Slashdot Mirror
Keystroke Logger Faces Federal Wiretap Charges
securitas writes "In what prosecutors say is the first case of its kind, a former insurance claims manager was indicted on federal wiretapping charges for allegedly installing a keystroke logger on another employee's computer. The device was secretly installed 'on a PC used by a secretary to senior executives at Bristol West Insurance Group.' Reuters reports that the man, who had been fired, was gathering information for a class action lawsuit against his former employer. SecurityFocus interviews would-be keystroke logger user Larry Lee Ropp who reportedly installed the KEYKatcher device on the PC."
From http://www.keykatcher.com/testimonials/index.html
"I must thank you for this great invention. Early this year, I discovered my 14-year-old daughter was on the ICQ with a person with a name of "P****". I was shocked and did not know what to do. I then e-mailed the editor of Parent and Child and they reccommended me to do a search on the internet. I was very fortunate to have purchased a KEYKatcher. The ability to read my daughter's e-mail has helped us to make the right decision about the school she would attend last September..."
I mean, is there any useful use for this device at all?
Small potatoes make the steak look bigger.
When is the last time you remember hearing about an indictment for actual wiretapping? Doesn't it seem like people get away with wiretapping regularly? I'm thinking about things like the illegally recorded phone conversations with Monica Lewinsky. Or does the law specify exemption if it is done for a good cause?
You are receiving this message because your browser supports Slashdot Sigs and you have Slashdot Sigs enabled.
This is why you should always check your keyboard cable on your work-PC.
Not only does it keep you secure, but you might score a brand-new keylogger for free.
According to this politech posting by bernieS, it appears that the feds are going to be doing a little bit of double backing.
It raises an important question, I think: are keyloggers wiretapping devices? They don't involve telecommunications lines directly, so can they be considered in the same class?
Some food for thought.
While his heart may have been in the right place, it sounds like he went to far. Once the class action suits started, once the state of Calif. started investigating, there was very little need for his cloak and dagger actions. The courts could have done the work. If he felt that they were tampering with evidence, destroying evidence, or not providing everything the courts demanded he could have come forward. In my view, he put his own neck on the line in a wreckless way.
He was collecting the names of all the insurance company's clients... So uh... so he could notify them of their ability to join the class action lawsuit!
He was... he was helping the government investigate a corrupt company, yeah! He was James Bond! Saving the innocent from themselves!
Yeah... he had no intention whatsoever of joining a competing company and stealing the client list.
Good. It is not the decision for just any man to make, on when to invade someones privacy. (Most) Laws exist for a reason. This man broke one. Hopefully he'll spend some time in jail.
Read all about it here.
I want to drag this out as long as possible. Bring me my protractor.
The EU convention on cybercrime, which is law in most (all?) EU countries since 2000 prohibits the interception of private electronic communications. A key logger would certainly fall into this category.
However, there have been very few convictions under these laws, only a couple of "hacking" cases in the UK afaiaa.
It's not only about domestic/workplace espionage. Spyware vendors (a species that rates somewhere between slimemolds and spammers) use similar techniques to spy on and report back on people's use of their computer.
Ceci n'est pas une signature
....He got busted when he call the company to get the device back!
Not the smartest thing to do. He deservse whatever he gets.
I think I think, therefore I think I am.
I think we all know who the real bad guy is. But this guy was asking for it. On the bright side, perhaps we will get some kind of ruling out of this to clarify the keylogger-wiretap legal grey area. Related Article
They were to apply federal wiretapping laws to spyware? If an unauthorized piece of software transmits information about my activities to a third party without my knowledge... that sounds like wiretapping to me.
I better go with a wireless keyboard! That'll stop people from capturing my keystrokes!
We had a consultant (former employee) work at a branch office. The owner said to keep an eye on them. I want to the branch office and told every employee that I was installing a keyboard logger and why. When the consultant (former employee) logged on, they had no idea they were being tracked. I discovered they had a back door account and were logging into a supervisor account. Good or bad, I discovered the holes in my system.
I have to agree that this sort of behaviour is absolutely inevitable in nowadays everyday life. In the past it was called "social control" where small communities monitored each other's behaviour to see if somebody wasn't stepping out of line. If they would, due psychological force could be executed to get them in line again ("gossip"). Now this practice has mainly gone away simply because there are less and less small communities, and thus we need to monitor other people by different means. Ofcourse, in due time virtual communities will take over the "social control" thing in a comparable way, but it's not there yet.
