Forgot your password?
typodupeerror
The Courts Government Security News

Keystroke Logger Faces Federal Wiretap Charges 346

Posted by CowboyNeal
from the watching-the-watchmen dept.
securitas writes "In what prosecutors say is the first case of its kind, a former insurance claims manager was indicted on federal wiretapping charges for allegedly installing a keystroke logger on another employee's computer. The device was secretly installed 'on a PC used by a secretary to senior executives at Bristol West Insurance Group.' Reuters reports that the man, who had been fired, was gathering information for a class action lawsuit against his former employer. SecurityFocus interviews would-be keystroke logger user Larry Lee Ropp who reportedly installed the KEYKatcher device on the PC."
This discussion has been archived. No new comments can be posted.

Keystroke Logger Faces Federal Wiretap Charges

Comments Filter:
  • Just slightly OT (Score:5, Interesting)

    by The-Bus (138060) on Friday March 26, 2004 @08:50AM (#8678587)
    From http://www.keykatcher.com/testimonials/index.html

    "I must thank you for this great invention. Early this year, I discovered my 14-year-old daughter was on the ICQ with a person with a name of "P****". I was shocked and did not know what to do. I then e-mailed the editor of Parent and Child and they reccommended me to do a search on the internet. I was very fortunate to have purchased a KEYKatcher. The ability to read my daughter's e-mail has helped us to make the right decision about the school she would attend last September..."

    I mean, is there any useful use for this device at all?
    • Re:Just slightly OT (Score:5, Interesting)

      by REBloomfield (550182) on Friday March 26, 2004 @08:55AM (#8678620)
      we actually use something similar in the school i work at. Students are monitored by the logger, if it finds a word or phrase in our database, then a screenshot is sent to us, and we can then watch the student in real time over VNC.

      eg. student types in http://192.168.0.1/admin then we know about it (ficticious example: idea is that the kid is going somewhere he shouldn't).

      • by mirko (198274) on Friday March 26, 2004 @09:01AM (#8678645) Journal
        So, they'll begin typ1ng l1k3 w4r3z m0f035 t0 /\v01d b31ng tr4x0rr3d by n4z1s ?
        • Re:Just slightly OT (Score:5, Informative)

          by REBloomfield (550182) on Friday March 26, 2004 @09:03AM (#8678658)
          we're not trying to read what they're doing, it's frankly of no interest, we're more concerned with *what* they're doing. For example (again) They have no need to ever run a .com file, so if it comes up in the log, i can find out why, and deal with it. Typ1ng l1k3 7h15 will achieve bugger all if they actually want to use the system...
          • by Anonymous Coward
            it is possible to type .com without typing the letters in order or even next to each other. just use the mouse and reposition the cursor between each key. i hope the students don't know you are using keyloggers, because if they do and don't want to be caught then you are going to quickly teach them how to obfuscate their typing.
            • it doesn't actually catch the key strokes, it catches what's on screen. This includes text in program menus, and text on web pages. if they see .com, we know about it (it isn't this cut and dried obviously). As said before, obfuscation doesn't help if you want to type 'command.com'. c0mm4nd.c0m just doesn't have the same effect....
              • by Anonymous Coward
                I suppose you have clear rules for students then? So everyone surely knows that they should not try to run .com files etc. ? Or is this surveillance done in great secrecy to avoid provocating students with some accurate set of rules?
                • Re:Just slightly OT (Score:2, Informative)

                  by REBloomfield (550182)
                  yeah, they're called policies, and they are signed by the students, and by the students parents, and they are available for all. When they log on, they are reminded that their actions will be monitored, and they consent to this before they are given access.
                  • by maximilln (654768) on Friday March 26, 2004 @09:56AM (#8678973) Homepage Journal
                    Just because you sign a policy agreeing to slavery doesn't make it legal or ethical.

                    Every single person who uses the excuse "I can play God because you signed the policy agreement" should be bludgeoned to a pulp with wet noodles.

                    Why wet noodles? It'll take longer to achieve the pulp stage and sting more.
                    • Re:Just slightly OT (Score:5, Interesting)

                      by elmegil (12001) on Friday March 26, 2004 @11:35AM (#8679856) Homepage Journal
                      You've never had to deal with rule breakers, have you? It's not a matter of "playing God" in most cases, it's a matter of making sure that the rules are adhered to. If all you do is sit back and repeat the rules, and are only able to do anything about the most flagrant rulebreakers, all you end up doing is pushing the real troublesome ones underground. Policies should not only say "you agree to be monitored" but also what you can do if you think you've been mistreated, and provide real relief if you are.

