Illustrative Risks to the Public
in the Use of Computer Systems
and Related Technology
Peter G. Neumann, Computer Science Laboratory,
SRI International, Menlo Park CA 94025-3493

Risks cases as of 27 November 2000, Copyright 2000, Peter G. Neumann, SRI International EL243, Menlo Park CA 94025-3493 (e-mail Neumann@csl.sri.com; http://www.CSL.sri.com/neumann/; telephone 1-650-859-2375; fax 1-650-859-2844): Editor, ACM SIGSOFT Software Engineering Notes, 1976-93, Assoc.Ed., 1994-; Chairman, ACM Committee on Computers and Public Policy (CCPP); Moderator of the Risks Forum (comp.risks); cofounder with Lauren Weinstein of People For Internet Responsibility (http://www.pfir.org, announced in RISKS-20.65). See also Lauren's Privacy Forum Digest (http://www.vortex.com), partially sponsored by the ACM CCPP.

Items Listed by Categories

Descriptor Symbols

The following descriptor symbols characterize each entry.

! = Loss of life/lives; * = Potentially life-critical or safety problem

V = Overall system or subsystem surViVability problems (with respect to diVerse adVersities, including attacks and malfunctions). Startlingly many cases fit this category; many V-unflagged cases also represent failures to continue performing properly, or delays, or other cases of misuse that could have led to much more serious survivability problems.

$ = Loss of resources, primarily financial

S = Security/integrity/misuse problem; P = Privacy/rights abuse or concern

H = Intentional Human misuse (e.g., user-administrator-operator-penetrator)

h = Accidental Human misuse or other inadvertence

I = Insider; O = Outsider; A = Inadequate Authentication or Access controls

d = System Development problems

e = Improper Evolution/maintenance/upgrade. (H,h,i,f,d,e involve human foibles.)

r = Problems with Requirements for system or operation (including the overall system concept)

f = Flaws (or Features in design, or hardware/software implementation

i = MisInterpretation/confusion/human errors at a man-system Interface

m = Hardware Malfunction attributable to system deficiencies, the physical environment, acts of God, etc.

M = Malfunction specifically due to electronic or other interference

+ = Beneficial; - = problematic with none of the above categories

@ = This item is also listed in another category

Items Listed by Categories

Recent Items (yet to be merged in)

Vm PGN's Univ. Maryland survivable systems course beset with survivability problems (S 25 1:)

fm California government agencies' computers fail, cars impounded; Pac*Bell blamed (R 20 62)

Vfm Software disaster leaves new Australian submarine unfit; wide range of pervasive hardware/software failures reported (R 20 48)

*fh Cancelling errors, serendipity in avoiding risks, and Kepler: note by Henry Baker (R 20 48,51)

Vm Weather-predicting Cray C90 supercomputer lost in fire, weather predictions reduced (R 20 62)

Vm Netcom file-server hardware outage loses half of the e-mail customers, depending on first letter of name (R 20 49)

m Airport security check powers up computer (R 20 55)

f MIT system weather command gives "Temp: 2147483647 F (2147483647 C)"; yes, that's 2³¹ - 1 (R 20 51-52); USA Today weather page: high of 577 F (R 20 58)

? NOAA radio +61 degrees F, wind-chill -64 (R 20 57)

f/m/h? Date failure on weather.com: 28 Apr not 16 Sep (R 20 58)

$fh Dispute over membership software used by German SPD (R 20 41)

$f Reliability of NT in embedded applications (R 20 41)

f Microsoft Word footnote problems irks federal appeals court: Word does not count words correctly (R 20 52)

fe IE2 cannot read www.microsoft.com for upgrade (R 20 55)

if More anomalies in Microsoft driving directions (R 20 62-63)

? Risks of "self-destructing e-mail" from Disappearing Inc. (R 20 62)

h,h Linux banned after Samba misconfigation blocks NT authentication (R 20 61)

rh Vending machine default phone number 000 (Australian emergency number) yields hundreds of false alarms (R 20 47)

f Kangaroo helicopter responses mess up Australian virtual-reality simulators (R 20 47,76)

hf Can you trust AT&T Wireless PCS text messaging? (no) (R 20 52-53)

f Risks of financial planning engines with bogus results (R 20 48)

h EverQuest is the "digital version of crack" (R 20 52)

rd More on California's software woes: welfare system problems (R 20 53)

h (but blamed on computer) Argos retail offered Sony Nicam TV for 3£ instead of 300£ (R 20 57)

f E*Trade Market Watch shows Dow Jones average at $1, down $10936.88 (R 20 56)

Vmfm Power coming back on causes UPS to lose power (R 20 55)

+/-?? Programming competency and the use of FORTH (R 20 49-53)

$f Toyota smog-warning computer suit (R 20 48)

fh CNN report on Gary Shandling lawsuit names him as "Changeling"; spelling corrected? (R 20 47)

h White House admits over one year of VP's e-mail lost forever (S 25 4:8, R 20 91)

f Software fault stops 76,000 customers receiving phone calls (S 25 4:8, R 20 87)

h UCITA, the Uniform Computer Information Transactions Act (Schneier, S 25 4:8 and R 20 87, and Simons in August 2000 CACM Inside Risks)

f Microsoft Explorapedia Nature: earth rotates in wrong direction (R 20 87)

+ Patent office revamps Web patent reviews (R 20 87)

h- 50 million U.S. adults at risk for Internet illiteracy (R 21 08; S 26 1:)

(f/m/h?) Computer-related sewage release into Massachusetts Bay (R 21 08; S 26 1:)

fid Not-so-smart weapons in Kosovo (R 21 01; S 26 1:)

de Satellite system outage hits Associated Press (R 21 04; S 26 1:)

m/f/h? Root servers used by Network Solutions failed (R 21 03; S 26 1:)

$dh $35M San Mateo CAlifornia health system upgrade is a downer; receivables backlog over $40M; blame scattered (R 20 98)

$d WA King County blew $38 million on canceled payroll system (R 21 01; S 26 1:)

*Sr Thai robot has Web interface controlling a gun; risky! (R 21 02; S 26 1:)

eh Northeastern University admits 25% too many students (600 extra) after DB upgrade loses potential applicants (R 21 01; S 26 1:)

f CSX crew spots problem signal, averts collision; insulation problem? (R 21 04; S 26 1:)

e Upgrade to Guildford Station (Surrey, UK) software disables hundreds of train tickets for automated gates (R 20 94: S 26 1:)

fi DC Metro can't label rerouted holiday trains on 4 Jul 2000: confusion (R 20 95; S 26 1:)

m Computer crash caused loss of scheduled cab pickups (R 20 98; S 26 1:)

m Sliced fiber-optic cable in Lancaster PA disrupts local and long-distance phone service NY to MD (R 20 93; S 26 1:); another outage in Massachusetts (R 20 97)

m Heavy rains take out State Department phone service for 2 hours, backup batteries out because of earlier fire (R 20 93; S 26 1:)

$mh Drop of welding material causes fire that affected 27 cables, telephone service for 25,000 (R 20 93; S 26 1:)

m Remote line break leaves San Juan Puerto Rican without power (R 21 04; S 26 1:)

- Booming computer firms are running out of power (R 20 98)

- Russian troops override power shutoff for unpaid bill affecting missile base (R 21 05; S 26 1:)

!h Illinois man dies after utility cuts power for arrears (R 20 95; S 26 1:)

f New Pentium III chip recalled (R 21 04; S 26 1:)

*h F-117 stealth fighter in near-miss with UAL jet (R 21 04; S 26 1:)

*SHA Fake air controllers alert in UK (R 21 04; S 26 1:)

f/m? Collapse of UK air-traffic control computer (R 20 93-94); known bugs reduced from 500 to 200 (R 21 01)

def U.S. west-coast ATC woes 19 Oct (hundreds of flights affected) and 23 Oct 2000 (loss of flight plans for Northern CA and Western NV) (R 21 09; S 26 1:)

mf FADEC computers cause uncommanded shutdowns of aircraft engines in flight; linked to power transistor (R 21 05; S 26 1:)

m Total primary/secondary power outage at Sydney Airport leaves 20 planes circling (R 20 94; S 26 1:)

m/f? Sydney Airport's new $43M baggage system fails for second time in five days (R 21 02; S 26 1:)

h Oregon lottery coincidence reported by Infobeat caused by computer crash: winning numbers published before they were drawn by editor mistakenly using Virginia numbers after a crash! (R 20 94)

ef DB upgrade causes crash of Italian online stock trading (R 20 95)

f Fox network misprograms time on US VCRs for a year (R 20 95)

fh Army Automated Time and Attendance Production System (ATAAPS) loss of data for 10 days (R 20 97)

f Computerized air-conditioning bugs chill employees (R 21 05; S 26 1:)

- ISP whacks game fan with $24,000 bandwidth fine (R 21 08; S 26 1:)

e Memorial Society software upgrade loses some life-time members (R 21 08; S 26 1:)

!!(f/h?) Russian nuclear sub explosion (missile test awry) kills crew of over 100 in Barents Sea, 13 Oct 2000. Also, Izvestia reported over 507 sub crew members had died previously. (R 21 01)

*f Sydney train system traps man's leg (R 21 01)

f New UK Millennium Bridge closed after one day, alarming instability despite extensive simulation; resonant frequencies at walking speeds! (R 20 93,95)

+/- People For Internet Responsibility (PFIR) Statement on Internet Policies, Regulations, and Control (http://www.pfir.org/statements/policies) (R 20 96)

S Navy to use Windows 2000 on aircraft carriers (R 20 95)

f Microsoft Windows Update Corporate Web site "features more than 1,000 system updates and drivers for the Windows 2000 platform"!!! (R 21 04)

f Y2K-leapyear hangover: CDMA GTE wireless date 31 Jun 00 (R 20 92)

+/- Stephen King's not scared of trusting online readers (R 20 98)

END of yet-to-be-merged recent material ...

Space

..... Manned/Womanned [Peopled?] Space Exploration:

!!$$Vrfh Shuttle Challenger explosion, 7 killed. [Removed booster sensors might have permitted early computer detection of leak?] [28Jan1986] (S 11 2) [Probably not? See Paul Ceruzzi, Beyond the Limits - Computers Enter the Space Age, MIT Press, 1989, Appendix.]

* Mercury astronauts forced into manual reentry? (S 8 3)

$f STS-1 1st Space Shuttle Columbia backup launch-computer synch problem. See Jack Garman, "The bug heard 'round the world" (S 6 5:3-10) Oct. 1981.

*f STS-2 shuttle simulation: bug found in jettisoning an SRB (S 8 3)

*f STS-2 shuttle operational simulation: tight loop upon cancellation of an attempted abort; required manual override (S 7 1)

*Vf STS-6 shuttle bugs in live Dual Mission software precluded aborts (S 11 1)

*m STS-9 Columbia return delayed by multiple computer malfunctions (S 9 1)

*f STS-16 Discovery landing gear - correlated faults (S 10 3)

*if STS-18 Discovery positioned upside down; mirror to reflect laser beam from Mona Kea aimed upward (+10,023 miles), not downward (... feet) (S 10 3)

*$ STS-20 Two-day delay of Discovery launch: backup computer outage (NY Times 26 Aug 1985); Syncom 4 satellite failure as well (S 10 5)

$f SRS-36 Atlantis launch delayed [25Feb1990]; "bad software" in backup tracking computer system, but no details given. (S 15 2)

h Shuttle Discovery shutdown procedure for two computers reversed (S 16 1)

*hife STS-24 Columbia near-disaster, liquid oxygen drained mistakenly just before launch, computer output misread (S 11 5)

*f Columbia orbiter suddenly rotates, due to telemetry noise (S 15 3)

$m Columbia delayed by computer, interface, sensors; then navigation (S 16 3)

$f Shuttle Endeavour computer miscomputes rendezvous with Intelsat satellite; nearly identical values interpreted as identical; those SW problems force spec changes (AviatWkSpT 29May/8Jun1992, S 17 3 duplic S 17 4)

* Shuttle computer problems, 1981-1985; 700 computer/avionics anomalies logged; landing gear problems in STS-6 and -13; multiple computer crashes in STS-9, cutting in backup system would have been fatal; thermocouple failure in STS-19 near disaster (S 14 2)

m Atlantis spacecraft computer problem fixed in space (S 14 5)

$f Untested for change, SW delays shuttle launch; 3-min on-line fix (S 15 3)

$(m/f?)V Shuttle Atlantis launch scrubbed: "faulty engine computer" (S 16 4)

$*V Columbia launch scrubbed at T-3sec 22Mar93, leaky valve (S 18 3:A14)

$*V STS-56 Discovery launch scrubbed at T-11sec 5Apr93, main propulsion system high-point bleed valve open-indicator went to off, closed-indicator did not switch to on. Indicator problem? program error? (S 18 3:A14)

h Discovery SRB recovered with missing pair of pliers (S 18 3:A14)

fm Channel blocked, Discovery exhausts storage for ozone data (S 18 3:A14)

H Experimental Space Shuttle e-mail address divulged, bombarded (S 16 4)

m Woodpeckers delay shuttle launch (S 20 5:8)

*m Docking problem aboard Soviet space station Mir (S 15 5)

m Mir Space Station computer problems add to difficulties; main computer failed during docking attempt, 19 Aug 1997 (R 19 31,32), with detailed analysis by Dennis Newkirk (R 19 33)

m Mir computer failure affects steering; replacement computer fails to load (end of May 1998, just before Discovery launch) (R 19 78)

*$d GAO reports on NASA Space Station: increased safety risks, costs (S 17 4)

* Risks of junk in space much greater than previously thought (S 17 4)

*f$ Potential software nightmare for International Space Station, with considerable discussion (R 19 49-51)

..... Satellites, Probes, Others:

$f Hubble Space Telescope problems, soaring costs, missed deadlines, reduced goals, etc. (S 15 2); sensors misdirected because of wrong sign on precession in star data; antenna # 2 limited by misplaced cable, #1 limited because software had only one limit stop, same for both (S 15 3) No system test. 1mm error in monitor program of mirror polisher (S 15 5) See M.M. Waldrop, Science 249, 17Aug1990, pp.735-736.

Vf/m Hubble Space Telescope antenna swing causes shutdown (S 17 1)

fh More Hubble SW: misloaded ephemeris table, bad macro (S 18 1:24)

$fhV $150M Intelsat 6 comm satellite failed; booster wiring error, payload in wrong bay; miscommun. between electricians and programmers (S 15 3)

$mV Canadian TeleSat Aniks die: solar coronal hole electron flux (S 19 2:3) Anik E-2 control restored, but with shorter life ($203M asset) (S 20 2:11)

fmV SOHO Mission Interruption Preliminary Status and Background Report documents apparently unconnected multiple failures that caused the satellite to lose control (R 19 87)

fhV Final report on the Solar and Heliospheric Observatory (SOHO) spacecraft failure: software flaw and improper command (R 19 90); mis-identification of a faulty gyroscope, staffing problems, inadequate training, ambitious schedule, unreviewed procedure changes, etc. (R 19 90, 94); contact finally reestablished. (S 24 1:31)

hm 5 printers off-line or jammed, Voyager 1 data lost over weekend (S 15 5)

f Voyager 2 software faults at launch, 20 Aug 1977 (S 14 6)

V$ Titan 34D, Nike Orion, Delta-178 failures follow Challenger (S 11 3)

V$* Titan 4 rocket test-stand SRB explosion; simulation missed failure mode (S 16 4)

V(m/f?) Final Titan 4A launch explodes with Vortex satellite; total cost over $1B, Aug 1998 (S 24 1:32, R 19 91)

mV Titan 4B leaves missile warning satellite in useless orbit (R 20 36)

Vm/f? Titan 4B with Milstar communications satellite separates four hours early, resulting in a useless low orbit, 30 Apr 1999 (S 24 4:26, R 19 36)

Vhm$ 6 successive Theater High-Altitude Area Defense (THAAD) failures, including three typos; then a "success" (R 20 43,45); Titan 4B failure (R 20 39) blamed on shifted decimal point in upper-stage software (R 20 45)

Vf,f Delta III launch ends after 71 seconds due to software flaw; two weeks later, Delta III leaves Loral Orion comm satellite in useless low orbit 4 May 1999 (R 20 38)

Vmfh Centaur/Milstar upper-stage failure due to attitude-control system software (R 20 49); roll-rate filter constant .1 factor (-0.1992476, not -1.992476) (R 20 57,59)

Vm$ Private imaging satellite Ikonos 1 disappears 8 minutes after launch (S 24 4:26, R 20 36); loss blamed on an electrical problem that prevented the aerodynamic payload cover from coming off. Subsequent Ikonos launched successfully (R 20 60):

f Terra spacecraft navigation software problems (S 25 3:18, R 20 78)

Vm/f? Russian rocket blows 12 Globalstar satellites (S 24 1:32, R 19 95)

h Boeing space station tanks accidentally taken to Huntsville dump (R 20 83)

Vh Space Station endangered by NASA flight controllers' blunder in maneuvering around space junk; predicted distance also way off (R 20 46-47)

SH Space Station Problem Reporting Database hacked (R 20 47-48)

V$ehf Canaveral Rocket lost; wrong key hit in loading guidance SW (S 16 4)

df NASA finds problems in EOSDIS Earth Observing System (EOS) spacecraft flight operations software development, expected to delay launch (R 19 67)

m+ Apollo 11 lunar module, pen used to replace circuit breaker (S 18 3:A14)

Vr* Lightning hits Apollo 12. "Major system upsets, minor damage". See article by Uman and Krider, Science 27 Oct 1989, pp. 457-464. (S 15 1)

V$m Lightning changed Atlas-Centaur program (51 sec). $160M lost (S 12 3, 15 1)

@V*$m Lightning hits launch pad, launches 3 missiles at Wallops Island (S 12 3)

V$f Mariner 1 Venus probe: HW fault plus programmer missed superscript bar in `R dot bar sub n'. See Paul Ceruzzi, Beyond the Limits - Flight Enters the Computer Age, Smithsonian, 1989, Appendix (S 14 5). (Earlier reports had suggested DO I=1.10 bug (see next item) or a garbled minus sign (or hyphen.) (S 8 5, 11 5, S 13 1)

$f Project Mercury had a FORTRAN syntax error such as DO I=1.10 (not 1,10). The comma/period interchange was detected in software used in earlier suborbital missions, and would have been more serious in subsequent orbital and moon flights. Noted by Fred Webb. (S 15 1)

*f Gemini V 100mi landing err, prog ignored orbital motion around sun (S 9 1)

V$f Atlas-Agena software missing hyphen; $18.5M rocket destroyed (S 10 5)

@VSH Lauffenberger convicted of logic bombing GD's Atlas rocket DB (S 17 1)

Vm Navy Atlas rocket places satellite in worthless orbit (S 18 3:A14)

V$f Aries with $1.5M payload lost: wrong resistor in guidance system; (S 11 5)

V*f TDRS relay satellite locked on wrong target (S 10 3)

Vm AT&T Telstar 401 satellite failure (S 22 4:26, R 18 76)

Vm Ariane 5 test problems: motor failures, nitrogen leak (S 20 5:9, R 18 27,28)

V$f New Ariane 5 failure (S 21 5:15); More on Ariane 5: conversion from 64-bit floating to 16-bit signed caused Operand Error (R 18 27-29,45,47); Note: Matra made software for Ariane5 and Taipei subway system (S 21 5:15); Incidentally, Robert L. Baber, Univ. Witwatersrand, Johannesburg, suggests you browse http://www.cs.wits.ac.za/ bob/ariane5.htm - showing how a simple correctness proof could have avoided this problem. (R 18 89-91)

*Mm Cosmic rays hit TDRS, Challenger comm halved for 14hrs [8Oct1984](S 10 1)

$Mr Sunspot activity: 1979 Skylab satellite dragged out of orbit (S 13 4)

hM 1989 pulsar discovery now attributed to TV camera interference (S 16 3)

V$hfe Soviet Phobos I Mars probe lost (Sep 1988): faulty SW update (S 13 4); cost to USSR 300M rubles (Aviation Week, 13 Feb 89); disorientation broke radio link, discharged solar batteries before reacquisition. [Science, 16Sep1988] More on Phobos 1 and 2 computer failures (S 14 6)

V$? Soviets lose contact with Phobos II Mars probe. Automatic reorientation of antenna back toward earth failed. (S 14 2)

V$f 1971 Soviet Mars orbiter failed after "unforgivable" SW bug; new info (S 16 3)

f Assessment of predictions on the Russian Mars Probe crash site (S 22 2:22)

V$fm 1993 Mars Observer lost entering Mars orbit (S 18 4:11; R 14 87,89; 15 01); loss blamed on fuel line leak (Washington Post, 10 Jan 1994)

f What really happened on Mars Rover Pathfinder? David Wilner on VxWorks system resets and preemptive priority scheduling, and Glenn Reeves - first-hand commentary must be read (R 19 49,50,53,54) and further discussion of priority inversion (R 19 50,53,54,56)

V$fm Mars Climate Orbiter lost, dipped too close to Mars due to English/Metric confusion; Mars Polar Lander reprogrammed to report back directly on 3 Dec 1999 (R 20 59-62); Mars Lander then lost entirely on landing attempt, search abandoned after a month. Crash finally blamed on software shutting engines off prematurely (R 20 84,86)

$f/h? NASA HESSI shake test 10 times too strong, damaging spacecraft (S 25 3:15, R 20 86)

$f Sea Launch rocket drops satellite into Pacific Ocean (S 25 3:15, R 20 84,86); single line of code allowed launch with second-stage valve open, causing helium leak (R 20 97)

Vfm$ Electronics startup transient opened telescope cover prematurely, destroying Wide Field Infrared Explorer (WIRE) spacecraft (R 20 47-48)

V$m $1.4B Galileo antenna jammed, en route to Jupiter (S 18 4:11)

V$m Landsat 6 vanishes; space junk tracked by mistake (S 19 1:10)

V$f Magellan space software problems: serious design flaw fixed (S 14 5) Nonatomic setting of scheduled and active flags interrupted. See H.S.F. Cooper, Jr., The Evening Star: Venus Observed, Farrar Straus Giroux, 1993. Discussion in J.M. Rushby, SRI-CSL-95-01.

$m Magellan spacecraft manual guidance overcomes faulty computer chip (S 15 2)

V*h Soyuz Spacecraft reentry failed, based on wrong descent program, (orbiting module had been jettisoned, precluding redocking) (S 13 4)

V$fe Viking had a misaligned antenna due to a faulty code patch (S 9 5)

*f Ozone hole over South Pole observed, rejected by SW for 8 years (S 11 5)

? Global-warming data confusion (R 19 91-92)

@Vfm Channel blocked, Discovery runs out of storage for ozone data (S 18 3:A14)

* Continuing trend toward expert systems in NASA (S 14 2)

f SW bug on TOPEX/Poseidon spacecraft "roll momentum wheel saturated" alarm aborted maneuver. It was recoverable, however. (S 18 1:24)

Defense

V!hhh U.S. F-15s take out U.S. Black Hawks over Iraq in Friendly Fire; 26 killed, attributed to coincidence of many human errors. (Other cases of friendly fire included 24% of those killed in the Gulf War.) (S 19 3:4) According to a seemingly reliable private correspondent who has read through at least 62 volumes of investigation reports, the public was seriously misled on this situation and there was a considerable cover-up. For now, contact me if you want further background.

!!$rhi Iran Air 655 Airbus shot down by USS Vincennes' missiles (290 dead); Human error plus confusing and incomplete Aegis interface (S 13 4); Commentary on Tom Wicker article on Vincennes and SDI (S 13 4); Aegis user interface changes recommended; altitude, IFF problems (S 14 1); Analysis implicates Aegis displays and crew (Aerospace America, Apr 1989); Discussion of further intrinsic limitations (Matt Jaffe, S 14 5, R 8 74); USS Sides Cmdr David Carlson questions attack on Iranian jet (S 14 6)

!!$rfe Iraqi Scud hit Dhahran barracks (28 dead, 98 wounded); not detected by Patriot defenses; clock drifted .36 sec. in 4-day continuous siege, due to SW flaw, preventing real-time tracking. Spec called for aircraft speeds, not mach 6, only 14-hour continuous performance, not 100. Patched SW arrived via air 1 day later (S 16 3; AWST 10Jun91 p.25-26); Shutdown and reboot might have averted Scud disaster (S 16 4) Patriot missiles misled by `accidental' decoys; T.A. Postol report (S 17 2); summary of clock drift, etc. GAO/IMTEC-92-26, February 1992 (S 17 2); reprisals against Postol for his whistleblowing (R 13 32, S 17 2); Army downgrades success to about 10% rather than 80% (R 13 37, S 17 2, 17 3) GAO report documents clock problem in detail (S 17 3) 24-bit and 48-bit representations of .1 used interchangeably (S 18 1:25)

*f Patriot system fails again (S 25 3:18, R 20 85)

*f Software snafu slowed critical data during Iraq raid (S 24 3:25, R 20 23)

!!V$h? Sheffield sunk during Falklands war, 20 killed. Call to London hindered antimissile defenses on same frequency? [AP 16May1986](R 2 53, S 11 3) An "official" version disputes this conclusion - see "The Royal Navy and the Falkland Islands" by David Brown, written at the request of the Royal Navy. Page 159 of that report discusses another problem with the Sea Wolf system, occurring several days later.

!V$ British Falklands helicopter downed by British missile. 4 dead (S 12 1)

!!V$f USS Liberty: 3 independent warning messages to withdraw were all lost; 34 killed, more wounded. Intelligence implications as well. (S 11 5)

!Vhfi? Stark unpreparedness against Iraqi Exocets blamed on officers, not technology, but technology was too dangerous to use automatically (S 12 3); Captain blamed deficient radar equipment; official report says radar detected missiles, misidentified them. (S 13 1)

Vrf$ USS Yorktown Aegis missile cruiser dead in water for 2.75 hours after unchecked divide by zero in application on Windows NT Smart Ship technology (S 24 1:31, R 19 88-94); letter to Scientific American: it was an explicit decision to "stimulate" [sic] machinery casualties? (S 24 4:26, R 20 37)

$hfe Navy software problems in upgrading software on battle cruisers USS Hue City and USS Vicksburg (S 23 5:25, R 19 86-87)

*Vf 5th Bell V22 Osprey crash: assembly error reversed polarity in gyro (S 16 4); Bell V-22 Osprey - correct sensor outvoted (S 17 1)

*H Fraudulent test SW in Phalanx anti-missile system, Standard missile (S 13 4)

Hhf West German flies Helsinki-Moscow through Soviet Air Defense (S 12 3)

Hhf Soviet Air Defense penetrated again by amateur pilot (S 15 5)

$h Russian missile-site power outage due to unpaid utility bill? (S 20 1:17)

**f Returning space junk detected as missiles. Daniel Ford, The Button, p.85

** WWMCCS false alarms triggered scrams 3-6 Jun 1980 (S 5 3, Ford pp 78-84)

** DSP East satellite sensors overloaded by Siberian gas-field fire (Daniel Ford p 62); Ford summarized (S 10 3)

**f BMEWS at Thule detected rising moon as incoming missiles [5Oct1960] (S 8 3). See E.C. Berkeley, The Computer Revolution, pp. 175-177, 1962.

** SAC/NORAD: 50 false alerts in 1979 (S 5 3), incl. a simulated attack whose outputs accidentally triggered a live scramble [9Nov1979] (S 5 3)

*** Serious false 2200-missile-alert incident 3 Jun 1980 described by Stansfield Turner, mentioning thousands of other false alarms (S 23 1:12, R 19 43)

*fmh Russian early-warning system close to retaliatory strike: Norwegian weather rocket mistaken for American Trident (R 19 85)

m Report from Kommersant Vlast on Serbukov-15 base false detection of ICBMs en route to Moscow on 25 Sep 1983; human intervention stopped retaliation; system allegedly misbehaved due to radiation (R 19 97)

*$VfM Libyan bomb raid accidental damage by "smart bomb" (S 11 3) F-111 downed by defense-jamming electromagnetic interference (S 14 2) More on U.S. radio self-interference in 1986 Libyan attack (S 15 3)

* Iraq using British Stonefish smart mines, with "sensitive" SW (S 15 5)

*SP Britain bugged radio equipment sold to Iraq (S 16 4)

*SP Trojan horse implants in DoD weapons (S 16 4)

*SP Trojan horse inserted in locally netted printer sold to Iraq? (S 17 2)

*Vm Arabian heat causing problems with US weapons computers (S 15 5)

*V$m Lightning hits launch pad, launches 3 missiles at Wallops Island (S 12 3)

* Frigate George Philip fired missile in opposite direction (S 8 5)

*h? Unarmed Soviet missile crashed in Finland. Wrong flight path? (S 10 2)

*Vf 1st Tomahawk cruise missile failure: program erased [8Dec1986] (S 11 2)

*Vm 2nd Tomahawk failure; bit dropped by HW triggered abort (S 11 5, 12 1)

f/m? CALCM cruise missile software bugs revisited (S 22 2:22)

hi Accidental launch of live Canadian Navy missile: color-code mixup (S 22 1:18)

*$rf Program, model flaws implicated in Trident 2 failures (S 14 6)

*VrmM RF interference caused Black Hawk helicopter hydraulic failure (S 13 1); More on Black Hawk EMP problems and claimed backwards pin (R 17 39,42)

*f Sgt York (DIVAD) radar/anti-aircraft gun - software problems (S 11 5)

$f Software flaw in submarine-launched ballistic missile system (S 10 5)

V$f AEGIS failures on 6 of 17 targets attributed to software (S 11 5)

Vf WWMCCS computers' comm reboot failed by blocked multiple logins (S 11 5)

$ WWMCCS modernization difficulties (S 15 1)

*$f Gulf War DSN 20-30% call completion persists 3 mos. until SW patch (S 17 4)

$f Armored Combat Earthmover 18,000 hr tests missed serious problems (S 11 5)

$rfi Stinger missile too heavy to carry, noxious to user (S 11 5)

**V$$Sr Strategic Defense Initiative - debate over feasibility (S 10 5); Pentagon says SDI complexity comparable to nuclear reactors (Newsweek, S 17 3) See Way Out There in the Blue: Reagan, Star Wars, and the End of the Cold War, Frances FitzGerald, Simon & Schuster, 2000 for a fine retrospective analysis.

$d SDI costs, budget issues, risks discussed (S 17 4)

$ StarWars satellite 2nd stage photo missed - unremoved lens cap (S 14 2)

f StarWars FireFly laser-radar accelerometer wired backwards (S 19 2:2)

$* 1.7M resistors recalled. Used in F-15, Patriot, radar, comm aircr. (S 16 3)

$hd DoD criticized for software development problems (S 13 1)

* US Navy radar jammers certified despite software errors, failed tests (S 17 3)

$ USAF software contractors score poorly on selections (S 14 1)

$d ADATS tank-based anti-copter missile system development problems, $5B overrun, unreliability, ... (S 16 1)

$d British air defense system ICCS SW causes ten-year delay (S 15 5)

*Sf US Army Maneuver Control System vulnerable to software sabotage (S 15 5)

$d US-supplied Saudi Peace Shield air defense software problems (S 15 5)

$d Serious software problems in UK Trident nuclear warhead control (S 15 5)

*m Russian nuclear warheads armed by computer malfunction (R 19 14)

*h Outdated codes made US missiles useless until annual inspection (S 14 5)

S Classified data in wrong systems at Rocky Flats nucl. weapons plant (S 16 4)

SPh Classified disks lost by Naval commanders on London train (R 17 54)

hi? Listing of US Navy safety problems in two-week period (S 15 1)

Vm Rain shuts down Army computers; lightning effects and prevention (S 15 1)

* Role of e-mail, Internet, FAX in defeating 1991 Soviet coup attempt (S 16 4); (S) power surges used to fry faxes and computers in countermeasure (S 16 4)

* Russian auto-response missile system still in place in Oct 1993 (S 19 1:10)

!! Analysis of U.S. peacetime submarine accidents http://freeweb.pdq.net/gstitz/Peace.htm

Military Aviation

!!V$f Handley Page Victor tailplane broke, crew lost. 3 independent test methods, 3 independent flaws, masking flutter problem (S 11 2-12, correction S 11 3)

!Vf Harrier ejection-seat parachute system accidentally deployed, blew through the canopy, but without ejecting the seat and pilot, who was killed (S 13 3)

f Harrier targets police radar gun; fortunately not armed! (S 21 4:14)

*V(h/m?) Japanese pilot accidentally ejected into the Pacific (S 19 4:12)

*V$h Sea Harrier 1 accidentally bombs its own carrier, Ark Royal (S 17 3) 5 injured. Auto aim-off SW blamed for the Ark Royal bombing (S 18 1:23)

*V$f SAAB JAS 39 Gripen crash caused by flight control software (S 14 2, 14 5)

*V$fmhi 2nd JAS 39 Gripen crash 8Aug1993 blamed on pilot/technology (S 18 4:11); interface difficulties, complicated analysis (S 19 1:12)

*V$rf Software problems in B-1B terrain-following radar, flight-control; electronic countermeasures (stealth) jam plane's own signals (S 12 2)

*V$h B-1B swept wing punctures gas tank on the ground; blamed on low lubricant; problem found in 70 of 80 B-1Bs inspected (S 14 2)! No computer sensors?

$fd Stealth development problems including SW miscalculation in wiring (S 15 1)

$f UHB demonstrator flight aborted by software error at 12,000 feet (S 12 3)

*V$fh F-22 prototype crash first blamed on computer SW, then on pilot (S 17 3)

*V$f F-18 crash due to missing exception cond. Pilot OK (S 6 2, more SEN 11 2)

*Vhi F-18 missile thrust while clamped, plane lost 20,000 feet (S 8 5)

*f F-16 simulation: plane flipped over whenever it crossed equator (S 5 2)

*f F-16 simulation: upside-down, deadlock over left vs. right roll (S 9 5)

$Vhi F-16 landing gear raised while plane on runway; bomb problems (S 11 5)

*Vfh Unstallable F-16 stalls; novice pilot found unprotected maneuver (S 14 2)

$d USAF ECM systems: software 2 years late for F-16 and F-111 (S 15 5)

*hif Accidental shootdown of one Japanese F-15 by another (R 17 65, R 18 18); controversy continues (R 18 41,57)

*V$f? F-14 off aircraft carrier into North Sea; due to software? (S 8 3)

*V$f F-14 lost to uncontrollable spin, traced to tactical software (S 9 5)

Vf YF-23 fly-by-wire prototype attempted tail corrections while taxiing. Same problem on first X-29. (AFTI/F-16 had weight-on-wheels switch.) (S 16 3) AFTI/F-16 DFCS redundancy management: ref to J.Rushby SRI-CSL-91-3 (S 16 3)

+- Historical review of X-15 and BOMARC reliability experiences (S 17 3)

$ Systems late, over budget (what's new?); C-17/B-1/STC/NORAD/ASJP (S 15 1)

V*$fd C-17 SW/HW problems documented in GAO report; 19 on-board computers, 80 microprocessors, six programming languages; complexity misassessed GAO: "The C-17 is a good example of how not to approach software development when procuring a major weapons system." (S 17 3) Chairman John F. McDonnell's reply (S 17 4)

f C-130 testbed uncovers 25-yr-old divide-by-zero bug in X-31 SW (S 16 3)

*Vmf X-31 crash, 19 Jan 1995 (R 17 45,46,47,60,62; 60=Pete Mellor)

*VM US missile-warning radar triggers accidental explosions in friendly aircraft; radar must be turned off when planes land! (S 14 2)

* AF PAVE PAWS radar can trigger ejection seats, fire extinguishers (S 15 1)

!$h 1988 RAF Tornados collided, killing 4; flying on same cassette! (S 15 3)

V$ef DarkStar unmanned aerial vehicle (UAV) crash from software change, cost $39M (S 22 1:17-18)

mM? Air Force bombs Georgia - stray electromagnetic interference? (S 14 5)

*hme, etc. Navigation, GPS, and risks of flying (R 19 73,75,77); Implications of the U.S. Navy no longer teaching celestial navigation (R 19 75,77-79,81-82)

Commercial Aviation

..... Commercial flight incidents

!!$V(hi?) Korean Airlines KAL 007 shot down killing 269 [1Sept1983]; autopilot on HDG 246 rather than INERTIAL NAV? (NYReview 25 Apr 85; SEN 9 1, 10 3, 12 1) or espionage mission? (R.W. Johnson, "Shootdown") Further information from Soviets, residual questions (S 16 3); Zuyev reports Arctic gales had knocked out key Soviet radars; Oberg believed Sakhalin air defense forces were "trigger-happy" following earlier US Navy aircraft overflight incursions [Reuters 2Jan1993]; Analysis of recent articles on KAL 007 (Ladkin, R 18 44)

!!Vfe Korean Airlines KAL 901 accident in Guam, killing 225 of 254; worldwide bug discovered in barometric altimetry in Ground Proximity Warning System (GPWS) (S 23 1:11, R 19 37-38)

*fhi Analysis of potential risks of the Enhanced Ground Proximity Warning System (EGPWS), by Jim Wolper (R 19 56); pilots computer literacy? (R 19 57); relationship with GPS accuracy (R 19 57)

* Missile passes American Airlines Flight 1170 over Wallops Island (S 22 1:18)

!!V(m?h?) TWA Flight 800 missile-test accident hypothesis causing near-empty fuel-tank explosion off Long Island widely circulated in Internet e-mail, causing considerable flap. Missile theory officially discredited. Minireview of James Sander's The Downing of TWA Flight 800 (R 19 12); speculative discussion on the downing of TWA 800 (R 19 13); possibility of EMI raised in article by Elaine Scarry, New York Review of Books, 9 Apr 1998 (R 19 64-66). Harvard Magazine Jul-Aug 1998, pp. 11-12, diagram shows TWA 800 at 13,700 feet between a P3 Orion directly overhead at 20,000 feet, Black Hawk helicopter and HC-130 at 3,000 feet both directly below (with a C-141 and C-10 nearby). But this seems unlikely. (R 19 86) Report from Commander William S. Donaldson III, USN Ret., 17 July 1998, claiming a hostile missile attack http://www.aci.net/kalliste/donaldson.htm.