In the meantime, we shall have to rely on the usual methods of camera's, microphones, keyloggers and traitors. I think we can learn a lot from former Soviet-Russia and sortlike countries that have executed this behaviour in great practical ways...
I can't think of anything that's terribly legal. I knew there was a reason I never do anything important on publically-accessible terminals. I guess it's a nice device to own if you're a bad parent with a tinfoil hat.
How on earth would just using the device make you "a bad parent with a tinfoil hat"?
Contrary to kid's beliefs, most parents have little interest in snooping on whether your friend Monica likes Jeff and also got new shoes, or whatever. However, it would be nice to have some forensic material available to save your ass if you get involved with something stupid.
I vaguely recall an old slashdot article that said the encryption was pretty weak, if not already broken.
Now you're a "bad parent with a tinfoil hat" if you take effective measures to monitor or control your kid's internet use (at least as far as the computers you control goes)?
I thought you were a "bad parent" if you just let your kids go willy-nilly wherever they wanted unsupervised. Now if you monitor them, you're also bad. What's the solution - no internet access period?
I'd say if you're that interested and concerned about what your kid is doing, you're most likely a great parent. Granting unlimited freedom isn't good parenting. Apathy isn't good parenting.
btw, it's hardly "tinfoil hat" material to believe that your kid might encounter something you wouldn't want them to see on the net. In fact, if you believe the unfettered net is appropriate material for unsupervised children, I think you're the one who is probably wearing Reynolds Wrap.
We haven't yet seen the results of what the silver internet-in-hand generation will be like, anyway, so your notions are ass-borne, not based on observation.
Wiretapping involves capturing information that is being sent (i.e. is already in transit), meaning the tap is between points A and B; spyware [generally] initiates and handles its own sessions, meaning points A and B are different. Spyware usually sends metadata as well: "information about [your] activities" != the actual keystrokes that were sent.
I posted this link earlier in the thread. You might want to go there and read about wiretapping.
I want to drag this out as long as possible. Bring me my protractor.
So he just walked over and installed it on her PC. She should've had xlock running while she was away.
*DrugCheese rants*
so when is the disclaimer going up at thinkgeek?
http://www.thinkgeek.com/gadgets/electronic/5a05/
disclaimer: please do not buy this product and use it for what you think you were going to use it for, thank you... same with that x10 camera you were thinking about too, while we're at it
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
As adults, they may be presented with similar policies. Only this time, they have the "choice" of consenting or losing their job.
Mea navis aericumbens anguillis abundat
It's illegal for an employee whether or not they are currently employed for a particular company to install a keylogger, but it's perfectly legal for an employer to do the same thing? An employer using the disclaimer that an employee may be observed at work using logging such as this would make it legal? Poppycock!
I don't recall if it was KEYKatcher or another product, but when recovering data from the dongle one could choose to view the raw keystrokes (the potentially munged data you mentioned) or the end result, i.e. all the typing with backspaces, etc. applied, so instead of "fooo^Hbar" you would see "foobar". I don't know how CTRL-{C|X|V|B|U|I} and other combinations would be represented - guess I better buy one and find out.
I want to drag this out as long as possible. Bring me my protractor.
So we've got this guy working for an insurance company who decides to inform the Dept. of Insurance that they are cancelling policies unlawfully. This is a good thing and brave of him to do it. Hopefully his motivations were purely good and not just because he was pissed he didn't get a raise last year or something.
And let's face it, insurance companies are the some of the worst kinds of organizations in corporate America. They collect huge sums of money via premiums - that are based in people's fear that something terrible could happen. And then as soon as you need them (you have an accident, someone in your family gets ill, etc.), they immediately initate every effort to not pay you in your time of need. I know it's how they do business, but it's a disgrace. I have experienced this first hand more than once ...
Back to the story, the guy then plants a keystroke logger on a secretary's PC in order to collect further info for his crusade and to aid lawyers in a class action suit against his company. He obviously crossed a line here. And in the middle of this, he finds himself fired (curious). So he asks a former co-worker to retrieve the logger for him? And of course being a good insurance company employee, she rats him out.
I applaud his intentions, if they were indeed based in fairness and the public good. He did get carried away for sure by planting the bug. But I can't believe the stupidity of (1) admitting he planted it to a former co-worker and (2) expecting her to help him retrieve it and f--k the company she still worked for. I guess he really was a bit of a dreamer ...
Why do I get the impression that this article specifically avoids mentioning software keyloggers? Whether or not they're currently illegal under the law shouldn't they be?
+++ATHZ 99:5:80
Aint that a bitch.