                      As a former university sysadmin, there were times when we would find out someone was breaking the rules, but to enforce them we had to have real evidence. This involved surveillance, usually electronic/email. We then made our case to the dean of students, and if they agreed that the rules were broken, punishment was handed out. The student always had the ability to appeal to higher authorities if they thought they'd been mistreated or the punishment was too harsh. Enough checks and balances that it was never abused; we didn't snoop on students who had not done anything to arouse suspicion, and I can't recall any cases where we went to any great depths investigating anyone who wasn't found to be guilty of enough of an infraction to justify our time.

                      That said, I think continuous keystroke logging is excessive and likely more prone to abuse, but still, there is NOT any absolute guarantee of privacy, even if I'm using my own equipment. That's why the FBI can go to a judge and get permission to wiretap a suspect (let's leave aside the fact that I believe that PATRIOT has gutted a lot of the appropriate checks and balances in this system). The other side of that is that you can't just wiretap someone because you want to, and getting back OT, that's what happened here. Regardless of how noble the cause, the means was illegal.

                    • by maximilln (654768)
                      -----
                      You've never had to deal with rule breakers, have you?
                      -----
                      This sums up my whole issue with Big Brother techniques such as keyloggers.

                      Even former university sysadmins play favorites. Teachers play favorites, parents play favorites, PEOPLE IN GENERAL play favorites. While playing favorites is a natural part of human existence there's no good to come of installing more and more systems to further antagonize those who aren't the favorite.

                      In our society the people writing the rules are far too priveleg
                  • Consent (Score:5, Insightful)

                    by Detritus (11846) on Friday March 26, 2004 @10:05AM (#8679032) Homepage
                    While they may have consented, did they really have a choice about the matter? They have to be in school. They may not be able to pass their classes without the use of the computer.

                    As adults, they may be presented with similar policies. Only this time, they have the "choice" of consenting or losing their job.

                    The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, beg in the streets or steal bread.

                    -- Anatole France

                    • Re:Consent (Score:3, Insightful)

                      by STrinity (723872)
                      While they may have consented, did they really have a choice about the matter? They have to be in school. They may not be able to pass their classes without the use of the computer.

                      Of course they don't. They're students. When were you ever given a choice in school -- "Well, you can read The Scarlet Letter, or you can play with your gameboy." This is no different from teachers walking around the classroom to make sure everyone's doing their assignment.
                  • by Catbeller (118204) on Friday March 26, 2004 @11:11AM (#8679605) Homepage
                    MEMO: Privacy and Intellectual Property Protection Policy of NorthByNorthwestern University

                    Anyone (hereafter referred to as "we") in the employ of NBNWU designated by appropriate management can monitor any activities of any student, employee, or casual visitor to to your dorm at any time. We reserve the right to record any activities, up to and including really gymnastic-quality sex. We reserve the right to distribute said information and cool tapes if we want to. Get over it.

                    If you (student/employee/casual sex encounter) do not like this, we suggest therapy for your sad case of paranoia.

                    If you (student) do not like this, you are free to quit this institution and become free to obtain any employment you desire in the fast-growing field of janitorial work.

                    We reserve the right to give your ass up to the Feds on command. Or even if we feel they may be interested. Or if you seem suspicious to us in any way.

                    We feel that you (student/employee/casual encounter) should feel safer in the hands of a benevolent power such as We; what are you complaining about, hippy? Something to hide? Hmm?

                    We are broke, and are of necessity closing down Student Health Services for lack of funds. This will not deter us from investing 23 million dollars in an all-campus surveillance system necessitiated by the vicious attack on one of our coeds by Millie the pit-poodle.

                    All independent ad-hoc "dark" networks, and of course independently created wireless networks are forbidden as they violate the purpose of maintaining the public safety of NBNWU; unmonitored communications are sadly reliquated to the distant past. 9-11 9-11 9-11, and of course, 9-11.

                    We at NBNWU also feel that consistent with our finest traditions of preparing our graduates for the rigors of the working world, our students should acclimate themselves to the weekly anal examinations, virginity and drug tests, and loyalty oaths prepared by your loving administration. We love our President, our God, and our Alumni Association.