!!V$rh Air New Zealand crashed into Mt Erebus, killing 257 [28Nov1979]; computer course data error detected but pilots not informed (S 6 3, 6 5)

!!V$f/m? Lauda Air 767-300ER broke up over Thailand. 223 dead. Cockpit voice recorder: thrust reverser deployed in mid-air. Precedents on 747/767 controlled; investigation in progress. (S 16 3, AWST 10Jun91 pp.28-30) Suitcase full of cheap lithium-battery Chinese watches exploded? Earlier lithium battery problems: South African 747 in 1987, killed 159; Cathay Pacific 1990 emergency landing (S 16 3, Sunday Times, London, 23 Jun 91) Many other planes may be flying with the same thrust-reverser defect; FAA, Boeing simulations, suggest 757 less aerostable than though (S 16 4) Ex-Boeing expert had warned of software flaw in 747/767 proximity switch electronics unit; he claims he was ordered to suppress data. (S 17 1)

!!Vhifmr Northwest Air flight 255 computer failed to warn crew of unset flaps misset, thrust indicator wrong; 156 dead (S 12 4); circuit breaker downed the warning system that should have detected those problems. [But who checks the checker?] Simulator, plane behave differently (S 13 1) Report blames pilot error, unattributed circuit outage (S 13 3) Report that the same pilots had intentionally disconnected the alarm on another MD-80 two days before raises suspicions. (S 14 5, R-08.65) NW sues CAE over spec error in flight training simulator (S 15 5) A Federal jury ruled on 8 May 91 that the crew was to blame.

!!V$mf/h/i? British Midland 737 crash, 47 killed, 74 seriously injured; right engine erroneously shut off in response to smoke, vibration (Flight International 1 Apr 89); suspected crosswiring detected in many OTHER planes (S 14 2); low-probability, high-consequence accidents (S 14 5); random memory initialization in flight management computers (S 14 5); Kegworth M1 air crash inquest: many improvements suggested (S 15 3); Criticism of "glass cockpits" (S 15 3); UK AAIB fingers 737-400 liquid crystal display layouts (S 16 3); now-retired British vicar Reverend Leslie Robinson claims a witches' coven was operating under the flight path (R 20 12)

!!Vh Aeromexico flight to LAX crashes with private plane, 82 killed (S 11 5)

!!Vh Metroliner&transponderless small plane collide 15 Jan 87. 10 die (S 12 2)

!!Vh Two planes collide 19 Jan 87. Altitude data not watched by ATC. (S 12 2)

!!Vfih 1994 China Air A300-600 Nagoya accident killing 264: final report blames pilots and autopilot human-computer interface (R 18 33); (see also R 16 05-07, 09, 13-16)

!Vh Air France Airbus A320 crash blamed on pilot error, safety controls off (S 13 4); 3 killed. Airbus computer system development criticized (S 13 4); Subsequent doubts on computers reported: inaccurate altimeter readings; engines unexpectedly throttling up on final approach; sudden power loss prior to landing; steering problems while taxiing (S 14 2); reportage by Jim Beatson (R 08 49, 08 77), barometric pressure backset? (S 14 5) investigators blame pilot error; pilots charge recorder tampering (S 15 3) Pilots convicted for libel in blaming technical malfunctions! (S 16 3)

!!V? Indian Airlines Airbus A320 crashes 1000 ft short of runway; 97 die (S 15 2) A320 flight modes (S 15 3); apparent similarities in crashes (S 15 3) Air India unloading their A320s (S 15 5)

V(m?) Air India Airbus 320 autopilot failure [19Apr1999]? (S 24 4:26, R 20 32)

!!Vhmi French Air Inter A320 crash on approach to Strassbourg airport [20Jan1992]; 87 dead, 9 survivors; 2,000-foot altitude drop reported (R 13 05); crash site at 2496 feet. Report fingers mixture of human and technical error, airport ill equipped, serious failings in altimeter system, pilot unable to stop descent (S 17 2); Air Inter official charged with negligent homicide (S 18 2:9); Commission of Enquiry blamed Pilot Error (S 18 4:12); New case of A320 descent-rate instability identified approaching Orly, related to Air Inter crash (S 18 1:23); Final report blames crew training and interface problems (S 19 2:11)

!Vf 1994 Toulouse A330 accident blamed on experimental SW. 7 died (S 19 4:11)

* A320 flight-control computer anomalies summarized by Peter Ladkin (R 18 78)

!*(V,etc.) Compendium of commercial fly-by-wire problems (Peter Ladkin) (S 21 2:22)

@!!$hi Iran Air 655 Airbus shot down by USS Vincennes' Aegis system (above)

?h Qantas airliner challenged by US Cowpens, Aegis missile cruiser (S 17 4)

!V(f/h/i?) Varig 737 crash (12 dead) flightpath miskeyed? (S 15 1)

!V 707 over Elkton MD hit by lightning in 1963, everyone killed (S 15 1)

!V$m AA DC-10 stall indicator failed; power was from missing engine (S 11 5)

!V Bird strikes cause crash of Ethiopian Airlines 737, killing 31 (S 14 2)

!V Dominican Republic 757 crash 6 Feb 1996, cause unclear (S 21 4:13, R 17 84)

!V BirgenAir crash at Puerto Plata killed 189 (R 17 87)

!!V$hi Further discussion of American Airlines Cali and Puerto Plata B757 crashes (R 18 10); in Cali crash, killing 159 of 163: same abbreviated code used for different airports (S 22 1:17); in a trial, evidence was given that 95 of 8,000 navigational beacons were not included in the airline database, including Cali's Rozo (R) - see media reports 17 Apr 2000. US Federal jury allocated responsibility 17% to Jeppessen, 8% to Honeywell, 75% to American Airlines (R 20 92; S 26 1:)

!fi EFIS failure main suspect in Crossair crash (S 25 3:17-18, R 20 78)

!Vh 1996 B757 Aeroperu Flight 603: duct tape over left-side static port sensors? (S 22 2:22; R 18 51,57,59) Peru Transport Ministry verified this [Reuter, 18Jan1997]

Vm Migratory birds jam FAA radar in Midwest (R 17 44)

m Lovesick cod overload Norwegian submarine sonar equipment (R 20 07) [Who needs a cod peace?]

!!V Chinese Northwest Airlines BA-146 Whisperjet crashed on second takeoff attempt, killing 59; cause not available [23Jul1993] (S 18 4:12)

!V Ilyushin Il-114 crash due to digital engine control failure (S 19 1:9)

*V mi Dec 1991 SAS MD-81 crash (ice damaged engine) due to auto thrust restoration mechanism not previously known to exist by SAS (S 19 1:12)

*Vf 11 cases of MD-11s with flap/slat extension problem, including China Eastern Airline plane that lost 5000 feet on 6 Apr 1993 (S 18 4:11)

Vhf? Chinook helicopter engine software implicated (S 23 3:23, R 19 51)

*Vrh Lessons of ValueJet 592 crash: William Langewiesche in Atlantic Monthly (R 19 62,63)

*Vf DC-9 chip failure mode detected in simulation (S 13 1)

!!V$f Electra failures due to simulation omission (S 11 5)

!V$f Computer readout for navigation wrong, pilot killed (S 11 2)

*Vhi South Pacific Airlines, 200 aboard, 500 mi off course near USSR [6Oct1984]

*Vhi China Air Flight 006 747SP 2/86 pilot vs autopilot at 41,000 ft with failed engine, other engines stalled, plane lost 32,000 feet [19Feb1985] (S 10 2, 12 1)

*V Simultaneous 3-engine failure reported by Captain of DC-8/73 (S 14 2)

*Vfm Boeing KC-135 autopilot malfunction causes two engines to break off (S 16 2)

*Vf Avionics failed, design used digitized copier-distorted curves (S 10 5)

*Vf Lufthansa A320 overruns runway in Warsaw; actuator delay blamed (S 19 1:11); Logic flaw in braking system; fix required fooling the logic! (S 19 2:11)

mV A320 engine-starter unit overheats after takeoff, trips breakers, gave false thrust-reverser indications, engine control failure (S 19 2:12)

*V$f 727 (UA 616) nose-gear indicator false positive forces landing (S 12 1)

*Vhi USAir 737-400 crash at NY LGA; computer interface, pilot blamed (S 15 1)

!Vi Crash of USAir Flight 427 nearing Pittsburgh, 8 Sep 1994: see Jonathan Harr, (The New Yorker, 5 Aug 1996 (S 22 1:17)

*V Tarom Airbus automatic mode switch escaped pilot's notice (S 20 1:16)

*Vf British Airways 747-400 throttles closed, several times; fixed? (S 15 3)

*Vf JAL 747-400 fuel distribution stressed wings beyond op limits (S 16 3)

*Vf Older Boeing 747 planes suspected of diving due to autopilot design flaw; 747-400 speed reduction of 50 knots ordered; 747-200 sudden increase in thrust, another pitched upwards; etc. (S 17 3); FAA report on possible 747 autopilot faults relating to altitude losses (S 18 3:A15)

Vf 747 tail scrapes runway; center of gravity miscalculated by improper program upgrade (R 19 11)

*Vf Boeing 757/767 Collins autopilot anomalies discussed (S 19 1:10)

**V 767 (UA 310 to Denver) four minutes without engines [August 1983] (S 8 5)

*Vf 767 failure LA to NY forced to alternate SF instead of back to LA (S 9 2)

*Vm Martinair B767 Aircraft suffers EFIS failure; instruments blank (S 21 5:15)

*V(f/m?) B777 autopilot/flight-director problems [Oct1996]? (S 22 4:29, R 18 83)

V$ Boeing 777 landing-gear weakness; strength off by factor of 2 (R 17 04)

*Vf 11 instrument software failures in BA aircraft in Jul-Aug 1989 (S 15 5)

m Fire alarms on Boeing 777 triggered by tropical fruit and frog cargo (S 22 1:17)

*m INCETE power ports in use in at least 1700 aircraft can result in exploding batteries? (R 19 94)

m* High-flying hijinks: canine passenger sinks teeth into plane (R 20 54)

..... Private plane incidents

!Vrhi John Denver plane crash linked to unlabelled implementation change over spec: lever up for off, down for right tank, to the right for left tank; not very intuitive! (R 20 43)

..... Airport problems

m Power failure disrupts Ronald Reagan National Airport 10 Apr 2000 for almost 8 hours; backup generator failed (R 20 87)

$fd $200M Denver airport baggage system seriously delays opening (S 19 3:5); costly stopgap old-fashioned system planned in the "interim" (S 19 4:6); new software problems for incoming baggage (R 17 61); city overruled consultant's negative simulation results (R 18 66)

Vdfm$ Kuala Lumpur International Airport: Risks of being a development pioneer (R 19 68); airport opens 30 Jun 1998, but baggage and check-in systems failed for several days (R 19 84); similar events at the opening of the new Hong Kong airport a few days later (R 19 85)

Vm Amsterdam Schiphol airport computer down for 30 minutes, major delays (R 19 85); unchecked out-of-range value (R 19 93)

V$fe American Airlines' SABRE system down 12 hours; new disk-drive SW launched "core-walker" downing 1080 old disk drives, stripped file names ... (S 14 5)

Vm American Airlines' Sabre system software problem down for four hours (30 Jun 1998, evening rush hour) affected hundreds of flights across 50 airlines; second crash in a week (R 19 84)

f/m SAS new baggage system miseries at Copenhagen Airport (R 19 97)

h SAS reprinted summer airline timetables for the winter, but Internet version was correct (R 20 05)

mh Boston airport electronic display fiasco on flight to Philly (R 19 96)

..... Masquerading

*VSH Miami air-traffic controller masquerader altered courses (S 12 1)

*VSH Roanoake Phantom spoofed ATC, gave bogus information to pilots for 6 wks, caught (S 19 2:5); out-of-work janitor pleads guilty (R 15 39)

VSH Manchester (UK) air-traffic-controller message spoofer (UK) (S 21 2:21)

..... Other air-traffic control problems

*h 20-foot aircraft separation near-collision over LaGuardia Airport, 3 Apr 1998, due to controller being distracted by spilled coffee (R 19 79,84) together with increased error rates and radar dropouts results in FAA ordering retraining of air-traffic controllers (R 19 79)

fe Westbury Long Island TRACON upgrade failed test, but backup to old software backfired (R 19 79)

*Vfm Radar blip lost Air Force One (S 23 4:21, R 19 63)

Vm* Air Force One disappeared from the Gibbsboro NJ radar twice on 5 Jun 1998, with President Clinton en route to MIT for the commencement speech; also reported was near-collision with a Swissair 747, missed by radar, Oct 1997 (R 19 79); Air Force Two disappeared from radar, 7 Jun 1998, and the same radar failed with AF2 overhead 17 Jun 1998 (R 19 82)

*h Delta plane 60 miles off course, missed Continental by 30 feet (S 12 4)

Vf SW fault in aircraft nondirectional beacon landing approach system (S 16 3)

V* New San Jose CA ATC system still buggy, plane tags disappear (S 14 2)

*Vf ATC computers cause phantom airplane images (S 16 3)

Vf West Drayton ATC system bug found in 2-yr-old COBOL code (S 16 3)

*Vh Open cockpit mike, defective transponder caused 2 near-collisions (S 12 1)

*Veh ATC equipment test leads to Sydney landing near-collision (R 20 24)

*Vmf More ATC problems, fall 1998: New air-traffic control radar systems fail, losing aircraft at O'Hare (R 20 07); Dallas-FortWorth ARTS 6.05 TRACON gives ghost planes, loses planes (one for 10 miles), one plane on screen at 10,000 feet handed off and showing up at 3,900 feet! 200 controller complaints ignored, system finally backed off to 6.04 (R 20 07); near-collision off Long Island attributed to failure at Nashua NH control center (R 20 11); TCAS system failures for near-collision over Albany NY (R 20 11); two more TCAS-related incidents reported (R 20 12); landing-takeoff near-miss on runway at LaGuardia in NY (R 20 13); discussion on trustworthiness of TCAS by Andres Zellweger, former FAA Advanced Automation head (R 20 13)

V(f/m?) Faulty TCAS behavior. Australian report shows two faulty TCAS cases: Jan 1998 near Hawaii, TCAS off by 1500 feet vertically, caused false maneuvers; Jun 1999 over China, TCAS had higher plane descending toward the lower (R 20 60,62);

*Vfm Complete ATC power failure in the U.S. Northwest, 15 Jan 1999, discussion by Seattle controller, Paul Cox (R 20 19)

*Vmh Dulles radar fails for half-hour 23 Nov 1998 (R 20 10); discussion of air-traffic control safety implications (R 20 11), and ensuing comments from a controller (R 20 12)

*Vh Risks of runway crossings with tight takeoff/landing schedules (R 20 10)

f Airline clock wraparound in displays: UA Flight 63 from SFO "Delayed 1 hr 39 min, Arrive Honolulu Intl 12:01am Tues Early 22 hr 35 min" (R 20 15); More United Airlines Website flight curiosities (R 20 44)

h Couple join Mile-High Club, disrupt British air-traffic control (S 19 1:10)

h Accidentally enabled sex-aid vibrator in hand luggage causes bomb scare on Monarch Air flight; apparently not unusual (R 20 34)

*Vm Air-traffic control data cable loss caused close calls (S 10 5)

V$SHm Attack on fibre-optic cables causes Lufthansa delays (S 20 2:12)

VmM Display lasers affect aircraft: pilots blinded over Las Vegas (R 17 55)

*d Reports on new En Route Centre NERC for UK ATC (R 19 18,23,69)

*Vfm Review on air-traffic control outages by Peter Ladkin (S 23 3:26, R 19 59)

*VM More on EMI and RF interference from passenger devices in aircraft systems (Ladkin) (R 19 24); still more, including discussion of Elaine Scarry article in 26 Sep 2000 The New York Review of Books (R 21 04,08)

VSfM Case of GPS jamming of Continental flight by failed Air Force computer-based test (R 19 71) more on GPS jamming/spoofing: British Airways flight lost all three GPS systems while French military was testing jammers; Continental DC-10 lost all GPS signals while Rome Lab was experimenting with jammers (R 19 74,85)

Vf/h? GPS kills 8 in air (R 20 44-45) and radar-assisted collisions (R 20 45)

@*VM Cell-phone linked to London to Istanbul crash-landing? (R 19 34,36,37)VM Australia's Melbourne Airport RF interference affected communications, traced to an emanating VCR! (R 17 44)

*VM Osaka Int'l Airport's radar screens jammed by TV aerial booster (S 12 3)

*M Cellular telephone activates airliner fire alarm (S 14 6)

Vfmhi? Aviation Risks using Windows NT avionics systems (S 23 3:27, R 19 46)

*Vfi Flawed ATC radars: planes disappear from screens; other problems (S 12 1)

hi Controller screwup causes NW 52 to Frankfurt to land in Brussels (R 17 38,40)

*Vdef Risks in the new Sydney airport control system (R 17 43)

*m Computer outage in Concorde leads to rocky nonautomatic landing (S 12 4)

*Ve British ATC 2-hr outage, 6-hr delays: faulty HW/SW upgrade (S 12 1) Computer problems down FL ATC, slow airline flights in Southern U.S. (S 19 1:11)

*Vfmd Air-traffic-control snafus in Chicago, Oakland, Miami, Washington DC, Dallas-FortWorth, Cleveland, New York, western states, Pittsburgh! (S 20 5:12); Another Oakland airport radar outage 28 Nov 1995, two hours (R 17 49)

V*fm Philadelphia airport radar problems, May 1999 (R 20 42) More radar glitches at Philadelphia airport 10 Mar 2000 (S 25 3:18, R 20 84)

Vhm Brief KC power outage triggers national air-traffic snarl (S 23 3:23, R 19 51)

!Vm New York air traffic slowed for 10 hrs by construction contamination (R 19 41)

*f Fall 1998 air-traffic control upgrade problems: New Hampshire (R 19 93), Salt Lake ATC (R 20 05); Dallas-FortWorth ARTS 6.05 (S 24 1:31, R 20 07), Chicago (R 20 07)

Vm Effects on automated traffic controls of plane crashing into 500Kv power line near Cajon Pass; more than 1000 traffic lights out (R 19 29,30); earlier effects of power failure in Perth (R 19 30); risks of major outages (R 19 32,33)

*Vhe Southern Cal plane crash due to software change? (S 12 1)

*Vmf Alaskan barometric pressure downs altimeters; FAA grounds planes (S 14 2)

*Vfm FAA Air Traffic Control: many computer system outages (e.g., SEN 5 3, 11 5), near-misses not reported (S 10 3)

*Vf ATC computer system blamed for various near-misses, delays, etc. (S 12 4)

*Vhi Air-traffic controller errors. O'hare near-miss: wrong plane code (S 12 3)

V(f/m/h?) 2 jets in near-miss approaching LAX; Brazilian VASP MD-11 pilot blames autopilot, others blame pilot (R 19 10)

*Vh F-16 incidents, TCAS: 4 separate risky military approaches (S 22 4:28, R 18 83)

*V$fm FAA report lists 114 major telecom outages in 12 months 1990-91; Secretary Pena blames air-traffic woes on computer systems (S 19 4:11) 20 ATCs downed by fiber cable cut by farmer burying cow [4May1991] (S 17 1); Kansas City ATC downed by beaver-chewed cable [1990] (S 17 1); Other outages due to lightning strikes, misplaced backhoe buckets, blown fuses, computer problems (S 17 1) 3hr outage, airport delays: Boston unmarked components switched (S 17 1) More on the AT&T outage of 17Sep91 noted below (5M calls blocked, air travel crippled, 1,174 flights cancelled/delayed) (S 17 1)

fh WashingtonDC air traffic slowed 11 Jun 1997: old wiring error (S 22 5:13)

V$fe SW bug downs Fremont CA Air Traffic Control Center for 2 hours [8Apr1992]; 12 of 50 radio frequencies died [17Apr1992], reason unspecified (S 17 3)

V$d New Canadian air-traffic control system SW problems, system late, it crashes, planes flying backwards, frozen displays, no radar,... (S 17 4)

*Vm NY Air Route Traffic Control Center computer failure (S 21 5:15)

*Vef Computer glitches foul up flights at Chicago airports (S 24 4:26,R 20 38)

@See below, general telephone problems that affected traffic control.

*$ Discussion of the implications, needs for oversight, assurance (S 17 1)

*V$m FAA ATC computers in Houston down for 3 hours; long delays (S 12 2)*

*V$rm El Toro ATC computer HW fails 104 times in a day. No backup. (S 14 6)

Vhfm Accidental power outage affects Pacific Northwest air traffic (S 21 2:21)

Vm Dallas-FortWorth ATC system power outage affects southwest (R 17 40)

Vm Las Vegas approach radar outage (R 17 41)

*V$m London ATC lost main, standby power, radar; capacitor blamed! (S 12 2)

*f London ATC goof - US ATC program ignores East longitude (S 13 4)

*f Software misdirects air-traffic controller data in Boston (S 13 4)

@d New £300 million UK air-traffic control system confronts complexity (S 22 1:18)

*Vh Commercial plane near-collisions up 37.6% in 1986; 49 critical (S 12 2)

*H Radar center controllers (So.Cal) concealed collision course info (S 12 2)

*V Jetliners in near-miss over Cleveland; wrong freq assigned, neither plane in contact with controllers (S 16 4)

*Vid Complexity of the airplane pilot's interface increasing (R 18 63)

*V Computer errors involved in plane crashes? (Aftonbladet) (R 18 65,66)

* Problems with below-sea-level aircraft altitudes (R 18 72,74)

h Plane takes off, flies for two hours, without pilot (R 19 47)

*Vf `TCAS Sees Ghosts' (see IEEE SPECTRUM, August 1991, p.58) (S 16 4); Traffic Alert Collision Avoidance System blasted by ATC people (S 17 1); See also relevant discussion on human errors by Don Norman (S 17 1:22)

Vih? TCAS related collision-avoidance mistake discussed (S 18 1:24)

*f Air-traffic controller reports on potential TCAS problem (S 18 3:A15)

Vf TCAS blamed for near collision over Portland WA; previous reports of phantom planes and misdirected avoidance maneuvers (S 19 2:12); Followup report (S 19 3:9)

*f?/+ TCAS incidents: northwestern U.S., Tehran (S 20 5:13)

? Discussion of TCAS near-miss in Southern Calif. (R 19 55,56)

*Vf Chicago's O'Hare Airport radar lost planes, created ghosts (S 17 1)

*h GAO faults FAA for inadequate system planning in Los Angeles area (S 15 5)

$ FAA drops navigation system contract (S 21 5:16)

*Vhi Four 1986 British near misses described - all human errors (S 12 2)

*Vf/m? Leesburg VA Air Traffic primary, backup systems badly degraded (S 15 1)

*Ve? DFW ATC 12-hour outage after routine maintenance (S 15 1)

*V$ Computer outages force delays in So. Cal, Atlanta (S 12 2)

* Macaque reaches 747 cockpit controls; monkey loose on Cosmos 1887 (S 12 4)

$ Travicom computerized air cargo system withdrawn; £5M lost (S 12 2)

$H Computer hides discount airline seats from agents; lost sales (S 12 2)

$f Pricing program loses American Airlines $50M in ticket sales (S 13 4)

f,h,i Ordering airline tickets on-line: Nonatomic transaction gave tickets but no reservation (R 19 27); name confusions on e-tickets, with similar names (R 19 28) and identical names (R 19 29)

$d American Airlines reservation system SW woes adding cars, hotels (S 17 4)

V$m Power outage causes Australian airline reservation system "virus" (S 13 3)

f Delayed DoT airline complaint report blamed on computer (S 12 3)

$ First-day snafu at new Pittsburgh Airport; BA luggage uncoded (S 18 1:25)

Vm Hong Kong Flying Service computers corroded by hydrogen sulphide (R 19 41)

$f*h British Air 10M-pound inventory system loses parts, earnings, convictions, user confidence, nearly causes deaths, and costs legal expenses (S 18 1:9)

Rail, Bus, and Other Public Transit

!Vh 42 die in Japanese train crash under manual standby operation (S 16 3)

!$Vm Loose wire caused Britrail Clapham train crash, 35 killed (S 14 6)

!!$Vhi Canadian trains collide despite "safe" computer; 26 killed (S 11 2)

*Vmh Rail Canada train derailed 3 Sep 1997; early warning alarm ignored by untrained crew, who disconnected it (R 19 94-95,97)

!Vh Southern Pacific Cajon crash kills 3; tonnage computations wrong (S 14 6)

!Vm Cannon St train crash in London, 1 dead, 348 injured, brakes failed (S 16 2)

!Vm Kings Cross passenger trapped in automatic door, killed; no alarm (S 16 2)

!V*h London commuter train crash out of Euston Station, 8 Aug 1996 (S 22 1:18)

V!*h Ladbroke British train collision, Oct 1999; driver ran red Signal 109 (R 20 59-60, 62-63)

*V(r?f?) London underground train went 4 stops with fail-safe doors open (S 16 2)

*Vrf London Docklands Light Railway crash; protection system incomplete (S 12 4)

*Vh DLR unmanned trains crash under standby manual control (S 16 3)

e DLR train stopped at station not yet built to avoid changing SW (S 16 3)

*hf London Underground wrong-way train in rush-hour (S 15 3)

*fh London Underground train leaves ... without its driver (S 15 3)

*fh Another London Underground driver leaves train, which takes off (S 19 2:2)

@SH London Underground hacked by insider posting nasty messages (R 17 36)

*h 1928 British rail interlocking frame problem revisited (S 15 2)

*f British Rail signalling software problems, trains disappear (S 15 5)

*Vm Leaves on track cause British Rail signal failure (S 17 1)

*Vf Removal of train's dead-man's switch leads to new crash cause (S 17 1)

*f/h? Severn Tunnel rail crash (100 injured) under backup controls (S 17 1)

V*fm Intercom hang-up caused 1997 Toronto train collision, 19 Nov 1997; 50 hospitalized; "dwarf signals" (R 20 49)

!Veihh Head-on train collision in Berlin killed 3, injured 20; track controls mistakenly set to one-way traffic, overseer overrode halt signal (S 18 3:A3)

!Vm German high-speed train disaster Jun 1998 and implications; automated system with inadequate sensors and overrides (R 19 80,81,83,89)

Vfm Berlin new automated train switching system (Siemens Generation C) fails from the outset of its use (R 19 77)

f Berlin S-Bahn stopped by switching SW stack overflow (S 22 2:19)

*feh NY City subway crash due to operator, outdated parameters (S 20 5:8)

*m Runaway train on Capitol Hill (S 24 3:26, R 20 13)

m Computer crash freezes train traffic in 8 US states (S 20 3:8)

$Vdef Stack overflow shuts down new Altona switch tower on first day (S 20 3:8)

m Paper-clip causes hard-drive overflow, triggering traffic-control computer failure stopping trains in south Finland for an hour (R 19 10)

* Train Accident in China due to safety systems known not to work (S 17 1)

*m Control faults cause Osaka train to crash, injuring 178 (S 19 1:4)

f/m? Computer glitch causes severe train delays in Melbourne (R 20 48)

Vm Electrocuted snake cancels 34 trains in northern Japan (R 19 88)

*hi Amtrak mainline train collision in Maryland, Feb 1996 (S 21 4:13)

Vf/m? Amtrak ticket system breaks down (S 22 2:19)

Vrm Hurricane Floyd had widespread effects, Amtrak operations center problems in Jacksonville affected trains in Eastern Seaboard, Chicago, Michigan; also DC commuter rail (R 20 58); ISDN lines, ATMs, EDS (R 20 62); nationwide AT&T cellphone service interruptions (R 20 59);

Vm/f Emergency Alert System interrupts hurricane announcement, and crashes for 20 minutes (R 20 58)

f/m Train-ticket vending machine bogus tickets; innocent victim harassed (R 19 20)

Vm Swedish central train-ticket sales/reservation system and its backup both fail (R 20 05)

!i Washington D.C. Metro crash kills operator (S 21 4:13)

Vmf Washington D.C. Metro Blue Line delay 6 Jun 1997; system+backup failed (R 19 22)

Vmfe Computer crash impacts Washington DC Metro (S 23 3:25, R 19 50)

Vf/m? Computer problems foul up the Washington D.C. Metro system; graphics system froze (R 20 60)

*h Atlanta MARTA commuter train jumps track, injuring 19 (S 21 5:14)

*f LIRR trains fail to trigger computerized crossing gates (S 22 1:18)

m Lightning knocks down wall of an English pub, and closes fail-safe railroad crossing that blocked fire engines (R 19 72)

Vfm Computer crash shuts down Taipei subway (S 21 5:14) Note: Matra made software for both Ariane5 and Taipei subway system (S 21 5:15)

V$mf Swiss locomotives break down in cold weather; SW fails (S 20 2:11)

*f Flaw discovered in Swedish rail control system after near miss (R 19 22)

fh Union Pacific merger aftermath: gridlock, lost trains (S 23 1:11, R 19 41)

* Japanese railway communications jammed by video game machines (S 12 3)

* Japanese train doors opened inadvertently several times; EMI? (S 12 3)

*f SF BART train doors opened between stations during SF-Oakland leg (S 8 5)

f SF BART automatic control disastrous days of computer outages (S 6 1)

*V$m BART power mysteriously fails and restores itself 5 hours later (S 12 3) battery charger short and faulty switch subsequently identified (S 12 4)

m BART ghost train, software crash, 3 trains fail, system delays (S 22 2:19)

f BART ghost trains; 567 cases in two years (R 20 31-32)

f SF Muni Metro: Ghost Train recurs, forcing manual operation (S 8 3)

f SF Muni Metro: Ghost Train reappears; BART problems same day (S 12 1)

mM San Francisco Muni adds new communicating streetcars, has to remove old ones blocking comms to increase service (R 19 95); Muni driver leaves car, which went on driverless! (R 19 95)

*fm Chunnel has ghost trains, emergency stops (due to salt water?) (S 20 3:9)

Vf Phantom trains down Miami's Metromover inner loop for 2 days (S 20 5:8)

$*H SF Muni Metro crash; operator disconnected safety controls (S 18 3:A3)

$d Washington D.C. Metro stops payments on troubled computer (S 23 4:21)

h LA Rapid Transit District computer loses bus in repair yard (S 12 2)

$f LA RTD phantom warehouse in database "stores" lost parts (S 12 2)

fhi Analysis of the Chicago train/bus crash (R 17 43)

$*f Puget Sound ferry computer failures - 12 crashes; settlement vs builder $7 million; cost of extra $3 million for manual controls! (S 12 2); Electronic "sail-by-wire" replaced with pneumatic controls (S 14 2,15 2)

*Vm Water seepage stops Sydney automated monorail computer controls (S 13 4)

Vfh Daylight savings time changeover halts train for an hour (S 15 3)

m Risks of the modern train: lots of inconveniences (R 20 54)

Automobiles

!hi Driver kills cyclist while trying to save Tamagotchi virtual pet on her key ring (R 19 67)

!$h Wilson (draw)Bridge warnings not set, truck plows into car (S 17 1); See relevant discussion on human errors by Don Norman (S 17 1-22)

!$f? Mercedes 500SE with graceful-stop no-skid brake computer left 368-foot skid marks; passenger killed (S 11 2)

!$f? Audi 5000 accelerates during shifting. 2 deaths. Microprocessor? (S 12 1)

*$f? Microprocessors in 1.4M Fords, 100K Audis, 350K Nissans, 400K Alliances/ Encores, 140K Cressidas under investigation (S 11 2)

fmM More on risks of microprocessors in cars (S 16 2)

*SM Sudden auto acceleration due to interference from CB transmitter (S 11 1);

*M Sudden acceleration of Dutch bus commonplace: interference (S 23 1:11, R 19 40)

M GM sudden acceleration (31 deaths, 1121 injuries between 1973 and 1986) linked to EMI in court; Audi cases still suspected; cars less protected than aircraft (R 19 38); note from Adam Cobb in Australia (R 19 42)

M Remote-control car starter also controls car doors, turns on heater, defroster, or air-conditioner, up to 400 feet away (R 19 37)

f(i?) BMW under GPS navigation driven into Havel River (R 20 14)

M Swedish policeman's handheld digital radio triggered his car airbag, which hit him with the radio unit (R 19 43)

SMr Cell phones can interfere with auto systems (R 19 63)

SM Czechs ban mobile phones in gas stations (interference) (R 19 68-69)

Sf Denver car-emission testing program bypass (S 21 4:17, SAC 14 3)

f$ Emissions software glitch falsely fails hundreds of older cars in Atlanta (R 20 04)

*? Fly-by-wire SAAB: joystick, no mechanical linkage, keyboard, screen (S 17 3)

*Vefm Jaguar loses all power due to faulty car phone installation (S 15 5)

*f 1986-87 Volvos recalled for cruise control glitch (S 13 3)

* General Motors recalls almost 300K cars for engine software flaw (R 18 25)

f*$ General Motors recalled almost one million cars (1996-97 Chevies, 1995 Cadilacs) for undesired airbag deployments; Chevy fix involved software change (R 19 85)

- Comments on software explosion in new automobiles (S 22 2:23)

*H Home-reprogrammed engine micro makes 1984 Firebird into race car (S 12 1)

SH Hacking of car engine computers reaches Australia (S 13 4)

*f Anti-skid brakes and computer controlled race cars? (S 12 1)

*Vrf Car with computerized steering loses control when out of gas (S 12 4)

*Vf Non-fail-safe power-outage modes - car locks (S 13 1)

*Vrm Experimental semi-truck micro died (EMI) when near airport radar (S 12 1)

*$f El Dorado brake computer bug caused recall of that model [1979] (S 4 4)

i?m?f? Ford/VW/Nissan cars with Microsoft dashboard Windows PCs (S 23 3:25, R 19 54)

*$f Ford Mark VII wiring fires: flaw in computerized air suspension (S 10 3)

*Vf Cadillac recalling 57,000 cars for headlights-out computer problem (S 12 3)

V$f Oldsmobile design lost: hard disk wiped, backup tapes blank! (S 12 4)

f GM blames smelly Astros and Safaris on faulty computer fuel mix (S 13 4)

*mh Computer blamed for unbalancing of tires (S 14 6)

$drf Computer traffic/revenue model problems delay Denver highway (S 17 3)

m True Value 500 lap-counters in 5 cars fail during race; no time for backup (S 22 5:13)

*m Automated Pentagon car barrier hoisted limousine, injuring Japanese Defense Minister and five others, Sep 1998; faulty sensor (R 19 97); same gate malfunctioned, Aug 1990, injures German defense attaché and American aide (R 21 06; S 26 1:)

*f Problems with the Wide Area Augmentation System (WAAS) (S 25 3:17, R 20 84)

..... Roller-coaster accidents

*m? 42 Japanese injured in roller-coaster car crash (EMI?) (S 12 3)

*$f Computer-controlled Worlds of Fun roller coaster trains collide (S 15 3)

*$f Dorney Park roller coaster crashes; same design flaw, builder (S 18 4:2)

* Roller Coaster controls balance scariness and safety? (S 15 5)

*e Astroworld ride jams at top with reporters; untested SW change (S 16 3)

*f Blackpool roller-coaster (1) fault traps 30; (2) 2 trains collide (S 19 4:5)

+? More on making roller coasters idiot-proof: automation (R 19 93)

Motor-Vehicle and related Database Problems

!!h Bus crash kills 21, injures 19; computer database showed driver's license had been revoked, but not checked? Also, unreported citation (S 11 3)

!P Murderer got actress Rebecca Schaeffer's address from CA DMV; new regs on DB access: notify licensee, delay response for two weeks (S 14 6)

$SP Misused (25% of sample) computerized Calif auto registration info (S 16 4)

SHI 24 California DMV clerks fired in fraudulent license scheme (S 23 1:14, R 19 27)

@California DMV fosters identity theft: 100,000 of 900,000 duplicate license requests in 1999 were fraudulent! (R 21 07; S 26 1:)

*SH California Ex-DMV worker admits altering driving records for money (S 17 1)

$SH Personal misuse of motor vehicle data by London policeman (S 17 1)

$SPH Iowa theft ring misusing license plate info, busted (S 18 1:19)

*SH British auto citations removed from database for illicit fee (S 11 2-4)

$SH Father's desktop publishing used for bogus drivers' licenses (S 18 3:A8)

P Risks of stored digitized photos on drivers licenses (S 19 1:9)

$f California DMV computer bug hid $400 million fees for six months (S 11 2)

$f Toronto motor vehicle computer reported $36 million extra revenue (S 11 3)

Vef NJ DMV computer system upgrade crashes on first live use (R 19 80)

V(m?e?) Mass. Motor Vehicle computer down after maintenance (S 14 6)

f Alaskan DMV program bug jails driver [Computerworld, 15Apr1985] (S 10 3)

f? Parisian computer transforms traffic charges into big crimes (S 14 6)

$ Georgia vehicles stopped as stolen; new tags match old ones (S 15 3)

$f New California DMV computer system issues large erroneous bills (S 16 1)

$e SW patch adds $10-30 to 300,000 auto tax bills in Georgia (S 19 3:5)

$ Chicago cars get erroneous tickets for illegal parking (S 15 3)

$h 1000 IL residents dunned for bogus parking violations (S 15 3)

$f NYC parking violations computer issues many bogus bills per year (S 15 5)

f Computer glitch mails Mass. driver's licenses `en masse' (S 22 4:29, R 18 83)

f NJ DMV computer changes drivers' names to "Watkins Leasing Co." (S 12 3)

*f 100-year-old's age computed as 0, license renewed without test (S 15 2)

$ NSWales computer deregisters ALL police cars; unmarked car scofflaw (S 15 2)

i Mileage input default problem in Ill. exhaust emission enforcement (S 17 2)

$fd California DMV system upgrade botched; $44.3M deadend (S 19 3:5)

..... Automated highways:

* Human risks in IVHS automated vehicles (R 19 08,10,11)

Electrical Power (nuclear and other) and Energy

..... Nuclear power:

!!!V$rh Chernobyl nuclear plant fire/explosion/radiation [26Apr1986] (S 11 3) Misplanned experiment on emergency-shutdown recovery procedures backfired. Fatal (at least 31), serious cases continue to mount. Wide-spread effects. (The town of Chernobyl is now being dismantled.) [Vladimir Chernousenko, director of exclusion zone, estimates already 7-10K deaths among the clean-up crew, according to San Francisco Examiner, 14Apr1991, p. A-6.] 500,000 contaminated, 229,000 in clean-up crew (San Fran. Chron, 17Apr91); 8,500 in clean-up crew dead, many others (San Fran. Chron,14Apr91,p.A10)

*Vh Russian nuclear sub near-disaster due to utility power shutoff? (R 17 42,44)

*V(f/h?) Russian nuclear sub explodes 13 Aug 2000: torpedo-launch test backfires, with crew over 100; previously, 507 nuclear sub crew members had died overall (R 21 01)

*V$f 14 failures in Davis-Besse nuclear plant emergency shutdown (S 11 3)

*$hrmi Three Mile Island PA, now recognized as very close to meltdown (S 4 2), with 4 equipment failures plus misjudgement. SW flaw noted (S 11 3)

!!V,$ Various previous nuclear accidents - American (3 deaths SL-1 Idaho Falls) Soviet (27-30 deaths on Icebreaker Lenin, three other accidents) (S 11 3)

*r Subsequent to Chernobyl, US Nuclear Regulatory Commission relaxed fire isolation guidelines, enabling a fire to wipe out two systems (S 11 3)

*$ Crystal River FL reactor (Feb 1980) (Science 207 3/28/80 1445-48, SEN 10 3)

*Vrf Bug discovered in Shock II model/program for designing nuclear reactors to withstand earthquakes shuts down five nuclear power plants (S 4 2)

* Nuclear power-plant safety (S 12 4)

*$f? British nuclear reactor software safety disputed (S 14 6)

*d Untested risk management system for UK nuclear power stations? (S 18 2:10)

*$hf? Sizewell B nuclear computer safety software complexity causes concern; Sellafield reprocessing plant computer error adds further concerns (S 17 1) Official report summarized. Maintenance work underway. Two shield doors left open. Waste raised. Plant still shut down, more study. (S 18 1:27) See also Dolan (R 15 58) and Parnas (R 15 59) on software testing.

