buying costly fireproof cabinets, you might simply keep backup disks
at another location—perhaps a more secure approach, anyway.
Why, however, do I say “trying” to make your computer and its
information “safe”? An ex-hacker, Ian (“Captain Zap”) Murphy, now a
computer security consultant, wisely observes: “You’re safe from average
crooks—they don’t envision a nice, mild-mannered human being working at
anything more than a souped-up typewriter. But you can never, never be
able to 100 percent secure a computer system. Even the most trusted user
could say, ‘F— the damn payroll,’ and destroy your records.”
But in the best of all worlds, your electronic files are safe, accurate,
and if need be, tamperproof and confidential. The equipment is sound.
And so are you and others working with it. You’ve shown good judgment.
You’re ideally safe not only from crooks but also your own blunders. You
know you often can’t keep paper copies of all your electronic jewels,
your treasured business files, at least not without giving up the
conveniences of computerization. You have faith, then, that your green
screen, at your command, will display the right blips. I’m stretching
the meaning of the word “blips” to emphasize the transitory nature of
what you see on the screen. Without your stashing it away on a disk or
otherwise—and without your making an electronic backup—it may be lost
forever.
The unlucky owner of the East Coast company will never see his blips
again because he violated a major precept of data security. He stored
his original disks and his copies in the same room—the one with the
fire.
“The remark at all times in cases like this is ‘Why didn’t the dealer
tell me?‘” says Harold Joseph Highland, a top computer crime consultant
and author of _Protect Your Microcomputer System_ (John Wiley & Sons,
1984).
A store can only sell you a computer, not common sense. Nor can this
chapter impart it to you. It can, however, pound away at the elements of
data security—people, policies, hardware, and software. They go
together, these four. And so do the criminal and noncriminal parts of
data security. If you’ve lost control of your computer files and don’t
know what’s normal, you’ll hardly notice the abnormal. You’ll never
thwart a computerized embezzler, for instance, with a gun. You will with
good software. Buy it and errors in your electronic files may leap out
at you. May. Remember Canyes’s Law of Computing: “Sooner or later you’ll
feel like killing yourself.”
In other places I’ve written about good software and other mundane ways
to make yourself less suicidal. And here, too, you’ll read of everyday
calamities like coffee spilled on floppy disks. But this is also the fun
chapter, the one with the stories about errant whiz kids and a computer
crook who supposedly stole $8 million and got away with it.
Each of their sins met Harold Joseph Highland’s definition of a
computer-related crime. They were “committed using a computer as a
tool.”
“In other words,” explains Highland, who has taught computer science at
the State University of New York, “you use the computer to get to
financial records. Or to get to software if you’re illegally copying
software.”
Estimates of the size of the threat have ranged from the double-digit
millions up to over $5 billion a year. This uncertainty has sparked a
feud between the icebergers and some computer makers.
Highland is an iceberger. He says that reported computer-related crimes
are “just the tip of the iceberg,” that the annual loot is at least $750
million and more likely reaches the billions. Another expert wrote a
crime article livened up with a drawing of the _Titanic_. Meanwhile, the
Computer and Business Equipment Manufacturers Association pooh-poohs all
but the more conservative estimates. “Computer crime is not now, never
has been, and never will be out of control,” an association official
once said, “unless security is completely ignored. And that is not going
to happen.”
“If that’s your opinion, sir,” counters Captain Zap, the computer felon
now working as a security consultant, “why are fourteen-year-olds
getting on defense networks? And what about adult criminals doing their
thing on banks?”
Also, how about computer crimes against small business?
“No one’s going to find out why Joe Blow goes out of business,” says Ken
Churbuck, a New Hampshire lawyer and former computer engineer, who
believes that electronic crime may be the downfall of many more small
businessmen than supposed. “You think Joe Blow can afford an
investigation? You think anyone else wants to autopsy the corpse?”
Large business or small, however, don’t swear off computers and buy
quill pens for your accountants. You may or may not get robbed
electronically, but you’ll very possibly lose money if you cheat
yourself of the benefits of computerization.
Although computer crooks may be difficult quarry at times, at least you
can console yourself that they’re normally _not_ geniuses.
Consider a story from Highland. The law caught up with one
crook—presumably more knowledgeable about computers than banks—after he
asked a teller to cash seven identically dated checks made out to him.
The embezzler had simply learned how to take advantage of a feature in
the check-printing program. It allowed checks to be reprinted in the
event of mistakes; only his stupidity offset this programming error.