                    Your tuition will be raised by 15% this year. If you have a problem with this, take it up with the 10,000 people waiting to get in behind your expelled butt.
              • Re:Just slightly OT (Score:4, Interesting)

                by maxwell demon (590494) on Friday March 26, 2004 @09:32AM (#8678810) Journal
                You mean like www.microsoft.com or someone@hotmail.com?

                And BTW, for running a .com file, it suffices to just type the name without the ".com"!
              • I'd be interested to know what kind of performance hit this monitoring software has.

                Can it recognise the phrases in different fonts/colours?

          • Lessons learned... (Score:5, Insightful)

            by Anonymous Coward on Friday March 26, 2004 @09:23AM (#8678771)
            I have to agree that this sort of behaviour is absolutely inevitable in nowadays everyday life. In the past it was called "social control" where small communities monitored each other's behaviour to see if somebody wasn't stepping out of line. If they would, due psychological force could be executed to get them in line again ("gossip"). Now this practice has mainly gone away simply because there are less and less small communities, and thus we need to monitor other people by different means. Ofcourse, in due time virtual communities will take over the "social control" thing in a comparable way, but it's not there yet.

            In the meantime, we shall have to rely on the usual methods of camera's, microphones, keyloggers and traitors. I think we can learn a lot from former Soviet-Russia and sortlike countries that have executed this behaviour in great practical ways...
      • by Vellmont (569020) on Friday March 26, 2004 @09:04AM (#8678661)
        Good to hear that Big Brother is alive and well in our schools. This kind of thing just makes me sick. Is it appropriate to have computers monitor the phone line in a school for keywords or phrases, and then listen in when they're detected?
        • by eclectro (227083) on Friday March 26, 2004 @09:12AM (#8678698)

          Actually, kids in schools can not prevent the search of their lockers, as the school owns the lockers. I imagine it is this same logic that is extended to computers owned by the school.

          The same unfortunately is applicable to many places of employment. Owning the equipment gives employers the right to monitor it. I believe that this was decided in the supreme court.

          You should never assume that you have privacy on equipment you do not own.

          • by Vellmont (569020) on Friday March 26, 2004 @09:23AM (#8678768)
            So if the school owns a phone they can listen in on all calls? It may be legal for the school to do the monitoring, but that doesn't mean it's the right thing to do. I find it frightening that a generation can grow up with the expectation of being monitored constantly.
          • by azaris (699901)

            You should never assume that you have privacy on equipment you do not own.

            OK, then I suppose you'd be fine with a clothing store videoing their customers in the changing room and selling the tapes on the Internet. After all, those people have no expectation of privacy since they don't own the store.

            Similarly, an ISP would be permitted to decrypt the passwords of their clients, rummage through the data stored on their servers and see if there's anything useful or naughty in there.

            We must concede that

            • by eclectro (227083) on Friday March 26, 2004 @10:10AM (#8679068)
              I did not imply that I am fine with anything.

              I am just stating fact. It's true that it would be wrong for companies to place video equipment in changing rooms and bathrooms, and in fact there are laws specifically preventing this.

              You can be sure that you are covered by five different cameras as you enter and leave changing rooms. Also, most stores have spies close to these areas.

              So much as ISPs and computer privacy is concerned, I wouldn't say they have the right to do anything. but that does not mean they don't have some capability and can use it covertly. One example might be is if you are a spammer.

              Also as you know, the FBI can intercept much of your email traffic with carnivore if they wanted to, and because of the patriot act they do not need to get a court order to do so anymore.

              Privacy is not a constitutional right. Modern electronics means that we as citizens are going to monitored and watched more than ever before.
            • by Atzanteol (99067)
              Oh for chrissakes. The original poster was monitoring children in a classroom. Children! Children are supposed to be monitored. You want an 11-year old going to images.google.com and typing in this new word 'lesbian' he's heard so much of (in Massachusetts at least)? We all know what's going to come up, and it's a bit more educational that many would like.

              What if the childs surfing for porn? Emailing a friend about commiting suicide? Chatting with perverts? Planning a murder of a teacher? You thi
              • Re:Just slightly OT (Score:4, Interesting)

                by maximilln (654768) on Friday March 26, 2004 @10:46AM (#8679389) Homepage Journal
                If you're relying on a keystroke logger to clue you in to children who have problems with any of these issues then let it go. You're already too late.

                If parents and mentors were even close to taking responsibility for their children they'd pick up on these issues long before a keylogger alerts them to it.