I was just thinking last year how stupid these insurance companies were for always sending cancellation notice as opposed to a bill. (I live in Michigan.) So when I actually get a cancellation notice I don't know if its simply a bill, or an actual cancellation notice.
I have never received a bill from an insurance company, only cancellation notices, and I've been with at least 5 different ones. What more info is needed? we know they do this.
For those who didnt RTFA, Ropp was trying to get the list of people who they pulled this fast one on, from the companies password protected (DMCA anyone?) database.
More power to you Ropp. If the government mandates one must buy something, that thing should be heavily regulated by the government. racket.
Life sucks using a crippled Windows machine!
Without command.com, how are these kids ever going to learn?
weierstrass
my password really is 'stinkypants'
I was working for the President of a company who seemed to have information about others that left me wondering. So, I ran a program, (I believe it was Spycop), to scan for anything nefarious on my computer. Nothing found, fortunately.
However I shared this program with a colleague and she ran it and found a keylogger that would send emails from her company laptop, to a blind email account. He apparently had a thing for her roomate, a former employee, and was using this to spy.
My colleague was shocked that this would happen, but as it appeared to have been non-functional for a while due to internet login issues, she didn't say anything, and I told her what to delete to kill the program from running.
That way, any deletion of the software could at least appear to be accidental.
From now on, I'm only doing text input with charmap!
Sure it may be a little slower, but hey, I'm paid by the hour!
Life is too short to proofread.
Should keylogging a co-worked be illegal? Yes (though if it is done by your employer and you signed consent then no, just like phone monitoring ... free will works both ways).
... VNC not included :).
... idiots), their credit card # (amazon), or their root password. Keylogging is far more invasive.
Should keylogging be considered wiretapping? NO. It is a distinctly different technology and all lumping things together does is make it easier to confuse the issue the next time someone wants a warrant to do something -similar-.
Keylogging, network interception and a whole host of other things are still quite different from basic phone taps. They should be given a distinct category that can be properly defined.
If anything, the expectation of privacy on the line between your computer and your keyboard is MUCH higher than any expectation people have today for phones (when was the last time you started typing and realized someone else was typing on your computer as well
Plus, you can't expect that by listening in on a phone you are going to regularly hear someone's social security # (my bank uses it for my login id
In the end I think the guy should be penalized more than wiretapping, but not -as- a wiretapper.
It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
can someone post some info on how to detect the app? (my empl is blocking access to the site).
there's no place like ~
While i dont that exact product, i did log application useage at a previous job.
It would tell me every application that was run. Later a report was reviewed for unautorized useage of applications... ( which is a bad thing for network security, and is against our AUP the employees sign when hired )
Thats useful in the business world.
You also have cases where employees are sending out harassing email's.. So you log their activities ( with HR's approval ) to help prevent law suits against the company.
---- Booth was a patriot ----
All of this is a far cry from using electronic spy tools to secretly monitor the children's activities. What kind of message does it send to the kids? "Be good! Because if you don't, we are always watching. No matter where you go, we are watching!" Is that really the lesson we want to teach the children? Be good, not for the sake of being a good person, but for the sake of not getting caught.
And that is the difference between appropriate supervision and eletronic surveillance. With the former, the goal is to teach the children, mold them by example and through good leadership, and let the keep their individuality and allow them to experiment within appropriate bounds. With the latter, its simply trying to keep kids away from things which *could* be bad for them.
In short, if a school thinks it needs to install this kind of electronic monitoring system, I think it is indicative of a lack of appropriate supervision and/or quality teachers.
My kids' teacher should know what my child is doing (approximately) without resorting to spying.
Taft
If you're relying on a keystroke logger to clue you in to children who have problems with any of these issues then let it go. You're already too late.
While I think Columbine was sad, I don't think gun control/key loggers/video monitoring would be an approtiate answer. I do think responsible parents are a great answer.
I am not a great parent. I try to be a responsible parent, and make sure my children are behaving/polite/safe/etc. It is alot harder these days, I think, then when I was 10 or 12. If I did something wrong, like shooting soda cans in the backyard with my shotgun (we lived in a semi-rural area), when my parents weren't home. The neighbors would have said something to my parents (there by fixing the problem). Not today!!! No sir, we call the police or family services. You dare try to make your child obey by swatting their butt with your hand. You, sir, are a child abuser!
I have no problem with parents using keyloggers to monitor their children, but what 12 year old needs to have ICQ/AIM? I also believe that parents should monitor their children's activity on the web. (History?) I have a local start page with all of the pages, my kids would need to go to.