*$f? French nuclear power software safety considered error-prone (S 15 1)

*Vm Oswego NY Nuclear reactor offlined by 2-way radio in control room (S 14 5)

VSMr Interference downs Iowa nuclear power plant (2nd time) (S 18 1:12)

*f SW error at Bruce nuclear station releases radioactive water, and raises questions about Darlington (S 15 2); more on Darlington, shutdown SW difficult to modify, verify (S 16 2)

* Fuzzy control in nuclear reactor startup/shutdown (Omron FZ-1000) (S 16 3)

*r Nuclear Regulatory Commission Emergency Response Data System vulnerability: only one modem (R 20 11)

*hhf Report by Chiaki Ishikawa on Japanese nuclear accident, with significant radiation release: a case study of bad design (R 20 61)

*f Grenoble neutron reactor 10% over limit; equations wrong and instrument miscalibrated, ordinary not heavy water assumed in both cases! (S 15 2)

$df New French reactor's distributed computer system abandoned (S 16 2)

*$VSH Lithuanian nuclear power-plant logic bomb detected (S 17 2)

Vhi 20 of 59 Soviet N-Plant shutdowns 1st half 1991 due to `human error' (S 16 4)

f (Assumed) false alarm at San Juan Capistrano nuclear plant (S 16 4)

*Vf Power surge shuts down 9 Mile Point nuclear station Oswego NY; uninterruptible backup power fails as well; site area emergency triggered (S 16 4)

$* Tolerability of Risks from Nuclear Power Stations (report) (S 18 1:11)

* Northeast Util. Millstone 2 nuclear power problems, underreporting (S 19 4:7)

Vhi Xerox machine caused nuclear-power plant emergency halt (S 21 5:16)

VSH Florida nuclear controls "vandalized"? Switches glued (R 18 35)

*H More than 150 cases of falsified reports on welds in nuclear-power plants. (R 19 39)

@eh Pilgrim nuclear plant Y2K readiness questioned by NucRegComm (R 20 40)

*+/- California's Diablo Canyon 1 nuclear reactor auto shut down releases some radioactive steam; shutdown worked properly (R 20 89)

..... Nonnuclear power:

hd Grid-lock: Software missing, California electric power deregulation delayed (S 23 3:25, R 19 52)

VSHO Calif. PG&E power substation damaged; note links attack to McVeigh verdict (R 19 21)

mf$ "Heading off emergencies in large electric grids" (IEEE Spectrum article, April 1997, pp.43-47) (R 19 09)

@$* Risk: Analysis, Perception and Management (report), assessing the worth of a human life around £2M to 3M, .5M in Transport Dept. (S 18 1:11)

*V$r 1965 Northeast power blackout due to set-too-low threshold being exceeded

*V$f Power blackout of 10 Western states, propagated error [2Oct1984] (S 9 5)

*V$mh Western U.S. power blackouts, more propagated effects [2Jul1996] (S 21 5:13); apparently, initial report of outage from tree on power line was not relayed: operator could not find a phone number

*V$mhf West-coast summer power losses: 10 Aug 1996 affected 8 million accounts in 8 states, parts of Canada and Baja, with major outages, air-traffic effects; many interlinked causes. 13 Aug outages included Palo Alto shutdown due to erroneous signal (S 22 1:16); Palo Alto outage fried the Cable Co-op Playboy channel scrambling chip, programs went out in the clear (S 22 1:17); Stanford outage 10-11 Oct 1996 takes down Silicon Valley Internet connectivity, newpaper Web sites; caused by rats, explosion (S 22 1:16) (R 18 27-29,34)

VSH(O?) 3.5-hour San Francisco power blackout 23 Oct 1997 blamed on sabotage (S 23 1:13, R 19 42)

V$m Downtown Chicago hit by electrical blackout, 12 Aug 1999; 3 of 4 transformers down, plus high-voltage cable (R 20 55)

*V$hm Another San Francisco power outage: SFO Airport, Pacific Stock Exchange, rapid transit down, 1 million customes affected (S 24 3:25, R 20 11)

*$Vm Auckland NZ without power for weeks; El Nino drought affects cables (R 19 61); Auckland major power supply failure (4 power-cable failures): analysis report released (R 19 88)

*V$ Don't forget the 6-week power outage in Quebec in winter 1996-97 due to massive collapse of heavily iced transmission towers, which had massive effects. Although it was not directly computer related, whoever designed the towers certainly did not allow for reality as the weight of the ice was way over the designed load.

*Vrfm Maine Emergency Broadcast System fails: no emergency power (R 19 55)

V$m Intel shut down by power-company software bug, 5-hour outage (R 18 02)

*m Jan 1994 L.A. earthquake power failure affects Pacific NW (S 19 2:3)

Vm$$ Chicago Loop tunnel flood blows power,computers,comm 13Apr92 (S 17 3)

*Vf Ottawa power utility loses working three units to faulty monitor (S 11 5)

V$fdmh $25M Australian power system runs amok; damages = $1.5M (S 20 2:11)

*VSi Misdirected phone call shuts down local power (S 20 3:7)

*V$rm Squirrel arcs power, downs computers in Providence RI (S 12 1)

V$rm SRI attacked by kamikaze squirrel who downs uninterruptible power (S 14 5)

Vrm 4th SRI squirrelcide causes 8-hour outage, surges, system rebuild (S 20 1:17)

Vrm$ 5th SRI squirrelcide causes 18.5-hour institute outage, knocking out cogeneration power and disconnecting from utility power (R 19 96); earlier cases: see (R 17 91, R 18 52-53).

m Another squirrelcide: San Jose Airport power cut (R 20 87)

V$rm Squirrel attack brings down Walla Walla (S 21 2:17)

Vrm Squirrel knocked out Trumbull Connecticut infrastructure computer center (S 22 1:17)Vrm Snail causes Liechtenstein's cable TV system to fail (S 22 1:17)

Vrm Kamikaze raccoon downs cold fusion experiments (S 14 5)

Vrm Rat bridging connector downs U.C. Berkeley campus power (S 19 4:6) @Also, see Nasdaq squirrel outages (S 13 1) and (S 19 4:5-6)

Vrm Rat-induced short-circuit at Barranquilla airport closes airport (R 19 38)

Vrm Rat-patrol cat in Dhaka, Bangladesh, shorted out power station control room (R 19 74)

Vr* House cat kills power to commercial district in Dhaka Bangladesh (R 19 67) ("Un chat" in the dark?)

Vm Fire ants enjoy the comfort of electrical equipment (R 19 17-19)

Vrfh Vacuum cleaner interrupts uninterruptible power (S 19 3:8)

*Vm Reactor overheating, low-oil indicator; two-fault coincidence (S 8 5)

Vhi Trainee raises false alarm on utility emergency printer (S 12 3)

Vmf Fire risks compounded by loss of residential power; alarms and cordless phone ran off house power (R 19 82)

..... Natural Gas

Vm One-meter ice block in main gas supply knocks out 1/4 of gas in Victoria, Australia, with secondary power losses (R 19 81)

V*hm UK Cable-and-Wireless employee accidentally cut gas line while repairing phone line (R 19 96)

V*m Esso natural gas plant explosions in Victoria, Australia, killed 2, requires 5M people to shut off gas, despite three other plants (R 20 01)

Medical, Health, and Safety Risks

..... Various hospital and health-care problems

!hrife Therac 25 therapeutic accelerator programming and operational flaws; 2 [now 3] killed, 3 injured (S 11 3, 12 3); see also Ivars Peterson, Science News, 12 March 1988; Jon Jacky, The Sciences, NY Acad. Sci Sep/Oct 89. See the definitive article by Leveson/Turner, An Investigation of the Therac-25 Accidents, IEEE Computer, July 1993, pp. 18-41: 2 deadly flaws: a nonatomically edited command line whose effect did not complete within 8 seconds, a six-bit counter that when zero bypassed the collimator check. Hardware interlock in Therac 20 eliminated.

!(ei?) Zaragoza Spain cancer radiation mistreatment; at least 3 died (S 16 2)

*f Brit. hospital radiation underdoses by 30% due to SW bug (S 17 2, 19 1:3)

!h$ 3 patients die when Russian hospital omits utility payments (R 20 25)

*Vm Fuse caused a hospital to disconnect from the power grid (R 20 11)

Vrm Power outage leaves hospitals in the dark; inadequate backup (S 24 4:26-27, R 20 25)

!fh Woman killed daughter, tried to kill son and self; "computer error" blamed for false report of their all having an incurable disease (S 10 3)

!Vhri Girl electrocuted by heart-monitor plugged into electrical outlet (S 12 1)

m Seizure-inducing video hospitalizes 650 Japanese youths (R 19 51)

[!h bogus] Report of cleaning person inadvertently killing patients (R 18.28,29); story later apparently debunked (R 18 72) mfh "When Doctors Make Mistakes" (New Yorker, 1 Feb 1999) considers user interfaces on defibrilators, design variations in anesthesia controls (R 20 18)

rfhm Computer-based patient monitor problems: improvements still needed in anesthesiology (R 20 49-50)

*+/- Open-source anesthesia software (Salon, R 20 52)

*VmM? Medical monitors reboot in mid-surgery due to EMI? (R 20 49); other medical risks (R 20 51-52)

V*m Clinical disruptions following loss of telephone service (R 20 50)

h* Medical paper retracted following discovery of programming error (R 20 48); Statistical errors in medicine (R 20 49); Misplaced priorities with electronic hospital records (R 20 50)

*fmd Life-threatening flaw in implantable cardioverter-defibrillator and other life-threatening medical equipment failures (R 20 48); Complexity and Safety in Medical Electronics, Dr. John Doyle (R 20 53)

*fh Clinac 1800/2100C interlock boards switched, some calibrations x2 (S 16 4)

*fi Risks of false alarms in medical systems; disconnected alarms (S 19 2:3)

@*SHI Hacker-nurse unauthorisedly changes prescriptions, treatments (S 19 2:5)

h Bremen hospital computer uses financial bottom-line whether to give intensive care; local government objects (R 18 84)

$ Walter Reed Hospital health care system botches prescriptions, lab orders; access to narcotics not secure; increases doctors' workloads (S 17 3)

$f NY Blue Cross system confuses patients with same gender, birthdate (S 17 3)

m Harvard Pilgrim HMO scheduling system creates chaos (S 21 4:13)

@f/h? Empire Blue Cross/Shield glitches necessitate $50M write-off (S 18 3:A5)

i Infirmary patient mistook painkiller button for call button (S 18 2:5)

*rf Blood test for man born in 1889 "normal" (for 1989 birth!) (S 15 2)

*f Medical SW fails to identify high cancer risks in British women (S 17 3)

!$dfh London ambulance service SW development woes; major test fails (S 17 3) Complicated system, incomplete training, "wartime action room" (S 18 1:26) Up to 20 deaths from delays, worst case 11 hrs (S 18 1:28); LAS made `virtually every mistake in the book' in implementation. (S 18 2:9)

*Vf 100 US hospital computer systems die; 2**15 days after 1/1/1900 (S 14 6)

$ Computer delays cost Nottingham Hospital over £300K (S 17 1)

*f Three medical product recalls due to software errors (S 14 5)

*f Overseeing dementia patients by computer: conflicting advice (S 16 4)

*f Multipatient monitoring system recalled; mixed up patients (S 11 1)

*f Diagnostic lab instrument misprogrammed (S 11 1)

*fi AI medical system in Nevada gave wrong diagnosis, overdose (S 11 2)

$* 2nd mammogram after first botched causes health insurance denial (S 16 3)

f Doctor phone analysis skewed by inability to register long waits (S 18 2:13)

*h Nondial emergency phone gives recording to DIAL another number! (S 15 2)

*SHi Rochester General Hospital disowns Web site heart-attack info (R 20 83-84)

..... Pacemakers, interference, etc.

!SrfM Arthritis-therapy microwaves set pacemaker to 214, killed patient (S 5 1)

!SrfM Retail-store anti-theft device reset pacemaker, man died (S 10 2, 11 1)

*VSrfM Electrocauterizer disrupts pacemaker (S 20 1:20)

*Vrif Pacemaker locked up when being adjusted by doctor (S 11 1)

+M Improved designs (including sealed titanium cases) have reduced the likelihood of RF interference. See Design of Cardiac Pacemakers, John G. Webster (ed.), IEEE Press, 1995, pp. 207-211.

!VrSM Cellular/radio RFI affects medical equipment; defibrillator fails; TV-RFI-altered diagnosis leads to unneeded pacemaker (S 19 4:7)

+M RF risk turns pacemaker failure into accidental life-saver (S 19 4:7)

*Vf Risks of flaws in programmable defibrillators (R 19 50,52,53)

i Heart-monitoring software interface problem (R 18 49,50)

*SM Stereo speaker risk to heart device (S 14 5)

*Vm Failed heart-shocking devices due to faulty battery packs (S 10 3)

*VrM Medical electronics RF susceptibility: triggers hospital alarms respirators failed because of portable radio interference (S 14 6)

VrSM New HDTV signal shuts down Baylor heart monitors on same frequency (R 19 62)

!SrM Miner killed by radio-frequency interference (S 14 5)

..... Chemical health hazards

! Higher miscarriage rate for women in computer-chip manufacturing (S 12 2)

!* Reports on miscarriages in U.S. chip workers, Finnish VDT users; effects of Nintendo and other games on epilepsy (S 18 2:10)

* "Dirty Secrets" of chip industry: hazardous chemicals (R 19 55)

*f(h?) Computer flaw drops chlorine level, makes water undrinkable in Lewiston ME (S 24 1:32, R 19 92)

..... Electromagnetic and other occupational hazards

*f/h US occupational hazards much worse than in Europe? (S 14 6)

*m Video display terminal health safety a continuing concern (S 11 3, 11 5); Series of three New Yorker articles by Paul Brodeur, 12-19-26 June 1989 Article on VDT Radiation, Paul Brodeur in MacWorld (S 15 5); VDT health effects discussed in K.R. Foster book chapter (R 14 70, S 18 4:5)

*m Scandinavian study shows magnetic fields increase leukemia risks (S 19 1:3)

? Mobile phones cause memory loss? (R 20 23); Italian hospitalized for "acute Internet intoxication" (R 20 24) Studies continue to show possible health hazards from cell phones.

* Computer noise linked to stress, especially in women (S 15 5)

*f Killer terminals -teletypes (old) and Televideo 910s (S 14 1)

* Repetitive strain injury, other risks in video terminal use (S 12 2)

$ British Telecom pays £6000 for repetitive strain settlement (S 17 1)

$ Apple settles RSI claim, after lawyer's error; IBM off the hook (R 16 86)

$i Three awards (largest $5.3M) for arm, wrist, hand injuries attributed to Digital LK201 keyboard (R 18 66); references on RSI (R 18 68); Judge overturns all but smallest verdict in Digital keyboard case (R 19 14); a New York jury ruled Digital was not responsible for 9 workers' RSI cases (R 19 82)

* Carpal tunnel syndrome (R 10 12,10.14), ulnar nerve syndrome (R 10.13)

*$ Long Island county legislation on VDT Use (S 13 3)

* VDTs and dermatology: rosacea, acne, seborrheic dermatitis, poikiloderma of Civatte. Medical article, useful references. (S 13 4)

* VDTs and deterioration of eye focusing (S 13 4)

* Health risks from dusty computer displays (R 18 21,23)

* Glass cleaner causes static sparks, PC fires (S 13 2)

!$ 2 Compaqs (Portable II) exploded after battery circuits rewired (S 12 1)

*V GPS receiver explodes; PLGR violent venting at Fort Irwin (R 18 32)

* Health hazards attributed to laser printers (S 12 1)

@m Display lasers affect aircraft: pilots blinded over Las Vegas (R 17 55)

*f Dangers of computerized robot used in surgery (S 10 5)

* Computer use and extension phones linked with weight gains (S 15 3)

m*? Risks of computerized Japanese toilets (R 20 51-52)

*!h Trash compactor kills shoplifter; original story on automatic initiation incorrect (R 20 90-91)

..... 911 problems

@!Vhi Death of 5-year-old boy due to SF 911 computer equipment failure (S 12 2) Ultimately blamed on terminal operator failing to press a button.

!f CADMAS 911 dispatch SW problem contributed to woman's death (S 16 1)

@!f Emergency dispatch EMS SW truncates address, man dies (R 11 55,57,60)

@!f 911 software discarded updated address in fatal Chicago area fire (S 17 1)

!Vfmh NYC 911 system crash during backup generator test: backup failed for an hour, main for 6 hours (R 20 19)

m Los Angeles 911 system with no alternative power fails for 17 hours, but backup system worked! (A novelty in RISKS archives!) (R 20 03,07)

m Wet cable leads to 120 false 911 calls (R 20 10)

h? Fort Worth TX police computer makes 1,300 invitational calls in the wee hours: "reverse 911" (R 20 23)

Vm* Small fire escalates into major disruption for 113,000 Toronto phone lines, with resulting protracted outages including 911 services (R 20 49,51)

Vf/m/h? Glitch misroutes Nevada 911 calls to San Diego CHP (R 20 62)

..... Database issues

SHI DMV security code disclosed at hospital in New Haven (R 18 28)

$SHAI Mass. hospital technician accessed ex-employee's account, accessed 954 files, harassed former patients, raped girl (R 17 07, SAC 13 3)

SHI 6000 AIDS records stolen from Miami hospital PCs and diskettes (S 19 2:9); bad prank follows (S 20 5:10)

SHI 4000-person AIDS database leaked to press, Pinellas County, FL (R 18 48,53); former Health Dept employee and roommate charged (Reuters, 15 Feb 1997)

f SW error almost doubled apparent death rate in St. Bruno, Canada (S 15 3)

P Confidential medical records sold at auction (S 16 4)

..... More safety risks

- Internetomania: psychology of net usage (S 23 5:26, R 19 78)

*fm? Medical image compression problems discussed (S 16 2)

S Actress Margot Kidder's breakdown reportedly triggered by computer virus' lost files (R 18 46)

!h Woman electrocuted in hotel; faulty air-conditioning? (S 20 5:9)

!f [bogus] 2 dead, 1 brain-dead from Chilean bank terminal [Weekly World News] (S 12 2)

mf? Baby death due to software-controlled air bag deactivation? (R 20 28)

* Computer CPU falls on man's foot (S 12 4)

+ E-mail between Bordeaux and Minneapolis rescues a suicide attempt (S 18 1:6)

+ Microchip in dog tag identifies Australian boy (S 19 1:3)

Other Environmental Risks

(!)*$$hif Exxon Valdez oil tanker on autopilot runs aground with captain absent; worst oil spill in US history; computer records deleted (S 14 5)

*fh Automatic speed reduction causes New Orleans Bright Field crash (S 22 2:19)

*f/h Computers blamed each time, 3M, 5.4M, 1.5M gallons of raw sewage dumped into Willamette River in three separate incidents (S 13 3, 13 4)

h GPS setup error affects dredge dumping in California (S 24 4:27, R 20 30)

rfh 1993 Midwest flood-warning problems; operations, models flawed (S 18 4:5)

h/f? Orlando newspaper forces stormwater tax delay; computer blamed (S 17 2)

* Smoke ban in India brings back mosquitos, malaria (nontech risk) (S 19 4:7)

@*f Ozone hole over South Pole observed, rejected by SW for 8 years (S 11 5)

@fm Channel blocked, Discovery runs out of storage for ozone data (S 18 3:A14)

Robots and Artificial Intelligence

!m Japanese mechanic killed by malfunctioning Kawasaki robot (S 10 1, 10 3) (Electronic Engineering Times, 21 December 1981)

!m At least 4 more, possibly 19 more robot-related deaths in Japan (S 11 1)

!mM? 6 of these deaths due to stray electromagnetic interference? (S 12 3)

!m Michigan man killed by robotic die-casting machinery (S 10 2, 11 1)

! [bogus] Chinese `AI' computer electrocutes its builder (S 10 1) [WWN]

!f [bogus] Computer electrocutes chess player who beat it! (WWN) (S 14 5)

* Two cases of robot near-disasters narrowly averted by operators (S 11 3)

V(!) Budd Company robot commits suicide by dissolving its electronics (S 13 3)

$hi Programmed tunnel-digging robot runs amok (a-muck), $600,000 to fill hole (S 22 5:13)

f Servant robot runs amok, winds up in court (S 11 5)

f NBC network-news robot camera runs amok during broadcast (S 13 3)

$S Risks of on-line robotic SW repair: SoftRobots (S 12 4)

Vmf? Stanford robot veered off course, fell down stairs (S 18 1:7)

V$m Fiber cable snap ends Dante robot only 21 ft into Mt Erebus volcano (San Francisco Chronicle, 3 Jan 1993, p.B-6)

V$m Dante II robot explores Mt Spurr plagued by problems: bear chews on antenna; power loss; topples over; tether snaps; finally helicoptered out (S 19 4:5)

f Hospital delivery robot blocks exit from elevator (R 20 42)

Other Computer-Aided-Design Problems

*rh Hartford Civic Center Roof collapse: wrong model (S 11 5, ref. 14 5)

*f Salt Lake City shopping mall roof collapses on first snowfall (S 11 5)

@Vm Computer-center roof collapses in snow, downs 5000 ATMs (S 18 3:A4 and 5)

$rf America's Cup Stars&Stripes misdesign due to modeling programs (S 12 1)

*f John Hancock Building in Boston - problems in "active control" (S 12 1)

*f Potential building collapse: the 59-story building saga in New York (S 20 5:10)

Accidental Financial Losses, Errors, System Outages

$eh Largest computer error in US banking history: US$763.9 billion (S 21 5:13)

*$h Oct 1987 Dow-Jones index losses amplified by program trading (S 13 1); Side-effects of saturated computer facilities; brokerage sued (S 13 1); Losses over 100 points truncated to two digits by Signal service (S 13 1); Program trading halted by Wall Street firms for own stability (S 13 3)

$f L.A. County's pension fund loses $1.2B over 20 years due to programming error (R 19 66)

$fe New £170M system gyps British pensioners of up to £100 each week (R 20 05)

V$m U.S. national EFTPOS system crashed on 2 Jun 1997 for two hours, 100K transactions were "lost". One CPU failed, backup procedures to redistribute the load also failed. (R 19 21)

$hi Reuters/ZDNet typo (TMCO instead of TMCS) causes wild stock fluctuations (R 20 11)

$f Multiple stock transactions result from blocked confirmation (S 13 1)

V$f E-Trade computers crash repeatedly (S 24 3:25,R 20 20)

V$ef Schwab's e-brokerage crashes (S 24 3:25, R 20 23)

$h German stock exchange bond futures goof: wrong buttons (S 24 3:25, R 20 09)

e$ Canadian Imperial Bank upgrade affected half the transactions (S 22 2:22)

fh? Canada's Bank of Commerce glitch delays 85,000 transactions (R 19 72)

$e Fidelity Brokerage computer problems from new system installation (S 22 2:22)

$h Mistyped password put two brokers in the same computer files (S 13 1)

$f Midwest Stock Exch 13-yr error redirected $Millions in broker fees (S 17 1)

f/h? Stock listing error: IBM at 0 1/16, down 88 1/2; implications? (S 17 1)

$h Milano stock falls 20% due to typing error (S 19 1:5)

$f Investment program turns into selling-only doomsday machine (S 19 1:5)

$f Computer malfunction causes panic selling at Hong Kong stock exchange (S 22 2:20)

e Risks of Dow-Jones over 10,000: D10K (R 19 64,73); no big deal - nothing adverse happened.

reh Berkshire-Hathaway 1st NYSE stock to exceed $10,000 per share (S 18 1:9); Warren Buffet's never-split NYSE Berkshire Hathaway stock quotes BRK.A reach $32768 per share, must be entered by hand, blowing on-line databases (R 19 64); similar events in Australian stock market (R 19 70)

$f $32 Billion overdraft at Bank of New York (prog counter overflow) (S 11 1)

$fe Ent Federal Credit Union misprocessed multiple same-day transactions for over a year, retroactively deducted $1.2 million from accounts (R 18 53)

$h Franklin National Bank earlier lost $50M in speculation, led to demise (R 18 54)

$f UK bank SW glitch hands out extra £2B in half hour (S 15 1)

$hi $2 Billion goof due to test tape being rerun live (S 11 2)

$m Mag-snag hits Reserve Bank of India's clearing operations (S 19 3:6)

$d UK paid SD-Scicon £7.3M for scrapped IBM 3090 SW system (S 18 1:11)

$dh BofA MasterNet development blows $23M; backup system gone(S 12 4) Two BofA executives leave after DP problems costing $25M (S 13 1); $60M more spent in botched attempt to fix it (S 13 2)

($) Barclays Bank almost transfers £14 billion to Greece (S 17 1)

$def $18M new system hinders collection of $10M in L.A. taxes (S 16 2)

$h British woman overdrawn by £121 billion, due to typing error (R 20 04)

$f $100M overdraft plus daily interest in Sydney - "computer error" (S 13 1)

$rih $.5M transaction became $500M due to "000" convention; $200M lost (S 10 3)

$hi? California bank deposited $1M instead of $100K; it was spent (S 19 3:5)

$$ High stakes: Wall St bank wires average over $1.2 trillion/day (S 12 2)

$h Slow responses in Bankwire interface SW resulted in double posting of tens of $millions, with interest losses (S 10 5)

$f Australian Comm. Bank doubled all transactions for a day (S 13 2)

$h Some French civil servants get paid twice, others not at all (S 21 2:17)

$(f/h?) Double posting of credit-card charges (S 19 3:6)

$fi NYC subway fare cards double-deduct; user interface at fault (S 19 3:6)

$fe Extra line in Chemical Bank program doubles ATM withdrawals (S 19 3:6)

$h Doubled payroll run surrounds Thanksgiving, run before and after (S 20 2:9)

he National Australia Bank operational goof: payroll program not restored after test, payroll missed (R 19 97)

$h $98,002 refund check based on zip code, not correct amount $1.99 (R 19 16)

$f German Bundesbahn (railway) software messes up payrolls (S 20 2:9)

$h Computer blunders blamed for $650M student loan losses (S 14 2)

$h Unvetted software patches threaten $26B federal retirement fund (S 20 3:7)

f/h? Empire Blue Cross/Shield glitches necessitate $50M write-off (S 18 3:A5)

$f California state computer wrote $4M checks accidentally (S 11 5)

h? 75,000 duplicate Calif. unemployment checks issued accidentally (S 18 3:A5)

$f Farmer receives $4M US Government check instead of $31 (S 17 3)

$f Canadian Pacific stock price sanity check rejects legitimate data (S 12 4)

$h Australian man can keep $335,000 windfall from computer data error (S 12 4)

$f/i/h? Howard Jenkins receives accidental $88M; bank system error (S 19 4:8)

SHI Dutch electronic-banking direct-debit scandal: Friesian church minister discovers surprise privileges (R 18 81)

$f SW errors blamed for £71,000 VAT misdeclared; £21,000 fine results (S 16 3)

$h First Boston loses $10M to $50M on computer securities inventory (S 13 2)

$f New software system blocks commercial loans in California (S 14 5)

$f $2B (3M bank transactions) stalled when computer rejected posting (S 13 2)

rf More on ATM range checking. $999,999,999 deposit test goes through (S 15 5)

$f Computer system refuses deposit of $200K; max just under $100K (S 17 4)

f Bank's Exchange network overloads in Oregon and Wash, ATMs act up (S 15 5)

mh Computer aspects of Credit Lyonnais Fire discussed (R 18 14)

Vm Computer-center roof collapses in snow, downs 5000 ATMs (S 18 3:A4 and 5)

$fi Chase Manhattan computer glitch affects thousands (S 21 4:12)

m$ 2000 Toronto-Dominion ATMs crashed for a weekend (S 22 2:22)

$h Codelco loses $207M on mistyped instruction (buy, not sell) (S 19 3:5)

$f Ben & Jerry's expects first-ever loss, partly due to SW problems (S 20 2:11)

$f NZ Databank computer error withholds funds for many accounts (S 16 2)

$m European ATM repeated debit (S 14 2)

Ve Chemical Bank's ATMs go down after botched file update (S 19 4:6)

Ve 1529 Bank of America ATMs down after maintenance goof (R 19 16)

Vfe Bank of Montreal card functions paralyzed by software flaw (R 20 01)

e Non-U.S. Bank ATM users' debited, get no money; botched upgrade (S 18 2:12)

$ Norwegian bank ATM gives 10 times the requested cash; long lines (S 15 3)

$h European bank mounted wrong tape redid monthly transfers (S 14 2)

$he Wells Fargo deposits slip - another software glitch (S 14 5)

$f Wells Fargo 1987 IRS forms stated 100-times-salary for employees (S 15 1)

h? Resolution Trust Corp badly overreports to IRS on interest paid (S 18 2:11)

$f 120,000 long addresses mess up British building society computer (S 14 6)

$f Program bug permitted auto-teller overdrafts in Washington State (S 10 3)

h 2,000 Texans get false overdraft notes from Bank One in Y2K test (R 20 13)

$h Glitch causes 4 billion euro overdraft (S 24 4:27, R 20 30)

$h New Zealand student grants debited instead of credited (S 14 5)

fm More nonatomic ATM transactions: account debited, no cash (R 19 40)

$h Brown University senior's account mistakenly given $25,000 (S 12 2)

$f $80,000 bank computing error reported - by Ann Landers (S 12 4)

e? Lisbon ATM gives receipt in esperanto instead of espanol (S 18 2:11)

$dem Brit. Foreign Office accounting computer outage off by £458M (S 16 2)

$f $40M Pentagon foreign military sales computer misses $1B (S 13 3)

hi British audit missing £37M (16M `usual errors', 21M lost) (S 18 3:A6)

$fe Minnesota PR firm cut over to untested system, bills months behind (S 13 4)

f$ San Jose system stops issuing garbage bills (S 22 2:20)

$fe IRS reprogramming delays; interest paid on over 1,150,000 refunds (S 10 3)

$fh IRS overbills 1000 people by $68M in five flood-damaged states (S 18 4:4)

$h IRS audit turns up $752 VDT valued at $5.6M; $36K payment for idle mini; 32 duplicate payments, overpayments worth $.5M, $17.2M undocumented (S 18 4:4)

$SP IRS computer modernization problems: privacy and security, cost (S 18 4:4)

$f Variances in up to 25% of adjustable-rate mortgage bills (S 16 1)

$f British retail price index 1% off, costs £121M, testing (S 16 1)

V$h San Jose library lost two weeks of records. Books, fines lost. (S 11 3)

V$fm Los Alamitos racetrack lost $26K in excess payoffs; betting halted (S 16 2)

fi Risks of banks' not retaining data between Quicken runs (R 19 39)

$h Fire-control test backfires in midst of bank's end-month processing (S 15 5)

$fm Newly centralized Sendai postal/banking computer crash effects (S 16 3)

+ NY Federal Reserve bank Fedwire EFT survives power outage, no loss (S 15 5)

$m LA Federal Reserve computer snafu delays bank deposits (S 17 3)

V$f SW flaw freezes Barnett Banks (Florida) computer for one day (S 17 4)

$fh 5M NWB credit-card users get erroneous bills (S 17 4)

$ Buy.com mispriced a monitor; automated price search promises lowest price; (R 20 21)

@SH World Bank virus ("Traveller 1991") (S 16 4)

S$e Barclays Internet-banking security-glitch following software upgrade enables access to accounts of others (R 21 01; S 26 1:)

..... Lottery, Gambling, etc.:

($) Connecticut lottery computer accidentally gave backdated tickets (S 13 3)

$ShH Proprietor tries to cash 5 extra winning lottery tickets (S 18 4:3)

$f(H?) SW enables winning tickets purchased after lottery drawing (S 16 1)

f/m Maryland Lottery software glitch distributes wrong winning numbers (S 22 1:20)

$f,h California Lotto computer crash and its costly effects (S 14 1)

$m Computer problems delay California Lotto payouts (twice) (S 15 3)

h Calif. lottery computer gets ahead of itself; sales halted early (S 20 5:10)

Vm U.K. lottery terminals downed by satellite network breakdown (S 20 5:10; R 17 18)

f$ Arizona Lottery Pick 3 random number bug: 9 never picked; not so random after all (R 19 83)

H Cooperative database develops winning combinations for Dutch soccer scatchables with 1445 alternatives; competition cancelled (S 22 1:21)

$h Programmer unauthorizedly limits sale of certain lottery tickets (S 15 3)

$f California lottery delayed; Daily 3 had flawed pseudorandom program (S 17 3)

$f One-armed bandit chips "incompatible"; 70.6%, not 96.4% payoff (S 17 4)

$f Electronic Keno game beaten; pseudorandom sequence gets reset (S 19 3:10)

fS Unlosable casino game: browser click on back to undo loss; risk of negative bets for intentional losses subtracted from losses! (S 22 1:20)

@$Hhi Greyhound racetrack takes bets after race; NZ$7,000 payout (S 18 2;4)

$em Racetrack betting seriously impaired by degraded computer system (S 12 2)

$Vf Saratoga Race Track parimutuel computer down on opening day (S 14 6)

V$m Dog-track computer outage costs bettor $17,000 (S 19 2:2)

$ Breeder's Cup tote-board display crashes, reduces betting take (S 22 2:21)

Vm 1996 Melbourne Cup off-course betting computer fails (S 22 2:21, R 18 58))

$SH Russian cockroach race swindle involved altered computer files (S 22 2:21)

+/- U.S. Senate bans Internet gambling (R 19 89); U.S. House rejects bill restricting Internet gambling (R 20 95)

+ Co-owner of offshore online gambling business goes to prison (R 21 01; S 26 1:)

Financial Frauds and Intentionally Caused Losses

$SHA See Bruce Schneier article on the Future of Fraud (R 20 08)

$SHOf TILT! Counterfeit pachinko cards send $588M down the chute (S 21 5:19); Pachinko cards suggested by a CIA briefing to hinder money laundering (S 22 1:18)

$SHI Volkswagen lost $260M to computer based foreign-exchange fraud (S 12 2) 5 people (4 insiders, 1 outsider) convicted, maximum sentence 6 years.