“You don’t have to be knowledgeable,” Highland says. “You can be an
absolute idiot and try a computer-related crime.”
Some of the victims, alas, show their own streaks of naïveté. One small
business lost thousands of dollars to a bookkeeper who funneled it to
relatives’ firms via phony invoices. Such crimes happen with or without
computers. But the company begged for trouble here by retaining an
accountant old-fashioned enough to have felt at home alongside Scrooge
and Cratchitt. Computers baffled him but not the embezzler, who knew of
this vulnerability.
Executives at big corporations needn’t be smug about such grass-roots
examples.
Many large companies, for instance, have reduced _the crooks’_ risks in
computerized crime by auditing samples instead of everything—pulling one
hundred checks, perhaps, out of a batch of four thousand. The young man
trying to cash his seven duplicates worked for a large West Coast firm
given to quick and dirty sampling; just tote up the odds of catching him
through an audit if he’d been smart enough to go to different banks.
Ideally, at least, your system should flag quirks like the seven checks.
You can also complicate life for computer crooks by studying classic
cases of the past.
Mostly the criminals sinned with or against large computers. And yet
eternal truths linger on even in the micro-mini age. In fact, some
mainframe cases may mean even more to the desktop crowd today, with so
many small computers hooked up as terminals on large systems. You might
also say giant machines are acquiring plenty of pygmy siblings—joined
Siamese style with them at the brains. And the big and small machines
aren’t just wired together by phone or otherwise. Increasingly,
mainframes are sending electronic copies to micros outside
data-processing departments. What’s more, in power and capabilities, the
pygmies are matching some big IBMs and Univacs of yore.
So whether you’re using a $1,000 Apple or a $100,000 mini, you’ll come
out ahead knowing about the Golden Oldies of computer crime.
Computer consultants, especially Donn Parker, a prominent expert with
the SRI think tank in Menlo Park, California, have labeled various
offenses.[50]
Footnote 50:
The categories of computer-crime offenses, together with many
examples, come from Donn Parker’s _Computer Security Management_,
published in 1981 by Reston Publishing Company, Reston, Virginia.
Another book for more information is Parker’s _Fighting Computer
Crime_, published in 1983 by Charles Scribner’s Sons, New York, N.Y.
Data Diddling
When a time-keeping clerk hoodwinked a railroad, he committed the most
tried-and-tested computer crime: =data diddling=.
That’s just jargon for fiddling with data before or during entry into
the machine.
The culprit’s duties included filling out time forms for three hundred
employees, and he learned that someone had shown a fit of
absentmindedness in setting up a computer system storing pay and hour
records. The railroad put workers’ names as well as their identification
numbers into the computer. But the machine used only the numbers to
track down names and addresses to print on checks. Manually processing
the forms, however, humans normally ignored the computer numbers. They
actually had the gall to think of the workers just by their names.
Wheels turned in the clerk’s head. Why not sneak in overtime pay by
using other people’s names on the paper forms but _his_ own number for
the myopic computer? And so his income increased by several thousand
dollars each year.[51]
Footnote 51:
The example of the railroad clerk is from a report Parker coauthored
for the Justice Department, “Computer Crime: Criminal Justice Resource
Manual.”
The clerk’s end came only when an auditor by chance looked over W-2
forms and asked why the railroad had been so generous toward the man.
Confronted, the clerk confessed. There’s a moral here: if you have a
timekeeping and payroll system, don’t rely on ID numbers alone. Attach
to them the first few letters of workers’ names. Also, include a
cross-comparison of names and numbers in your auditing procedure.
Today scattered terminals—or micros or minis used as them—make data
diddling as tempting as ever. A police officer in an eastern city told
me criminals had walked into the offices of used-car lots, sneaked in a
few minutes on terminals there, and altered financial records in a
credit bureau’s computer.
Forget about the mystique of computer crime. People have been diddling
credit bureau files for years by changing or deleting paper records.
Machines and lack of paper records in some cases just make their work
easier and faster.
The Trojan Horse
A comely woman at a New England firm was the victim of what might
loosely be called a computerized sex crime.
“She would be doing her electronic paperwork,” Tracy Kidder said in
_Soul of a New Machine_, “when suddenly everything would go haywire, all
her labor would be spoiled, and on the screen of her cathode-ray tube
would appear cold, lascivious suggestions.” Someone had electronically
wheeled in a =Trojan horse=—hidden unauthorized instructions in the
computer’s program.
The “sex crime” kept up daily for several weeks, leading an executive to
observe that the villain must have “the mentality of an assassin.” It
was unfair. Young computer whizzes at the company played horse pranks on
each other all the time. But this victim couldn’t strike back.