                Ode to a generation that is completely self-absorbed until the last possible moment when "DANGER WILL ROBINSON" is blaring over loudspeakers.
          • by dogfart (601976) on Friday March 26, 2004 @12:48PM (#8680652) Homepage Journal
            You should never assume that you have privacy on equipment you do not own.

            And since most people own damn little, they effectively have no privacy. Should your landlord have the same right to monitor their tenants? Suppose someone is sneaking in an overnight visitor in violation of the lease? Should the landlord be able to monitor your communications to find this out? They own the building, you don't.

            Privacy rights that extend only as far as you own the computer equipment are effectively useless, as they would cease to exist once your networked data travels outside your property boundary. After all, the phone/cable company owns the wires, and you are using their equipment.

        • Re:Just slightly OT (Score:4, Interesting)

          by Mose250 (724946) on Friday March 26, 2004 @09:13AM (#8678704)
          Not really - what's the difference between this and just having a teacher walk around and glance over the kids' shoulders? The fact that VNC is used instead of a pair of eyes? Computers in schools have never been a place for completely anonymous internet access.
          • You can tell when a teacher walks over and is monitoring what you type, just like you can tell when someone is in the same room as you listening to a conversation.
            • And when VNC is being used, the icon in the system tray goes black. they can tell when they're being watched. But then, under your way of thinking, security cameras on all entrances to the school are bad as well. I mean, who cares if random strangers come on site?
      • Damn, I'd done some great moderations to this thread. I didnt realise that posting Anon would undo them all.

        FWIW I consider the attacks on the parent poster flamebait. If I could mod them as such again, I would.
      • Re:Just slightly OT (Score:5, Interesting)

        by Huogo (544272) <adam&thepeacock,net> on Friday March 26, 2004 @10:21AM (#8679137) Homepage
        I've found that booting to a Knoppix CD, then connecting to a proxy on my webserver through an SSH tunnel is a very good way to avoid being monitored. NetOp (basically VNC) won't work, VNC won't work, watching my history won't work, and the server logs won't work. All the data is encrypted, with nothing running client side to monitor me. Only way is for someone to look over my shoulder.
        • Re:Just slightly OT (Score:4, Interesting)

          by MrScience (126570) on Friday March 26, 2004 @01:08PM (#8680873) Homepage
          Unless you used something hardware based... say, the KeyCatcher mentioned in an above post. In which case it catches all keypresses, whether you're running OS/2, BEOS, in the BIOS, or Linux.

          Of course, since I type in Dvorak, it wouldn't be able to figure out what the heck I'm typing (since I use a software driver to convert a QWERTY keyboard).
      • by dave420 (699308) on Friday March 26, 2004 @10:33AM (#8679232)
        and when the user types in ptt:h/1/290816...a/dinm and uses drag-and-drop/cut'n'paste to rearrange the letters and then press enter, your keystroke logger knows all about that, right?

        I'm sure it works well for you, but don't put all your trust in it. It's ridiculously easy to fool something like that - ridiculously easy.

        Wouldn't it be better to use policies and actually restrict their actions, as opposed to trying to half-ass guess when they're doing something wrong so you can send out the heavies? It's kinda like an automated CCTV system that looks for people in black/white striped tops, wearing masks and carrying black bags with dollar signs on... The sort of students who know how to get round stuff like that are the ones you want to be watching. Ironic, really... By using that approach to security, you've made yourself less secure.

    • Re:Just slightly OT (Score:5, Interesting)

      by Liselle (684663) * <slashdotNO@SPAMliselle.net> on Friday March 26, 2004 @08:57AM (#8678626) Journal
      I can't think of anything that's terribly legal. I knew there was a reason I never do anything important on publically-accessible terminals. I guess it's a nice device to own if you're a bad parent with a tinfoil hat.

      The question in the back of my mind on this article though: what would they have done if it was a software keylogger, instead of a hardware one? Do the wiretap laws still apply in the same capacity? I understand from TFA that the fact that it logged emails made him a target for it.
      • Re:Just slightly OT (Score:5, Interesting)

        by orthogonal (588627) on Friday March 26, 2004 @09:25AM (#8678781) Journal
        I can't think of anything that's terribly legal

        Well, there are very few cases, but... I installed a (software) key logger on my own box in order to get the raw data needed to figure out my personal letter frequency in typing -- the standard English frequency wouldn't apply, as I do a lot of C and C++ coding. (How often do you see semi-colons, let alone curly braces, in standard English writing?)