$SH Computer problems at BCCI; records "confused"? (S 16 4)

($)H Four financial frauds, each foiled (e.g., by luck) $70M Chicago First National, $54.1M Union Bank of Switzerland (S 13 3) 250M kroner Norwegian clearing house Bankenes Betalingsentral BBS (S 13 3) $15.2M Pennsylvania lottery scam - post-fabricated ticket (S 13 3)

$SH $70 million bank scam attempt; bogus request overdrew account (S 17 3)

$S Risks in CHIPS clearinghouse handling $1M/sec. $20M stolen in 1989, distributed widely; culprits caught but only $8M recovered (S 18 1:10)

$SHI Salomon Brothers scandal aided by misuse of database confirmations (S 16 4)

$SHO FBI arrests Emulex securities and wire fraud suspect in stock manipulation hoax (R 21 04; S 26 1:)

$SHO Jason Diekman settlement: $272,826 for perpetuating false information on the Internet and profiting from stock fluctuations in Just Toys Inc. and The Havana Republic (R 21 04; S 26 1:)

$SHOA/I Russian hacker Vladimir Levin breaks Citibank security (S 20 5:13), sentenced to 3 years in jail (R 19 61) $10 million transferred, but most of it recovered

$SH $15.1M fraud accidentally foiled because of a computer error (S 13 2)

$SH $9.5M computer-based check fraud paid legitimate DCASR invoice (S 13 2)

$SH Czech hackers allegedly rob banks of $1.9M (S 22 2:22)

$H European Community study of fraud on the Internet (R 19 13)

$SHI Olympia WA HealthDept check scam detected; four indicted (S 18 1:12)

$SHI Military pay fraud nets $169,000 using bogus account (S 23 1:14, R 19 26)

$SHO Plot to tap British bank/credit-card information by higher-tech gang revealed by coerced software expert in jail (R 18 70)

SHAO Chinese hackers who transferred 720,000 yuan to their own bank accounts sentenced to death (R 20 14)

@SHI Massachusetts welfare fraud investigators fired: tax-record misuse (S 22 1:20)

@$S Risks of Conn. fingerprinting system to catch welfare recipients (R 18 69) Also, note earlier NY Medicaid proposal (R 13 40)

fe Software incompatibility hinders Florida fingerprint system (R 20 02)

$SHI Teller embezzles $15K, caught by computer audit-trail (S 19 3:10)

$SH Brussels BNP branch hit by BFr 245M computer fraud (S 19 1:6)

$SHI Joseph Jett, Kidder Peabody, created $350M phantom profits, got bonus of $9M; scheme undetected by KP oversight (double meaning not a pun) (S 19 4:12)

$SH U.K. computerized bank fraud nets £1M (S 14 2)

$SH 1993 Prague computer crime up 75.2% including a $1.2M transfer (S 19 1:7)

$SH $1.2M Czech computer fraud culprit gets 8 years in jail (S 19 2:7)

$SHI Japanese bank workers steal 140 million yen by PC (S 20 2:12)

$SHI Bank executive in Malaysia transfers $1.5M (S 15 5)

$SHI $550,000 Tokyo bank fraud suspected in funds transfers (S 19 2:6)

$SHI Beijing Hotel managers embezzle $9K by rigging billing records (S 19 4:13)

$H Chemicals cause checks to disappear, bogus checks clear and vanish (S 13 3)

$SHA Foiled counterfeiting of 7,700 ATM cards using codes in database (S 14 2); five admit automated teller scam (Mark Koenig) (S 14 5)

SHO Italian thieves use bank cards, PINs, captured with bogus machine (S 17 4)

$SH Bogus ATM used to steal PINs, withdraw $100,000; two arrested (S 18 3:A9) 2 arrested; 300 accounts hit at 50 banks; $12M in fraud activity (R 14 85)

$SHP UK stolen ATM captures IDs/PINS, enables 250K-pound theft (S 19 4:12)

SH$ Phony ATM installed on High St in London, nets £120K (R 17 34)

SH Theft of entire ATM bungled in British Columbia (R 19 20)

$fSH Instant money: Bogus deposit exploits ATM flaw (S 22 2:21)

$SHO Polish gang carries out ATM fraud in Israel (S 22 2:23)

@$SH 1994 UK National Audit Office report on computer misuse in government: 140% increase; 655 cases, 111 successful; £1.5M defrauded; misuse; 350% increase in viruses; 433 computer thefts, worth £1.2M (S 20 3:11)

$SH European cyberfraud: $150K phone calls, $400K Dell losses (SAC 13 3)

$SH Cybercrime losses double to $10 billion; 485,000 credit-card numbers stolen from e-commerce site; hacking credit cards is preposterously easy; (Credit-card fraud worldwide is reportedly just under $1 billon a year, at about .7 percent of gross. It represents only about 2% of banking losses. PGN) (R 20 85)

$SP Professor stole 40 student SSNs and IDs to get credit cards (R 21 02; S 26 1:)

$SHfe Stolen ATM card nets $346,770; limits inoperative (S 20 2:12)

$SH Health cards used to rip off ATM for $100K (S 20 3:12)

SH Bogus card reader opens ATM door and helps capture IDs and PINs (S 19 3:10)

@$SP Barclays credit system voice-mail hack gives sensitive info (S 18 1:20)

@$SH U.Texas Dean's conferred password used to misappropriate $16,200 (S 17 3)

$H Two charged with computer fraud in jewelry store credit scam (S 18 2:14)

$SH Reservation computer fraud nets 50M AA frequent flier miles (S 14 1)

$SHI Frequent flier computer scam nets 1.7 million bonus miles (S 14 2); Prison terms for travel agents in AA FreqFlyer ticketing fraud (S 16 2)

$SH $Millions of bogus airline ticket sold in Phoenix (S 14 6)

$fH Reversing air return/depart dates fakes out reservation computers (S 14 6)

$SH Bogus computer message nets 44 kilos of gold from Brinks (S 14 2)

$H `Credit doctors' sell clean credit records to high-risk clients (S 13 4)

$SPH ASIS seminar reported $15M in 1991 Medicare fraud penalties (S 18 1:21)

SH Wall St audit trail off enables $28.8M computer fraud (S 12 4) [bogus???]

$H Hertz computer system kept two sets of books for accidents (S 13 2)

$h Hertz charged $5 for gas if < 50 miles driven and tank filled (S 18 2:9)

$H Value Rent-A-Car system charged for bogus 5 gallons (S 18 2:9)

$SH NYC gas pumps rigged to deliver less fuel than charged (S 18 4:3)

$SH Harrah's $1.7 Million payoff internal fraud - Trojan horse chip? (S 8 5) 11 indicted (17 riggings in 3 yrs); `winner' later found dead (stoolie?)

$SH Computer-generated Dartmouth graduation tickets sold for $15 (S 19 4:12)

$h Manual card-swipe gains weeks in taxi charge float (R 20 02)

SH States (MO, NJ, TX) crack down on "cyberfraud" (S 19 4:10)

SHOI Italian police stop digital bank robberies with bogus shadow system; 21 arrested (R 21 08; S 26 1:)

SHOA Linear search nets 17,000 bank records from GST Startup certificate suppliers (R 20 94)

..... Tax fraud and tax data misuse:

$SHAI Massive NY City tax fraud wipes out $13M in taxes; many implicated (S 22 2:23,R 18 63)

$SH Dublin tax collectors faked VAT repayments by spoofing computer (S 12 4)

$SH 45 phony computerized IRS tax returns net $325,000 in refunds (S 14 6)

$SH Computer-filed tax returns net $100K in refunds from bogus W-2s (S 18 1:14)

$SH Tax preparer accused by IRS of $1.1M fraud, 431 false electronic claims; Congressional hearing discloses inmates creating bogus returns; 61,000 bogus returns in 1st 10 months of 1993 totalling $110M (S 19 2:5-6)

$HI Store owner hid $17.1M sales, avoided $6.7M in taxes; cost: $15M (S 18 4:7)

$H Point-of-sale tax evasion via software data diddling in Quebec (S 23 3:25, R 19 48)

SHI IRS agent accused of giving defendant tax data on judges/jurors/... (S 16 3)

SH Thief nabs tax preparer's computer, generously returns floppies (S 13 3)

SPI Risks of IRS outsourcing processing of tax returns (R 18 81,82,87)

mfP Off-by-one error reveals other people's tax details (S 18 3:A6)

..... ATM and credit-card fraud:

$SH US Coast Guard accessed Customs' computer to transfer $8M (S 12 3)

$SH ATM money dispensers blocked and emptied later by youths (S 11 5)

$SH Barclays Bank hacked for £440,000? (S 11 5)

$SH 5 British banks penetrated, blackmail attempt to disclose method (S 16 1)

$SH Cyber-terrorists blackmail banks and financial institutions (article with considerable hype) (R 18 17,24)

$SH MasterCard lost $381M in 1991, Visa lost $259M in 1989 to card fraud; Credit-card fraud investigations of computer misuse in San Diego (S 17 3)

$SHI Visa victim of PC theft with info on 314,000 credit-card accounts (R 18 62)

@SH Nasty scam exploiting Y2K card authorization expirations (R 18 68)

$SH Risks of credit-card numbers being sniffed (R 17 69,71,76, S 21 4, SAC 14 3)

$S FBI sting nabs man trying to sell 100,000 credit-card data items for $260K (S 22 5:14)

$SPH 2,300 credit-card numbers stolen from ESPN Sportszone, NBA.com (R 19 24)

$SHI Tower Record credit-card info offloading; 2 convicted (S 21 4, R 18 02)

SHI Time Inc. employee peddles credit-card information (to detectives) (S 17 4)

$SHI NJ car dealership in theft of 450 credit-card numbers, almost $4M (S 19 2:7)

$SHIO 40 arrested (9 postal workers) in massive D.C. credit-card fraud (S 19 2:7)

$SH 3 Britons charged with 2.5M pound European credit-card fraud (S 19 2:8)

$SHO 2 computer crackers sentenced for $28M MCI credit-card fraud (SAC 13 3)

$SH ATMs gave $140,000 on Visa card over weekend - software glitch (S 11 2)

fSA SW failure in UK credit-card authentication system (S 21 2:18)

$VmA Diner's Club authentication in Belgium out; Royal Bank transmission failure in Canada affects many (R 20 02)

$SHOf Thief gets $63,900 with stolen ATM card&PIN, ATM program error (S 17 2)

$SHAf Security Pacific ATM theft bypasses PINs, limits, nets $350,000 (S 14 1)

$SHfe Australian Westpac ATMs big losses (IMS 2.2 installed untested) (S 12 3)

$SHA $1800 card maker and spied PIN numbers nets $86K from ATMs (S 12 3)

$SHA PC spoofed Italian bancomat ATM, ate cards after capturing PINs (S 14 1)

$SHI UK Clydesdale Bank cash machine fraud; insider job suspected (S 16 2) bank engineer records ATM PINs, fabricates cards, takes money (S 17 3)

$SHrf ATM accepted lollipop cardboard as $1M (New Zealand) deposit (S 11 5)

$Hhf Two cases of erroneous deposits $95,093.35 and $520,000 (R 17 32,35)

$ 525K Smith Barney customers credited temporarily with $19M each (S 22 5:13)

$SH ATM scam gets PINs for stolen cards in Boulder (S 13 4)

$SH UK banks suffer phantom ATM withdrawals, ATM removals! (S 17 3)

@$SH 550 felonies in 1991 for SSN misuse; 12 people adopt a single SSN; $10,000 charge loss; 5 people cleaned out someone else's benefits (S 16 4)

$H Scholarship scam used to gain SSNs, bank and credit-card numbers (S 18 1:14)

$SHI Social (In)Security employees sold 11,000 SSNs to activate cards stolen in the mail (S 21 4),(R 18 02)

P Virginia appeals court bans use of SSNs in voter registration (S 18 3:A11)

SH Japanese department-store credit-card fraud case; incidents are increasing (R 20 77)

$H Japanese BBoard fraud traps passwords, gains money; culprit caught (S 17 4)

$Hhi Greyhound racetrack takes bets after race; NZ$7,000 payout (S 18 2;4)

$SHf Firmware bugs in Dutch gambling machines easy to exploit (S 13 4)

$f Bug in Queensland gambling machines scrambles checking facility (S 17 2)

$SHO Sierra On-Line gaming site cracked (R 19 52)

$SHOIA Risks of offshore Internet gambling (S 23 1:14, R 19 27)

+ Federal prosecutors indict offshore Internet gambling operators (R 19 63)

@+/- Senate bans Internet gambling (R 19 89)

$H Video quiz game scam - teams of "experts" with right answers (S 11 5)

$fH Students cheat Brit.Telecom, gain £68,000 in contest (S 17 4)

$H West German crackers use knowledge of Poker game machine programs for big payoffs. 160,000 machines at risk. (S 12 3)

$SPH Brazilian bank reserve data disappears; political link? (S 18 2:15)

$SPH Kuwait Investment Off. diskettes stolen from Spanish Govt. (S 18 2:16)

$$H Nick Leeson's Barings losses predate new risk-management system (S 20 3:7)

$H Savings and Loan defaults linked to internal fraud, creative mismanagement. What could computers have done for S&Ls to prevent fraud/abuse? (S 14 2)

$SH FBI estimates average computer fraud $650K, total $3B-$5B/year (S 12 3) and $1.5M average for computer frauds in financial institutions [old data?]

$H Customs Service back-dates computer clock at end of fiscal year (S 14 5)

$H Alleged fraud in computer billing services (S 14 5)

SH Risks in check forgery (S 15 1)

Stock-Market Phenomena

$HI Bre-X Minerals gold scam (Indonesian no-gold) causes unprecendented trading, crashing Toronto Stock Exchange computer system (R 19 09); Bre-X, stock from $200 to .06, files for bankruptcy (news item, 9 May 1997)

$ Computer-induced big stock-market swings (S 11 2, 11 5)

$rf Vancouver Stock Index lost 574 points over 22 months - roundoff (S 9 1)

$f Wild stock trade swing reports suppressed on 13 Oct 89 (S 15 1)

$f Quotron SW problem gives wild swings in Dow Jones Industrial Ave (S 15 1)

$f London Stock Market index quotes down for 2:20 [23Jan1990] (S 15 2)

V$m NY Stock Exch. halted for 41 minutes; drum channel errors killed primary and backup computer systems [24Feb1972]

V$fe SW update halts NY Stock Exchange for one hour [18Dec1995] (S 21 2:16)

V$m(h?) Voltage-dip power glitch downs NYSE for 24 minutes [22Oct1991] (S 17 1)

Vm NY Stock Exchange computers crash for about an hour [26Oct1998] (R 20 05)

V$m London Stock Exchange computer system crashes [23May1986]

$hfe London Stock Exchange horrors on cutover to new system (S 12 1)

$S London Stock Exchange "Taurus" problems in paperless authorization (S 17 2)

$df Chicago's Globex trading system delays, critical test fails (S 17 3)

V$m Hurricane Gloria in NY closes Midwest Stock Exchange (S 11 1)

V$df Alberta Stock Exchange shuts down again, 3rd time in 1997 (S 22 4:25, R 18 89)

V$m Telstra's Haymarket exchange overloaded, crashing bank computers, data/fax lines for an hour in Sydney; 1000 manual resets needed (R 19 90)

V$rfh Singapore Stock Exchange outage crashed repeatedly due to interaction with backup system (R 20 47)

mf Stock market problems in 27-28 Oct 1997 fluctuations (S 23 1:10, R 19 29)

V$m Nasdaq OTC stock trading halted for 3 hours (S 12 1)

V$m Squirrel arcs power, halts Nasdaq computers (S 13 1)

V$m Another Nasdaq squirrel 34 min outage, backup power fails (S 19 4:5-6)

V$de/m SW upgrade downs Nasdaq for 2.5 hrs, backup fails (S 19 4:5-6)

$Vhe Network Solutions goof bumps Nasdaq off the Internet (S 23 1:10, R 19 34)

$Vrih NASD loses records on 20,000 brokers (S 22 4:26, R 18 82)

$Vdfh Johannesburg Stock Exchange computer fails, again (S 22 1:17)

$V$m Toronto Stock Exchange down 3 hours; multiple disk failures (S 14 6)

SH Toronto Stock Exchange virus scare causes all-night search (S 18 2:16)

V$m Five NY futures market shut down; uncertainty over cause (S 15 3)

$S GAO finds computer security at stock exchanges vulnerable (S 15 2)

$S Stock Exchange network security flawed, lacked risk analysis (S 16 4)

$H Chicago Bd of Trade automating commodities markets to hinder fraud (S 16 4)

$h Salomon accidental stock sale, value in $ entered in shares column (S 17 3)

h Elbow on keyboard causes 145 sell orders (for 14,500 government bonds) on French futures exchange (R 20 04)

$reh Spanish bank accidentally buys many shares because of bounds check missing after Euro cutover (R 20 20)

$h Iomega stock volatility blamed on AOL postings (R 17 91)

$h Computer glitch on Citicorp merger alters Dow Jones industrial average (R 20 03)

*SH Spoofed press release on Aastrom Biosciences Web site announcing merger with Geron caused stock rumbles (R 20 81)

$h Leaving a field blank temporarily wipes out 13.2B£ in stock selloff (R 20 57)

Telephone Frauds

$SHOA Increasing phone fraud, switch cracking (E.Andrews, NY Times, 28Aug91) Mitsubishi lost $430,000 in 1990, P&G lost $300,000 in l988. NY City Human Resources Administration lost $529,000 in 1987. WRL lost $106,776 in 3 wks. CIA PBX cracked as well... (S 16 4)

$SH $4B phone fraud per year reportedly due to organized crime rings (S 18 3:A7)

$SHO Nevada teens `blue-box' $650,000 in phone calls (S 13 4)

$SHO Canadian $500K phone fraud from altered voice-mail messages (S 19 2:8)

SHAO Pacific Bell voice-mailboxes hacked, bogus messages and passwords (S 19 2:8)

$SHAO Zotos switchboard cracked for $75K in calls (S 13 4)

$SHA Phone credit-card numbers stolen from computer. $500M total? (S 12 3)

$SHO Netfill porn access scams 900,000 credit cards (R 20 37)

$SH Bogus cellular phone chip permitted free calls ($100M/year?); Secret Service developed SW patch, blocking 5000 calls the first day! (S 16 3)

$SH Buyers of hot cracked Italian portable phone pay seller's calls (S 17 2)

$SH US Sprint, computer penetrations, free calls, arrests (S 12 4)

$SHA Crackers attack phone information systems and switches; arrests (S 13 4)

$SHAO AT&T computers penetrated by Herbert Zinn, Jr. (`Shadow Hawk'); $1M program previewed (S 12 4); sentenced; more background (S 14 2)

$SHAO Pac*Bell System computer attacker Kevin Mitnick arrested (S 14 1); further background (S 14 2); sentenced to year in prison (S 14 6); Leonard DiCicco pleaded guilty to aiding Mitnick in DEC SW theft (S 15 1); Kevin Mitnick arrested again after hi-tech tracking (S 20 3:12)(SAC 13 3)

$SH Corte Madera CA teenagers arrested for $150,000 in phone calls (S 13 3)

$SH Milwaukee computerized phone phreaking (S 14 2)

Sfh Risks of modern PABXs and digital phones (R 19 52)

SHAO Many telephone answering machines remotely accessible by anyone (S 13 3)

Sf Security problems in Deutsche Telekom T-Net-Box answering machine (R 19 29)

Sf Remote-access phone security discussed; serious risks (S 18 4:8)

S Sprint account balances freely accessible; potentials for misuse (S 16 3)

$hH NY Telephone free long-distance calls due to software glitch (S 14 5)

$SHf Ringback number glitch in Ireland permitted free calls for 2 wks (S 16 4)

$S Computer intruders access NASA phones. $12M in calls? (S 16 1)

$SH Staten Island youths arrested for voice-mail misuse (S 16 1)

$SH WA prison inmates phreak Fone America via collect-call indirection (S 17 1)

$SH Swedish phone system free call-back from payphones (S 17 1)

$SH Japanese Daiwa Bank hit by prison inmates' phone fraud (S 18 2:16)

$SH $85,000 phone fraud on Minnesota Representative's account (S 18 3:A7)

$SHO Phone calls to Moldova result from porn scam (R 18 80,83,84,87); 38,000 customers get credits or refunds totalling $2.74M (R 19 45)

$SH Prisoner gets free calls by spoofing victim's call forwarding (S 18 4:6)

$SH Plumber call-forwards his competitors' phones (S 20 2:12)

SH$ Emergency call-boxes ripped off, cell-phone serial nos. reused (R 17 35)

SH$ German telephone card system cracked, many free calls made (R 17 36)

SHf$ British Telecom replaces payphone software after flaw exploited (R 17 36)

SH Rigged phone trapdoor enabled priority NBA playoff tickets (S 18 4:7)

@$SH Aussie Cracker charged with phone fraud, accessed US computers (S 16 4)

- Connecticut Dept of Public Utility Control gets slammed (long-distance carrier changed) (R 18 69)

Election Problems

FLASH! We have reporting election problems here for many years. In the 2000 election, particularly in Florida, the chickens have come home to roost, exemplifying everything we have been saying all these many years. Similar to the 1988 fiasco where a 210,000-ballot undervote occurred in the Senate Race in four counties run by BCR/Cronus, 19,000 votes were disqualified for the president in Palm Beach County, and many more in Broward County - perhaps because of the confusion raised by the butterfly ballots. There are also some reports of the left-hand and right-hand pages being improperly aligned, so that a vote for one candidate actually counted for another candidate. Dimpled chad became important - perhaps resulting in part from blocked chad trays (and there was a lot of extra chad resulting the invalidated multiple votes!).

Also, see the November CACM Inside Risks articles from 1990 (PGN), 1992, 1993, and 2000 (Rebecca Mercuri) (http://www.csl.sri.com/neumann/insiderisks.html). Numerous counting problems are noted in the on-line RISKS (R 21 10-12). We note that punched-card systems are inherently flaky (!), but that direct-recording electronic systems tend to be subject to serious fraud, and Internet voting is a disaster waiting to happen in light of the inadequate security of the Internet, personal computer systems, and subvertible servers. Election 2000 demonstrates once again that we need to reexamine the entire election process objectively, and devise less-easily subvertible checks and balances that can provide much greater assurance. (See my analysis in S 26 1:.)

If you are seriously interested in what might be needed for a high-integrity election process, and a further study of the inherent risks, see the outstanding University of Pennsylvania PhD thesis (http://www.seas.upenn.edu/~mercuri/evote.html) of Rebecca Mercuri (mercuri@acm.org), Electronic Vote Tabulation Checks and Balances, 2000.

S[H?] Election frauds, lawsuits (S 11 3, 11 5), mid-stream patches in HW/SW (S 10 3, 10 4), David Burnham, NY Times, 7/29, 7/30, 8/4, 8/21, 12/18 1985. [Most lawsuits later thrown out: not guilty or lack of evidence.] See "Accuracy, Integrity, and Security in Computerized Vote-Tallying, Roy G. Saltman, NBS special publication, 1988, for a definitive report.

S Role of standards (Roy Saltman)(S 18 1:17); see also (R 14 08-11) [Roy has retired from NBS/NIST, and was evidently the government person most knowledgeable about punched-car systems. He is still active.]

SHrf System designs, bad software engineering, standards (Eva Waskell, S 11 3)

SH Computers in Elections (see Ronnie Dugger, 7 Nov 88 New Yorker, and several cited reports); 1988 problems in Florida - 210,000 votes less for Senate race than for President in 4 counties administered by one voting machine company, Business Record Corp., part of Cronus Industries of Dallas, Texas (The New York Times, 12 Nov 1988, S 14 1:20, R 7 78); tally error in Grand Rapids (S 14 1:19-21)

$f Votes lost in Toronto (S 14 1, 14 5); Toronto district finally abandons computerized voting; year-old race still unresolved (S 15 2)

S[H?] Alabama, Georgia election irregularities (S 12 1)

Sh Texas beefs up security of computerized voting (S 12 1)

h Clerical error blamed for election computer program mishap (S 11 5)

hfm 1995 San Francisco elections (S 21 2:19)

f/h/H? Computer error in Cape Town election affects results (R 18 17)

mfie Problems in Montgomery County election, 7 Nov 1995: anti-moisture spray effects, delays, bad operator initialization, phantom votes (R 17 50,56)

h Wrong result in German Bundestag elections due to FAX of double-sided results pages (R 20 04)

m Static electricity affects ballot counting (S 22 1:18)

h Missouri legal decision questions automatic ballot counting (S 13 2)

f Quebec election prediction bug: wrong pick [1981] (S 10 2 pp 25-26, 11 2)

h 6000 moved Australian voters lost from computer election rolls (S 14 6)

hi Brazilian computer blocked twins, like-named siblings from voting (S 12 1) (This problem may still exist in 1994, unless new report was old.) (R 16 45)

SH Cat registered as voter to show risks (no pawtograph required) (S 20 1:16)

m CMU elections suspended because roster database system was down (S 19 2:8)

m Computer miscounts SDI vote in Congress (358 ayes & 237 nays > 435) (S 13 3)

*h Computer data-entry error in vote tallying (2828, not 28) (S 13 4)

h Risks of global editing - name change: `Pollack' -> `Turnoutack' (S 14 5)

f/h? 8 Durham NC precincts had correct totals counted twice (S 15 1)

f/h? VA governor's race also had totals counted twice (S 15 1)

h Read-ahead synchronization glitch and/or eager operator causes large data entry error, giving wrong winner in Rome Italy city election (S 15 1)

h Leftover test data alters Yonkers NY election results (S 15 1)

rf Manual districts required live fudging of Michigan election system (S 15 1)

f Another experience with voting machines in Fairfax County VA (S 15 1)

f Swedish election results delayed by computer errors, 140% returns (S 17 1)

f German parliament election: program rounds up Greens' 4.97%, but 5% needed to count; corrected error gives Social Democrats one-seat majority (S 17 3)

$h Mis-set parameter invalidates Oslo parliamentary election (S 19 1:5)

fh Other risks in unaccountable computerized elections (S 19 1:6)

SH Electronic ballots eschewed in India due to rigging fears (S 16 3)

+? Church of England has certified software for its elections (S 17 1)

SHAO Absentee ballot fraud detected in Colorado since 1984 (S 18 1:18); 11 indicted in Costella Cty CO; 2536 voters with pop. 2278 (R 15 41)

VSH San Jose State voting computer crashes, "fixed". (S 18 1:18)

$f NY City electronic voting machines still unaccepted after spending $20M (R 19 06)

+? A little humor: use of "fixed" vs "repaired" (S 18 1:18)

m Computer disk crash gives ballots with 2 candidates omitted (S 20 1:17)

S? Tampering blamed for lost Peruvian candidacy signatures (S 20 1:18)

hfi Alberta vote-by-phone fiasco (S 20 2:8)

..... 1992 U.S. election events:

m Misaligned Votomatic in Berkeley caused mispunched cards (S 18 1:15)

S? Sandia helps NM develop "uncrackable" phone voting system (S 18 1:15)

hf Oregon computer error reversed election results (S 18 1:16)

hf Programming error reverses DistAtty election landslide in Oregon (S 18 1:16)

h Ventura Cty CA votes reversed on 13 state propositions (S 18 1:16)

h/H? Another voting machine misaligned, biased toward Bush (S 18 1:16)

..... 1996 U.S. election events:

+ Hanging chad removal in punch-card ballots overturns Massachusetts primary election (S 22 1:21)

? Louisiana results questioned because of evidence of misrecorded votes

..... 1998 U.S. election events:

h ABC News accidentally posted test election results before the election (they were correct in 61 out of 70 Senate and Governor races!); Fox TV did a similar thing for a Yankee-Padre World Series game (R 20 05)

..... 2000 U.S. election events:

hi(H?) U.S. and Florida Presidential race complexities [noted at the beginning of the section, outcome still in progress]

h Exit polls blamed for misleading results in disputed Florida counties, although those polls seemingly correctly reflected the intent of voters whose ballots were invalid! (R 21 11, S 26 1:)

fe New voting protocol and new ballot tally system in Cochise County AZ special election resulted in miscounting (R 21 07; S 26 1:)

S Vote auction Web site moves overseas after being outlawed (R 21 11, S 26 1:)

..... Other year 2000 items:

fS? Contribution from Douglas W. Jones, Chair of Iowa State Board of Examiners for Voting Machines and Electronic Voting Systems (S 26 1:, R 21 10). This updates his earlier report on risks in electronic voting in Iowa (R 18 15).

dfeiSPHh NSF workshop on feasibility of e-voting, commentary by Avi Rubin and others (S 26 1:, R 21 10-11)

f$ Also in 2000, Pennsylvania county wins $1M for faulty MicroVote computer voting machines (R 21 10)

..... Internet voting:

rSH Garciaparricide in 1999 All-Star balloting? 25,259 on-line votes cast by a Perl devotee; 22-vote max detected: same e-mail address; needed IP spoofing (R 20 47-48)

SP 2000 Arizona Democratic primary allows Internet voting (R 20 83) and more people voted that way than all votes in the 1996 election. Needs for privacy and anonymity difficult to meet (R 20 84); crypto for voting (R 20 85); See http://www.pfir.org/statements/2000-02 for a discussion by Lauren Weinstein of risks in Internet voting.

fSH Problems with Australian ABC TV show online voting scores (R 21 06; S 26 1:)

Insurance Frauds

$SH Possible fraud on reinsurance - message time stamp faked??? (S 10 5)

$H N-step reinsurance cycle; software checked for N=1 and 2 only (S 10 5)

Security Problems

in computers and communications: Penetrations, Trojan Horses, Viruses, Time-bombs, Scams, Blackmail, and Other Problems:

..... Recent security items for incorporation below:

SH UK Sunday Business reported intruders seized control of a British military satellite, and demanded blackmail (R 20 23)

Sf Security flaw with frames in browsers (R 20 09); risk of coopted back - not just in JavaScript (R 20 11-12)

SAO 3Com security advisory admits to undocumented backdoor for CoreBuilder and SuperStack II switches (R 20 07)

Sf Seeming SecurID flaw granting root access on login (R 20 10) actually NIS client code flaw (R 20 11)

fS Excel 4.0 and Excel 98 mixes up hard disk and floppy, with nasty potential consquences (R 20 08); Excel messes up large numbers (R 20 14)

Sf Internet Explorer 4.01 Son of Curatango cut-and-paste flaw (R 20 09)

Sf NT server worm attacks 10 MCI Worldcom networks (R 20 13)

S Win98 Trojan Horse in installation of Java/Y2K upgrade (R 20 13)

SAO PalmPilots can scan remote-control infrared codes (R 20 10,13); risks of RF garage-door openers, infrared alarm systems, etc. (R 20 13)

SM Auctioning of frequency spectrum undermines Pentagon's ability to counter interference risks on cruise missiles (AW&ST item) (R 20 07)

SM Sweden recommends banning mobile telephones on ships; Norwegian man consistently caused ship rudder to swing despite vessel on autopilot (R 20 08)

SM Security risks of laptops in airline cockpits (R 20 12)

SH Risks of Internet vote rigging: BBC Sports Personality of the Year (R 20 11)

SH Rhode Islander sentenced for intentional damage and unauthorized access (R 20 23)

M Man's cell phone interferes with all traffic in GTE Wireless tower (R 20 18)

S Viruses spread in Sea Launch documents (R 20 16)

VSH Smurf denial-of-service attack on Ozemail ISP (R 20 16)

SH Unsuccessful cracker takes it out on challenge creator (R 20 19-20)

$SHO German bank being blackmailed by putative cracker (R 19 56)

- High-school student expelled for writing article on hacking (R 19 56)

SH Ransom note on Yahoo demands freeing Kevin Mitnick (R 19 50)

S(not-H?) Matthew Bevan (a.k.a. Kuji) cleared of unauthorized access charges; also reference to GAO report on Rome Lab breakins (R 19 48)

$S Wells Fargo issues ATM/Check cards, which are actually debit cards; analysis by Lauren Weinstein (R 19 49)

Sf Security vulnerabilities in Common Desktop Environment (CDE): faulty argument check (R 19 57)

Sf Potential risks associated with Mobil Speedpass at gas pumps: replay attacks with RF and no PIN in TI's TIRIS (R 19 52)

SHm 4-watt GPS/Glonass jammer from Russian Aviaconversia (R 19 54)

*M? Australian air-safety report gives 30 cases of possible in-flight electronic interference (R 19 55)

+ Lufthansa combats mobile phone risk with detector (R 19 48)

Si Risks of new Motorola car-control-via-pager system (R 19 50)

+ Discussion of IEEE/ACM Code of Ethics (R 19 57)

$H Oregon DMV lost $15K photo licensing equipment (R 19 16)

m Report that "hackers get into Ramsay case computer" (R 19 23) is false; it was a dead CMOS battery!! (R 19 24)

Sfi Security flaw in Rogers Cablesystems Wave gives access to other users' data (R 19 43)

m Mobile-phone electromagnetic radiation causes short-term memory loss; related to talkers' road accidents? (R 19 39)

S PBS and TV "Barney & Friends" signal to activate interactive Barney doll via Microsoft ActiMates set-top box (R 19 39)

? Satanic Risks with GPS in every mobile phone? Comments on Lucent, Limbo, Styx, 666 5th Ave. in NY, from the Fortean Times (R 19 51)

- Computer system implicated in need for death-penalty review (R 19 29)

S Discussion of leaked report on Mondex security flaws (R 19 38)

- Gerber net hoax (R 19 43)

S+$ "Crack a Mac" contest server cracked; winners get 100,000 Swedish kronor each (R 19 31)

? Encoded circuit board missing from Chinese rocket (R 19 84) Chinese suspected of extracting it, later report it must have burned up on reentry

H? Three alleged Quebec hackers accused of posting bomb recipes (R 19 81)

SHO Department of Energy discovers security vulnerabilities, with 1400 Internet systems having classified or sensitive information (R 19 81)

SHO German phone-cards cracked by Dutch crackers (R 19 77)

ShHOA Dutch ISP WorldOnline security failures (R 19 85)

SHOA CzERT group of hackers ravage Czech & Slovak cyberspace (R 19 77-78)

SHO Information Warfare in Israel (R 19 77)

Sfi Excite referer-log security hole (R 19 78-79, 19 90)

SH/h/f/etc. Discussion of defining the line between hacking and Web surfing, by Eli Goldberg (R 19 84-85)

SP Burglars foiled by cordless-phone interception (R 19 80)

S SPA/BSA report: computer industry lost $11.4 billion in piracy.

