legalxml-courtfiling — archive

[John Messing]

<JM>[Note: For those not comfortably familiar with the technology being discussed, please visit http://www.law-on-line.com/tutorial1.htm for a description of encryption processes generally. Signatures and hashes begin at http://www.law-on-line.com/tutorial3.htm, and there is a glossary of terms available. An interactive quiz applies the concepts to examples and hypotheticals. Some people who have used it reported finding the explanations at the site extremely useful to get a handle on the processes involved.] As I understand the described system by John Aerts, Gary Poindexter, and Jim Keane, a hash of an order is obtained and stored in a database. The relational association in the database between a username and a stored hash is considered a "signature" since the judge provided a password to submit the order to the system understanding that the submission was an act of signature and the association between the user's identity and the hash of an order in the database evidences the intended signature. I agree with Charles Gillam of ContentGuard in his posting where he points out "I have heard of persons entering systems and placing unauthorized material there." Other responses I have received stress the vulnerability of the database and the network as a source of concern, and the ease of spoofing a judge's IP address (if IP addresses are used) was also specifically mentioned as another potential security threat by one knowledgeable expert... The security of the database against attack is important since as Gary Poindexter points out, the hash or message digest can be generated by anyone through use of the hashing algorithm, which unlike encryption keys, is available generally to anyone. With it, anyone can generate a hash of a file. SHA-1 referenced by John Aerts is a commonly used hashing algorithm. The intentionally free availability of hashing resources creates a possibility of an intruder replacing a genuine hash in the database with another one of his or her making, thus tricking the system into believing a judge signed an order other than the one originally submitted. Such an attack requires an ability to break-in to the network and database to effectuate the substitution. There is a recent case documented of such an actual break-in and alteration of court records in Riverside, CA, which led to the conviction of two consultants. They pled guilty and were sentenced to nine years apiece. The incident is cause for concern about the architecture and process described by John Aerts, Gary Poindexter, and Jim Keane. Here is some of the media web coverage. </JM> ========================================================================== From: http://www.sans.org/newsletters/newsbites/vol5_6.php "-- Two Men Sentenced for Altering Data in California Court Computer System (7 February 2003) Two hackers have pleaded guilty to breaking into Riverside County (CA) court computer system and altering data to make it appear charges had been dismissed in a number of cases, including one against one of the hackers. The two obtained access to the system through a password one of them had copied while working as an outside consultant to a local police department. William Grace and Brandon Wilson were each sentenced to nine years in prison. http://www.msnbc.com/news/870163.asp?0dm=C17LT [Editor's Note (Ranum): {<JM>redacted</JM>} (Grefer): This incident may serve as a timely reminder to our readers to implement (and test) a policy of regular password changes.]" ================================================ <JM>Some of the details of how the attacks were made and discovered can be found at http://www.sachitechcops.com/news1115.htm I have excerpted from the story by William Overend, of the Los Angeles Times: </JM> "Most recently, the San Diego task force was called to help solve a Riverside County case that had court officials puzzled. Employees had noticed that bail amounts had been reduced to zero in some cases and future court dates had been deleted. Investigators logged on to the computer system and began watching it around the clock, said the task force leader, Michael Groch. 'The investigators could see the suspect activity while it was taking place,' Groch said. 'Eventually, it turned out to involve a man with considerable computer skills.' According to investigators, Brandon Wilson and William Grace cracked into the county's court computer system 72 times, altering Wilson's records and those of four other people to make it appear that their cases had been closed. Charges included possession of illegal drugs and weapons, failure to appear in court, driving under the influence, and manufacturing and importing weapons. Officials say Wilson changed the records to show that the charges had been dismissed. Wilson also changed drug and gun charges for one woman, and traffic charges for a man, investigators said. Wilson also was charged with altering the records of an accused embezzler and another man charged with driving under the influence. Facing 216 felony counts each since their arrest in June, Wilson and Grace have pleaded not guilty and await trial in Riverside County." <JM>[Since the time the article was written they reportedly pled guilty and were sentenced. See earlier quoted article from SANS.]