        A nice side benefit is that I could review the key log -- to see if anyone else had been using my computer.
      • I can't think of anything that's terribly legal. I knew there was a reason I never do anything important on publically-accessible terminals. I guess it's a nice device to own if you're a bad parent with a tinfoil hat.

        How on earth would just using the device make you "a bad parent with a tinfoil hat"?

        Contrary to kid's beliefs, most parents have little interest in snooping on whether your friend Monica likes Jeff and also got new shoes, or whatever. However, it would be nice to have some forensic mate

        • How on earth would just using the device make you "a bad parent with a tinfoil hat"?

          I will give you the benefit of the doubt and assume that you misunderstood what I said, instead of only hearing what you wanted to hear. I said that it's a device that a bad parent with a tinfoil hat might find useful. Not that using the device makes you a bad parent with a tinfoil hat. Is the difference clear?

          Read the AC's comment below mine, he/she states the point you're looking to refute: clicky. [slashdot.org]

    • Re:Just slightly OT (Score:5, Interesting)

      by Chess_the_cat (653159) on Friday March 26, 2004 @09:02AM (#8678648) Homepage
      I mean, is there any useful use for this device at all?

      Definitely. If you're a writer of some kind, install a KeyKatcher and you've got an instant backup of everything you've written. If your word processor crashes, no problem; fire up KeyKatcher and cut and paste everything you've lost. Beautiful stuff.

    • by Anonymous Coward on Friday March 26, 2004 @09:07AM (#8678674)
      I mean, is there any useful use for this device at all?

      No. Not unless you think like this:

      Dear god, think of the children. WON'T SOMEBODY THINK OF THE CHILDREN?

      The correct solution is called parenting. There is no substitute for parental supervision and being involved with your children's activities. You wouldn't let a child watch whatever TV station they want, completely unsupervised - so why would you do the same with an internet-enabled computer? Call me old fashioned, but I don't even think a child should be allowed access to a net-connected computer unless it's in a shared, plainly visible family room environment.

      Using tricks to snoop on your kids like this will breed an attitude of distrust and paranoia. You'll also only find out what they're up to after the event. Instead of working against them, you should actively work with them.

      Plus, with a software solution - you actually have to check the logs from time to time. If you care so little that you'd rather a piece of software babysat your child, eventually you'll stop reading the logs because that involves effort.
      • There's a report on the BBC today (sorry, at work, no link) about how British kids are getting less sleep than their parents' generation because so many children have one or more of: TV, PlayStation, PC in their bedroom. I'm in my 30s and can remember being told that "if you don't turn that radio off, you'll lose it." The idea of having a 'net connection in my bedroom boggles my mind.

        • That link in full:
          BBC Newsround [bbc.co.uk] - for kids! Oh the shame!

        • by D-Cypell (446534) on Friday March 26, 2004 @10:33AM (#8679226)
          British kids are getting less sleep than their parents' generation

          Yeah!! Damn kids, they should be doing exactly what their parents were doing at their age...

          Taking lots of mind altering drugs and having unprotected sex with complete strangers!!

          What is the world coming to!

          Why is it that every generation feels the need to tell the next how much they lacked discipline! Thats part of being a kid! Consider it compensation for the next 45-50 years you will be stuck behind a desk.
          • Getting serious (slightly...) for a minute... I don't feel that "my" generation needs to tell the younger generation that "they lack discipline". That's just passing the buck. It's my generation's responsibility to *provide* discipline - even if that means saying "you can stay up all night surfing pr0n once you leave home/reach 18/run away and join the circus - and not before!

            But yeah, back to the humour... I'm just bitter!

    • Re:Just slightly OT (Score:3, Interesting)

      by dwave (701156)
      They promote their product as a technical solution to a social problem? I don't think this will work.