*VM Electromagnetic interference on defense systems such as Patriot, Predator, radars, telephones, etc. (S 24 1:34, R 20 04)

M Sensormatic Ultra-Max shoplifting gate in bookstore interfered with 72-year-old man's defibrillator (R 20 05)

M GPS on M.V. Manatoulin cargo ship failure traced to interference from the captain's TV antenna (R 19 90)

SH Malaysian unrest; broadcasters' reports censored; satellite communications intercepted and blacked out (R 20 01)

SH Irish gang physically takes out telephone exchange (R 20 01)

fS JavaScript flaw in Netscape allows reading of other caches (R 20 02)

Sf Cult of the Dead Cow Windows 95/98 BackOrifice Backdoor (R 19 90)

Sf NT security flaw allows impersonation of admins (R 19 90); further discussion on the old days, C2 certification, etc. (R 19 95-96, 20 01-02)

Sf Windows NT 5.0 reportedly about 48M lines of source code (R 19 90)

SHAO AOL-official masquerader changes aol.com domain-name entry, takes AOL off the Net (R 20 04)

SHO Computer consultant-hacker investigated for using 2,585 computers and 10.63 computer-years in prime-number search; detected by US West intrusion response team (R 19 97)

SHf Small credit unions easy targets for debit-card fraud (R 19 93)

Sf BankBoston and USTrust ATM teller machines truncate PINs to four digits! (R 19 89)

SH Custom alarm decoders break electronic car systems quickly (R 19 93)

ffffSH Frequent security break-ins at the Pentagon (R 20 24)

Sh Sweep detects 31 secret files in former CIA Director John Deutch's PC (R 20 30)

SH JavaScript eBayla virus infects eBay auction (R 20 32-33)

SH Fake Swedish ATM front panel copies cards and PINs (R 20 31)

$H 13-year-old makes $3M in bids on eBay auctions, wins a few and messes up others (R 20 35)

SHf Yugoslav forces have been intercepting unencrypted NATO air communications and thwarting attacks; consequence of ITAR export-control regulations? (R 20 37)

SH Military-strength version of Windows NT certification problems: NT 3.5 is C2 (when standalone), NT 4 is not certified for the networked use NATO uses it for (R 20 36)

Sf Woody's Office Watch reports virus-infected documents on MS Web site. (R 20 34)

S Shamir's TWINKLE machine could increase speed of factoring by 3 to 4 orders of magnitude, threatening 512-bit public-key crypto keys (R 20 38)

Sf False virus detection: searching for Melissa (R 20 40); HotMail and the happy99.exe infection; Virus Scan misses it (R 20 40)

Sfff Discussion by Bruce Schneier on Why Computers are Not Secure (S 25 2:18, R 20 67,69)

Srf DVD CSS encryption algorithm cracked with 2¹⁶ attack with 6 bytes of known plaintext, with 40-bit key; freeware software remove copy protection (R 20 64-65,67,69), with detailed analysis by Bruce Schneier (R 20 66); jail for possessing a debugger? (R 20 74)

Sf GSM cell-phone encryption cracked by Birykof and Shamir (R 20 67,69) See http://www.crypto.com/papers/others/a5.ps

SHf Pirate broadcasters overtake Radio Data System (R 20 74)

Sf BlackICE Defender security product opens up gaping flaw (R 20 64)

$Sf U.K. bank (Halifax) suspends on-line share trading over security flaw enabling you to trade for others (R 20 66)

$SH Hacker redirected browsers from Staples to Office Depot (R 20 66)

SH "Anonymous" Hotmail e-mail threat traced to AOL user (R 20 66)

Sf Defective crypto in Netscape e-mail password saver (R 20 68,70,74)

S Netscape mail confounds two accounts for one user (R 20 70)

Sf Installing IE 5.0 changes the OS topology! (R 20 66)

Sf No bounds checking in Microsoft RTF controls (R 20 66, 68-69)

Sf Mini-Zip virus (R 20 66)

SH Canadian debit-card fraud: doctored swipe readers transmit mag stripe info and PIN (R 20 69)

$S Sanity.com allows CD orders without payment, in attempt to avoid credit-card risk (R 20 68)

P Sanity.com violates its own privacy policy by divulging e-mail addresses (R 20 71)

Sf Further CERT Advisories 99-15,16 on buffer overflows (R 20 69)

SHV Dell loses five days' production time in Ireland to FunLove Virus (R 20 66)

$SA Automated money laundering: counterfeit Japanese 500-yen coins made from Korean coins worth about 50 yen accepted by coin machines; coin return yields a genuine coin! (R 20 67-68)

Si Risks in MS Outlook 98: sensitive attachments missent (R 20 67); trying to delete e-mail: embedded html executes OpenWindow to remote site (e.g., porn, which is logged) (R 20 69)

SH Various risks of Conducent/TimeSink ads in software (R 20 65)

*Sfi ATM user trapped for 9 hours by automatic 9pm lock, with no escape (R 20 66)

SH$ Salary payment diskettes intercepted and manipulated (R 20 54)

VS* If payments are delinquent, car might not start, or could stop while running (R 20 54)

SHA Web users "page-jacked" by pornographers (R 20 60)

SHA "United Loan Gunmen" attack on NASDAQ, AMEX, previously C-Span, ABC, Matt Drudge sites (R 20 58)

h Stray faxes for U.S. Embassy go to Auckland NZ chicken farmer (R 20 56)

SHAPf* More on biometrics, including iris scans (R 20 41-43); Thumbprints in Malaysian smart cards (R 20 43)

SHA Author of false e-mail arrested for starting panic (R 20 47-48)

SHAO Yet another ATM scam: Trojan-horsed keyboard (R 20 46)

S New ICQ Trojan as JPEG (R 20 57)

Sf Hotmail Trojan horse captures passwords (R 20 57)

Sf Race condition flaw in Microsoft JVM / Java library with IE4 and IE5 (R 20 55); further flaw in MS bytecode verifier (R 20 62)

Sf Microsoft "fixes" the macro virus vulnerability in MS Office (R 20 42); also problems in Word 97 (R 20 57,59)

Sf W32/ExploreZip.worm "virus" and user interfaces (R 20 44)

Sf*$ Vulnerability in Windows SSL server and common browsers: private key with exponent 1 (R 20 41)

Sff ActiveX security problems in IE (R 20 44), in Windows 98 (R 20 50-51); Richard M. Smith's test page for dangerous ActiveX controls, recommendation to turn off ActiveX in IE5 (R 20 56)
http://www.tiac.net/users/smiths/acctroj/axcheck.htm

Sf More risks of Internet Explorer 5 (R 20 54); more flaws in Internet Explorer 5.0 interactions with ActiveX (R 20 61) plus further flaw in MS Java VM (R 20 62)

Srf Security vulnerability in Netscape: <title> of bookmarked page is executed! (R 20 42)

SHf Allaire/ColdFusion firewall vulnerabilities (R 20 43)

SHOA Hackers breach Firewall-1 (R 21 02; S 26 1:)

Sf Critical Path has serious security hole affecting many including NSI (R 20 59)

S Security flaw in Texas Hold 'em Poker program (R 20 56)

S Auto-Fix feature for Dell PCs opens up security hole (R 20 55)

SH$ eBay scam results from last-minute withdrawal of ridiculously high bid (R 20 51)

S-ethics Clinton's Executive Order on Unlawful Conduct on the Internet (R 20 53)

Sm,h,rf Maldesigned Baltimore computer system CCMS slows Pentagon background checks (R 20 46)

? Supreme Court upholds CDA barring indecent speech online (R 20 45)

VSHf,etc. Risks of e-mail borne viruses, worms, and Trojan horses, by Bruce Schneier (R 20 45); security sites vandalized (R 20 53)

S Commentary from Bruce Schneier on Back Orifice 2000 (R 20 57)

Sf CERT Advisory CA-99.06 ExploreZip worm (R 20 44); See http://www.cert.org for background.

ShA DoD password management policies questioned (R 20 50)

SA Security risks in "Treasury Direct" (R 20 50)

SH Microsoft employee apparently posted aliased message falsely blaming AOL for a security flaw (R 20 54)

SHf London Underground sequence rollover: certain 2-year-old Travelcards work again! (R 20 48)

SM*? Cell phones and aviation electronics; One year in jail for cell-phone use on a plane (R 20 50-52); Chinese jet driven off course (R 20 53)

Hhm Cell-phone hoax takes down Lebanon's phone networks (R 20 43)

hi Report on hacker altering MIT grades false; spreadsheet missorted (S 25 3:16-17, R 20 84-86)

* Possible victims of Iridium demise: Pacific rower, Norwegian transpolar skiers (S 25 3:18, R 20 85); Iridium flames out (R 20 87)

$h Reserve Bank of Australia (RBA) announced an unexpectedly larger interest rate hike at at 9:30 a.m. on 2 Feb 2000, but accidentally sent 64 people e-mail 6 minutes earlier. In those 6 minutes, approximately AUD$3 billion worth of bill and bond futures were dumped on the market. (David Shaw, R 20 78)

f U.S. Census prepends extra digit to house numbers in mass mailing (R 20 83)

$hf UK woman dunned for underpayment of four pence (R 20 75); other small debts (R 20 76)

f Letter from Jim Allchin, Microsoft on Windows 2000 bugs (R 20 80) and comments (R 20 81-82)

f More on MS Outlook Express feature: line begins with "begin ", following which everything is an attachment (R 20 75-76); more risks with pine bug (R 20 78-79,81)

f Risks of Authenticode in Windows 2000 (R 20 81 after R 18 89)

fi Computer-truncated flower-delivery message brings police (R 20 83)

hi National Weather Service tests leak out live (R 20 82)

f Weather.com leaves visitors in the cold, with erroneous temps (R 20 85)

SHO Feb 2000 distributed denial-of-service attacks disable Yahoo, Amazon, eBay, CNN.com, Buy.com, ZDNet, E*Trade, and Excite.com for a few hours each. (S 25 3:19, R 20 79)

SP French spies listen in to British business phone calls (S 25 3:20, R 20 77)

$SHO Hackers sued by software-filtering company (S 25 3:20, R 20 84-86)

$SHAO Credit-card data used for extortion (S 25 3:20, R 20 75)

*fff Rhode Island computer arrested innocents (S 25 3:20, R 20 76)

$SHAO Global Hell hackers steal 63,000 passwords (S 25 3:20, R 20 76)

SHAO Judge sends message to network vandals: "go to jail" (S 25 3:21, R 20 83)

+S U.S. removes most restrictions on encryption software (S 25 3:21, R 20 76-77)

+S U.S. government abandons Bernstein restrictions (S 25 3:21, R 20 82)

SP China to require encryption information (S 25 3:21, R 20 78)

SH Online prankster distorts Clinton chat (R 20 80)

SHOf Junk e-mailer uses closed e-mail list as a relay (R 20 79)

Sf UK ISPs leave themselves wide open to potential abuse (R 20 83)

Sf CERT Advisory http://www.cert.org/advisories/CA-2000-02.html on malicious html tags embedded in client Web requests; (R 20 78)

$- Offshore online gambling operator convicted in NY placing illegal wagers over phone lines (R 20 84)

Sfi Risks of a hyperactive anti-viral immune system (R 20 84)

SHh etc. Computer Security: Will We Ever Learn? (Bruce Schneier, S 25 4:8-10 and R 20 90)

S Peter Junger case: encryption code protected by First Amendment (R 20 87-88)

P UK Regulation of Investigatory Powers Bill requires ISP to record all traffic; use of crypto can put you in jail if you cannot produce the key! (R 20 90)

SHf Code protecting Stephen King e-book Riding the Bullet cracked (R 20 87)

SHAO Love Letter Worm affects Microsoft Outlook users; See CERT Advisory CA-2000-04, http://www.cert.org/advisories/CA-2000-04.html, summarized in (R 20 88); See related items (R 20 88-89), security patch to disable attachments (R 20 89), and risks of antiviral software (R 20 90)

Sf Risks of reading zipped Microsoft text including .exe files (R 20 90-91)

SHf Peacefire: Eudora "Stealth Attachment" security hole discovered (R 20 88)

SHf Netscape Navigator improperly validates SSL sessions, CERT Advisory CA-2000-05: http://www.cert.org/advisories/CA-2000-05.html, summarized in (R 20 88); see also Misleading warning (R 20 89)

SHf Microsoft Office 2000 UA ActiveX Control Incorrectly Marked "Safe for Scripting": CERT Advisory CA-2000-07, http://www.cert.org/advisories/CA-2000-07.html, summarized in (R 20 89)

SHAO Canadian teen (Mafiaboy) held in February 2000 Web attacks on Yahoo, CNN.com, eBay, Amazon (R 20 87)

Sf Web server displays admin password on failures (R 20 87)

SHP The Mirror reports recovery of top-secret stolen UK laptop with Strike stealth-fighter data (R 20 89)

SHP Qualcomm CEO's laptop vanishes, containing corporate secrets (R 21 05; S 26 1:)

SHf Windows NT storage residue in supposedly deleted files (R 20 88)

Shm Venezuela postpones election due to computer problems (R 20 89)

*Sf Discussion of 2 devices allowing police to stop arbitrary cars (R 20 89) GM's OnStar for location, but also may allow remote hacker activities (R 20 90)

S? India considering use of railroad communications for Internet connectivity (R 20 90-91)

S?f? More risks of networked home appliances (R 20 88)

M Study shows mobile phones do interfere with old-generation avionics (R 20 89)

SV Scientists spot Achilles' heel of the Internet; critical nodes (R 20 98)

SHI During a Verizon strike, 2 NY employee saboteurs cut a power cable next to a telephone cable, suffering burns (R 21 03; S 26 1:)

Sf NATO antivirus developers accidentally create Anti-Smyser1 virus that spills secrets (R 20 93; S 26 1:)

Sf Major security hole in Anna annapa.com online organizer service (R 21 02; S 26 1:)

Sfh "Verify your age with a credit card": more than $188M fraud (Lenny Foner, R 21 03; S 26 1:)

SH Cyber-extortion increasing (R 20 94; S 26 1:)

*m Microsoft software can damage your hardware! Plastic CD-ROM fragments and frags (R 20 92); hairline fractures in center hole dangerous (R 20 94)

f Another Win95/DOS interaction (R 20 93)

Sf Outlook buffer-overflow bug on date allows self-executing Trojan horses (R 20 97)

SHOAi Fake PayPal site (PayPaI.com) collects user IDs and passwords (R 20 97)

S (not-for-kids) Burger King gives away CD-ROM with porn addresses (R 20 93)

f Edmonton man finds security hole in video slot machines, gets sued (R 20 93)

Sf Risks of using HTML Mail and HTTP proxy "censorware" together (R 21 05-06; S 26 1:)

Sr Tighter security at Los Alamos may actually decrease security (R 21 07; S 26 1:)

Sf SSL Server Security Survey: 32% dangerously weak (R 21 02; S 26 1:)

Sfde? New Navy aircraft carrier to run Win 2000 for critical functions (R 21 05)

Sf Windows NT/2000 "Lock Computer" allows palm sync (R 21 04-05)

Sf Pretty Good Bug found in Windows versions of PGP for "trusted" third parties (R 21 03)

fS Norton Antivirus 2000 defect on Win2000 content (R 20 94)

Sf Security hole in Netscape infects computers, opens access (R 21 01)

SH? (no) Report of hacker endangering astronauts in 1997 (R 20 93) disclaimed by NASA (R 20 94)

SHA Risks of automated boarding passes for airline e-Tickets (R 21 02)

e NY State running out of fingerprint IDs (R 21 02)

[S-spoof] New security vulnerability: 13-year-old `r00ts' popular polynomial, crypto-spoof article by Leonard Richardson (R 21 03)

..... End of recent security items yet to be inserted ..... Security flaws:

*SHAf Many known security flaws in computer operating systems and application programs. Discovery of new flaws running ahead of their elimination. Flaws include problems with passwords, superuser facilities, networking, reprogrammable workstations, inadequate or spoofable audit trails, ease of perpetrating viruses and Trojan horses, improper handling of line breaks, etc. Lots of internal fraud and external penetrations.

f Stanford sendmail buffer overflows saturated systems (S 15 1)

Sf Security flaw (buffer overflow) in popular e-mail programs and the programming language implications (R 19 90-93)

Sf More on buffer overflows: CERT Advisories (S 24 3:27, R 20 21) Note: Steve Bellovin remarks that 8 out the 13 CERT Security Advisories for 1999 involved buffer overflows!

Sf Ross Anderson et al. responded to MobilCom challenge (R 18 45) to hack GSM for 100,000 DMarks, found flaw, but discovered the offer had been withdrawn. (R 19 48)

SPAHO Unencrypted Secret Service pagers intercepted, despite demos of the vulnerabilities 3 years before at Hackers on Planet Earth (S 23 1:13, R 19 39,40)

SPAHO New Jersey company intercepts pager messages, sells them to media (S 23 1:13, R 19 35)

f GSM phones recalled for software upgrade (R 19 27,30)

@Sf Crypto-based security in 90 million GSM phones cracked by Silicon Valley "cypherpunks" (R 19 67) $SHf CERT Advisory, IP spoofing attacks, hijacked terminal connections; Robert T. Morris, Tsutomu Shimomura, John Markoff, Kevin Mitnick (S 20 2:13)

S Security flaw in NCSA httpd phf (R 18 69,70); CERN httpd (R 18 71)

S Sun's Hot Java executes its code on your Web browser (S 20 3:9)

Sf Netscape had a rough time securitywise: 40-bit crypto breakable, random number generator crypt seed breakable, bounds-check flaw (S 20 5:13)

SO More risks of allegedly random numbers: spoofability (R 18 89)

S Andrew Twyman reduces cost of cracking Netscape's 40-bit crypto to $584 (from $10K) (S 21 4:18, SAC 14 3, R 17 65)

S Risks of Trojan horses with HotJava and Word (R 17 39-41,43,45,46,52); see particularly Marianne Mueller in (R 17 45)

Sf More browser/server security problems in Java/JavaScript/Netscape (S 21 4:18, SAC 14 3): Dean, Felten & Wallach, Princeton, in (R 17 77); others (R 17 65,66,77,79,80,83-91,93-95, R 18 01,02); Abplanalp and Goldstein (R 18 06); David Hopwood (R 18 08), including a summary of Java-related bugs, with a pointer to John LoVerso's JavaScript bug list (R 18 08); further problems were reported in Java and JavaScript (R 18 09), in Netscape 2.02 (R 18 13,14), and again in Java (Hopwood, R 18 18). Princeton team finds Java security bugs in Microsoft Internet Explorer 3.0beta3 and Netscape Navigator 3.0beta5 (R 18 32); More on Java security (Mueller, R 18 50); Flaws in and Microsoft's warning on Internet Explorer 3.0 (R 18 36,38); ActiveX security risks (R 18 69)

Sf More Java woes: Princeton team finds new flaw in Java ClassLoader that disables security controls in Netscape Navigator 4.0x (S 23 5:27, R 19 86)

- Appropriateness of Confutatis Maledictis in MSIE advertisment? (R 19 23)

VSf Land Attack (land.c) denial of service on TCP implementations; Microsoft implications; also see BUGTRAQ (R 19 48,49)

f Microsoft Office 97 e-mail gives sight to blind copies (R 19 08)

Sf Ruminations on MS security (S 23 4:24)

SH Enumeration of over 100 holes in Windows NT (R 19 65)

f Another privacy bug in Netscape Navigator 2.0 (S 22 4:31, R 18 74)

SP More on risks in Netscape browsing histories (R 18 79)

SOf Netscape flaw allows reading of entire hard drive (R 19 22,23)

SAf Netscape Communicator 4.01 for Windows 95/NT risks include forgeable digital signatures (R 19 30)

Sf Netscape Communicator 4.02 and 4.01a allow disclosure of passwords (R 19 34)

$Sf Risks in Secure Electronic Transaction (SET) protocol (R 19 31-36,48)

SHP Security hole in Shockwave Web browser exposes e-mail (R 18 91)

Sf More on Java security (R 18 77,79,87); Another Java security flaw (R 19 11)

f Discussion of local classes in Java, flaw and fix (R 19 41,42)

Sf Good Java security vs good network security (R 18 61)

S More on Java performance (R 19 77) and applet security (R 19 78-79,81); vendors unite against bad applets (R 19 84), but Li Gong reminds us of the pervasiveness of mobile-code risks: CD-ROM, zip drive, Lisp code, Java applet, Word document, agent software, browser plugin, postscript file, removable storage, ActiveX components, articles posted to newsgroups, any number of scripting languages, attached e-mail components (MIME), floppy disk (demo disks you receive in the post), someone over the phone asking you to run a program, ... (the list goes on and on) (R 19 85)

f Security hole reported in Java 2 (JDK 1.2) (R 20 30), fixed in JDK 1.2.1

Sf Security problems in ActiveX, Internet Explorer, Authenticode (R 18 80-86,88-89); in particular, see detailed comments from Bob Atkinson (R 18 85) and subsequent responses (R 18 86-89); Paul Greene at Worcester Poly finds IE flaw (R 18 85); EliaShim notes two more IE flaws (R 18 88); Another ActiveX flaw (R 19 06,09)

i ActiveX controls - You just can't say no! (S 23 3:26, R 19 55)

SOf Internet Explorer runs arbitrary code: MIME type overridden (R 19 14)

Sf IE security bug with Active Scripting (R 20 80)

SOf More on Web browser risks (R 19 18)

Sf More on NT security (R 18 82,84,86-88); Another Windows NT security flaw (R 19 02)

Sf NT passwords bypassable by overwriting hashed password (R 18 62)

Sf Making good ActiveX controls do bad things (R 18 61); more risks (R 18 62)

Sf Chaos Computer Club demonstrates ActiveX/Quicken flaw on TV (R 18 80,81)

SHO Beware of offer of remote ActiveX-enabled antivirus scanner (R 19 30)

Se Microsoft Java/COM integration support does automatic upgrades (R 18 64)

@SP Discussion of security and privacy implications of "cookies" (squirreled information in browsers) (R 18 19,20, 63,65,67,68,70,72,78,79,88,92); residues in Internet Explorer 3 (R 18 68);

Seh Over 10,000 sites running nonsecure versions of NCSA Web server (S 21 4:17, SAC 14 3)

Sf SATAN anticracker software; discussion; version 1 flaw (S 20 3:12)(SAC 13 3)

Sf Master password generation algorithm uses program bug in LOGIN (S 12 3)

Sf Flaw in Sun 386i - argument that bypassed authentication (S 14 5)

Sf DEC/Ultrix 3.0 breakins using tftpd, weak passwords, and known flaws (S 15 1)

Sf SunOS 4.0.x rcp problem, exploiting /etc/hosts.equiv , /.rhosts (S 15 1)

Sf Password Snatching? RS-232 data tap advertised for $29.95 (S 12 3)

S Flaws in Kerberos version 4 and 5 (S 21 4:17 SAC 14 3, CERT Advisory CA-96.03)

Sf Security hole in SSH 1.2.0 permits remote masquerading (R 17 66,68, SAC 14 3)

Sf Trojan horsing electronic countermeasures? Def.Electr. Oct 89 (S 15 1)

SH Risks of infrared-reprogrammable parking meters (S 15 5)

Sf Risks from using laptops with cellular phones (S 15 5)

SHf Justice Department computers vulnerable remotely (S 15 5) @ $S GAO finds computer security at stock exchanges vulnerable (S 15 2)

S PRODIGY security and integrity problems discussed (S 15 2)

Sf CTSS raw password file distributed as message-of-the-day; editor temporary file name confusion. See Morris and Thompson, CACM 22, 11, Nov 1979. (S 15 2) Also FJCorbató, 1991 Turing Award Lecture, CACM 34, 9, 1991, pp. 73-90.

SPf Bad pointer dumps encrypted passwords as message-of-the-day (R 17 44)

SH Dictionary-based password cracking (Morris-Thompson) happening (S 15 2)

$Sh NZ Kiwinet posts new default password (S 16 4)

$Sf RISC architectures crashable from user mode (S 15 5)

Sf SunOS SPARC integer division grants root privileges divide&conquer (S 16 4)

S Hitachi's dynamic microcode download facility (S 16 2)

S Root console spoofable by function-key remote reprogramming (S 16 4)

S Security breach in UK Government Whitehall computer (S 17 2)

SH Crackers of Boeing and Seattle US District Court fined $30K (S 18 4:9)

f FAX in send mode receives someone else's FAX instead (S 19 2:3)

i Wrong fax code sends antiQuebec message to French-language papers (S 19 3:9)

SP IRS checks mailed with visible SSNs and amounts (S 19 4:10)

SP Lexis-Nexis P-Trak database includes unselectable SSNs (R 18 43-45,47-49)

Sf Univ. California computerized retirement system flaw (S 21 4:17, SAC 14 3)

Sf Authentication in Lotus Notes has security flaws (S 20 3:9, R-17.10)

Sh? Randal Schwartz finds security flaws in Intel, convicted (R 17 23,28)

Sf More on Windows security bugs (R 17 62)

Sf Windows 95 security hole: file names beginning with extended-ASCII 229 (S 21 4:17, SAC 14 3)

Sf Win 95 Microsoft TCP/IP flaw freezes system (R 19 26)

f Filename bug in Windows 95 (S 21 5:18)

i Risk of renaming a Windows 95 computer on a network (R 19 56)

i Windows 95 renaming problem (R 19 66)

f Warning! NT 4.0 utility wipes system configuration (R 18 49)

f Windows NT 4 corrupting filespace and deleting directories (R 19 63)

Sf Password unsecurity in NT cc:Mail release 8 (R 19 37)

Vmf Massive NT outage due to registry corruption (R 19 60)

f Bug in DoD Common Operating Environment screen-lock consumes resources (R 19 42); NT screen savers also risky (R 19 43)

i Risks related to Ctl-Alt-Del (R 19 28,29,31,32)

Sf Paper by Avi Rubin on Microsoft Passport flaw (R 20 85)

Sf Bug in Microsoft Word 6.0, 6.0a releases unintended info (S 20 1:19)

Sf More on Microsoft WORD macro security problems (R 18 70-72,75-77,79-89)

Sf Microsoft again distributes a Word Macro Virus: WAZZU.A (R 18 53)

Sff Microsoft vulnerabilities, publicity, and virus-based fixes (good analysis by Bruce Schneier, R 21 01)

Sf Macro virus lists from Klaus Brunnstein, ftp://agn-www.informatik.uni-hamburg.de/pub/texts/macro/ and ftp.informatik.uni-hamburg.de/pub/virus/macro/macrolst.* (R 19 24)

S+ After October 1997 Macro Virus contamination and Eligible Receiver demonstration of significant vulnerabilities, NASA requested DoD to attempt penetration exercises (R 19 74)

Sf New Word macro virus WM/PolyPoster posts Word documents to 23 Usenet newsgroups (R 19 85)

$SHO Chernobyl CIH virus hits on 13th anniversary, attacks Windows 95/98; damage reportedly worst outside U.S., especially South Korea (R 20 34) and Sri Lanka, with usual rumors that it was created by an anti-virus supplier (R 20 37)

Sf OS/2 Warp TCP/IP misfeature (S 21 5:19)

SHA Another risk of reusable passwords: sharing them to avoid Web fees (R 18 85)

@SHI Dutch electronic-banking direct-debit scandal: Friesian church minister discovers surprise privileges (R 18 81)

..... Penetrations and misuse by "nonauthorized" personnel:

!SH China executes hacker for embezzling £122,000 (S 18 3:A12)

SPH British Telecom's Prestel Information Service - demonstration for a reporter read Prince Philip's demo mailbox and altered a financial market database [London Daily Mail 2Nov1984] (S 10 1) Break-in being prosecuted (1st such prosecution in Britain) (S 11 3) Conviction reversed by Appeal Court and House of Lords (S 13 3)

SHAfe W.German crackers plant Trojan horses, attack NASA systems, exploit flaws in new OS release (S 12 4, 13 1); perpetrator arrested in Paris (S 13 2). See also (R 08 36,37 [response from `pengo'],38).

$SHAOf Lawrence Berkeley Lab computer break-ins by Markus Hess; Stoll planted phony computer file; file requested (S 13 3, Cliff Stoll, CACM May 1988); see Cliff Stoll, `The Cuckoo's Egg: Tracking a Spy ...', Doubleday 1989. Hess and others accused of KGB computer espionage (S 14 2); Three of the Wily Hackers indicted on espionage charges (S 14 6), `mild' convictions on espionage, not `hacker' attacks [15Feb1990] (S 15 2)

S Report from the Chaos Computer Club Congress '88 (S 14 2)

SHf Hacker enters Lawrence Livermore computers (S 14 1)

SH South German hackers hack TV German Post dial-in poll (S 14 6)

SH Discussion of Dutch Intruders breaking in to U.S. systems (S 16 3)

SH Dutch Hackers H.W., R.N. arrested; reportage from Rop Gonggrijp (S 17 2)

SH First Dutch computer hacker arrested under new Dutch Law (S 18 3:A12)

$SH Kevin Poulsen (Dark Dante) arrested (S 16 3); accused of rigging radio contests by phone hacking (S 18 3:A13) tapes, other evidence seized from locker ruled inadmissible (S 19 2:9); espionage charges dropped; Poulson pleads guilty to other charges (S 21 2:20)

$SH Leonard Rose (Terminus) guilty of unauthorized possession of UNIX source and distributing access-capturing Trojan horses (S 16 3)

$SHA 5 NY Master of Disaster hackers' Federal 11-count indictment (computer tampering/fraud, wire fraud, wiretapping, conspiracy; phones, computers, credit) (S 17 4); Phiber Optik (Mark Abene) sentenced to 1 year + for conspiracy, wire fraud (S 19 1:8)

S? Feds arrest hackers nationwide in Operation Sun Devil; Steve Jackson Games investigated for cyberpunk fantasy game rules (S 15 3); Secret Service rebuked for Steve Jackson Games investigation (S 18 3:A8)

$SH "Sun Devil" indictments: "Doc Savage" arrested for tel/credit fraud (S 16 3)

$SH FtWorth programmer Donald Gene Burleson plants time-bomb, deletes 168,000 brokerage records; convicted, fined (S 13 3, 13 4)

SH University of Surrey hacker arrested ... and released; Edward Austin Singh penetrated 200 systems (S 14 1)

SH UK "Mad Hacker" (Nicholas Whiteley) goes to jail (S 15 5); appeal fails (S 16 2); new British Computer Misuse Act (S 15 5)

SH Intruder hacks into Cambridge University systems (R 18 09-10)

SH UK hacker "Datastream" finally arrested (S 20 2:13)

SH Hackers break into Macedonian Foreign Ministry phones (S 23 3:24, R 19 46)

SH R.G. Wittman accused of felonies in hacking NASA computers (S 17 1); sentenced to 3-year probation, mental health treatment (S 17 3)

$SH 2 Norwegians fined for fraud; telephone fraud, browsing ignored (S 19 1:8)

@SH$ Russian hacker Vladimir Levin breaks Citibank security (S 20 5:13, R 17 27-29,61); Levin pleads guilty (R 17 61), sentenced to 3 years, with $240,015 restitution; 4 accomplices previously pleaded guilty (R 19 61)

SHOA 3 Croatian teenagers cracked Pentagon Internet systems. Classified files allegedly stolen (?). Zagreb Daily suggests damaging programs could cost up to $.5M (?) (R 18 84)

SH Pentagon computers hacked ("most organized and systematic" according to John Hamre); Cloverdale high-school kid blamed (R 19 60); in blaming "hackers", DoD seems to be oblivious to its own bad security

SPH Carlos Salgado Jr. pleads guilty, max up to 30 years, $1M fines (R 19 34)

SH Wendell Dingus sentenced to 6 mos home monitoring for cracking USAF and NASA computers from Vanderbilt U. (R 19 35,36)

SH Former IRS employee indicted for fraud, illegal browsing (S 20 5:13)

SH* NY Police Department phone system cracked (S 21 5:19)

SH British man (Black Baron) convicted as malicious virus writer (S 20 5:14)

S Cancelbot derails online promo (WSJ via Edupage 20 Dec 1994) (S 20 2:11)

$SH Criminal hacker arrested in Winnipeg (S 20 2:12)

SH 16-year-old boy cracks university computer security (S 21 2:20)

@SH DMV security code breached at hospital in New Haven (R 18 28)

@SH AIDS database compromised in Pinellas County, FL (R 18 48,53)

SH Geraldo show demonstrates how to break into tracer.army.mil (S 17 1)

SHA Milwaukee 414s broke into many computers (some with guessable passwords)

SHAO Australians use dictionary attack on various U.S. computer systems (S 15 2)

$SPH Thieves ransack 55 government computers in Australia (R 18 14)

SH St. Louis teenager Christopher Schanot arrested for computer fraud (R 18 01)

SPH Two convicted: 1,700 Tower Record credit-card numbers offloaded (R 18 02)

$SH U.Texas Dean's conferred password used to misappropriate $16,200 (S 17 3)

S References to CERT memo and Dave Curry article on countermeasures (S 15 3)

fH Fudging a poll on program(med) trading? (S 15 1)

SH USAF satellite positioning system, others cracked by 14-yr-old (S 14 6)

Sf Sony satellite dishes remotely reprogrammable? (R 17 33)

SH CerGro voice-mail hacked, mailboxes used for illicit purposes (S 13 4)

SP Olympics e-mail misuses affect Tonya Harding and Cathy Turner (S 19 3:10)

$SP Barclays credit system voice-mail hack gives sensitive info (S 18 1:20)

SH Voice-mail phreaking alters recorded message (S 19 3:10)

@$SH AT&T computer break-ins (Herbert Zinn) (S 12 4)

@$SH Pac*Bell System computer attacker Kevin Mitnick arrested (S 14 1); arrested again after hi-tech tracking (S 20 3:12)(SAC 13 3)

SHAO Computer crackers arrested in Pittsburgh, West Coast (S 12 4)

SH Argentine Hacker encounters computer wiretap (S 21 4:17, SAC 14 3)

$SH Computer intrusion network in Detroit (Lynn Doucett) (S 14 5)

$SH Fired computer engineer caught downloading proprietary software (S 13 2)

*SH Ex-employee arrested in file theft via Internet (S 19 3:10)

$S MIT student arrested for running BBS used for pirate software (S 19 3:11)

$H Australian hackers face jail or fines (S 13 2)

$SH Australian intruder fined $750 for copying programs (trespass) (S 15 3)

$SH Aussie Cracker charged with phone fraud, accessed US computers (S 16 4)

$SH Phone cracker tried for Palomar Hospital felony wiretap/eavesdrop (S 17 2)

*SHAO Hospital intruder captures password, alters drug protocol (S 19 3:10)

*SH Tampered heart monitors, simulating failure to get human organs (S 19 2:5)

SH 16yr-old Brit (Jamie Moulding) tried to sell cracked MoD files (S 16 4)

$SPH Brit. Min. of Defense computers penetrated by 8LGM; 3 arrested (S 18 3:A9), hacked into NASA, ITN's Oracle, ... 2 given 6-month sentences (S 18 3:A12)

SH TV editor raids rival's computer files (S 14 2)

SH Fox TV computers hacked, access to news stories in progress (S 15 3)

$SH TRW Credit information bureau breakins - one involved gaining information on Richard Sandza (Newsweek reporter who wrote "anti-hacker" articles) and running up $1100 in charges (S 10 1)

$SH 14-yr-old cracks TRW Credit, orders $11,000 in merchandise (S 15 1)

$S 12-yr-old boy arrested for tapping TRW credit files (S 15 3)

$SH Risks of unauthorized access to TRW credit database (S 15 3)

$SHAO U.S. Reps Zschau, McCain computers penetrated, mailings affected (S 11 2)

VSH/h? Ross Perot's computers lose 17K names; intruder or inadvertence? (S 17 4)

SPHA NJ Republican staffer breaks into Democrats' computer (S 16 1)

SHAO Bogus e-mail says Dartmouth prof cancels exam; 1/2 noshows (S 19 4:12)

SHAO Grade-changing prank at Stanford (around 1960) (S 8 5)

SHAO More class grade changes: Alaska, Columbia U., U. Georgia (S 16 3); Berkeley High School, despite requiring two passwords! (R 20 92)

S Remote student tests by push-button phone; Psych 519, Gov's State (S 16 1)

$SH Southwestern Bell computer penetrated: free long-distance calls (S 11 3)

$SPH British Airways dirty tricks tapping into Virgin Air data (S 18 2:15)

$SH Bloodstock Research thoroughbred genealogy computer system break-in

SHf Systematic breakins of Stanford UNIXes via network software (S 11 5) Brian Reid, "Lessons from the UNIX Breakins at Stanford", pp 29-35, Oct 1986

SHAO UK's MI5 phone recruitment hotline spoofed by KGB impersonator (R 19 20)

SH Masquerader acts as Liz Taylor's publicist, hacks answering machine (S 15 5)

$S Laser printer counterfeiting and new US legislation (S 15 5)

SH Free Software Foundation trashed, added passwords for integrity (S 16 4)

$SH Remote-control automobile locks opened by signal replay attacks (S 18 4:7)

$SH GM charged VW with industrial espionage (S 18 4:8); settlement eventually reached: VW agreed to pay GM $100M and buy $1B in parts over 7 years [Wall Street Journal, 10Jan1997, A3]

SPf Risks of presumed anonymity in tar files, e-mail (S 18 4:10)

@$SH Foiled counterfeiting of 7,700 ATM cards using codes in database (S 14 2)

@*H Prison escapes via computer manipulation (S 10 1, 12 4)

@*$H Masquerading spoof of air-traffic control comm altered courses (S 12 1)

SH Dan Farmer's security survey [2Jan1997] catalogs attacks on government sites, banks, credit unions, etc. See http://www.infowar.com. (R 18 74)

$SH 1994 UK National Audit Office report on computer misuse in government: 140% increase; 655 cases, 111 successful; £1.5M defrauded; misuse; 350% increase in viruses; 433 computer thefts, worth £1.2M (S 20 3:11)

$SHO Computer breakins cost businesses estimated $800 million worldwide in 1995 (R 19 47)

SHOA Stanford Linear Accelerator Center (SLAC) computer system penetrated 2 Jun 1998 using LAN sniffers (R 19 80-81)

SHOA Canadian charged with breaking into U.S. government computer (R 19 74)

SHOA Woman cracker gets five-month prison sentence for deleting info from Coast Guard personnel database (R 19 84)

SHO Milw0rm crackers penetrated India's Bhadha Atomic Research Center (BARC), copied 5MB, relating to India's nuclear research, altered BARC Web site, deleted files, in protest of nuclear testing (R 19 78)

SHf Critical mass or critical mess at Los Alamos? Lax security (S 23 4:21)

SH Jonathan James (cOmrade) sentenced to six months detention for having penetrated DoD and NASA computer systems, intercepting 3,300 e-mail messages and stealing passwords when he was 15 (R 21 06; S 26 1:)

SH Jason Diekman, 20, charged with cracking into university computers and NASA, stealing hundreds of credit-card numbers to buy thousands of dollars of clothing, stereo equipment, and computer hardware (R 21 06; S 26 1:)

SHOA Raymond Toricelli charged with breaking into NASA computers, capturing passwords, running porn ads (R 20 95)

..... Web site hacks and risks:

VSH Justice Department's Web site is infiltrated (S 22 1:21, R 18 35)

VSH CIA disconnects home page after Web site hacked (S 22 1:21-22)

VSHAO Air Force Web page hacked (S 22 2:23, R 18 64)

