full-disclosure - Re: Truths in "Truth in Caller ID Act"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200610011759.k91Hxfwa001562@turing-police.cc.vt.edu>
Date: Sun, 01 Oct 2006 13:59:40 -0400
From: Valdis.Kletnieks@...edu
To: "J. Oquendo" <sil@...iltrated.net>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Truths in "Truth in Caller ID Act"

On Sun, 01 Oct 2006 12:28:41 CDT, "J. Oquendo" said:

> Now argumentatively how will the United States seek to prosecute say a
> telemarketer from using a service abroad to traverse back into the U.S.? Let's
> re-read the letter of the law again shall we? "unlawful for any person within
> the United States, etc., etc., to cause any caller identification, etc., etc."
> So how does caller ID change, is it cause by the telemarketer, the server
> sending out the caller ID information, or the provider of that server.
> Obviously the telemarketer led the server to change the information, but
> ultimately the provider dished out the number, hence the provider being the
> true culprit.

You mis-read the legalese.

"unlawful for any person... to cause.."  is the important text here.  That
means "If you did something that as an end result made it happen, you're in
trouble".  If you're in Pensacola, Florida, and issued a command that led to
a server in Moscow, Russia generating a bogus caller-ID, then you caused it
to happen, and it doesn't matter where/how it *actually* goes down.

> How will U.S. authorities track him down? They won't.

In general, these things usually succumb to a "follow the money" investigation.
If the fraudster in Pensacola collected any money, he can be tracked down that
way.

Also, the intent here isn't to give the LEOs new ways to track down the crooks,
it's giving them new ways to *lock them up*.  Let's say they do their "follow
the money" thing, and they *know* that Joe Foobar did it.  However, some of
their evidence and methods are a bit... ummm.... "unconventional", and likely
to not hold up if it goes to a jury trial, after all the motions to suppress
evidence and so on.  However, they *do* have rock-solid proof that Foobar did
in fact forge caller-IDs as part of the scam.  So you send him up the river for
3 to 5 on 23 counts of forged caller-ID.

Remember - Al Capone never got convicted of any of the evil things everybody
knows he did.  He ended up in the slammer for income tax evasion.... 

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/