      Friends with children who are computer literate often ask me if there's a way to limit the log on time for the children's accounts. I've no children myself but I always advice against the technical way. If there's an apparent problem (homework not being done properly, neglect of friends, socialising with the wrong kind of people etc.) parents have to dedicate time to their kids and find an agreement togethe
    • Re:Just slightly OT (Score:5, Interesting)

      by Cr3d3nd0 (517274) <Credendo AT gmail DOT com> on Friday March 26, 2004 @10:03AM (#8679023)
      As a matter of fact I just found a maybe not so much legal, as a justifiable use for a keylogger. My girfriend lives at home with her mom, 6 year old brother, and her mom's boyfriend. Being the geek I am I took the time to help clean their system of spyware and the like when I ran into a few child pornography pictures in the recycle bin. Seeing as they have a 6 year old child living there I wanted to keep an eye on their system to find out where the pictures had come from. Sure enough three days later I got a log in the email of the boyfriend chatting with a young child online. I informed the mother, and the police and now the asshole is up on child porn charges. Obviously they couldn't use the keylog information but the fact that the pictures were on there was enough.
  • When is the last time you remember hearing about an indictment for actual wiretapping? Doesn't it seem like people get away with wiretapping regularly? I'm thinking about things like the illegally recorded phone conversations with Monica Lewinsky. Or does the law specify exemption if it is done for a good cause?

    • Wiretapping laws actually vary from state to state. Some states allow you to secretly record a conversation as long as you are a part of that conversation. A few states do not allow this - you have to tell people you are recording them.

      In this instance, the guy at the insurance company was not a party to the conversations going on. Therefore he was obviously in danger of violating the law.

      Being a whistleblower means that you call up the FBI and you let them do the investigating. Here, he was playing the r
    • Whats even more interesting is that according to him, the Dept of Insurance had encouraged his activities.
      The Dept of course denies this, and i'm having to wonder if this is just a means to distance themselves from any sort of legal mess that could come along with encouraging a wiretap without a warrant. Then again, maybe im just wearing this tinfoil hat backwards.
      • There is probably truth to both sides. I think he probably was involved with the Department of Insurance, though I doubt they told him to install the keylogger. Looks like he got a little overzealous and the Department of Insurance is washing their hands of his activity.
  • This is why (Score:5, Funny)

    by lxs (131946) on Friday March 26, 2004 @08:55AM (#8678616)
    This is why you should always check your keyboard cable on your work-PC.

    Not only does it keep you secure, but you might score a brand-new keylogger for free.
  • by windex (92715) on Friday March 26, 2004 @08:55AM (#8678619) Homepage
    According to this politech posting by bernieS [politechbot.com], it appears that the feds are going to be doing a little bit of double backing.

    It raises an important question, I think: are keyloggers wiretapping devices? They don't involve telecommunications lines directly, so can they be considered in the same class?

    Some food for thought.
    • A keyboard is a two way communication device. The inputs are the keys you press, and the outputs are the num lock/caps lock and scroll lock lights. In theory, you could use a keyboard to communicate with another person using Morse code with the space bar to send and the num lock light to receive them.
      • In theory, you could use a keyboard to communicate with another person using Morse code with the space bar to send and the num lock light to receive them.

        In practice, though, you'd likely use the alphanumeric keys conveniently provided for just this purpose.
  • by MyNameIsFred (543994) on Friday March 26, 2004 @08:56AM (#8678623)
    While his heart may have been in the right place, it sounds like he went to far. Once the class action suits started, once the state of Calif. started investigating, there was very little need for his cloak and dagger actions. The courts could have done the work. If he felt that they were tampering with evidence, destroying evidence, or not providing everything the courts demanded he could have come forward. In my view, he put his own neck on the line in a wreckless way.
  • Oh, so it's "okay" (Score:4, Insightful)

    by the_skywise (189793) on Friday March 26, 2004 @08:59AM (#8678635)
    He was collecting the names of all the insurance company's clients... So uh... so he could notify them of their ability to join the class action lawsuit!

    He was... he was helping the government investigate a corrupt company, yeah! He was James Bond! Saving the innocent from themselves!

    Yeah... he had no intention whatsoever of joining a competing company and stealing the client list.

  • Good. (Score:2, Insightful)

    by Anonymous Coward

    "In what prosecutors say is the first case of its kind, a former insurance claims manager was indicted on federal wiretapping charges for allegedly installing a keystroke logger on another employee's computer ..."


    Good. It is not the decision for just any man to make, on when to invade someones privacy. (Most) Laws exist for a reason. This man broke one. Hopefully he'll spend some time in jail.

  • by sczimme (603413) on Friday March 26, 2004 @09:00AM (#8678643)

    Read all about it here [cornell.edu].
  • The EU convention on cybercrime, which is law in most (all?) EU countries since 2000 prohibits the interception of private electronic communications. A key logger would certainly fall into this category.

