Chapter Ten

10.1. Security

The term security has a few different shades of meaning when it's applied to computer stuff. The obvious use is in relation to keeping private things private.

10.2. Network Privacy

Computer communication is about as private as telephone calls. In other words, any given message might be private, but it could easily be seen by many different eyes along the way. When you're speaking on the telephone, there's always the chance that an engineer is listening to your conversation at any one of the (possibly dozens of) exchanges along the way. This is normal and they may well not be doing it from choice or noseyness - it's simply standard operational procedure for certain purposes. (However, if it's a particularly juicy conversation, there's a good chance they'll relay it over loudspeakers so all the staff in the exchange can have a laugh!)

Email through networks goes through a similar sort of system and may pass through quite a few computers on the way to where it's going. The sysops of any system on the way can look at your message - although it's not quite such a normal procedure as listening to phone lines.

So, although you can be reasonably confident that most of your mail won't be read, you must assume it can be under all circumstances.

This of course is quite separate from the other possible way your mail could be intercepted - surveillance by police or security services. Computer communication is no more or less susceptible to taps and electronic surveillance than phone calls. You should never say anything on any phone anywhere in the world that you don't want the police or government to hear. Likewise, you should never send any messsage over any computer network that you don't want them to read.

With phone calls, it's possible to scramble them so it's really difficult, if not impossible, for anyone else to decipher what you say. The same goes for computer messages, but it's easier.

To scramble phone calls, you need special equipment, which is expensive. But with computer communication, all you need is some software, which runs on the computer you're already using. The process is called encryption.

Data encryption software is fairly easy to get hold of. The only software i'd recommend is called PGP. Everything else is likely to be suss! But even PGP won't guarantee that someone who's determined to find out what you're saying can't decipher it. It will however take them time and a lot of extra effort - so it's worth using just to fuck up anyone who's that interested in your communications. But still, don't say anything you could go to prison for!!! Data encryption can make you feel your messages are secure - but you can't be so sure...

I'm not going to go into encryption in any depth. Just get yourself a copy of pgp somehow - it's available for several different types of computer - and read the documentation that comes with it. It's a bit confusing in places, but it's not as complicated as the manual makes it seem, and there's a good rave on encryption and political stuff etc...

The main thing to remember about security in this context is: assume that everything you send around a network can be read by anyone who's interested enough to go to the hassle it involves for them. It's not much hassle for system operators if your mail isn't encrypted - it's pretty impossible if it is.

It's a fair bit of hassle for cops if it isn't encrypted - and a lot more hassle if it is. Whether they'll bother or not depends on two things: firstly, whether they think it's worth what they'll get out of it - and when it comes to special branch and asio, who knows what they'll consider is worth it, they're really weird! Secondly, particularly with political cops (asio and special branches) it depends on whether there's anyone else more interesting to watch... In australia, there's virtually nothing of any politically dodgy importance going on, but they've still got to justify their existence. This means, they're probably tapping your phone (and therefore your data communications). I know you're not doing anything very exciting, but no-one else is either and they've got to tap somebody's phones, so why not yours?

If you're planning to do anything you wouldn't talk about at the reception desk of your local police station, don't talk about it on (or even near) the phone or over a computer. Face to face in the middle of a park is better.

10.3. BBS Security

The other main meaning the word "security" has in computer contexts is in relation to who's allowed access to your computer files or message areas on a bulletin board etc.

All bulletin board software has a means of allocating all users security levels. All areas of the bulletin board can be set up to have security levels too. This means that anyone with a personal security level less than the security level of (say) a particular files area, can't look at the files in that area - they probably can't even tell that area exists. The same goes for message areas.

This is obviously important for more than one different reason. Firstly, you might have message areas where particular collectives discuss collective business - you don't necessarily want outsiders joining in these discussions or checking out what they're about.

Also, you could have some sensitive or even possibly illegal files on your system that you want to restrict access to for obvious reasons (like maybe you don't want to get busted...)

Most bulletin board software will allow you to restrict access to certain areas in other ways too: security levels are a bit crude for some things. You can usually give people access to certain groups - either by setting flags (like in superbbs) or by giving them access to numbered groups (like in waffle). This means that people with the same security levels can have access to different discussions or file areas. It's possible you won't use this stuff much, but it's worth being aware it's there if you need it.

The other aspect of this which is important is if you're setting up a public access computer in a bookshop, infoshop, community centre etc. If you want to run a public access bulletin board system in this way, there's certain steps you'll need to take to keep it secure.