VSHOA NASA's Web site http://www.nasa.gov hacked on 4 Mar 1997 (S 22 2:23, R 18 88)

VSHf Three Army Web sites hacked (S 23 4:24, R 19 63)

VSHf Hackers claim major U.S. defense system cracked (S 23 4:24)

f Art Money (when nominee-to-be for U.S. AsstSecDef) was quoted in Federal Computer Week at an AFCEA meeting as saying that hackers had changed troops' blood types on a DoD Web site, reportedly causing DoD to revisit what info to put on its Web pages (R 19 97); however, the following issue of FCW said that no such attack had occurred, although the possible scenario had been identified by a red-team exercise (R 20 02)

SH+H Pentagon uses offensive information warfare against Electronic Disruption Theater attacks beginning 9 Sep 1998 against DefenseLink Web site; EDT says it was illegal! (R 20 03)

S Pentagon to take stronger computer security measures; Eligible Receiver results indicate pervasive vulnerabilities (S 23 4:24)

VSHOA National Collegiate Athletic Association (NCAA) Web site hacked, racial slurs posted; 14-year-old high school freshman? (R 18 90)

VSHOA ACLU's AOL Web site cracked (R 19 77,81); further notes on AOL security (R 19 87)

VSHAO NY Times Web site attacked in support of Kevin Mitnick, and suggestions of what could have been worse in insidious misinformation (R 19 96)

VSHAO Lost World Web site hacked into Duck World: Jurassic Pond (R 19 20,21)

VSAO Swedish meat packer Web site penetrated and replaced (R 19 14)

SHAO Swedish 16-year-old arrested 3 hours after Web attack on Swedish National Board of Health and Welfare; discussion by Ulf Lindqvist (R 20 87)

SH Teenage hacker Raphael Gray arrested in Wales, hacked 9 e-commerce sites, stole Gates' credit-card info (R 20 87)

SHAO Man (Max Vision) indicted for vandalizing NASA, Argonne, Brookhaven, Marshall Space Center, DoD computers (R 20 87)

SH National Hockey League Web site denial of service attack: down over 5 days, due to lack of admin expertise (R 20 89)

V$SH Many New Zealand IHug Web sites wiped out by cracker (R 20 09)

SH Internet vandals Trojan-horse USIA Web site (R 20 18)

VSHf Hackers take down FBI and Senate Internet sites, 27 May 1999 (retaliation for Zyklon?), Dept of Interior and Govt facility at Idaho Falls hit on 31 May 1999 (R 20 43); Crackers do for U.S. gov't what critical infrastructure report couldn't (R 20 43)

SHOA George W. Bush's campaign Web site hacked, photo replaced (R 20 64)

SHAO Gallup Web site hacked just before primary election (S 25 3:21-22, R 20 83)

SH Zyklon admits attacks on NATO, USIA, Gore Web pages (R 20 58)

Sf EPA Web site shut down in response to Congressman's threat to divulge vulnerabilities (S 25 3:20, R 20 79-80); GAO says EPA's computer security is "riddled" with weaknesses (R 21 02; S 26 1:)

SH Japanese Government Web sites hacked: Science and Technology Agency penetrated, census info erased (R 20 77)

SHAO OPEC Web site hacked protesting oil prices (R 21 05)

S Risks of Web sites from computer fraud (R 19 44)

Sf Air Force thinks push-pull technology (e.g., Web browsers, PointCast) too risky (R 19 57); added risks from Netscape or anyone else giving away source code? (R 19 57-59)

SHPA Federal Web sites lack privacy safeguards (S 23 1:13, R 19 35)

$H Fake Web page cause 20% stock surge and then retreat in PairGain (R 20 30)

SHO Western Union Web site hacked, with info on 10,000 customers' cards (R 21 04; S 26 1:)

..... Password and authentication violations:

SH John-the-Ripper software finds 48,000 passwords (R 19 91)

S Password problem on Bloomberg Web site (R 20 08)

SHAOhe Stanford e-mail system passwords stolen by sniffer attack on un-upgraded systems, reportedly from Sweden and Canada (R 20 05)

SHA Organized e-mail theft in Seattle: compromised master key (S 24 3:27, R 20 09)

SH Strange case of Instant Messaging scam involving password on AOL (R 20 24); another scam on AOL using hyperlinks (R 20 28)

@$h Mistyped password put two brokers in the same computer files (S 13 1)

@$H Japanese BBoard fraud traps passwords, gains money; culprit caught (S 17 4)

..... Trap-doors, Trojan Horses, logic bombs, worms, viruses:

$$SHhf Internet worm attack 2-3 Nov 1988 on BSD-derived Unix systems, an intended constructive experiment that went awry (editor's discussion on software engineering implications; exploitations of sendmail debug option, finger, .rhosts, some dictionary-attacked encrypted passwords; references to detailed reports by Spafford, Seeley, Eichin/Rochlis) (S 14 1); Robert Tappan Morris indicted on felony count (S 14 6) Jury declares Morris guilty, Jan 1990; motions, sentencing pending (S 15 2) RTM sentencing and some implications (S 15 3); appeal fails (S 16 2)

$SHI Taco Bell register reprogrammed to redirect funds (S 22 4:31, R 18 76)

SH Unauthorized Internet activity; TELNET Trojan horsed (S 14 6)

SH New rash of Internet break-ins with Trojan-horsed net software (S 19 2:5)

SHA Another Trojan-horse bogus cash dispenser in Finland (R 20 03)

SH Trojan Horse infests 15,000 Internet Relay chat users with Back Orifice (R 20 03)

SH CERT alert: Trojan horse planted in TCP wrapper acquired by at least 52 sites (R 20 18)

Sf html e-mail or Web page can launches Excel Trojan horses (R 20 15)

SH Discussion of write-protectable hard drives as one way to defend against Trojan horses (R 20 21-22,24)

SH Two Penn State Hackers arrested, service theft, etc. (S 15 2)

SH C compiler Trojan horse for UNIX trapdoor (Ken Thompson, "Reflections on Trusting Trust", 1983 Turing Award Lecture, CACM, 27, 8, August 1984)

$SH Customer-owned payphones Trojaned to steal credit-card numbers (S 16 3)

SH? Rhode Island "disgruntled employee" arrested for "e-mail virus" (R 18 50)

$SH PC Graphics program Trojan horse (ArfArf) wiped out users' files (S 10 5)

SH PC-Prankster Trojan horse on PCs (S 12 4)

SH Another Trojan horse trashes DOS - NOTROJ (S 11 5)

SH Trojan turkey program deletes files (S 13 3)

Sf Microsoft Network e-mail binaries can contain executables (R 17 31,32,33)

SHOA Microsoft Network (MSN) fraudulent e-mail credit-theft risks (R 19 08)

VS AOL alerts users to e-mail Trojan Horse that crashes hard drives (S 21 2:20)

S Intel CD-ROM hoses hard drives (S 21 2:20)

*SH Software time-bomb inserted by unhappy programmer (extortion?) (10 3:15)

*SH Los Angeles Water&Power computer system software time-bomb (S 10 3)

$S Booby-trapped contracted software "destroys data"; unpaid blackmail? (S 15 3)

SH Lauffenberger convicted of logic bombing GD's Atlas rocket DB (S 17 1)

SH NY law consultant plants logic bomb (claim 56789), seeks repair job (S 17 4)

H Man accused of Trojan horsing his ex-wife's computer (S 18 2:4)

$H Typesetter disabled system, demanded arrears; bankrupted corp sued (S 17 4:7)

$SH Logic bomb allegedly planted in nonpaying customer's system (S 19 1:7)

SH UK Logic Bomb displays Margaret Thatcher picture when triggered (S 13 3)

@*SH Ex-employee Trojan-horses emergency system, which fails (S 17 4)

SH Trojan horse Christmas-greeting message contains saturating virus (S 13 1)

SH Apple II virus, Amiga virus, a chain letter; Canadian logic bombs; computer terrorism; voice-mail misuse (S 13 1)

SH Pandair Freight (UK) logic bomb case (S 13 1); backfires (S 13 2)

VSH Viruses halted government computers in south China (S 16 4)

SH World Bank virus ("Traveller 1991") (S 16 4)

SH Lehigh time-bomb virus propagates four times, wipes disk (S 13 2)

SH Israeli 13th-of-month PC time-bomb, would delete files 13 May 88 (S 13 2) Jerusalem Virus bet declared a draw (S 13 3) Time-bomb warning on SunOS for 13 May 1988 (S 13 3)

SH Jerusalem-B virus infects GPO library disk (S 15 2)

SH Jerusalem-B virus infects Chinese computers widely [13Apr1990] (S 15 3)

$S Fri 13th Virus found in a game software on the market (S 15 3)

SH Anticipation of time-bomb causes accidental clock bomb (S 13 3)

SH Various Macintosh Viruses/time-bombs - trap handler, INIT32 nVIR - Brandow/MacMag 2 March peace message, infected Aldus commercial software DREW, FreeHand (in shrink-wrap). (S 13 2)

Sd Apple distributes a CD-ROM with a "Trojan Horse" (S 19 2:10)

Sdh Ford Motor Co promotional floppy disk contains monkey virus (R 17 23)

Shf Cardiff software shipped self-destruct timebomb in Teleforms 4.0 (R 17 36)

SH More on viruses dangers of virus construction sets, propriety of assigning virus development in courses, plus more on the Atari ST virus, the (c) Brain virus and the Providence Journal attack, the Scores virus and the "ERIK" and "VULT" attacks, Elk Cloner, Disease DOS, and the growing anti- virus business - including contaminated versions of FLUSHOT that contained Trojan horses. (S 13 3 refers to on-line RISKS, VIRUS-L.)

SH (c) "Brain" Virus at eastern universities (S 13 2)

$SH Michelangelo - hype, preparation, and attack on 6Mar1992; Leading Edge shipped 6000 infected systems; Intel shipped 800 infected LANSpool 3.01; DaVinci shipped 900 infected eMAIL 2.0 disks (S 17 2) Various Michelangelo attacks were reported (in New Zealand, Australia, Japan, China, Poland, Germany, South Africa [where bootleg SW is prevalent], Canada); various US hits also noted (S 17 2) Norton's free antiviral utility more dangerous than Michelangelo (S 17 2)

SH Novell shipped a stealth virus, Stoned III, to 3800 customers (S 17 2)

$SH 2 Cornell students arrested for spreading Macintosh game virus (S 17 2) 10 hrs/wk for a year public service required as punishment (S 18 2:15)

$SH The Trojan horse named `AIDS', from `PC Cyborg Corp' (S 15 1); Joseph Popp accused on 11 charges, computer blackmail of medical institutes, attempting to obtain £6M (S 17 2)

@*$SH Lithuanian nuclear power plant logic bomb detected (S 17 2)

SH The "Twelve Tricks" Trojan horse (S 15 2)

SH DECnet `WANK' Worm on SPAN affected DEC VMS systems (S 15 1)

SH PC pest programs in China and Japan (S 15 1)

S Soviets claim unprecedented computer-virus shield (S 14 1)

SH "Virus" removes security barriers in Italian judicial computers (S 17 3)

SH Self-invoking RUNCOM self-propagates as virus on MIT's CTSS (S 13 3)

$H Use of a virus excuse for nondelivery of software (S 13 2)

$SHf Portable terminals for Hong Kong horse betting spoofable? (S 14 2)

$SH [Bogus] "Big Red" Trojan horse reported (as virus) in Australia (S 12 3); Hackwatch `expert' Paul Dummet [alias Stuart Gill] claims exposed (S 15 1)

SH Japanese PC-VAN network `Virus' posts passwords of NEX PC9800s (S 13 4)

SH Virus aimed at EDS infects almost 100 NASA computers instead (S 13 4)

S `Computer Virus Eradication Act of 1988' (S 13 4)

*S Virus hits hospital computers in Michigan, creates bogus patients (S 14 5)

$S "Virus" arrest in New Jersey (Chris Young) (S 14 5)

SH Black Baron gets 18-month sentence for virus activities (S 21 2:21)

S Prank "Virus" Warning Message in government service system (S 14 5) @SH Toronto Stock Exchange virus scare causes all-night search (S 18 2:16)

SH Trojan horses implantable by active electronic jamming? (S 15 1) @$mSe Minn. 9th Federal Reserve Bank vulnerability during recovery (S 16 3)

SH? Aum Shinri Kyo affiliate develops Japanese government software (R 20 83)

Sh(H?) U.S. State Dept embassies' Mission Performance Plan software written by Russians! (R 20 81)

S? Fantasy Baseball Journal errors attributed to a computer virus (S 18 3:A11)

SH Contact krvw@first.org for access to the VIRUS-L on-line newsgroup, documenting, cataloging, discussing innumerable virus problems!

NOTE: We long ago stopped reporting run-of-the-mill new viruses. Klaus Brunnstein reported the number of distinct strains has grown from five in early 1988 to over 1000 by early 1992. The number is now huge, over 10,000. See the VIRUS-L newsgroup for ongoing activities... But we must include two 1999 manifestations that result from the absence of meaninful PC security:

ffSH Melissa Macro Virus. See my article (S 24 4:28, R 20 26) and my Web site (http://www.csl.sri.com/neumann/house99.html) for testimony for the 15 Apr 1999 hearing of the House Science Committee subcommittee on technology, in which I consider Melissa as the tip of a very large iceberg - the abysmal state of computer and communication security. See also other items in RISKS on Melissa: Report by Robert M. Slade (R 20 26); hidden risks (R 20 28); effect on a UK bank (R 20 30); Risks of monocultures (R 20 26) and more virulent macro viruses (R 20 26); further analysis (R 20 30); Role of the GUID in identifying David Smith as the purported culprit (R 20 26,28,30-34), with wrap-up from Richard M. Smith (R 20 33); Smith faces five years in prison; claimed to have caused $80M damages and infected over 100,000 computers (R 20 68); further discussion of GUIDs accepted in court (R 20 70); Mainframe viruses (R 20 30-32) and origin of virus vulnerabilities (R 20 29)

SH CIH virus (26 Apr 1999) recalls Chernobyl (R 20 33)

..... Risks in voice-recognition systems

SH Risks of computer voice recognition monitoring gang members (S 15 5)

VSh Ross Perot's high voice tone shuts down newspaper phone hotline (S 19 2:10)

Sfi British discover Texas accent is needed for voice recognition system for UK criminals (R 19 78)

Sf Risks of voice-controlled human interfaces (R 19 25)

S Potential for Trojan horses in voice software (R 20 10) and remote controls (R 20 10)

S Trojan horses embedded in voicemail (R 20 10) and risks of turning on audio and video, e.g. Back Orefice (R 20 11-12)

VShi NCR phone instruction for Tower Star multiport removal: "execute rm -r star" (R 19 65)

VSi Voice-recognition software Format c: Return and Yes, Return (R 20 24)

Sf- Seagull squawks consistently interpreted by speech recognizing software as "Aldershot" (R 20 36)

..... Internal perpetrations and insider misuse:

ShI CIA Director Deutch and multilevel security (S 25 3:20-21, R 20 78)

ShAI DoE weak password policy on nuclear secrets (S 25 3:21, R 20 77)

$SPHI Man charged with counterfeiting Japanese bank ATM cards, based on insider access (R 20 34)

$SHI/O AOL tech support volunteer sentenced to year in jail (R 20 74)

SHI FAA programmer destroyed only copy of source code for flight-control data transfer; authorities recovered encrypted copy at his home (R 20 64)

SHI ISP/bookseller intercepted Amazon messages, trying to get competitive advantage; fined $250,000 (R 20 66)

SHI+O Hackers penetrated Russian Gazprom, controlled pipeline flow; Russian police noted twelve-fold increase in computer crime in 1999 over 1998 (R 20 87)

SHIf Rogue code in Microsoft software, dvwssr.dll, includes password to access thousands of Web sites (R 20 87-89)

*SHI Hacker-nurse unauthorisedly changed prescriptions, treatments (S 19 2:5; R 15 37,39)

$SHI $1M internal computer fraud at Pinkerton (S 16 4)

@$SHI NY police chief indicted for misuse of confidential database (S 13 4)

@SHI 3 police officers sentenced for misusing Police Nat'l Computer (S 14 2)

@$SPHI 45 LA police cited for searching private computer records (S 18 1:21)

@SHI IRS agent accused of giving defendant tax data on judges/jurors/... (S 16 3)

@$SHIO Harrah's $1.7 Million payoff scam - Trojan horse chip? (S 8 5) and San Francisco Examiner/Chronicle, 18 Sep 1983

$SH Nevada slot-machine ripe for $10 to 15 million phony payoffs? (S 11 2)

$H Amusement game machines have covert gambling mode (S 13 4)

@$f One-armed bandit chips "incompatible"; 70.6%, not 96.4% payoff (S 17 4)

*SPHAf San Fran. Public Defender's database readable by police; as many as 100 cases could have been compromised [Feb1985] (S 10 2)

$SHI Browsing by IRS employees: curiosity to fraud (S 19 4:13)

SHA Sabotage of Italian newspaper source text without access controls (S 17 1)

$SH Sabotage of Encyclopedia Brittanica database (S 11 5)

$S(H?) Forbes accuses former employee of sabotage; NY programmer accused of sabotaging Art Assets computer (R 19 47)

$SH Prescott Valley Arizona computerized financial records wiped out (S 12 2)

SPH LLivermoreNL system used as repository 50Gb 90K erotic images (S 19 4:6); Employee acquitted; pictures thought related to engineering! (S 20 3:11)

@SH Election frauds by vendor or staff charged? ... [see above]

@*SHI British auto citations removed from database for illicit fee (S 11 1)

S Reporting and misreporting on successful Internet penetration of Navy battleship in exercise by U.S. Air Force (R 17 56-58)

$SHI Trojan-horsed chips in gas pumps enable charging scam (R 20 03)

SHI Mars Bars fraud via data diddling (S 24 3:27, R 20 09)

..... Other intentional denials of service:

SHI David Salas, former subcontractor on a Calif. Dept of Info.Tech., was arrested on 3 felony charges for "allegedly trying to destroy" the Sacramento computer system (R 18 75,76)

H Mail-merge program used to generate 12,000 amendments for Ontario legislature in blocking attempt (R 19 06,08,09)

SH Bogus cable chips zapped, possessors bringing them in apprehended (S 16 3)

*$SH Sabotage causes massive Australian communications blackout (S 13 1)

SH Former estimator destroys billing/accounting data on Xenix (S 15 1)

SH DC analyst in dispute with boss changed password on city computer (S 11 2)

SH Insurance computer taken hostage by financial officer (S 12 3)

*SH Cancer database disabled; 50K bogus calls, 10K-pound phone bill (S 18 2:17)

@SH Swedish cracker disrupts 11 north Florida 911 Systems (R 18 90)

SAO Swedish teen-aged hacker fined for U.S. telephone phreaking etc. (R 19 13)

SHf Vandalism disrupts service at Stirling University for days (S 19 4:13)

VSH Denial-of-service attack with e-mail flooding (S 21 2:20)

$VSHI Disgruntled Reuters computer technie brings down trading net (S 22 2:23)

@!$$Hm World Trade Center blast and outages discussed (S 18 2:17)

@SH Vandals cut cable in Newark, slow NY-DC MCI service for 4 hrs (S 20 1:21)

H? Workmen strike at CERN; beer bottles halt accelerator reopening (S 21 5:16)

VSH Update on Windows NT denial-of-service attacks, Bonk/Boink, New Tear (S 23 4:24)

..... Internet Service Provider outages and security problems:

Vf/m Problems with on-line services: Prodigy "comm error" shown live on ESPN; AOL downed by flood; traffic chokes MCI inbound Internet gateways (S 19 4:8)

Pf Prodigy misdirects 473 e-mail messages, loses 4901 others (S 20 3:9)

SH Racist cracker trashes BerkshireNet (R 17 83, S 21 4, SAC 14 3)

$Vfh 14-hour Netcom crash due to extra & in code (S 21 5:14)

$e Microsoft, AOL, and AT&T also have netwoes (S 21 5:14)

VSHAO PANIX denial of service syn flooding attack (R 18 45); more on syn floods, IP spoofing, and how to defend (Fred Cohen, R 18 48)

VSHAO Major denial-of-service syn attack on WebCom in San Francisco area (S 22 2:23, R 18 69)

$e Bad upgrade gets America On-Line off-line for 19 hours 7 Aug 1996 (S 22 1:17, R 18 30-31)

Vfe More AOL outages: 2 Dec 1996; bad upgrade, 5 Feb 1997 (S 22 4:28, R 18 81)

Vfe E-mail volume brings down Microsoft Network (MSN) servers for C-E and T-Z names; Microsoft shut down entire service for several days to upgrade (R 19 09)

Sf WorldNet security flaw (R 19 19, correction in R 19 20)

Vh Telehouse `reliable' backup center in London downed by accidental power shutoff, downing most of the UK Internet (R 19 13,14)

VSH PING-of-death attacks from Serbia on NATO Web server, counterattacks on www.gov.yu (R 20 31)

..... Stolen equipment and computers - including sensitive data: [See also Piracy, below.]

$SH Computers stolen from SDI Office (S 13 3)

S Stolen laptop contains sensitive British military data (S 16 2)

SHO Sensitive customer data in stolen CalTrain ticket-by-mail computer (R 19 02,05)

SHO Stolen Levi Strauss personnel computer contains 40,000 SSNs and other identifying info, also bank account into for retirees (R 19 12)

SH Laptop with unspecified data stolen from London police car (R 18 24)

$SPH Thefts of doctors' computers lead to blackmail in Cheshire UK (S 18 1:22)

SH Stolen computer contains ophthalmology certification exam (R 18 53)

@SHI 6000 AIDS records stolen from Miami hospital PCs and diskettes (S 19 2:9); bad prank follows (S 20 5:10)

H May 1995 theft of $10M in Pentium chips; Asian syndicate indicted (R 19 21)

$H Armed theft of $800K in chips thwarted (R 19 23)

Hm Russian harvests 60 meters of cable in Ulan-Ude, disabling external phone service in Russia [19Jun1997]. Previously, 2 thieves in eastern Kazakhstan were electrocuted trying to steal high-voltage copper wires. (R 19 23)

Hm Backup system failure: cable stolen at Korat Royal Thai AFB, 1973 (R 19 24)

..... Piracy and proprietary software rights:

$dP Microsoft documents leaked on the perceived threats of open-source software, and desired MS countermeasures; see the "Halloween Documents" annotated by Eric Raymond (http://www.opensource.org/halloween.html http://www.opensource.org/halloween2.html) (R 20 04-05)

$SH FBI raid "Davy Jones' Locker" (400-customers pirated-SW BBoard) (S 17 4)

@SH Leonard DiCicco pleaded guilty to aiding Mitnick in DEC SW theft (S 15 1)

$SH Captain Blood, software pirate, nabbed in L.A. (S 21 2:21)

$SH Irish rock band U2 unreleased songs pirated from demo video, distributed on the Internet (R 18 62,63)

SH$ Finnish executives jailed for software piracy (S 20 5:13)

$SH Software piracy considered enormous, Hong Kong, worldwide (R 18 12-13)

S U.S. No Electronic Theft Act may criminalize non-profit software copying (R 19 52)

$S Software theft statistics: $7.4B losses in 1993, $9.7B in 1992; greatest increases in India, Pakistan, Korea, Brazil, Malaysia (S 19 3:11)

S British Visa source code compromised, ransom sought (R 20 75-76)

..... Incomplete deletions and other security residues:

!S,H? Mystery death of NZ man who bought old Citibank disks reportedly containing details of overseas accounts & laundering activities (S 18 1:13)

fSP Footnotes in the Starr report that had been deleted in WordPerfect reappeared in the House-translated html version; this is the old mark-as-deleted but don't-really-delete residue problem; also, some text was lost in the translation. (R 19 97)

Sf Effects of data residues in Microsoft Word (R 17 78,80) and Netscape Navigator 2.0 (R 17 79); incorrect text replacements in WordPerfect (R 17 80)

SP Discussion of security and privacy implications of "cookies" (squirreled information in browsers) (R 18 19,20, 63,65,67,68,70,72,78,79,88,92); residues in Internet Explorer 3 (R 18 68);

SP Residue problem in frequent-flier miles on number reissue (R 18 65)

*Sh Air Force sells off unerased tapes with sensitive data (S 11 5)

*S White-house backup computer files bypass shredders on Irangate (S 12 2)

Sf Sex, lies and backup disks: more D.C. risks in (non)deletion (S 21 2:17)

Sh Leftover sealed-indictment data on sold-off surplus computers (S 15 5)

Sh Secret FBI files sold off inside $45 surplus computers (S 16 3)

H Residual Gulf war battle plans incriminate $70K computer thefts (S 17 4)

S Deleted files still on disk give evidence vs Brazilian president (S 18 1:7)

SP Used hard-disk contains unerased confidential personnel files (S 18 4:9)

Sh UK cabinet secrets on National ID card found in surplus store (S 20 2:12)

P Czech intelligence computer stolen, with sensitive data (R 19 31)

+*H US charges man planned to kill 4,000 travelers; laptop evidence (S 21 5:16)

S More risks of core dumps (R 18 42,43,44)

..... Satellite takeovers and TV screwups:

VSH "Captain Midnight" preempted Home Box Office program (S 11 3, 11 5)

VSH Another satellite TV program interrupted (S 12 1)

$VSH Playboy Channel disrupted with bogus program "Repent Your Sins" (S 12 4); CBN employee convicted, facing up to 11 years in prison and $350,000 fines (S 16 1, R 10 62)

(m/f) Playboy Channel video appeared in the Jeopardy time-slot in the Chicago area for 10 minutes, due to a screwup (R 18 22)

e Upgrading Cartoon Network Channel gives Playboy video, Flintstones' audio (S 22 4:26, R 18 77)

SH WGN-TV and WTTW in Chicago overtaken by pirate broadcast (S 13 1)

SH Video pirates disrupt L.A. cable broadcast of 1989 Super Bowl (S 14 2)

..... Other cases:

SH British businesses suffer 30 computer disasters/year (S 12 1)

SH UK computer security audit estimates £40M fraud in 1987 (S 12 1)

S Accidental breach of Rockwell security bares shuttle software (S 13 3)

$SH Debit card copying easy despite encryption (DC Metro, SF BART, etc.)

$SH Thieves profit from $240,000 in debit-card transaction adjustments (R 19 42)

$SHO Counterfeit debit cards hit Burns National and others (R 19 53)

@$SHf TILT! Counterfeit pachinko cards send $588M down the chute (S 21 5:19)

$SH ATM cards altered by in-car home computer net $50,000 (S 12 1)

$SH Microwave phone calls interceptable; cordless, cellular phones spoofable

$SH Church cordless phone abused (piggybacked dialtone) (S 20 3:12)(SAC 13 3)

$SPH More cellular phone eavesdropping cases: Private call on saving the SF Giants (broadcast on TV frequency); Dan Quayle call from Air Force 2 on Gorbachev coup; Seabrook control-room calls including one on bad valve karma, heard by an antinuclear activist; Green Bay Packer football player calling a male escort service; intimate conversation allegedly with Princess Diana ("my darling Squidge") (S 18 1:20)

$SH Unsecure cellular phone fraud: $482M in 1994 (3.7% of revenue) (S 20 2:13)

$SH Massive cell-phone identifier interception (S 21 5:19)

$SH Callback security schemes rather easy to break (S 11 5)

$SHA 18 arrested for altering cellular mobile phones for free calls (S 12 2)

HS San Jose CA men arrested for altering, selling cellular phones (S 20 1:21)

+ E-mail tap nets German cell-phone fraudsters (S 21 2:19)

SH Risks of lap-top computers being permitted in exams (S 13 3)

$SH Embezzlements, e.g., Muhammed Ali swindle [$23.2 Million], Security Pacific ($10.2 Million), City National Beverly Hills CA [$1.1 Million, 23Mar1979] Marginally computer-related, but suggestive of things to come?

S On-line BBS bug fix downloaded to an M1 tank in Saudi Arabia (S 16 2)

..... More on information warfare and terrorism:

VSH Information Security: Computer Attacks at Department of Defense Pose Increasing Risks, GAO/AIMD-96-84, in Senate hearings (R 18 15)

$VS* Canadians assess risks of computer terrorism (S 16 1)

$S Cyber-terrorists blackmail banks and financial institutions (article with considerable hype) (R 18 17,24)

VS GAO report: Government computers at risk (R 21 04; S 26 1:)

Cryptography

..... Limitations of encryption and related problems (recent):

SP National Research Council study report (CRISIS) on U.S. cryptography policy available from National Academy Press (http://www2.nas.edu/cstbweb) (R 18 14,17)

Shi Robert Litt's comment on National Research Council crypto study (http://www2.nas.edu/cstbweb): it was written before he came on board and therefore he didn't feel obliged to read it. (S 23 5:27, R 19 80)

SP Hal Abelson (MIT/HP), Ross Anderson (Cambridge Univ.), Steven M. Bellovin (AT&T Research), Josh Benaloh (Microsoft), Matt Blaze (AT&T Research), Whitfield Diffie (Sun Microsoft), John Gilmore, Peter G. Neumann (SRI International), Ronald L. Rivest (MIT), Jeffery I. Schiller (MIT), and Bruce Schneier (Counterpane Systems), The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption, May 27, 1997 (ftp://research.att.com/dist/mab/key_study.txt or .ps; http://www.crypto.com/key_study). This report considers the technical implications, risks, and costs of `key recovery', `key escrow', and `trusted third-party' encryption systems. (R 19 17, discussion R 19 18) It has appeared in various places, including the World Wide Web Journal, volume 2, issue 3, Summer 1997, O'Reilly & Associates, pp 241-257. This report was reissued in the summer of 1998 with a new preface: "One year after the 1997 publication of the first edition of this report, its essential finding remains unchanged and substantively unchallenged: The deployment of key recovery systems designed to facilitate surreptitious government access to encrypted data and communications introduces substantial risks and costs. These risks and costs may not be appropriate for many applications of encryption, and they must be more fully addressed as governments consider policies that would encourage ubiquitous key recovery." [http://www.crypto.com/key_study]

SP McCain-Kerrey Senate bill seeks crypto key-recovery infrastructure (R 19 23)

SP Cryptography Policy and the Information Economy, Matt Blaze (R 18 71)

+/- The Net Never Forgets (R 20 09-10), although the UK Labour Party removed its earlier promises against encryption controls from its Web site (R 20 11)

SP 33 nations sign Wassenaar Arrangement on crypto export controls (R 20 11); some exemptions considered for open-source crypto software (R 20 11,12) and public-domain software (R 20 13)

+/- French announcement on changes in liberalizing crypto policy (R 20 17-18), legal quirk (R 20 20)

Sf Report on timing cryptanalysis of RSA, DH, DSS (Paul C. Kocher) (S 21 2:21)

SfmM($?) Many new crypto-related results: Crypto implementations, particularly in smart-cards, under theoretical attack by interference-induced faults: Boneh, DeMillo, and Lipton (Bellcore) on public-key crypto (R 18 50); Ross Anderson on smart-cards (R 18 52); Biham and Shamir on differential fault-induced analysis of symmetric crypto - DES, triple DES, RC4, IDEA, etc. (R 18 54, 56); also Paul Kocher (R 18 57) and Ross Anderson (R 18 58); retrospective research note on crypto fault analysis, J.-J. Quisquater (R 18 55); role of replication? (R 18 58); history - note on Bletchley Park Colossus breaking Fish ciphers (R 18 59); practical tampering attacks, Ross Anderson and Markus Kuhn, Usenix Electronic Commerce paper (R 18 62); more from Quisquater (R 18 64)

SHOA Paul Kocher provided information on three related attacks: Simple Power Analysis, Differential Power Analysis, and High-Order Differential Power Analysis, applicable particularly to devices such as smart cards. See Introduction to Differential Power Analysis, by Paul Kocher, Joshua Jaffe, Ben Jun, Cryptography Research (R 19 80)

SP RSA crypto challenges: Ian Goldberg cracks 40-bit RC5 in 3.5 hours, using 250 machines to exhaust 100B would-be keys per hour (R 18 80); Germano Caronni cracks 48-bit RC5 in 312 hours, using 3,500 computers to search 1.5 trillion keys per hour (R 18 82); RSA's DES-I challenge broken after 4 months (http://www.rsa.com) (R 19 23); RSA's RC5-56 challenge cracked by Bovine Cooperative (S 23 1:14, R 19 43); DES-II-1 challenge cracked: 63 quadrillion keys, 90% of keyspace (R 19 60)

SO DES Cracked: "EFF DES Cracker" Machine Brings Honesty to Crypto Debate; Electronic Frontier Foundation Proves DES Is Not Secure announcing the Deep Crack machine. See Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design, published by O'Reilly and Associates. (http://www.eff.org/descracker) (S 23 5:27; R 19 87); review of Cracking DES (R 19 90); implications on cracking passwords, including L0phtCrack (R 19 91-92)

+ Deep Crack (part of Distributed.Net's 100,000 PC attack) cracks RSA's DES Challenge III in less than a day, Jan 1999 (R 20 17-18)

S Elliptic curve 97-bit challenge broken in 40 days with 740 computers in 20 countries (R 20 61)

SH Lucent cracks SSL e-commerce encryption code (R 19 84)

S Cryptanalysis of Frog, a not-very-strong AES candidate to replace DES (R 19 92)

SP Implications of outlawing concealed messages: ban the Bible, smiley faces, foreign languages (Navaho used in WWII), on-line card catalogs, random numbers, what else??? (R 19 37-41); use of steganography, e.g., in graphical images (R 19 40,41); Feynman's censors in WWII objected to math! (R 19 39)

SP(f?) More on risks of key recovery: see also PGN testimonies before the Senate Judiciary Committee and House Science Committee subcommittee on Technology, with written responses to questions as well (http://www.csl.sri.com/neumann/).

S "Private doorbells" proposed alternative to key-recovery (R 19 85)

Sf More on cryptographic hashing and MD5, Paul Kocher (R 19 26)

S John Gilmore publishes strong crypto code for authentication (R 19 52)

Sf? Discussion of alleged weak RSA keys in PGP (R 19 50)

SP New attack on PGP keys with a Word Macro (R 20 19-20)

Sf Exchange/Outlook plug-in for PGP bypasses crypto (R 19 81-83)

S Why cryptography is harder than it looks, Bruce Schneier (R 19 61)

SH Cypherpunks break GSM digital cell-phone encryption in 90M units (R 19 67-68); response from GSM Alliance (R 19 69)

SP More on the key-recovery crypto discussion, including the Denning-Baugh report on crypto impediments to law enforcement (R 19 62,63,65,67,72)

S Discussion of smart-card security, responding to Card Technology Magazine declaring, "The smart card is an intrinsically secure device." (R 18 91)

S Commerce Secretary calls U.S. encryption policy a failure (S 23 4:25, R 19 68)

SP Ron Rivest's nonencryptive Chaffing and Winnowing (S 23 4:25, R 19 64); natural-language example (R 19 65)

SP Cellphone CMEA 64-bit encryption effectively only 24 or 32 bits (R 18 92)

S Myths about digital signatures discussed by Ed Felten (R 18 83,84)

S Leevi Marttila program translates C to English and back; used for crypto, what is free speech and what is not exportable? (R 19 92)

Sfi Microsoft Outlook e-mail glitch discloses unencrypted message; cancelled message not cancelled (R 19 74,76)

mh Risk of not backing up PGP Key Ring files (R 20 30)

hei Risks of running a public-key infrastructure (R 20 32-33)

SH Adi Shamir reports design of special-purpose machine to factor RSA prime products (R 20 37)

$SH Parisian programmer Serge Humpich makes his own smartcards; cracked 640-bit crypto key (R 20 77); despite negotiations to reveal the technique, he was convicted of fraud, but given suspended sentence (R 20 82).

VSH Stephen King's on-line-only eBook taxes Web sites on opening day, 14 Mar 2000, representing unintended denials of service! (R 20 85); it was rapidly reverse engineered, decrypted, and pirated; ISPs forced customers to delete it, but was still available elsewhere (e.g., a Swiss bulletin board); developers blame export controls for weak crypto! (R 20 86)

..... Limitations of encryption and related problems (less recent):

S 100-digit numbers factorable; crypto implications [as of 1988] (S 14 1)

SP DES vulnerabilities claimed by Shamir and Biham (S 16 4, R 12 43); requires large amounts of known plaintext, ADDS credibility to DES!

S 56-Bit Encryption Is Vulnerable, Says Phil Zimmermann (S 21 5:19)

S Discussion on the strength of 56-bit crypto keys (R 18 26,27)

SP Potential problems with NIST-proposed Digital Signature Standard (DSS) and DSA (based on ElGamal and Schnorr): Bidzos (R 12 37); Rivest, (R 12 57,58); others (R 12 33 to 35); Hellman, (R 12 63).

$SP Risks of export controls on workstations, cryptosystems (R 12 30-35); See also Clark Weissman, Inside Risks, CACM, 34, 10, p.162, Oct 1991.