Gallantly, the woman’s bosses set electronic traps to learn from which
terminal the masher was mashing. The villain, though, was too nimble.
“At one time,” said Kidder, “he made his escape by bringing to an abrupt
halt the entire system on which most of the engineer departments
relied.” Finally, one of the woman’s protectors chatted casually with a
suspect about the computer’s wondrous vulnerabilities to pranks. The
obscenities and glitches stopped.
This Trojan horse was just a prankster’s, but the company may have
squandered thousands of dollars in human and computer time to kill it
off.
Consider, too, the company—Data General, the mini maker that Kidder
admired.
Imagine a serious saboteur wheeling his horse into the computer of a
company without the same knowhow.
It happens. Donn Parker says Trojan horse tricks are “the most common
method in computer-based frauds and sabotage.” A horse, in fact, may
have shown up in the first federally prosecuted computer crime in
Minneapolis in the 1960s. A programmer told an IBM 1404 to drop an
unflattering series of bytes about his personal checking
account—overdrawn.
Trojan horses are more of a mainframe and mini problem than a micro one.
Normally, professional programmers don’t run desktop computers.
But as computer literacy spreads, this might not matter so much, and
besides, unsecured micros make such easy nuts to crack. “They’re
peanuts,” Highland says, “not butternuts.” Most micro systems today lack
electronic console logs—requiring operator ID numbers—that some bigger
computers have to tell who did what on the machines. In other words,
there’s no =audit trail=. John Lewis, an FBI agent teaching a course on
computer crime, told me, “I can write a perfectly error-free payroll
program on a micro, load it in from a disk, and run it. But I modify one
or two lines in there, saying, ‘When you find John Lewis’s name, add
$1,000 to net pay.’” You can even have the program zap the evidence
immediately after the crime. Significantly, too, you can reprogram a
micro in a fraction of the time you’d need on a mainframe.
And in the future the micros, while retaining their ease of programming,
will develop more electronic nooks and crannies in which to hide horses.
And what about the micros already hooked in at times with the big
computers or using down-loaded data from them? If a saboteur or con man
is giving fits to the giant machines, then the pygmy machines may suffer
along.
The Salami Trick
You just can’t make sense of your savings account statement. No matter
what you do, it’s a nickel off. You don’t, however, pursue the
matter—not over five cents.
All over your city your fellow depositors are thinking similarly.
A computer crook, meanwhile, is growing rich.
The nickels, dimes, whatever, add up. He works at the bank and has
programmed its computer to round interest downward, for instance, rather
than upward. The sliced-off money goes into a dummy account. From
hundreds of cheated customers, maybe thousands, he’s amassing enough
over the years for a new Buick. He may even have told the computer to
steal prudently and not clip anyone more than twice a year.
It’s the old salami trick, an MO of countless embezzlers inside and
outside the computer world—ranging from pudgy, fat-bottomed drones to
glamour figures in Hollywood and on Wall Street.
An amusing salami tale comes from Thomas Whiteside’s brilliant _New
Yorker_ series on computerized crime. The name “Zwanda” did the crook
in.
Programming for a mail-order sales company, he rounded down
sales-commission accounts and diverted the loot to a dummy account for a
“Zwanda.” The “Z” name made sense. The computer worked alphabetically,
and he could more easily guide the money to the end account.
“The system,” Whiteside says, “worked perfectly for three years, and
then it failed—not because of a logical error on the culprit’s part but
because the company, as a public-relations exercise, decided to single
out the holders of the first and last sales-commission accounts on its
alphabetical list for ceremonial treatment.
“Thus, Zwanda was unmasked, and his creator fired.”
Could Zwandas show up in your company’s microcomputer—not just
mainframes? Perhaps. It’s no less likely than the micro case mentioned
earlier in which the bookkeeper was paying bogus bills from his
relatives’ firms.
Of course, in the case of a micro, the trouble probably will be not in
the way the program is written but in how it’s set. Most micros, after
all, use off-the-shelf software.
Superzapping
It’s named after the “superzap” program used on some large IBM
computers.
“Superzap” is known among the pros as a break-glass program, the kind
you use in emergencies to change or divulge the computer’s contents. It
can bypass all security controls. You can also think of =superzapping=
another way. The computer is a high-rise building, and this program is a
master key to all the apartments or offices inside. Pity the building
manager if a thief can counterfeit the key.
Donn Parker, the source of those comparisons, says a New Jersey bank
lost $128,000 to superzaps.