Ode to a generation that is completely self-absorbed until the last possible moment when "DANGER WILL ROBINSON" is blaring over loudspeakers.
I'm more worried about the government that knows whats better for our children, then we as parents do.
Thanks for the post!
Vertical
72 CD D7 52 D0 7E D8 47 44 91 D5 84 D1 59 F1 A9-This is my 128bit integer. There are many like it, but this one is mine.
This goes a bit deeper than the knee-jerk reaction that _always_ follows events like the ones you've described. Although, I'm sure that the reaction by school districts nationwide, to the incident in Columbine made most high schools seem more like prisons to the students, this type of monitoring has become necessary because of tort law rather than criminal concern. Because the school/corporation is responsible for damage done by a student using its computers, and can be financially (and maybe criminally)liable for that damage (not to mention the negative publicity), it is IMPERATIVE TO ITS SURVIVAL for the entity to monitor and control that activity. This is not so much a case of infringed liberties as it is a case of our society (in general) shunning responsibility for its actions and always wanting to point the finger at somebody else. The ill effects of tort law don't just end there. Living in Massachussets, I can't go to the local bar and have more than a few drinks before I'm shut off because some judge decided that if I get in a car accident on my way home and cause damage, injury, or death, the bar is at fault and can be sued! This notion would set our Founding Fathers' heads spinning much faster than a breach of "liberties. "
Not that I think that wholesale monitoring is a good thing (For one thing, it wastes resources that could be put to better use), but I'm loathe to start accusing public and corporate entities of trying to control us, when it is WE who have forced them into this situation with frivolous lawsuits. If judges would stop holding the owners of facilites responsible for their misuse by the users, there would be no need for any of this.
"All of this is a far cry from using electronic spy tools to secretly monitor the children's activities. What kind of message does it send to the kids? "Be good! Because if you don't, we are always watching."
Like in class, like at lunch, like at recess... Sorry, but I fail to see the cause for massive paranoia here. It's not as if they're devoting an entire department to the electronic monitoring of these kids. It's more than likely just one, maybe two people at most who probably have other jobs. Child oversight is a fact of life for schools. No part of it is designed to be private. The whole notion that there is should be any privacy on campus is absolutely ludicirs.
Yes, they will be watching. THAT'S THERE JOB. To give ou an eductaion and keep you out of trouble. You can have privacy off campus or be smarter than the watchers. I was. But to actually expect any is stupid.
You need a FREE iPod Nano
Seems like the feds are contradicting themselves (I guess that's not a huge surprise). In the Scarfo case, the FBI claimed they didn't need a wiretap approval to put a keystroke logger on Scarfo's computer because they were only monitoring internal communications between the keyboard and the computer. Thus it wasn't a wiretap.
Now the government is prosecuting someone for doing the exact same thing. Has anyone else noticed this contradiction, or am I missing some important distinction?
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
A container, in a container... The school may be able to look in the locker because they own it, but can they look inside the bookbag inside the locker even though they don't own the bookbag?
How much you wanna bet that if this was a story about how the Chinese government was doing the same to internet cafe users, we'd be hearing braying about human rights and so on?
Its fascinating how the same faults in our enemies are lauded when we do it.
Dear god, think of the children. WON'T SOMEBODY THINK OF THE CHILDREN?
OK. I will. Children should be barred from using the internet. You wouldn't send your children out on the streets and back alleys to play with any stranger they might encounter would you?
Then why turn them loose on the internet and expect others to do the watching for you. Get Real and learn how to take parental responsibility for your "mistakes".
And there should be an internet license required with a minimum age and technical exam. Lets get these babies and twits off the internet... NOW!
For example, KeyKatcher "listens" for a user specified password, which should be a series of characters never typed inadvertently. When these keys are pressed, then the device "types" out a menu, allowing configuration and logged-text retrieval from the device. -Jonathan
I also run a keylogger on each of my employees' computers. It's a great way to get free new porn passwords.
How do you detetct these low-level keyloggers/Trojans ..etc?
Most scannner apps only scan the application level.
At least the court found they weren't covered by wiretap laws when performed by the FBI. So why should it count as wiretapping when it's not the government? It seems like some other law would have been better to prosecute under -- maybe electronic trespass or something similar.
If the latter, I'm going to unplug my toaster, as it's intercepting the 60Hz signal from my power company.
--Pat
Hehehe...well then...c'mon down to New Orleans, we're on the opposite end of the spectrum. Bars open pretty much 24/7, you can buy boozed 7 days a week, heck, we have drive through daquiri bars, and the bars down here give you 'to go' cups to take your drink with you when you leave the bar.