SP Sun exploits loophole in crypto ban for SunScreen SKIP E+ (R 19 17)

SP MD5 weakness and possible consequences (R 19 14,16,24,26)

$SP Computer Systems Policy Project estimates $60 billion market-share loss in year 2000 resulting from current U.S. export controls on crypto products (R 17 61)

$SP Crypto export licenses issued to Apple, Adobe, RSA (S 17 3)

$SP U.S. encryption export control policy softens somewhat (S 17 4)

S U.S. program export controls ruled unconstitutional by Northern California federal judge, Marilyn Hall Patel (R 18 69)

SP Charges dropped relating to PGP export and Phil Zimmermann (S 21 2:20)

SP Daniel Bernstein case involving export controls for crypto programs, snuffle and unsnuffle (R 19 05, 18 69, 19 52)

SH Forged "PGP has been cracked" message (not from Fred Cohen); pursuing the given URL could lead to your ISP disabling you! (R 19 08,09)

$SP NSA, FBI, cryptosystems: J. Abernathy, Houston Chron. 21Jun92 (S 17 4)

SP Escrowed Key Initiative (Clipper, Capstone, and Skipjack) discussed (S 18 3:A12, R 14 51-59, ff.); Skipjack Review by Dorothy Denning (R 14 81); more on Escrowed Keys, SkipJack, Clipper, and Capstone (R 15 46, ff.)

S NSA declassified 80-bit Skipjack encryption algorithm and its 1024-bit key-exchange algorithm (R 19 84)

S Comments on the U.S. Government Technical Advisory Committee to Develop a Federal Information Processing Standard for the Federal Key Management Infrastructure (TACDFIPSFKMI) (R 19 84-86).

SP "Key Recovery" replaces "Key Escrow" in U.S. encryption plan (R 18 50,54)

S Palisades Park NJ school employs 16-yr-old to break into locked-up computer system - need for key recovery mechanisms? (R 18 70,71)

$S Nov 1995 report on minimal key lengths for symmetric ciphers (R 17 69)

SPH FBI digital phone tapping, see M.G. Morgan, IEEE Institute, Sep/Oct 92

SP Police can't crack crypto used by Basque terrorist organization (S 17 3)

! Bank robber foiled by security screen (S 20 1:16)

..... Other topics related to cryptography:

- Discussion over who discovered public-key crypto first: UK's CESG, or NSA, prior to Diffie-Hellman? (R 19 51)

Sf Microsoft Crypto Service Provider confusion over "NSA" key discussed (R 20 57-58,60)

April Foolery and Spoofs

..... April Fool's Day items

SH 1984: Chernenko at MOSKVAX: network mail hoax (S 9 4)

SH 1988: self-referencing forged April Fool warning message (S 13 2,3)

+- 1990: Transmission of IP Datagrams on Avian Carriers (S 15 3)

$S 1995: Internet cybergambling (RISKS-17.02)

Microsoft will NOT acquire the Catholic Church! (S 20 2:7)

1997: French immune to Y2K: quatre vingts dix neuf (4x20+10+9) will increment to cinq vingts (5x20); Windows ninety-ten will adopt similar strategy (R 19 01)

1997: Proposal to lengthen the second by 0.00001312449483 to eliminate leap years (R 19 01) or slow down the earth's orbit accordingly (R 19 02)

1997: Microsoft buys Sun in order to kill Unix (R 19 01)

1997: Hale-Bopp solar wind (cosmic radiation) causes ticking and buzzing in computer mouse; problem worsened by Internet acting as giant antenna (R 19 02)

1998: Funding for a new software paradigm, removing rarely used code producing routinely ignored diagnostics, to combat software bloat (R 19 64)

1998: Quantum computer cracks crypto keys quickly (R 19 64)

1998: The Computer Anti-Defamation Law protecting developers against criticism (R 19 64)

1999: The Y9Z problem, Mark Thorson; 99 rolls over to 9A; 199Z (the year 2025) rolls over to 19A0; then 19ZZ can roll over to "2000" (R 20 26)

1999: Y2K bug found in human brain (R 20 26)

1999: Vatican announces all computer systems ready for new millennium; Roman numerals are the answer! (R 20 26)

1999: Historical retrospective analysis of the Y10K problem, dated 1 Apr 9990 (R 20 26)

1999: RFC2550 - Y10K and Beyond: marvelous RFC on solving the Y10K problem by Steve Glassman (R 20 27)

1999: Linus Torvalds starts for-profit LinusSoft; open-source advocates SlashDot launch SlashDot Investor; Richard Stallman of the Free Software Foundation now Senior Vice President for Ideology (R 20 26)

1999: Professor wants Y2K jokes banned on the Net (Edupage item, R 20 28)

1999: Congress votes to move Daylight Savings cutover to Monday to avoid Easter confusion (R 20 28)

1999: Tuxissa Virus creator (Anonymous Longhair) modifies Melissa to download and install Linux on infected Microsoft systems (R 20 29)

1999: Running out of time on Y2K? Add a month to the calendar (Martin Minow)

1999: Zurich loses citizens files on 31 Mar 1999 after Y2K upgrade test crash (R 20 29); was this real or April Foolish? Doesn't matter. The lesson is the same: keep backups (R 20 30)

Australian Securities & Investment Commission's April Foolery: Millennium Bug Insurance (R 20 37)

..... Other spoofs and pranks:

VSHOA See the various Web site hacks above, in which the Justice Department, CIA, Air Force, NASA, Army, and other Web sites had bogus pages installed.

VSHO 1984 Rose Bowl hoax, scoreboard takeover ("Cal Tech vs. MIT") (S 9 2)

H CNN nearly broadcast bogus on-line report of Bush's death in Japan (S 17 2)

SH Bogus report, BritTelecom NOT hacked for intelligence secrets (S 20 2:13)

SH AOL4FREE.COM virus report started out as yet another hoax, but such a virus was actually created within 24 hours (R 19 11)

SH Moynihan Commission report on Penpal virus hoax (R 19 04)

SH Washington DC street message board displays bogus message (S 15 1)

SHA Caltrans freeway offramp sign spoofed (S 21 2:20)

SHAO Bogus computer-generated draft notices swamp Univ. Minnesota (S 16 2)

SHAO Bogus e-mail submits Univ. of Wisconsin official's resignation (S 19 1:7)

SHAO German intruder forges White House messages (R 17 31,32)

$SH "Goodbye, folks" software prank costs perpetrator £1000 (S 11 3)

- [bogus] First cybersex pregnancy Weekly World News (R 19 60)

- Reactions to Mary Schmich's parody of Kurt Vonnegut on the Internet (R 19 29)

SHI London Underground hacked by insider posting nasty messages (R 17 36)

SH Risks of digital video editing - authenticity question (S 14 2)

S Risks in altered live video images: L-vis Lives in Virtual TV (R 18 18-21)

$SH Beeper messages to call back result in $55 900-number charges (S 16 3)

SH Password attack as e-mail root spoof demanding password changes (S 16 3)

$SH Houston City Hall voice-mail pranked; no passwords needed! (S 16 4)

S Stolen account used to send hate e-mail at Texas A&M (S 20 1:21)

- Computer system tracks school assignments and automatically calls home on students who cut classes until someone/something answers; spoofable (S 17 1)

Privacy

..... Recent privacy items to be inserted: SPf Privacy flaw in CyberCash 2.1.2 discussed by Steve Crocker (R 19 47)

SP Discussion of Easter Eggs (hidden features) in commercial software (R 19 53,55)

P Ontario removes privacy controls on students' personal information (R 19 48)

SP Swedes discover Lotus Notes (64-40 or fight?) has key-escrow crypto (R 19 52)

$SHPOe Japanese bank records stolen; aftermath of flawed upgrade (R 19 53)

P Location-tracing service of handy phones starts in Tokyo (R 19 58)

P Case of pharmacy mixing up confidential records (R 19 53)

P China cracks down on Internet access (R 19 54)

P Navy discharge case based on violation of don't-ask don't-tell, illegally gained AOL data (R 19 55); ruling reversed

PfSoftware flaw causes Virginia to misidentify 2300 people as child-support deadbeats (R 19 58)

+/- Response to West Virginia 'deadbeat-dad' glitches: woman builds system to counter effects (R 19 73)

S?P? Discussion of possible risks of interpreting robots.txt (R 19 57-59)

SP? Furby off-limits at NSA as security risk (R 20 16,20)

SP win.tue.nl ftp site hacked, login/uid info forwarded to Hotmail (R 20 18-19)

SP Serious security breach in Canadian consumer-tracking database (R 20 18)

P Furor over Intel's Pentium III processor ID discussed by Bruce Schneier (R 20 19); German report of flaw re-enabling override of ID disabling (R 20 23)

hPi U.S. Bureau of Labor Statistics posts official tables one day prematurely (R 20 05); another premature data release: Producer Price Index (R 20 16); Australian budget press release follows suit, blamed on "technical and human errors" (R 20 39)

SP Markus Kuhn and Ross Anderson's Soft Tempest, Microsoft, and copy prevention (R 19 59-60)

SP American Bar Assn OKs unencrypted Internet e-mail for client documents (R 20 34)

P? DejaNews feature on surreptitious URL link manipulation (R 20 34-36)

P IWC Watch Company site publishing visitors e-mail addresses (R 20 35); wrong URL posted! (R 20 36)

SP SingNet surreptitiously scans customer PCs: "looking for CIH virus" (R 20 40)

SP* Bank United of Texas to use iris scanners (R 20 40)

SPH MI6 agents "outed" on Web by disgruntled employee (R 20 39)

P Conflict between UK libel law and U.S. free speech on usenet items written in the U.S. (R 19 79)

SP Cell phones can be instant bugs! (R 20 53)

SP Electronic wiretaps on wireless devices outnumber those on wireline phones (R 20 41)

P Distributed cooperating Smart Dust particles as spies? (R 20 58)

P Proposal for Secret Service national ID database (R 20 57)

SPh Canadian spy secrets leaked on Web (R 20 55)

SP+/- NCIC 2000 began 11 Jul 1999, with remote mugshots, fingerprint searches, expanded coverage (probation, parole, sex offenders, in prison); risks of false positives, accuracy/timeliness of new entries, no probable cause; cost overran x2 (US$183M vs US$80M), took 7 years not 3; accuracy requirement relaxed; risks of use on ordinary folks? (R 20 53); Mass. requires mugshots/fingerprints for firearm owners with no law enforcement records, forwarded to Feds (R 20 54-55)

P California wants to sell confidential wage data (R 20 43)

SP Man recording police abusiveness sentenced for violations of wiretap statute (R 20 47)

P DoJ seeks wider access to computer data (R 20 55)

P Risks of sharing files via Yahoo (R 20 53)

Ph Risks of unexpected cell-phone redials (R 20 46)

P Minnesota Bank sued over client data sale (R 20 44)

SP Zero-Knowledge Systems allows five pseudonymous identities, but restricts number of messages (R 20 69)

SP Steganographic IDs in color copier/printer images (R 20 68)

SAPi Risks in ResearchIndex, digital library of CS papers (R 20 70)

SPhe Northwest Airlines may have leaked credit-card numbers after maintenance (R 20 74)

SPf TWA e-mail includes others' addresses (R 20 85)

SPf More on the MS Word deleted residue feature (R 20 83)

SPH Stolen MI5 laptop contains sensitive info (R 20 85)

$SHP DVD lawyers make "trade secret" public in unsealed lawsuit against Norwegian teen (R 20 77)

SPf Breach 12-13 Feb 2000 exposes H&R Block customers' tax records, Block shuts down 15 Feb, 2nd time in two weeks (R 20 80)

SP On-line confessional Web site promises privacy! (R 20 76)

SP Great West bank reveals personal info (R 20 80,82)

*SP Risks of Internet-connected heart devices (R 20 78)

P Georgetown Univ. study criticizes health sites for privacy intrusions (R 20 78)

P Lawsuit against Yahoo! for collecting cookies (R 20 78)

P Doubleclick saga: Michigan files "notice of intended action" over cookies (R 20 81)

*P Cybersex compulsives represent hidden health hazard (S 25 3:22, R 20 84)

P Havenco, data haven off-shore from UK (R 20 91)

P Julia Roberts gains access of her named domain, and other cases of domain-name hijacking (R 20 91)

P Pac*Bell publishes 400,000 phone books with Cox Communications customers' unlisted phone numbers, including names and addresses; Cox blamed for not pruning its own list (R 20 90-91)

SP Powergen: 7000 customers' Credit-card info exposed on the Web (R 20 97)

SPf Glitch at Amazon.com exposes e-mail addresses (R 21 04; S 26 1:)

SPf "Free" e-mail accounts and passwords exposed for a month (R 21 03; S 26 1:)

SP Kaiser Permanente medical e-mails go to wrong people (R 21 02; S 26 1:)

SPh Mix-up sends Spanish bank e-mail to Virginia BBoard (NewsScan, R 20 94)

SP Verizon's 28M private phone records exposed on Web (R 21 01; S 26 1:)

SP British law would allow police to intercept e-mail (R 20 95)

SP(+/-) White House revised encryption policy (R 20 95)

SP Google allows anonymous spam (R 20 95)

SP Anti-spam legislation passed in the House (R 20 95)

SP Hotel telephones give identity of called room occupants (R 20 93)

SP+/- People For Internet Responsibility (PFIR) Statement on Government Interception of Internet Data, 7 Sep 2000 http://www.pfir.org/statements/interception (R 21 04)

P Internet content for 2000 Olympics restricted to protect TV (including diaries, chats, streaming video) (R 21 07)

..... Privacy violations:

HSPO Newt Gingrich's teleconference compromised by cell phone (S 22 4:30-31, R 18 75,76)

S?h?+? Controversy surrounding Dallas Morning News posting news of alleged Timothy McVeigh "confession" on their Web site. Item obtained via computer breakin? Early Web posting to stave off injunction? (R 18 85) Bogus memo allegedly planted in attempt to trap a witness?

P Norwegian brothel surveillance camera broadcasts live on WorldWideWeb (R 19 13)

Phi Risks of errors in Calif Megan's Law CD of sex offenders (R 19 25)

P Discussion of Whitewater Filegate security/privacy issues involving FBI, Secret Service, White House (R 18 21)

S GAO criticizes White House for inadequate database controls (S 22 1:19)

SH Privacy risks in telephone company voice-mail archives (S 16 3)

SPH Civil liberties issues in National Crime Information Center (S 14 2)

SP Calif. to permit prisoner access to confidential drivers' records? (S 14 2)

SHI Database misuse by 11 prison guards in Brooklyn (leaking names of informants to prisoners, warning about searches, etc.) (R 19 20)

SP Justice Dept wants to scrutinize parolee computer use (R 18 70)

P Texas driver database on the Internet (R 19 22)

P Kansas sex-offender database full of incorrect entries (R 19 14); Also true in California DB: 2/3 of entries incorrect (R 19 24)

P Virginia's online sex-offender database not up-to-date (R 20 17)

SPH Bryant Gumbel's on-line critique stolen, given to Newsday (S 14 2)

SPH Belgian Prime Minister's e-mail tapped by penetrator (S 14 1)

SP Oliver North private e-mail appears in New York Times (S 18 2:17)

P? In-flight video privacy risks (S 18 4:9)

SPH Are your medical records adequately protected? Probably not. (S 14 2)

$PH Personal data being sold illegally by Nationwide Electronic Tracking (S 17 3); somewhat duplicated material in notes indictments (S 18 1:21)

@SHI 6000 AIDS records stolen from Miami hospital PCs and diskettes (S 19 2:9); bad prank follows (S 20 5:10)

@SH AIDS database compromised in Pinellas County, FL (R 18 48,53)

@$SHAI Mass. hospital technician accessed ex-employee's account, accessed 954 files, harassed former patients, raped girl (R 17 07, SAC 13 3)

SPH Medical privacy violation reported by victim, U.S. congresswoman (S 19 2:9)

P Australian insurance company builds household database from electoral rolls (R 18 02)

$P Proctor&Gamble matched telco call records after WSJ news leak (S 16 4)

SPH 2 Nissan employee firings allegedly based on eavesdropped e-mail (S 16 2)

SPH Washington State monitored e-mail; privacy lawsuit filed (S 16 2)

P 8 convicted killers sue to prevent Mass from monitoring phones (S 19 4:12)

SPf Undelivered `private' e-mail message returned, but NOT to sender (S 14 1)

SPH$ E-mail privacy rights vs company property lawsuit against Epson (S 15 5)

SPH Proliferation of spy viruses predicted (S 21 2:21)

$SP Risks in the British Data Protection Act (S 12 1)

SP Concern over privacy of Swedish Databank (S 11 5)

SP Discussion on computer privacy and search-and-match in Canada (S 15 1)

SP Canada's Privacy Commissioner issues report warning about EDI (S 18 4:9)

SP Thailand establishes centralized database on its 55M citizens (S 15 5)

SP Risks of being indexed by search engines (R 18 15)

SP Use of databases for investigative checks on would-be suitors (S 15 1)

P 4-star General Griffith's SSN posted on Internet site (R 19 28)

P Washington State posts criminal history records on the Net; legal issues (R 19 28)

P Alaska exposes its rascals on Web site (R 19 30)

SPH 30 implicated in selling Equifax credit records, bill histories (S 17 2)

SPHI Illegal sales of confidential SocSecurity and FBI data in 9 states (S 17 2)

SPHI Anaheim police employee leaks address of antiabortion target (S 18 3:A12)

SPH 2 women accused of selling confidential adoption information (S 18 3:A11)

SPH Ross Perot's campaign accused of stealing credit data (S 18 2:15)

P Privacy implications of Ohio school. child abuse records (S 18 2:17)

P Privacy concerns with Lotus Marketplace database of 80M households (S 16 1); Lotus Marketplace database withdrawn after 30,000 protest letters (S 16 2)

P Australian government bungles private data on 6000 households (S 17 2)

P Citicorp proposed marketing info on its 21M customers (S 16 4)

P AOL announces its intent to share data with telemarketers (R 19 26) and ads on private e-mail (R 19 40); eventually modified in response to objections

$SPH TRW settles lawsuit with FTC, 19 states, over privacy violations and erroneous data; improvements required, $300K payment (S 17 1)

+- L. Tribe proposes computer freedom/privacy cyberspace amendment (S 16 3)

S Privacy Act vs. Justice Dept. file matching on One Big File... (S 16 3)

$P Discrimination and privacy issues in insurance database (S 16 1)

SP Calling Number ID: negative ruling in California, free per-call blocking in Vermont; approved in 20 states, Washington D.C., and Canada (S 17 2)

$SPH Personal attack on USENET raises issues of privacy, ethics (S 12 3)

P Big flap over German request that CompuServe remove offensive material; in response, CompuServe disabled some newsgroups (R 17 59,61,62)

SPH NY Met's 1986 World Series parade: brokerage printout augments ticker-tape (S 12 1)

SP New York Yankee 1996 World Series parade; in absence of stock-market ticker tape, confidential records from NYC Housing Authority and Dept of Social Services rained down (R 18 55)

SP San Diego School payroll printouts appear as Xmas gift-wrap (S 12 2)

SP Public pleasure-boat database could help thieves (S 14 5)

SP Baby-monitor system bugs house, broadcasts to neighborhood (S 13 1)

? Pay-per-view failure lets adult station go unscrambled (S 19 3:8)

h/f? Free porn-in-the-morn hits San Francisco cable channel due to early scrambler time-out (R 19 60)

f Norwegian class gets porno image because of cache problem (R 19 48)

i Recycled URL leads to porn site (R 19 47)

- User-friendly Netscape transforms placeholder xxxx.htm in a developing Web site into URL www.xxxx.com for porno site (R 19 54)

H World Wide War on Wonderland Club of child pornographers (R 19 94)

? "MP3" second-most-searched-for string (popular compression program with no anti-piracy protection) after "sex" (R 19 95); meta tags (R 19 96-97, 20 01) used to force search-engine hits, although that situation may be improving (R 20 02)

SPH Teenage radio hams detect collusion in Los Angeles in 1911 (S 18 3:A11)

S William Gibson's Book of the Dead supposedly on uncopyable diskette! (S 17 3)

@* CA notifies licensee before responding to data requests (S 14 6)

..... Other items on privacy and related rights:

SP Risks of reverse telephone directories (R 19 62)

SP Risks of proposed universal CV database for everyone in the UK (R 19 67)

P Lexis-Nexis archives don't match print versions; near-lawsuit over false information (R 19 67)

SP On-line confession in Poland (R 19 70-71)

SP Idaho State rules Boise city e-mail subject to FOIA (R 19 63)

SP Clandestine writes: Intuit TurboTax clandestinely uploading INTUPROF.INI? (R 19 71); Software clandestinely uploading names and e-mail addresses: Blizzard's Starcraft, and Virgin's Subspace (R 19 70)

SHP Proposal to make fake IDs a federal offense (R 19 85)

SP Risks of Federal healthcare insurance database regulation (R 19 88)

P WIPO Copyright legislation, HR 2281; amendment permits reverse engineering for crypto research and security evaluation (R 19 88)

P- New Swedish personal information handling law makes most of the Internet illegal (R 20 05)

P FTC charges Geocities with misleading customers, selling private info without permission; Engage system to track individual Net usage (R 19 92)

$P Nancy Kerrigan settles X-rated lawsuit over faked porno images (R 19 97)

SPH Social Security claims agent takes revenge on woman by entering her death date in SSA database (R 20 01)

SP Security risks delay online registration system at U.Va. (R 20 09)

SP Discussion of Northwest frequent-flyer database privacy and integrity (R 20 12-13)

P Supreme Court rules against software filters for sexually explicit materials (R 20 10)

P Swedes outlaw naming an individual on the Internet (R 20 05,09)

P Shanghai entrepreneur Lin Hai tried in China for providing e-mail addresses (R 20 11)

P Windows 98 Registration Wizard may violate European Privacy Laws (R 20 25)

fSP IE 5.0 browser Favorites bookmarks graphic favicon.ico (R 20 31)

SP Privacy risk in "shopping-cart" software (R 20 33)

SP Major flaws in the WIPO domain name proposal, A. Michael Froomkin (R 20 24)

SP Raytheon probes e-mail moles, subpoenas Yahoo! (R 20 30)

..... Other electronic monitoring and tracking:

Sf Electronic card designed to spot football hooligans (S 14 5)

@fh Monitoring systems cause unintended changes in Bell Canada operator behavior and Metro Toronto Police (S 18 2:6)

SP Satellite monitoring of car movements proposed in Sweden (R 18 81)

SP Swedish narcotics police demand telephone card database (R 19 07)

..... Inference used in deriving protected data:

- Evident symmetry in scoring mask used to guess test answers (S 16 3)

+- Joe Klein's computer-detected authorship of Primary Colors (S 21 4:14) confirmed by handwriting analysis of typescript annotations, then finally acknowledged by publisher! (R 18 26,27)

Spamming, Junkmail, and Related Annoyances:

- Maryland attempting to outlaw `annoying' and `embarrassing' e-mail (R 18 81)

- Nevada contemplating outlawing unsolicited junk e-mail (R 18 87)

SHOA Vineyard.NET used as spam conduit for 66,000 messages (R 18 79)

SHOA More risks relating to spamming and spam blockers (R 19 02,05,10,13); legal implications (R 19 10)

Pf Overzealous spam blocking (R 20 49), and IMRSS (R 20 51-53); RISKS-20.44 blocked by overzealous Melissa detector at health.gov.au (R 20 45)

SP Porn spammers send cybergreeting with hidden URL (R 20 77)

SH FAX Attacks - risks of junkmail spamming saturation (S 14 1)

Shf More NSI woes; spamming its own customers with weak password scheme (R 20 58-59)

S Spam causes major ISP delay in e-mail (R 20 53)

- AOL enables blocking of 53 domains in attempt to reduce junkmail (R 18 56,62)

SHA Cyber Promotions: spam and get spammed, plus restraining orders (S 22 4:28, R 18 81, 19 13); Cyber Promotions spamming restrained by Earthlink injunction; CP agrees to pay CompuServe $65,000; CP hit by 20-hour retaliatory spam attack (R 19 13); CompuServe blocks some multiple-address mailings? (R 19 21)

SHAO Spammer Craig Nowak used Tracey LeQuey Parker's from: address; she received 5,000 bounces, and sued - along with EFF and Texas ISPs Assoc. (R 19 19,20)

SHAO Spammer retaliates against NJ ISP block by Beth Arnold, using her e-mail address and 800 number; she was ping stormed and flooded with calls (R 19 21)

SHA More spamming: Newmediagroup anti-spam measures draw retaliation (R 19 16,17,21); Anti-spam bills in U.S. House and Senate (R 19 18,21);

S Spam filtering (R 19 24)

SH Spams and associated risks (R 19 25,27,31-34); laws (R 19 35-36); $125 million lawsuit to stop striptease advertising via Strong Capital Management (R 19 27); Hewlett-Packard scanner spam (R 19 38); Pacific Bell Internet spammed with forged QueerNet address, causing Pac*Bell to misdirect its retaliation (R 19 44); Samsung spam and reverse-spam (R 19 32,33)

fh Monster accidental e-mail blitz (S 23 5:26, R 19 74)

f Matsushita's Panasonic Interactive Media filter spews out vulgarities (S 23 3:26, R 19 82-83)

+/-? Discussion of whether U.S. Code Title 47, Section 227 applies to spam (R 19 33-36,42,44)

SHf Risks of reading Trojan-horsed spam mail (R 19 49,50) and accidentally clicking on wallpaper icon (R 19 46)

SHO Travis County court fines Craig Nowak (see R 19 19-20) $19,000 for his spam activites (R 19 46)

SHi MCI Mail spam blocker and account-name changes may make things worse (R 19 53); further risks of overzealous anti-spam measures (R 19 55)

SHO Spammers blackmail AOL, threaten release of 1M addresses (R 19 53)

SHO AOL hit by e-mail scam and Trojan horse URLs (R 19 34)

S Trojan horse: 5-yr-old installs AOL CD-ROM from Chex Quest box (R 19 26)

SP SPAMMING: 6100 Cornell University students spammed with entire list in TO: field; 9 gigabytes (R 19 64); Rice University (R 19 66); Natl Assoc of Broadcasters deluges its own members with spam (R 19 62)

hf NASAA spams investors by mistake (S 24 3:25-26, R 20 07)

Other Unintentional Denials of Service:

..... Recent cases

$fm Greek tax information system experiences blackout (S 25 3:15-16, R 20 75)

f U.S. National Archives loses 43K e-mail messages, backup failed also (S 25 3:, R 20 76)

f/h? NSA system inoperative for four days (S 25 3:16, R 20 78)

$f/h? AT&T Business Internet Service major outage of primary and backup DNS systems (S 25 3:16, R 20 78)

$f Computer glitch cancels 86 America West flights (S 25 3:16, R 20 80)

$Vhm Northwest Airlines grounded for 3.5 hours after cable cuts off main and backup fibre (S 25 3:16, R 20 85)

$m Week-long outage in NE San Jose after cable cut downs 11,000 phone lines (S 25 3:16, R 20 84)

m Fire takes out Nottingham phones (S 25 3:16, R 20 80)

m Senate Web site dies as Clinton stresses Net-reliability (S 25 3:16, R 20 81)

i Online broker blames outages on software maker; incompatibility, not hacker attack! (S 25 3:16, R 20 83)

..... Older cases

(!)$V Amsterdam air-freight computer crashes, giraffes die (S 12 1)

@*Vf ARPAnet ground to a complete halt; accidentally-propagated status-message virus [27Oct1980] (S 6 1: Reference - Eric Rosen, "Vulnerabilities of network control protocols", SEN, January 1981, pp. 6-8)

@*Vf ARPAnet loses New England despite 7-trunk "redundancy" (S 12 1)

Vm Network crash halts Larry Ellison's OpenWorld demo (S 23 1:11, R 19 40)

mh Judge Zobel's awaited e-mail in "au pair" case delayed over an hour by Boston Edison Electric workers in a manhole disconnecting his ISP (R 19 45)

-/+ Estimates of the effects of the Starr report on the Internet (R 19 95): loc.gov, house.gov, and gpo.gov were essentially inoperative, but proliferation of mirrored sites eased the burden substantially (R 19 96); many comments that the Communications Decency Act I (ruled unconstitutional) would have had to penalize the Starr Report. with fines of $250,000 and 5 years in prison to anyone posting it on the Internet. AP estimated almost 6 million people browsed the report via the Internet.

V$he Computer collapse wipes out British Social Security NIRS records; manual payments prone to fraud (S 24 1:32, R 20 01)

- ACM's ISP cuts off service for late payment of fees (R 19 15)

Vmh Computer crash loses CBC radio listeners' requests (R 20 17)

f New Haven cable viewers see "SW Failure. Press left mouse. ..." (S 19 4:8)

*$Vm Weather Service phone circuit failure downs forecasts for 12 hours (S 17 1)

*$Vm Weather computers down for 12 hrs, blocking AFSS flight service (S 19 1:9)

Vm Cold weather impairs fiber-optic performance (R 19 41)

@he Computer test residue generates false tsunami warning in Japan (S 19 3:4)

Vm California Dept. of Labor computer system crash blocks labor certifications (R 20 25)

$fe Government computer withholds benefits from British widows (R 20 19-20)

*fh UK Serbian sanctions unenforced; Yugoslav breakup unprogrammed (S 18 1:9)

demi DEC SRC Topaz rendered useless by multiple interacting events (S 16 2, a new classical saga in article by John DeTreville, pp. 19-22)

m Hundreds of duplicate computer-mail copies due to errant gateway (S 12 1)

$f 3 e-mail problems give extra copies: Internet, UUCP, MCI (S 14 6)

mfh Part of the duplicate RISKS mailings problem resolved (S 15 3)

f Posting to vmsnet.announce.newusers unmoderated newsgroup returned half- hourly nasty messages; `announce' implies moderation! (S 15 1)

m Computer failures in automated GMAT testing (S 23 3:25, R 19 50)

!Vm Remote clock comm, 22 traffic lights down. 1 killed, 1 injured (S 14 2)

*f Lakewood CO traffic system fails; single disk drive, no redundancy (S 15 2)

*Vm Austin TX auto traffic-light computer crashes; 2 lights out (S 11 5,12 1)

*Vef Another traffic light outage in Austin TX (S 15 3)

f/h German computerized traffic-light stuck on morning rushhour (S 19 3:5)

Vef Massive failure of Washington DC traffic lights (S 21 5:16)

Vhe Dublin traffic lights out 28 Sep 1998: massive congestion (S 24 1:32, R 20 01)

*m More on traffic signals going four-way green (R 20 48)

$f Overloaded Ontario transit computer delays commuters (S 14 2)

*Vh Unplugged cable plugs Orlando traffic light computer system (S 14 1)

*$Vh Hinsdale IL fire seriously affected computers and communications (S 13 3)

$mSe Minn. 9th Federal Reserve Bank flooded as air-cooling pipe bursts; serious security vulnerability left open in backup operation (S 16 3)

$V Rhine flooding disrupts computer networks for two days (S 13 3)

$hV Noisy air conditioning shut off by mayor; downs computers (S 13 4)

h GPS lost time synch when first activated when cleaning crew unplugged the master time source! (R 19 30)

VSIh Nando.net shut down for three hours by custodian vacuuming, electrical overload, data server crashes (R 19 48)

hi German Bundestag sound system disabled by misplaced book (S 18 2:5); microphones still not working, months later! (S 18 4:4)

m Gobblings of legitimate automatic teller cards (S 9 2, 10 2, 10 3, 10 5)

m Mass swallowing of falsely expired ATM cards (S 12 2)

fmi ATMs swallow 400 bank cards; retry after no diagnostic that interconnection was broken (S 22 1:21)

h Australian ATMs snatch 921 cards. "Human error" (S 12 4)

$Vf&m Bank of America outage shuts down Cal ATMs, nationwide links (S 14 1)

$Vm Wells Fargo, BofA ATMs out of service (S 14 2)

$Vfm French ATM-authorizing computers down for 30 hours (S 18 4:3)

@$f 1992 leap-year-end clock bug blocks ATM machines 1 Jan 1993 (S 18 2:11)

Vf 1200 Citibank ATMs down four hours due to `software glitch' (S 18 2:11)

Vm Royal Wedding side-effect shuts down computer machine room? (S 11 5)

$Vm CMU library computer power outage; no catalogues (S 12 2)

Vfm Santa Cruz High computer crashes on opening day; no schedules (R 17 34)

m Blown transformer disables automated library card catalog (S 18 2:7)

$Vfmh Palo Alto library computer system errs increasingly, collapses (S 18 4:3)

$Vrm NY Public Library loses computerized references; no backup (S 12 4)

Vhe Sun Valley ski area forgets to back up access database (S 23 3:25, R 19 53)

$mhmh Fear of not enough backups (S 21 2:19)

Vhe Stanford Grad School of Business storage addition causes years of work to be lost for some people; upgrade failed to check backups first (R 19 66)

$Vm Computer crashes stop gasoline pumps, other businesses (S 11 5)

$ Other problems with fast-food computers as well (S 12 1)

$Vm Aylesford new supermarket checkout failure closes store (S 17 1)

$f UNICEF loses thousands of orders for greeting cards (S 14 1)

hi Fred Cohen's saga of HP200 data integrity woes (R 19 68,69)

$f US Gov't computer password check flaw results in crossed orders (S 16 3)

$m 1017 dipsticks ordered instead of 17 due to ASCII 0->1 error (S 16 3)

$h M.Ward warehouse dropped from database, cut off from shipments; employees paid for 3 yrs anyway by different computer system! (S 16 3)

* Hospital gets computerized Reagan vote calls, 20/hr for 6 hours (S 12 1)

$V Broker's phone tied up 3 days: errant computerized sales pitch (S 12 1)

f Phone call deluge from program bug in computerized Coke machines (S 10 2)

h Another Coke machine phones home for help, gets Ft. Bragg number (S 17 2)

? Potential risk of latest wireless and cashless Coke machines (R 20 38)

fh More machines phone home: summary notes cold drink dispensers, lonely oil tank, faulty public lavatory, medical insulin fridge alarmed because of low temperature (R 19 31,33); multiple autodial illegal (R 19 36)

hi Abandoned oil-tank phone harasses MA woman for 6 months (R 17 34,36,37)

$H? Compass Airlines jammed with 25,713 calls; computer generated? (S 16 1)

f Phone machines call each other; switchhook-flash glitch (S 19 3:8)

fh Stray signal loops beeperless remote answering machine (S 14 6)

Sfm Hare Krsna chant triggers answering machine remote (R 17 91-93)

m Sony TV remote control turns Apple Performa 6300 on/off (R 17 95)

$Vm Computer network node hit by lightning; down for weeks (S 11 5)

V$m Lightning strikes drawbridge controls (twice!!), out for days (S 13 4)

Vm Lightning disables lightning-strike-monitoring system (R 20 42)

VH Green-Card law firm uses the Internet to broadcast ads; volume of protest traffic shuts down systems (S 19 3:9)

Vm Basketball scoreboard clock fails as reporters PCs overload power (S 13 3)

$Vf Australian betting network downed after software inconsistencies (S 13 3)

$V Betting computer crash invalidates winners; class-action suit wins (S 19 4:9)

(h) Fire destroys on-line (sole) copies of secret ice cream flavors (S 13 3)

Vm NY Times omits op-ed page due to "computer breakdown" (S 20 5:9)

$Vh IRS has no contingency plans for computer disasters (GAO report) (S 11 2)

$Vhf Software can burn out PC monochrome monitor (0 horizontal sweep) (S 13 3)

f Hewlett-Packard recalls personal organizers, battery change loses data (S 21 2:18)

*m Product safety recall for Textronix TDS210/220 oscilloscopes (R 19 88)

Vf VMS tape backup SW trashed disk directories dumped in image mode (S 8 5)

Vf VAX UNIX file system disk purge runs amok at various locations (R 5 04)

m Disk failures after extended shutdown, bearing seal problem (S 15 3)

$m Electronic flash of BBC documentary crew hangs tape drives (S 12 4)

m EPROMS susceptible to ultraviolet, bright lights (S 14 1)

Sf Spreadsheet program destroys database (S 13 1)

m Rats take a byte out of Ugandan exam computers (R 20 05)

..... Other accidental denials of service due to interference:

$SM Computer interference from McDonalds toasters; paychecks higher (S 15 1)

$SfM Sputnik frequencies triggered garage-door openers

$SfM Pres.Reagan's command plane jams 1000s of garage-door openers (S 11 2)

SfM Fort Detrich communications jam garage-door openers? (S 13 1)

SM Garage door interference again - Mt Diablo and the Navy (S 14 5)

M EMI from USS Carl Vinson opens garage doors in Hobart (R 20 31)

SfmM Risks of Army ordnance being autozapped by EM radiation (HERO) (S 16 2)

SMi C-Guard antijam system jams cellular communications (R 19 73-74)

$VSmM Sunspots disrupt communications, Quebec power station, ... (S 14 5)

mM? Effects of Leonid meteor shower in 1998-99 on satellites? (R 19 23)

fmM Faulty car alarm jams S-band downlink for Lewis satellite (R 19 24)

SM Johnny Carson loses his hat to electronic interference (S 14 6)

mM Clocks leap forward gradually. Power line interference! (S 16 2)

*SM Airlines ban in-flight mouse use: interference with navig. systems (S 17 3)

*mM More on risks of RF interference in aircraft: cell-phone linked to London to Istanbul crash-landing? (R 19 34,36,37)

*SM Electronic interference affects airplanes, car brakes, robots (S 18 3:A10)

*SfmM More on risks of electromagnetic interference: medical devices (R 18 47) and airplanes (R 18 47,52)

SmM Interference effects of the next cycle of solar activity (R 18 62,63)

*SM Opel Corsa stops for mobile phones (S 18 3:A10)

*SM Interference from mobile telephones affects hearing aids, cars (S 18 3:A10)

VmM Mobile phone interference dependably crashes Netware servers (S 22 2:20)

SM Football coach-to-QB-helmet transmission interference problems (S 20 1:19)

SM RFI affects Kroll K-154 building-construction cranes in Toronto (S 20 1:20)

SM Microwave interference affects construction cranes in Seattle (S 20 1:20)

SM Accidental EMI observed during Emergency Response seminar! (S 20 1:21)

MH? Oral hackers could disrupt voice-operated systems (S 20 2:13)

SM British hospitals ban portable phones because of interference (S 20 3:10)

M* Studies of high-altitude cosmic-radiation effects on memory loss (R 18 79,81)

SM Risks of erasable "cash" in SmartCards? (R 20 25)

$mM? Damages awarded after Sleepezee Beautyrest high-tech bed controls went berserk. Electromagnetic interference? (R 19 11)

@!!M Sheffield (20 deaths), pacemakers (2 deaths), @SfM Electrocauterizer disrupts pacemaker (S 20 1:20)

@*SfM Air Force bombs Georgia - stray EMI?; @*M$ Challenger communications, CB auto interference, Ghost phone calls; @*M Fail-unsafe effects of microprocessor controlled autos; @*M Nuclear reactor knocked offline by 2-way radio in control room; @$M telephone outages, stock exchange outages, Tomahawk 2, Black Hawk; @$M "Grind" and "Sunset Boulevard" sets; and other cases noted here; @M Display lasers affect aircraft: pilots blinded over Las Vegas (R 17 55); @M Melbourne Airport VCR RF interference affects communications (R 17 44)

@VSM New HDTV signal shuts down Baylor heart monitors on same frequency (R 19 62)

@SfM Case of GPS jamming of Continental flight by failed Air Force computer-based test (R 19 71) more on GPS jamming/spoofing: British Airways flight lost all three GPS systems while French military was testing jammers; Continental DC-10 lost all GPS signals while Rome Lab was experimenting with jammers (R 19 74,85)

@SM Cell phones can interfere with auto systems (R 19 63)

@SM Czechs ban mobile phones in gas stations (interference) (R 19 68-69)

Law Enforcement Abuses, False Arrests, etc..