The main thing is you don't want to let just any old body have access to your bbs computer. The only access they should have to this system is the same access they'd have if they were calling in over a phone line. This means they have to use the bbs as if they were - in other words, you must provide a second computer to act as a public terminal for the bbs. This can be any old shitty, cheap, nasty, slow old heap that can run a communications program and has a serial port on it.

You can connect the terminal to the bbs computer through a null modem and let people do their bbs stuff through that. The bbs computer can be locked in a cupboard or have the keyboard locked - either physically, with a key, or by software (such as frontdoor, which has this capability). Also, it should probably have the video display turned off or disconnected while it's not being used by sysops. This is specially true for waffle, which displays the users' passwords when they enter them!

If you've got a dial-up line running on the same bbs, you'll have to either set it up as a multiline bbs, with the null modem one one line and the phone line on the other. Or you can set up two computers with the bbs runing separately on both, sharing files over a lan (local area network) and a third one acting as the public access terminal. This last method is better if you've got access to a few shitty old XTs (say) which you can't do multitasking on (and therefore can't set up a multiline bbs on).

10.4. False Names

Usually known as aliases, these really are the normal way of identifying yourself in the BBS world. They don't seem to be used nearly so much in the internet world though. Most people on internet use their real names - this is probably because of the difference in the way the two systems are used.

I think it's safe to say that on bbss the majority of messaging is done via echomail (i.e., basically public message areas) whereas on internet, it's mainly done through personal email. If you change your name on a bbs, chances are you'll still be able to read any messages addressed to your old personality. This doesn't apply to internet - except for usenet newsgroups, of course.

Also, of course, everyone on internet has their own email address that is much more connected to them than the equivalent on bbs networks. The software's designed so any message you send has your email address at the top. It's not very easy to change your email address.

There does exist what's known as anonymous email services on internet, which compensate for this. They are run by individuals as a public service and operate by switching your name at the top of your message to a false one and inserting the anonymous mail service's email address in place of yours. They keep track of who everyone is and forward any replies. Of course, these aren't necessarily to be trusted fully, but they are useful.

There are certain advantages to anonymity when it comes to net communications, but there are also certain disadvantages. The main one is that if you're communicating with people you know in real life how are they going to keep track of who's who? For instance, if we set up an anarchist computer network in australia, we're going to be mainly communicating with people we already know personally. If we all use false names, it's going to be impossible to work out what's going on. And it isimportant to know who's talking about certain things. Often the way we react to ideas depends on who they're coming from - sometimes this is a bad thing, but just as often it's a good thing too. We know who we can trust and who we can't, and covering our real identities with false names is going to make it harder to work together.

I think it's best generally to use your real name (or at least a close approximation) - after all, if it's the cops and asio you're hiding from, don't bother, they can work out who you are anyway. Just never do or say anything illegal using your real name. False names can come in handy occasionally for such things, but don't let them give you a false sense of security.

Anyway, having said all this, i must make it clear that these are just myopinions. Particularly in the area of security, i don't want to tell anyone what they should do. You have to work out for yourself what's the best approach and that way, it's your responsibility and no-one else's. All i can do is give as much information as possible - but don't forget, i could easily be wrong.

10.5. Data Safety

It's debatable whether this should come under security or not, but protecting your data from loss or accidental destruction is an important thing put a bit of energy into. It's very easy to accidentally erase a file and not be able to un-erase it. It's also not uncommon for component breakdowns (most notably hard drives) to completely trash everything you've built up over months or years.

The only way to protect against this is to keep copies of everything that you can't really easily get again. This process is known as "backing up" or "making backups".

The proper way to make backups is to always keep multiple copies of everything. The first time you back up your files, you'll only have one copy. But the second time you do it, you should keep the first one as well - as it's not impossible to accidentally end up with an unusable backup too! Then the third time you do it, keep the first two. After that, re-use the disk(s) you used for backup number one. Then overwrite backup number two etc. Keep going round in a cycle this way, making new backups after every significant change in your files.

If you follow this advice you'll never know how important it is to do so! You'll be one of the lucky ones (do they exist?) who don't tear out their hair every time something fucks up and they loose everything on their systems. Starting again from scratch, with no backups can easily be enough to stop you in your tracks and make you take up tiddlywinks instead. It's much better notto learn this through experience!!!

the end!