It was only recently that they even passed an open container law for the car...but, there was a loophole in that it only applied to the driver..so, if you got pulled over...just hand your drink to a passenger, no problem. I think they 'may' have fixed that one...
I'm spoiled...not having to go cups at other bars in the country sucks...you have to chug your drink before you can leave...
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
It's a (crude) way to save the typing you did on your great American novel after your disk crashes.
"As always, if you are killed or captured the secretary will disavow any knowledge of your actions. This tape will self-distruct in five seconds" (Tape bursts into flames.)
That is overly simplistic thinking. Why should he be prosecuted under this specific law and not other laws? The world's not black and white. There are different ways to achieve the same goal.
I am specifically suspect of this action because the FBI has previously claimed that keyloggers are not wiretaps and thus they should be able to use them without a warrant. So now they are saying that when other people do it, it is wiretapping. See what I mean about simplistic thinking? If you don't consider a wider view you run into horrible inconsistancies. We call that hypocrisy.
Among the deaf... TDD is still somewhat popular to communicate with others... after all a traditional telephone is pretty worthless. If one were log / monitor a TTD terminal... this would clearly be a form of wiretapping. I've always found it most annoying the cost of a TDD compatable modem vs the cost of a regular modem.
What seems to be more popular among the deaf these days is instent messenging. After all for the cost of a dedicated TTD terminal you can buy a full blown PC easily. It makes sense to get net access so you don't even need to tweek with your modem to set it to auto answer... just use the existing clients already on the market and communicate with anyone you damn well please.
Assuming that a TDD terminal is protected from wiretapping the same as a telephone, after all it is not only a telephony device but also a communications device, why would we even consider a PC any diffrent? Even if we are talking about just a keystroke logger... you put your self in a position to not only monitor what a person does that may not be communication related, but you can see what they communicate as well.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
Only the government can infringe the right to privacy like that.
In New York federal investigators used a search warrant to physically alter Scarfo's computer to install a hardware keyboard logger so that they could retrieve his pgp passwords This search warrant was a sneek and peek. They then went back in a month and took the computer on another search warrant.
I'm burning mod points to say this, but I have to add that the sneak and peek warrant was itself objectionable. If allowed to do this, how different will the FBI be from the KGB or the Stazi? Politicians from both sides of the aisle had been trying to sneak this by us for years. Patriot finally gave them what they wanted, and the provision does not sunset.
I recently got fired from an electronics engineering company in the town of Pullman, WA. I feel like I was treated unfairly, in that I was fired because I agreed to an electronic use policy that stated that the computer I used and anything send from it was able to be monitored. About 11 months ago, I broke up with my girlfriend. I really loved the girl, and hoped to clear up misunderstandings that led to the breakup. However, as these things go, sometimes the prettiest of comments are not said to one another. She said some things I don't think any person should hear. Sadly, and I'm not proud of it at all, I said some things back (of course wanting to uphold my pride, not really thinking that at the time I was only shooting myself in the foot, not only with what little was left of our relationship, but the fact that I was doing it from a company computer). About 3 weeks ago, my hard drive failed. I called our IS department, who came out to deliver a new drive. I erased the old one after I had transfered my files off it. Shortly therafter, they came to pick it up, saying they didn't want it to get into circulation again since it was damaged. Someone must have been thouroughly bored and decided to start a little investigation of my personal data by reconstructing what was on the drive. (Although I deleted files, I didn't reformat...my bad). Shortly after dropping off the old drive, I was told I was fired, because the company had viewed conversations to my ex that were automatically logged by MSN messenger. I'm still quite perterbed that they pulled this out almost a year after it happened. Also, the point was brought up...what gives them the right to monitor a computer, whether they own it or not, when they certainly can't do that with a phone?! How much of our lives are to remain ours, and private when we go to work? The reason they gave was that it put the "company's servers at risk". Hmm. Okay. Obviosuly not that much if nothing has happened, and it's been a year. I wrote the owner of the company, who I greatly respected, who handed it back to the HR department, who verified that they would not re-hire me, despite my personal life issues that led me to do this. On one hand, I see their point in not re-hiring, in that if you do it for one, you give grounds to have to do it for all. From another though, does this stink a little of improper HR and IT practices to anyone but me? -J
I type everything in ROT13. They'll never catch on to that.
Donate background CPU time to fight cancer.
Ten years from now: ... ...
i ll be viable evidence in trials against
**Keylog**
>Call transop received
Chocolate ration down ten percent.
____________________________________________
W
doubleplusungoodthinkers.