Monday, July 30, 2001

Re: Dutch government and virtual child pornography (Dinwiddie, R-21.47) A comment to a quite old posting, but it might still be interesting: George Dinwiddie brought up the issue, how difficult it is, to guess a person's age. This is a problem, when the definition of child pornography depends on the age of the person on the picture. In Austrian legislation the definition of child pornography does not depend on the age of the person, but something is child pornography, when one or more persons involved in pornography look as if they were under 14. This solves the problem of finding out the age, but obviously raises some others. Christian Reiser, ASSIST, 1190 Wien, Nussdorfer Laende 29-33 C.Reiser@internet-security.at, priv: Christian@Reiser.at +43 1 370 94 40 [Christian Reiser via risks-digest Volume 21, Issue 57] 0:00 # G!

JDS Uniphase quarterly results hacked? NO! I saw this interesting aside in an *Ottawa Citizen* article (27 Jul 2001) about JDS Uniphase's latest quarterly results: "The world's largest maker of fibre optic components was forced to halt the trading of its stock for most of the afternoon yesterday because a hacker broke into its corporate network and stole a draft copy of the company's fourth-quarter results. It had been released before the markets closed yesterday afternoon." The article is at http://www.ottawacitizen.com/business/010727/5066222.html The obvious risk here is the consequences of storing very valuable information unencrypted on a network-accessible computer. Nothing new in that lesson. What would be interesting is knowing is *how* JDS Uniphase knew that this break-in had occurred, and what form the break-in took. It sounded like a story we'd all be interested in hearing. A further article, from the *Globe & Mail* (28 Jul 2001), with the rather convoluted URL of http://rtnews.globetechnology.com/servlet/RTGAMArticleHTMLTemplate/C,C/20010728/wfhack?tf=RT/fullstory_Tech.html&cf=globetechnology/tech-config-neutral&slug=wfhack&date=20010728&archive=RTGAM&site=Technology contains more details. Apparently, there was no 'hacker' or 'break-in'. JDS had placed the release on their Web site. A sharp-eyed surfer noticed that if you type in the exact file name, up pop the results. I suspect that a document-naming convention was apparent from looking at previous financial results. As to how JSU found out about the 'break-in': the 'hacker' phoned them up and told them. Dave Isaacs [JDS apparently reported a $51 billion loss for the year ending 30 Jun 2001, and 16,000 jobs lost. PGN] [Dave Isaacs via risks-digest Volume 21, Issue 56] 0:00 # G!