------------------------------ From: Barbara E. McMullen and John F. McMullen Subject: Len Rose Sentenced (Reprint from Newsbytes) Date: 12 June, 1991 ******************************************************************** *** CuD #3.21: File 7 of 7: Len Rose Sentenced *** ******************************************************************** LEN ROSE SENTENCED TO 1 YEAR 06/12/91 BALTIMORE, MARYLAND, U.S.A., 1991 JUNE 12 (NB) -- Leonard Rose, Jr., a computer consultant also known as "Terminus", was sentenced to a year and a day in prison for charges relating to unauthorized sending of AT&T UNIX source code via telephone to another party. Rose is scheduled to begin serving his sentence on July 10th. The original indictment against Rose was for interstate transportation of stolen property and violations of the Computer Fraud and Abuse Act but those charges were dropped and replaced by a single charge of wire fraud under a plea agreement entered into in March. The charges involving the violation of the Computer Fraud and Abuse Act had been challenged in a friend of the court brief filed in January by the Electronic Frontier Foundation (EFF) who challenged the statute as "unconstitutionally vague and overbroad and in violation of the First Amendment guarantees of freedom of speech and association." The issues raised by EFF were not resolved as the charges to which they objected were dropped as part of the plea agreement. In his plea, Rose admitted to receiving misappropriated UNIX source code and modifying it to introduce a trojan horse into the login procedures; the trojan horse would allow its developer to collect passwords from unsuspecting persons logging on to a system containing this code. Rose admitted that he transmitted the modified code via telephone lines to a computer operator in Lockport, IL and a student account at the University of Missouri. He also admitted putting warnings in the transmitted code saying "Warning: This is AT&T proprietary source code. DO NOT get caught with it." U.S. District Judge J. Frederick Motz, in sentencing Rose, ordered him to sell his computer equipment and to inform potential employers of his conviction. Assistant United States Attorney Geoffrey Garinther, who prosecuted Rose, explained these portions of the sentence to Newsbytes, saying "The equipment was seized as evidence during the investigation and was only returned to him as part of the agreement when it became evident that he had no means of supporting his wife and two children. It was returned to him for the sole purpose of selling the equipment for this purpose and, although he has not yet sold it, he has shown evidence of efforts to do so. The judge just formalized the earlier agreement in his sentence. The duty to inform potential employers puts the burden of proof on him to insure that he is not granted "Root" privileges on a system without the employer's knowledge." Garinther added "I don't have knowledge of the outcome of all the cases of this type in the country but I'm told that this is one of the stiffest sentences a computer hacker has received. I'm satisfied about the outcome." Jane Macht, attorney for Rose, commenting to Newsbytes on the sentence, said "The notification of potential employers was a negotiated settlement to allow Len to work during the three years of his supervised release while satisfying the government's concern that employers be protected." Macht also pointed out that many reports of the case had glossed over an important point,"This is not a computer intrusion or security case; it was rather a case involving corporate computer software property rights. There were no allegations that Len broke into anyone's system. Further, there are no reported cases of anyone installing his modified code on any system. It should be understood that it would require a system manager or someone else with 'superuser' status to install this routine into the UNIX login procedure. The publishing of the routine did not, as has been reported, open the door to a marked increase in unauthorized computer access." Macht said that she believed that Rose had reached an agreement to sell the computer equipment. He had been offering it through the Internet for $6,000, the amount required to prepay his rent for the length of his prison sentence. Because of his financial circumstances, which Macht referred to as a "negative net worth", the judge did not order any restitution payments from Rose to AT&T. (Barbara E. McMullen & John F. McMullen/19910612) ******************************************************************** ------------------------------ **END OF CuD #3.21** ********************************************************************