    However, there have been very few convictions under these laws, only a couple of "hacking" cases in the UK afaiaa.

    It's not only about domestic/workplace espionage. Spyware vendors (a species that rates somewhere between slimemolds and spammers) use similar techniques to spy on and report back on people's use of their computer.
  • by Doc Squidly (720087) on Friday March 26, 2004 @09:07AM (#8678677)
    ....He got busted when he call the company to get the device back!
    Not the smartest thing to do. He deservse whatever he gets.
  • What if... (Score:5, Insightful)

    by RandoMBU (740204) on Friday March 26, 2004 @09:14AM (#8678712)
    They were to apply federal wiretapping laws to spyware? If an unauthorized piece of software transmits information about my activities to a third party without my knowledge... that sounds like wiretapping to me.
    • Re:What if... (Score:4, Insightful)

      by DaHat (247651) on Friday March 26, 2004 @09:38AM (#8678849) Homepage
      In the majority of those cases, you as the user are agreeing to the installation of the spyware.

      There is nothing wrong with monitoring yourself.

      Remember, this case is about an individual installing monitoring other people with out their consent or knowledge.

      In theory, if spyware were installed with out a note in the EULA saying so, and no other "I agree to let you know everything I do and where I go"... then yes, you could get them for wiretapping.
  • by spidergoat2 (715962) on Friday March 26, 2004 @09:23AM (#8678769) Journal
    We had a consultant (former employee) work at a branch office. The owner said to keep an eye on them. I want to the branch office and told every employee that I was installing a keyboard logger and why. When the consultant (former employee) logged on, they had no idea they were being tracked. I discovered they had a back door account and were logging into a supervisor account. Good or bad, I discovered the holes in my system.
  • by circletimessquare (444983) <circletimessquare&gmail,com> on Friday March 26, 2004 @10:01AM (#8679005) Homepage Journal
    so when is the disclaimer going up at thinkgeek?

    http://www.thinkgeek.com/gadgets/electronic/5a05/ [thinkgeek.com]

    disclaimer: please do not buy this product and use it for what you think you were going to use it for, thank you... same with that x10 camera you were thinking about too, while we're at it
  • Robin Hood (Score:4, Interesting)

    by JSkills (69686) <jskills&goofball,com> on Friday March 26, 2004 @10:18AM (#8679121) Homepage Journal
    First off, there are a couple of links to articles describing what happened, the Security Focus article [securityfocus.com] was the most informative.

    So we've got this guy working for an insurance company who decides to inform the Dept. of Insurance that they are cancelling policies unlawfully. This is a good thing and brave of him to do it. Hopefully his motivations were purely good and not just because he was pissed he didn't get a raise last year or something.

    And let's face it, insurance companies are the some of the worst kinds of organizations in corporate America. They collect huge sums of money via premiums - that are based in people's fear that something terrible could happen. And then as soon as you need them (you have an accident, someone in your family gets ill, etc.), they immediately initate every effort to not pay you in your time of need. I know it's how they do business, but it's a disgrace. I have experienced this first hand more than once ...

    Back to the story, the guy then plants a keystroke logger on a secretary's PC in order to collect further info for his crusade and to aid lawyers in a class action suit against his company. He obviously crossed a line here. And in the middle of this, he finds himself fired (curious). So he asks a former co-worker to retrieve the logger for him? And of course being a good insurance company employee, she rats him out.

    I applaud his intentions, if they were indeed based in fairness and the public good. He did get carried away for sure by planting the bug. But I can't believe the stupidity of (1) admitting he planted it to a former co-worker and (2) expecting her to help him retrieve it and f--k the company she still worked for. I guess he really was a bit of a dreamer ...

  • Software keyloggers (Score:3, Interesting)

    by maximilln (654768) on Friday March 26, 2004 @10:26AM (#8679177) Homepage Journal
    Why do I get the impression that this article specifically avoids mentioning software keyloggers? Whether or not they're currently illegal under the law shouldn't they be?
  • Ain't That A &!^(# (Score:4, Interesting)

    by dnoyeb (547705) on Friday March 26, 2004 @10:38AM (#8679296) Homepage Journal
    Aint that a bitch.

    I was just thinking last year how stupid these insurance companies were for always sending cancellation notice as opposed to a bill. (I live in Michigan.) So when I actually get a cancellation notice I don't know if its simply a bill, or an actual cancellation notice.