</JM> "Morgester said one problem in past computer crime cases has been a history of light sentences. In addition, many prosecutors are reluctant to pursue them because they are often complex and pose difficult jurisdictional problems. A criminal can touch victims thousands of miles away. 'An old adage in law enforcement is, 'If it doesn't bleed, it isn't a crime,' Morgester said. As with the state's other task forces in San Jose, Napa, Los Angeles and San Diego, the Sacramento office is a mix of top electronics experts and cops pulled from other duties." <JM>[The story goes on to note the paucity of criminal investigators for such cases, which raises a possibility of other, undetected such cases.]</JM> "By Dec. 31 this year, we estimate we will have 12,000 identity theft cases in Los Angeles alone. We have 11 investigators to handle them." . =============================================================================== <JM>Assuming proper security of a single court's database, the EFSP model envisioned by LegalXML which is being pursued more aggressively in this era of budgetary shortfalls, greatly complicates the security issues. Not only do courts need to be concerned with their own security, they need to be mindful of the security of the EFSP's with whom they interact on a regular basis (which may be multiple EFSP's where interoperable vendor systems access the court) and of any private lawfirms whose CMS systems may be automatically be updated by objects that communicate between an EFSP and an outside party. An attacker may be able to find a back door into the network at any vulnerable point and work backwards into the systems to reach the databases. The security issues are likely to increase dramatically as the infrastructure develops and matures. I am the liasion between the LegalXML CourtFiling TC and the DSS (Digital Signature Services) TC of Oasis. A digital signature service includes a web service that affixes a digital signature on behalf of a requestor. This is much like the hash + database example that is discussed in the postings from John Aerts, Gary Poindexter, and Jim Keane, but it adds an additional feature. Not only is the hash extracted and saved, but the hash is encrypted with a private asymmetric key. (An encrypted hash is the digital signature itself). An added advantage is that an encrypted hash is much harder to forge than a hash itself because one generally lacks the private encryption key, which unlike the hashing algorithm, is not freely available but is unique, guarded and hidden. In fact if one reads the SHA-1 description closely, SHA-1 is designed primarily as a basis for digital signature creation and verification, and the use of SHA-1 as a substitute for digital signatures is not an intended use. See John Aert's citation of authority: 180-1 Secure Hash Standard (SHS) -- 95 Apr 17 - To specify a Secure Hash Algorithm to be used by both the transmitter and intended receiver of a message in computing and verifying a digital signature. http://www.itl.nist.gov/fipspubs/fip180-1.htm Again, for those to whom the technology discussion is confusing, please consider visiting the tutorial that begins at http://www.law-on-line.com/tutorial1.htm Mo Abdulaziz' court, the Arizona Court of Appeals, Division Two, captures and saves the hash and digitally signs submissions for this very reason. It can be relatively easy transition from a hash only system to a DSS that also uses digital signatures, and the potential security advantages may be very important. There are other enhancements and configurations possible, including having the Clerk's office act as a DSS in its historic role of authentication of judicial orders, but they can be discussed off-line if anyone is interested in pursuing such a discussion A DSS avoids having to have end users each obtain, master, and use their own encryption keys and digital certificates, while still using digital signatures for security. It occupies an area somewhere between a hash-only system and full blown pki. Something like a DSS is probably indispensible for EFSP's, who may be far more attractive litigation targets than a court itself, which may (but not always) benefit from sovereign immunity against liability. The other part of the security picture is a continuing analysis of the threat and attack points to compromise a network and access the database. In this regard, the determination noted by Jim Keane of the DOJ that the hash-only practice of the federal courts did not compromise the secure DOJ network is more a statement about the interface between the two and the overal security of the DOJ network than it may be an approval of a particular hashing and storage method used by the federal courts. I think the security issues outlined in the postings, including this one, deserve top priority by LegalXML Court Filing and this subcommittee in particular. Thanks and as always best regards.