    I have never received a bill from an insurance company, only cancellation notices, and I've been with at least 5 different ones. What more info is needed? we know they do this.

    For those who didnt RTFA, Ropp was trying to get the list of people who they pulled this fast one on, from the companies password protected (DMCA anyone?) database.

    More power to you Ropp. If the government mandates one must buy something, that thing should be heavily regulated by the government. racket.
  • by kwandar (733439) on Friday March 26, 2004 @11:01AM (#8679526)

    I was working for the President of a company who seemed to have information about others that left me wondering. So, I ran a program, (I believe it was Spycop), to scan for anything nefarious on my computer. Nothing found, fortunately.

    However I shared this program with a colleague and she ran it and found a keylogger that would send emails from her company laptop, to a blind email account. He apparently had a thing for her roomate, a former employee, and was using this to spy.

    My colleague was shocked that this would happen, but as it appeared to have been non-functional for a while due to internet login issues, she didn't say anything, and I told her what to delete to kill the program from running.

    That way, any deletion of the software could at least appear to be accidental.

  • by theLOUDroom (556455) on Friday March 26, 2004 @11:02AM (#8679540)
    From now on, I'm only doing text input with charmap!

    Sure it may be a little slower, but hey, I'm paid by the hour!
  • by Jahf (21968) on Friday March 26, 2004 @11:02AM (#8679544) Journal
    Should keylogging a co-worked be illegal? Yes (though if it is done by your employer and you signed consent then no, just like phone monitoring ... free will works both ways).

    Should keylogging be considered wiretapping? NO. It is a distinctly different technology and all lumping things together does is make it easier to confuse the issue the next time someone wants a warrant to do something -similar-.

    Keylogging, network interception and a whole host of other things are still quite different from basic phone taps. They should be given a distinct category that can be properly defined.

    If anything, the expectation of privacy on the line between your computer and your keyboard is MUCH higher than any expectation people have today for phones (when was the last time you started typing and realized someone else was typing on your computer as well ... VNC not included :).

    Plus, you can't expect that by listening in on a phone you are going to regularly hear someone's social security # (my bank uses it for my login id ... idiots), their credit card # (amazon), or their root password. Keylogging is far more invasive.

    In the end I think the guy should be penalized more than wiretapping, but not -as- a wiretapper.
  • by Dr. Blue (63477) on Friday March 26, 2004 @11:39AM (#8679906)
    Seems like the feds are contradicting themselves (I guess that's not a huge surprise). In the Scarfo case, the FBI claimed they didn't need a wiretap approval to put a keystroke logger on Scarfo's computer because they were only monitoring internal communications between the keyboard and the computer. Thus it wasn't a wiretap.

    Now the government is prosecuting someone for doing the exact same thing. Has anyone else noticed this contradiction, or am I missing some important distinction?

    • No, you are right on track. So far, nobody in this thread has talked about whistleblower protection laws, or previous court cases regarding the act of keyboard logging. I am going to look into it, because I think you are right.
    • by _LORAX_ (4790) on Friday March 26, 2004 @12:29PM (#8680446) Homepage
      Yes,

      For those that don't know...

      In New York federal investigators used a search warrant to physically alter Scarfo's computer to install a hardware keyboard logger so that they could retrieve his pgp passwords This search warrant was a sneek and peek. They then went back in a month and took the computer on another search warrant.

      At no time did they have a wiretap warrant, they claimed that they didn't need one. This case seems like they are contradicting themselves in several ways. By prosecuting this grey hat, they may be giving Scarfo grounds for an appeal of his conviction based on the fact that the evidence was tainted.

      The reason this is important is that the requirements are more stringent for a wiretap warrant then for a search warrant, if they had had proper evidence they would have use it to get a wiretap, but they didn't.
    • by evilviper (135110) on Friday March 26, 2004 @02:22PM (#8681771) Journal
      In the Scarfo case, the FBI claimed they didn't need a wiretap approval to put a keystroke logger on Scarfo's computer because they were only monitoring internal communications between the keyboard and the computer. Thus it wasn't a wiretap.

      Sorry, but you missed the boat. In that case, the key logger was designed so that it would be DISABLED when it detected an internet connection. A keylogger that doesn't disable itself will capture keystrokes being sent over the internet, which then becomes a wire-tap.

If you think nobody cares if you're alive, try missing a couple of car payments. -- Earl Wilson

Working...