..... Database and audit-trail abuses:

@!PH Murderer got actress Rebecca Schaeffer's address from Calif DMV DBMS; new regulations on DB access: notify interrogatee, then delay response for two weeks (S 14 6)

!*$SHI Arizona ex-law-enforcement officer tracks down and kills ex-girlfriend; GAO report on NCIC itemizes that and many other flagrant misuses (S 18 4:7)

$SHI NY police chief indicted for misuse of confidential database (S 13 4)

SHI 3 police officers sentenced for misusing Police Nat'l Computer (S 14 2)

S Risks of STOVEACT, phone-enabled STOlen VEhicle [de]ACTivation (R 19 66)

*SHI SanFran police officer charged with deleting a warrant (S 17 1)

$SPHI 45 LA police cited for searching private computer records (S 18 1:21)

$SPHI Theft of 8.5K criminal records; investigator, 2 police indicted (S 18 2:16)

SH Maryland defense lawyers hustling clients from database of arrest warrants, sometimes tipping off defendants prior to arrest! (R 19 48)

$SPH Police frame sisters on murder charge with bogus ATM evidence (S 18 4:9)

P Victim ordered to surrender computer and passwords (R 19 43)

@S Risks in altered live video images: L-vis Lives in Virtual TV (R 18 18-21)

@P 8 convicted killers sue to prevent Mass from monitoring phones (S 19 4:12)

@$SHAI Mass. hospital technician accessed ex-employee's account, accessed 954 files, harassed former patients, raped girl (R 17 07, SAC 13 3)

The New York Times Web site exposes CIA agents (R 20 93)

..... False arrests resulting from mistaken identities

$Phi Repeatedly detained (S 10 3, S 11 1) for actions of an impersonator, Terry Rogan wins rights violation case (S 12 4); settles for $55,000 (S 13 2)

$Phi Other cases of false arrest due to computer database use: C.R. Griffin license not suspended; Sheila Jackson Stossier mistaken for Shirley Jackson; two Shirley Jones, diff birthdays, 6", 70 lbs diff (S 10 3)

SPH John Munden, UK policeman, acquitted after having his bank account cleaned out and false fraud accusation. Must read this one. (R 18 25)

VHm Computer crash falsely blamed on San Mateo Dist.Atty computer chief by would-be successor (S 22 5:14)

Phi Richard Sklar falsely apprehended three times because of impostor (S 14 2)

$Phi Roberto Hernandez falsely jailed twice; won $7000 first time! (S 14 5)

$Phi Joseph O. Robertson in for 17 months despite contrary evidence (S 14 5)

*Phi Martin Lee Dement 2 yrs LA County jail; fingerprint sys not used (S 14 6)

*$H Another bogus identity: Teresa Stover alias' VA DMV license; `perhaps thousands' of fraudulent licenses `bought'? (S 16 3)

Phi Donny Ray Boone spent 41 days in jail because his name was similar to one mentioned on The Osgood File (noted in Computer-Related Risks)

Phi Wrong Neil Foster arrested on incomplete database match (S 13 2)

Phi More computer-inspired false arrests, libel, etc. (S 12 3)

*hi Nonupdated stolen-car database; one owner shot, one roughed up (S 21 4:14)

*P(f/h?) Driver arrested in computer muddle: two cars with same plates (S 17 1)

*i Police raid wrong house (twice), due to uncorrected database typo (S 17 1)

hP Two Russ Hamiltons with same birthdate; wrong one jailed (S 19 3:6)

*$h Rented car falsely listed as stolen leads to false incarceration (S 16 4)

*h ATM photo of wrong person sent as rapist/robber; `downloading error' (S 16 4)

- Motorist gets citation based on photo, responds with photo of money (S 16 4)

hi Ex-worker falsely arrested for deleting files; files were there! (S 20 2:8)

fh? Man jailed erroneously because of computer glitch (S 23 3:23, R 19 58)

hi Mistaken identity: Going to jail innocently over a speeding ticket (R 19 69,71)

Ph Bank robbery "wanted" poster of wrong person due to unchecked match (R 19 29)

..... Effects of false database information

False entry for felony arrest hinders job seeking (R 20 92: S 26 1:)

..... Prison problems:

!m Busy Philippine phone lines prevent stay of execution; ultimate denial of service in unreceived death reprieve (R 20 47)

hi Philadelphia jail keeps 100 despite case dispositions (S 21 4:13, R 17 80)

*SHA Santa Clara prison data system (inmate altered release date) (S 10 1)

*SHA Drug kingpin escapes LA County prison via bogus release message (S 12 4)

SHA Convicted forger released from Tucson jail via bogus fax (S 17 1)

SHA Another phony-fax get-out-of-jail scheme: Richard Foster (S 23 1:14, R 19 27)

*f Seven Santa Fe inmates escaped; prison control computer blamed (S 12 4)

*hi Oregon prisoner escaped; frequent-false-alarm alarm ignored (S 12 4)

*ref New Dutch computer system frees criminals, arrests innocent; old system eliminated, and no backup possible! (S 12 4)

Semh Another computer-miscontrolled jail enables escape (S 23 1:14, R 19 44)

hf Prisoner released due to program design flaw (S 23 3:23, R 19 59)

Sf Kenton County KY Detention Center cell doors opened spuriously, remained open for 9.5 hours (R 20 24)

Sf New Southeastern Ohio Jail emergency evacuation system malfunctions, unlocks doors prematurely, prisoner walks out! (R 20 83)

df New Tulsa County jail system development woes set back operation (R 20 39)

f New El Dorado jail cell doors won't lock - computer controlled (S 13 4)

Sf San Joaquin CA jail doors unlocked by spurious signal; earlier, inmates cracked Pelican Bay State Prison pneumatic door system (S 18 2:4)

fm Oklahoma power outage freezes jail doors (S 18 2:4)

f Northern Calif. jail-door openings due to software errors (S 19 3:11)

S Limon (Colorado) prison is claimed to be escape-proof! (S 18 4:10)

fmh Multitude of new Pittsburgh Jail system woes (S 20 5:9)

hi Data entry omission extends prisoner's sentence (S 21 5:17)

hifm Baltimore (MIS)throws the book(ing database) at criminals (S 21 5:17)

@SP Justice Dept wants to scrutinize parolee computer use (R 18 70)

HSP Texas prisoner convicted of rape employed to enter Metromail survey results, harasses respondents (R 19 13)

..... Surveillance:

SP FBI's Carnivore monitors Internet traffic; summary of House Judiciary oversight hearing, by Lina Tilman (R 20 97; S 26 1:); sloppy pdf usage allows expurgated information on review team identities to be uncovered (R 21 08, S 26 1:)

SP Court says FBI has been given too much wiretap power (R 21 03; S 26 1:)

+- DoJ does not support FBI on CALEA-amendment roving wiretaps (R 19 90)

..... Other law enforcement problems:

m FBI Interstate Identification Index database system crashed on 11 May, for three days preventing background checks of some 100,000 would-be gun purchasers, and use of the NCIC 2000 Integrated Automated Fingerprint Identification System (R 20 88)

m*(!?) Inacessible database leads to police friendly fire in Spain (S 22 4:29, R 18 88)

$f New Dutch system fails to cope with police ticket writing (S 16 4)

* Undercover police use CHAOSNet BBoards in `snuff' film bust (S 14 6)

fi INS suspends immigration process due to EDS fingerprint data format incompatibility (R 20 10)

f Fault in electronic leg tag indicates false-alarm escape (S 14 6)

*mf System fails to report movements of murderer with electronic anklet (S 17 3)

fh Monitoring systems cause unintended changes in [Bell Canada operator behavior and] Metro Toronto Police (S 18 2:6)

f Long Beach CA crime statistics affected by program error (S 16 2)

- Old bounced checks jail hotel employee on visit from Barbara Bush (S 17 3)

$h Fees on unused account overdraw, generate felony arrest warrant (S 18 1:15)

- Swedish court fines parents for son's overly long name (S 21 5:17)

i Australian court emulates Swedes (S 21 5:17)

@SH "Virus" removes security barriers in Italian judicial computers (S 17 3)

@$ NSWales computer deregisters all police cars; unmarked car scofflaw (S 15 2)

@SP Police can't crack crypto used by Basque terrorist organization (S 17 3)

@SH* NY Police Department phone system cracked (S 21 5:19)

- Woman on murder charge blames chip implanted in brain by ex-husband (S 17 3)

fi Computer-generated will rejected by court (R 17 95)

fe When it was automated, Paris police computer mismatched split-out Corsican city code with postal code, and was unable to collect motorists' fines (R 19 41,42)

i Risks of Florida's automating traffic citations (R 19 34)

- Computer glitch turns traffic ticket into sex conviction (R 19 73)

..... Law enforcement successes:

+ Forensic use of GPS to catch murderer (S 23 3:26, R 19 83)

Identity Theft, Mistakes, Related Problems

..... Identity theft:

$Phi Terry Rogan's impersonator is noted above under false arrests.

$HP Imposter usurps Clinton Rumrill's existence (S 19 3:7)

$HhP New license sent to imposter who plagued Charles Crompton (S 19 3:7)

$SH 550 felonies in 1991 for SSN misuse; 12 people adopt a single SSN; $10,000 charge loss; 5 people cleaned out someone else's benefits (S 16 4)

SP Impersonator transfers numerous traffic citations to victim (S 17 2)

SHA Masquerader's name collision lands robbery victim in jail (S 23 1:14, R 19 28)

SHA NC identity theft defeated by victim's wife (R 20 08)

SP Report on identity theft (S 25 3:22, R 20 77)

SPh Actor Jerry Orbach sues eBay for auctioning off a contract containing his SSN, leading to fraud (R 20 85); new identity theft case (R 20 86)

SPHh Serious increases reported in identity theft (R 20 95, 21 04-05; S 26 1:) See http://www.calpirg.org for possible assistance if you have been had.

SPH California DMV fosters identity theft: 100,000 of 900,000 duplicate license requests in 1999 were fraudulent! (R 21 07; S 26 1:)

..... Risks of identifiers, particularly as authenticators:

SPIOA Risks involved in Social Security Admin PEBES database (R 19 05,06,09,12); legislation to bar use of personal information (R 19 10); See PGN's U.S. House testimony on PEBES and identity theft (http://www.csl.sri.com/neumann/ssa.html), subsequent extended position paper for an SSA panel (http://www.csl.sri.com/neumann/ssaforum.html); more on PEBES database problems (R 19 16); SSA restores PEBES service, with opt-in and a few other safeguards (R 19 37)

SHA Knowledge of SSN sufficient to convince SSA falsely of Kirsten Phillips' death (R 19 39)

SP Risks of SSNs: Chris Hibbert's SSN FAQ (http://cpsr.org/cpsr/privacy/ssn/ssn.faq.html) (R 19 12);

SP CALPIRG Theft Identity Guide for protecting your identity http://www.pirg.org/calpirg/consumer/privacy/toi/prevent.htm (R 18 91)

$Phi Discussion of identity cases, Inside Risks, CACM, 35, 1, Jan.1992.

..... Other personal name confusions and mistaken identities

Phi More mistaken-identity nightmares: O'Connor, Taylor, Stapelton (S 13 2)

Phi Michael W. Klein, mistaken identity due to outrageous mismatch (S 20 2:7)

hi Two Belinda Lee Perrys share the same birthdate (S 21 4:13, R 17 88)

$Phi Identical database record names cause nasty tax problem in Canada (S 12 4)

h Two Steven Reids in Montreal sharing same birthday (S 18 1:22); See also Don Norman et al., on-line (R 14 12-17) on Name Problems

hi Medical identity problem: confusion between Jim and James (S 23 3:24, R 19 46)

@f,h,i Ordering airline tickets on-line: name confusions on e-tickets, with similar names (R 19 28) and identical names (R 19 29)

fh Nasty name recognition problem in New Mexico state DMV and tax system arises in seeking interoperability (R 20 04)

Other Legal Implications

!$ Deaths of 3 lobstermen in storm not predicted by National Weather Service - 3 mos unrepaired weather buoy; $1.25M award (S 10 5) [NY Times, 13Aug1985] Overturned by federal appeals court. [AP, 15May1986] (S 11 3)

!m Spider triggers alarm, investigating dog is sick, man is shot (R 18 46)

SPH+/-? Discussion of Communications Decency Act, unconstitutionality (R 17 74), federal court judge enjoins indecency provision; foreign implications (R 17 71,72,83,91,92, EPIC Alert 3.04); Federal Court rules against Communications Decency Act (S 21 5:19); another ruling against Communications Decency Act (R 18 29)

S ITAR to allow personal-use export ("Matt Blaze exemption") (R 17 75, S 21 4, SAC 14 3)

SP Judge: Computer encryption codes ruled protected speech (S 21 5:19); 9th Circuit Court of Appeals upholds district court in Bernstein case (R 20 38)

$SH Anticracking bill S982 passes senate; between $2 and $4 billion in losses in 1995 reported (R 18 48)

P California court rules unwanted e-mails are "trespassing" in Intel case (R 20 35)

S ACLU files suit vs. Georgia Internet law against Web-spoof frauds (S 22 1:20)

f Caldera lawsuit over being sabotaged by Windows 3.1; MS claims lost source code invalidates lawsuit! (R 19 94)

$ SAP sued by bankrupted FoxMeyer Corp. for delivering unsuitable order-processing software; SAP disagrees (R 19 94)

SH Theft of UN computers impedes war-crime prosecutions (S 21 4:18, SAC 14 3)

*$ EC Machine Safety Directive enables suits over unsafe HW/SW (S 18 1:26)

$hfff Salvage Association awarded £662,926 from CAP Financial Services after badly botched accounting system was scrapped (S 18 1:8)

$H Logisticon disabled Revlon SW in contract dispute (S 16 1)

H? SoundWars: Creative Technology vs. Media Vision, SW sabotage? (S 17 4)

$PH INSLAW case over Promis SW - US House report available (S 18 1:7)

P Shetland Islands newspaper hyperlink controversy over Web links (S 22 2:20); subsequent reports (S 22 4:27, R 18 78-79,81)

$PH Borland vs Symantec lawsuits based on MCI Mail evidence (S 18 1:19)

S Risks of VeriSign digital certificates - legalese (R 18 47)

$ MS-DOS 6.0 infringes on Stac compression, Microsoft pays $120M (S 19 3:8)

$ Reuters Holdings PLC delays Dealing-2000 over liability issues (S 16 1)

S Conflicting testimony in NYC case; differing phone records (S 16 3)

+ E-mail provides evidence in LA police probe (S 16 3)

ih Van Nuys CA doughnut shop turns up in LAPD database because it is closest address to high-crime mini-mall street (R 18 70)

$SPH Case of Oracle wrongful termination based on e-mail evidence (R 18 07-08); disposition: Adelyn Lee vs Oracle's Larry Ellison: The (f)e-mail of the PCs is more deadly than the bail (S 22 4:27-28, R 18 81)

! Discussion of New Orleans police chief murdering accuser despite wiretap (Shabbir Safdar, R 18 01)

+ PC file name "murder" contains plotting details for alleged murder (S 16 3)

S? UK libel writ served overseas by e-mail (R 18 09)

@$f UK poll taxes uncollected; flaw in ICL Comcis SW; printout ruled invalid evidence, unitemized dunning notices rejected by court (S 18 1:10)

+ Newly linked fingerprint file breaks unsolved SanFran 1984 murder (S 17 2)

SH+ Bogus flying-saucer message traps police-band sniffers (S 18 3:A8)

P+ Marijuana conviction based on anomalous use of electricity (S 18 3:A13)

$SH London police foil million pound hacking plot (S 17 2)

* Computer records for bus tickets contradict killer's bogus alibi (S 17 1)

SPH Colorado Spgs Mayor reads Council e-mail, says it should be public (S 15 3)

$h US court rules computer malpractice in Diversified Graphics case (S 15 1)

$h Lawsuit vs Lotus' Symphony dropped (omitted General Costs proposal section) (S 11 5:11-12, 12 1)

$ Uncertainties about PC shutdown damage while under lawsuit (S 15 5)

$f Lloyds Bank pays £50K in libel suit over misbounced checks (S 18 1:13)

$* Risk: Analysis, Perception and Management (report), assessing the worth of a human life around £2M to 3M, .5M in UK Transport Dpt (S 18 1:11)

@$S Laser printer counterfeiting and new US legislation (S 15 5)

@SH$ Lawsuit against Epson on e-mail privacy rights (S 15 5)

@SH Litigated cases (Mitnick, Zinn, Burleson, Morris, British Telecom, ...)

@SH Implications of Sun Devil investigations

@$SPH TRW settles lawsuit with FTC, 19 states on privacy violations and erroneous data; improvements required, $300K payment (S 17 1)

*$ Can a computer system be held liable? (S 15 1)

$ Prodigy liable for contents because they exert editorial control (S 20 5:10)

+/-? Proposed Virginia law on self-disabling software (S 20 2:12)

** Launch on warning legality subject of law suit (S 10 2, 11 5) [suit lost]

H FBI's Cal House sting: ten-fold rise in computer backup deletions (S 13 4)

$SH Cable freeloaders caught in sting by ad offering free T-shirt (S 18 2:14)

$SH Users of pirated Cadsoft stung by offers of free program (S 18 2:14)

$SH Cable-TV sting operation: Ireland traps stolen black-box users (S 19 4:13)

$hSH FBI Medicare sting backfires; reported losses exceed $160K (S 20 2:11)

$ Sex-therapy software risks (S 11 2)

$ Computerized sex ring broken; records seized (S 11 5, S 12 1)

S Further risks of computers in prostitution (S 14 1)

$ $3M hi-tech prostitution ring raided, 4000-name database captured (S 17 1)

$ Heroin smugglers caught; stored computer data used as evidence (S 12 1)

* 7 terrorists arrested via phone numbers in wrist-calculator (S 12 3)

+ Residual evidence still stored in Psion EPROM nabs drug smuggler (S 13 2)

+ Robbers call first, break in, erase answering machine message, but are caught based on CNID record of the call (R 16 32)

SP Incorrect phone trace lands Bostonian in jail; digits transposed (S 20 3:11)

+ Portuguese drug ring ensnared by pager technology (S 19 3:10)

$ War-on-drugs communications network stalled by budget squeeze (S 17 2)

$H Schwab employees use e-mail to sell drugs (S 17 3)

* Detailed telephone bill provides alibi for accused murderer (S 12 1)

* Mobile phone ID may trap British kidnapper? (S 17 2)

$m Israeli supreme court appeal blamed on computer malfunction (S 11 5)

*$ Expert systems for criminal investigations (S 11 5)

$H Blackjack gambler with microprocessor faces trial (S 13 2)

$H Financial-computer penetrator acquitted: "Welcome to the..system" (S 12 1)

$h Man arrested after shooting his computer (S 12 4)

$H America's Cup floppies held to ransom for telemetry data (S 12 1)

$H Computer network used to advertise $250,000 in stolen ICs (S 12 3)

$H U2 rock-band ticket oversell detected, shuts out scalpers (S 17 2)

$h Canadian civil servants charged $1,270 for private computer use (S 12 3)

$h NM court's docketing files erased in botched backup; $1300 cost (S 15 3)

- Brazilian corruption probe runs out of computer resources (S 19 1:3)

$P Minnesota Nintendo Lottery from your home proposed, withdrawn (S 17 1)

SPH Exon anti-cyberporn bill (S 20 3:11)

SHI Massachusetts welfare fraud investigators fired: tax-record misuse (S 22 1:20)

$S Risks of Conn. fingerprinting system to catch welfare recipients (R 18 69) Also, note earlier NY Medicaid proposal (R 13 40)

- Self-help legal software illegal in Texas? (S 24 3:26, R 20 21)

? Federal Court holds that source code is a functional device (Peter Junger, R 19 88)

h Intel "accidentally" sues potential partner, Via Technologies (R 20 38)

Other Aggravation

..... Risks of whistleblowing:

$h Edward F. Wilson, whistleblowing aerospace SW Quality Assurer fired, life threatened (S 11 3)

- Roger Boisjoly fired after reporting O-ring problem that led to loss of the Challenger. (See Challenger, in SPACE, above.)

- Ted Postol harassed after report downgrading Patriot defense shortcomings (See Iraqi scuds, under DEFENSE, above.)

..... Internet and on-line hazards:

*SPH Hazards on the Superhighway: Woman cyberstalked by Vito; man receives fax from bogus lawfirm with false accusations; girl harassed; Chicago man sends obscene messages in someone else's name; Boston boy runs away to meet on-line Texas man (S 19 3:8)

PH Sexual harassment suit against Univ.Wisc-Madison over computer use by an individual (S 22 4:29, R 18 83)

i Sending the wrong message with flowers: interface risk (S 23 3:25, R 19 53)

h A risk of not keeping Web pages updated (S 23 1:12, R 19 41)

H Citibank sued for racist e-mail (S 22 4:29, R 18 83)

$H Internet scams: beware of pyramid schemes, bogus services, misleading equipment sellers, frauds, work-at-home offers (S 22 1:22)

@$SPH 2,300 credit-card numbers stolen from ESPN Sportszone, NBA.com (R 19 24).

$H E-mail scam from "Global Communications": dunning notice (S 22 1:22)

SH U.S. Intelligence agencies reportedly hacked into European systems (R 18 30)

h Cutting off husband's cybersex leads to assault (S 22 2:20)

P French police raid leading Internet service providers (R 18 21)

SPh Danish government puts its own records on the Web, illegally (R 18 63)

Se Intel LANDesk Manager reaches directly into networked workstations (R 18 59)

SP Detroit man charged with e-mail stalking (S 19 4:12)

P Gina Smith (ABC News) saga of e-stalker described in Commonwealth Club forum on privacy, 24 July 1997

SHI Emeryville Ontario cyberstalker (Sommy) (R 19 08) turns out to be family's son (R 19 10,11)

Vhi Risks of information (being and) not being on the Net: black holes (R 20 14-15)

..... Censorship, porn, and risks of filtering - or not:

SP U.S. Supreme Court rules Communications Decency Act unconstitutional (S 22 5:14, R 19 23)

fi White House Web pages off-limits to Surfwatch: photo of first couple and second couple triggers filter (R 17 79); Surfwatch also blocked NYNEX's Web page named iixxxpg1.html because of the "xxx" (R 17 81)

SP? No laptops on the Senate floor: fears of surfing, lobbyists, spamming, real-time on-line influence, etc., ignoring such possible benefits of being able to read pending legislation and to communicate! (R 19 29,32,33)

rfi AOL's Scunthorpe saga: risks of string-based censorship (S 21 5:17, R 18 07-08); more on AOL filtering of Internet e-mail (R 17 65, 18 18,41,42,44,46,48)

i The "finger" command and "Paul Hilfinger" (S 21 5:18)

rfi CyberSitter censors "menu */ #define" because of the string nu...de; binary equivalents of bad words (R 19 56-58)

rfhi More on dimwitted naughty-word filtering (R 20 39-40, R 21 03)

- Applied Micro Technology Inc. device censors closed-captioned broadcasts, e.g., turning Dick Van Dyke into Jerk Van Gay (R 19 63)

P China strengthens control over "cultural rubbish" on the Internet (R 18 73); Draconian controls on Chinese Internet usage (R 19 23)

SP German Cabinet approves Internet privacy, censorship regulation (R 18 69)

P South Korea clamps down on Canadian home page on North Korea (R 18 21)

rfh SW filters sex, blocking access to NJ counties Sussex, Essex,... (R 19 24)

P BUGTRAQ may be banned by Australian censorship (R 20 43)

fiP XXX Web filters take out Superbowl XXXIV sites as porn (R 20 77)

S Risks of junk-mail filtering (R 20 89, and see nondistributed issue RISKS-20.89x which would have been filtered!); Microsoft content-based spam Bcc: filtering (R 20 90-91)

i Police chief: don't permit certain file types (gif, pjg, ...) to stop porno (S 22 1:19)

SH? Gateway 2000 issues promo video tapes with mysterious insertion of offensive and objectionable materials (R 18 90)

- CompuServe German ISP indicted for transmitting porn content; former manager given suspended 2-year sentenced, 100,000DM fine (R 19 73,77)

+ U.S. Supreme Court rules ISPs not liable for content (R 19 83)

fi Royal Court, UK theatre group aiming to "shock and offend", gets new computer system that filters its own specialties! (R 20 84)

h USAF Space Command blocked San Francisco Exploratorium Yahoo site because of baking-soda/vinegar recipe (R 21 02)

..... Spelling correction

*h Spelling corrector fingers Mafia "enforcer" as "informer" (S 12 4)

h Spelling checker for massive drug abuse? Changes "payout" to "peyote" (S 17 3)

h Risks of spelling checkers: goddamn for Goldman; NAUSEA for NASA; colada for collider; one product name for another! Wilted for WilTel; (S 19 3:11)

- Mispeler: Kafka, Musil, Schnitzler to Kaffee, Muesli, Schnitzel (S 20 5:8)

- "Notre Dame" trashed by grammar checker for use of "dame" (S 20 5:8)

hi A spelling-checkered existence: WSJ says Tony Blair "eLabourated" (R 19 12)

hi More spelling curiosities: semper fidelis corrected to semipro fiddles (R 19 34-36); html mangling of & character (R 19 35); Cambridge (UK) City Council letter (spelling-checked) begins, "Dear Sir or Madman" (R 19 50); Dutch spelling checker turns Campbell into kampbeul (camp bully) (R 19 65); Spelling checker converts General Engr to General Negro (R 19 97); More spelling checkerisms: "Pope Beautifies 10 more" (R 20 24)

h "Sussex villages" corrected to "Susan villages" in quote of Finest Hour: The Battle of Britain (R 20 98)

f Nick Atty addressed as "Mr. Attorney" (R 20 25)

f Microsoft Word grammar checker suggests rigor mortis for school reviews (R 18 24)

f Microsoft Office 97 automagically transforms Michael Steffen Oliver Franz's initials `msof' into `Microsoft Office' (R 18 79)

h Etalfried Wedd's Loan Authorization, another name garbling (S 15 5)

h More on word processor context edit garbles (S 16 2)

h Newspaper search-and-replace: back in the "black" => "AfroAmerican" (S 15 5)

ih "tif" to "jpg" fix results in arjpgicial, idenjpgied in Sydney paper (R 18 24)

hi More spellchecker woes, in Radford University sports pages (S 20 1:17)

hi Enola Gay: Another text substitution (S 20 1:17)

i More spelling corrector amusements (Internet to Interment, etc.) (S 21 2:19)

- Limits of automated newsgathering: rugby position (hooker) confused with sex news (S 22 2:20)

..... Automated natural-language translation

f Systran French-English automatic translation oddities (S 15 1)

i Problems with computerized "translation" of English to Danish (S 21 2:19)

fh AltaVista translation interjects "communist" in Esperanto "Prague Manifesto" (R 19 51)

..... Name, number, word confusions (other than false arrests):

rf U.S. Social Security Admin systems cannot handle nonAnglo names, affecting $234 billion for 100,000 people, some back to 1937 (R 18 80)

hi? Minnesota State Senate candidate victim of photo "mistake"? (S 22 1:20)

- Risks of hyphenaters as in e-mail or E-mail vs. hyphenhaters as in email and Email: confusions avoided with hyphens (R 17 95,96, 18 01-04)

f Two John P. Taylors with same birthday get only one vote (S 17 4)

$f FL health services computer glitches; two babies identified as one (S 17 4)

$fi 1st patient with NO SSN, 9 months old, gets billed for many others (S 17 4)

h Mistaken duplicate SSN accusation hits NH Congressman Bill Zeliff (R 18 38)

$e Cygnus XI BBS phone number recycled to dermatological DB; unknowing access attempts by telecomm SW triggered 4 equipment confiscations (S 16 3)

hi Living soldiers listed as dead on Viet Vets' Memorial; input error (S 16 2)

- Computer (cash register) as excuse for poor restaurant service (S 16 1)

Sf Microsoft Trojan horse in Office97 installation (R 19 29)

i Fax program substitutes outgoing fax number for @a (S 21 2:20)

h Bulk US Mail from CA to Switzerla ND delivered abroad [fraud?] (S 14 6)

f Walter Jon Williams' SciFi novel glitched by letter substitutions (S 15 1)

ih Spelling corrector blamed for ACLJ->ACLU (S 19 4:10)

e/ih Library automation loses catalog detail; Madonna -> Mary,... (S 19 4:11)

hi Spellchecker goes beserk; editorial maimed (boss -> DOS) (S 20 2:9)

h LA Times splices two stories together (S 20 2:9)

$h 40,000 copies of book printed from unedited file by mistake (S 15 2)

fe Bible concordance program shuffles text; marvelous garbled text (S 16 1)

$f Bank computer develops costly crush on Fionas (S 20 5:10)

- Anglican Primate gets query on Primate Research; amusing response (S 17 3)

h CDs mislabeled; Dead Kennedys shipped as religious discs (S 18 2:5)

($)m Effects of single-segment errors in digital displays (S 14 1)

f Glowing letter of credit recommendation to `Bob A. Speake, Deceased' (S 16 4)

- Truncations beget name change (Community College of the Finger [Lakes])

h MS Mexico recalls offensive Spanish-language thesaurus (R 18 25)

Hi Vanity e-Mail domain names (e.g., DukeU.com) rile college administrators (R 18 50)

i More on European comma versus U.S. period in numbers (R 18 79)

i Help-desk question on "Press any key": Where's the any key? (R 19 60)

SPh Leftover phone numbers in supposedly new cell phone (R 20 15)

ei INTUIT support line sold off to sex support line (R 20 15); domain name change results in URL pointing to porno Web site (R 20 17)

hi Risks of 3-letter user IDs for free e-mail accounts (R 20 39-40)

h Grave error! Automated survey mailing software reaches for The Occupier, Burial Ground in UK (R 20 05)

..... File and domain name confusions

i Risks of naming files "core" (S 21 2:18)

h Risks of non-portable configuration files (R 17 62)

h Centraal Corp.'s browser uses single words instead of URLs; "bambi" was a bad choice, and led folks to a porn site! (R 19 63)

f Lynx 2.7.1 browser on mistyped URLs coerces http.org domain (R 19 42)

i Risks of Internet keywords in searching on incomplete URLs (R 20 10)

i Missing hyphen in URL nets similarly named porn site (R 19 63)

fhi More cases of misaddressed mail: off-by-one letter in domain (R 20 35) and reused domain (R 20 37); and systems doing what they thought you meant, not what you meant, in Outlook Express (R 20 36-37); Dodgy automatic address book resolution reported using IE5/Outlook 98 (R 20 34), and a similar experience (R 20 36); confusion on MS Web site between versions of NT 4.0 Service Pack 4 and 5 (R 20 37); Flash BIOS chips needing reprogramming (R 20 35)

hi Domain-name confusions (R 20 40)

..... Tax problems

$h David Brinkley gets erroneous $2137 penalty from IRS, retaliates (S 12 4)

$h IRS computer issues illegal $47,000 bill (S 13 1)

$h? IRS mistakenly sends Dickie Ann Conn $1B for $67K back taxes (S 16 2)

fh IRS incorrectly warns 90,000 taxpayers of Nannygate delinquency (R 19 28)

$drS IRS computer project a four-billion-dollar fiasco (S 21 4:12); IRS drops Internet Cyberfile tax filing plan (S 22 1:19)

h/m? Multiple (16,000!) California tax forms mailed to some businesses (S 22 2:20)

@$e SW patch adds $10-30 to 300,000 auto tax bills in Georgia (S 19 3:5)

$h/m? San Francisco's property tax computer fails to send bills (S 16 2)

$h/f? British poll tax tales: bill for £4M instead of 70; bill delivered to "Occupier" at a bus stop in Kent. (S 15 3)

$f UK poll taxes uncollected; flaw in ICL Comcis SW; printout ruled invalid evidence, unitemized dunning notices rejected by court (S 18 1:10)

f 1.3m-pound award against ICL for faulty poll-tax software (S 20 1:17)

$fh Bug in MacInTax drops "other" income in recalculated tax returns (S 17 3)

f 20 income-tax preparation programs give 20 different results (S 19 4:10)

f Intuit TurboTax, MacInTax incompatible with Quicken data (S 20 3:9)

SPf MacInTax security glitch leaves Intuit master system vulnerable (S 20 3:9)

f Another MacInTax glitch (S 22 4:29, R 18 88)

($)f New problems with Intuit tax software for 1996 (S 21 4, R 17 75)

$fh Tax-program bug causes $36,000 overpayment (S 18 3:A6)

f QuickTax 97 miscalculates self-assessment taxes (R 19 30)

@$Phi Identical database record names cause nasty tax problem in Canada (S 12 4)

..... Other cases:

!f Hillsborough soccer computerized turnstiles -> space available (S 14 5)

![H?] 8 deaths, 1 disappearance, 1 injury relating to Marconi systems (S 12 3) (ultimately 9 deaths) (S 12 4)

!Vh False computer data shuts off home power; alternative kills girl (S 12 1)

*f Briton survives "sea monster" attack due to computer glitch (S 19 3:5)

Sf Overload caused Experian credit reports to go to wrong people (R 19 31)

$hi TRW blows credit reports for everyone in Norwich VT; 1 input error! (S 16 4)

$hi TRW false data misreports local taxes; TRW blames subcontractor (S 17 1)

@$ TRW settles lawsuit with FTC, 19 states on privacy violations and erroneous data; improvements required, $300K payment (S 17 1)

$fP Credit queries from shopping around can be cumulatively harmful (S 16 4)

$f Casino blames $320,000 jackpot on malfunction, reneges on payoff! (S 16 1)

$h Pepsi promotion .5M winners blamed on computer glitch (S 17 4)

*h Wrong bar codes result in water shut-offs in Utah (S 14 6)

f Nielsen snafu hurts cable network's ratings (S 23 1:11, R 19 37)

$f Software error really messes up 'round the world yacht race (S 14 5)

fh SW prevents correction of recognized Olympic skating scoring error (S 17 2)

fi Computer scoring glitch at Olympic boxing: evident winner loses (S 17 4)

f/h? Computer-generated sports scores recycle old results (S 18 1:11)

$h $300,000 budget error downsizes Whig Standard (Kingston, Canada) (S 17 2)

*h Weather Service false warnings, disaster reports in live test (S 12 2)

he Computer test residue generates false tsunami warning in Japan (S 19 3:4)

*$hi Poor input data blamed for nonprediction of European storm (S 13 1)

fi Limitations of mouse-based interfaces on disabled persons (R 18 87,88)

*m Carrier control unit blamed for nuclear false alarm (S 11 5)

f/m? Channel Tunnel syndrome? Train false alarm triggers evacuation (S 19 4:8)

V Channel Tunnel closed in both directions on 20 Aug 1997, cause not reported (R 19 32)

$df Bargain Harold's receivership blamed in part on computer problems (S 17 3)

h British Telecom test computer wakes up customer at 4:30am daily (S 18 1:6)

Vi Program conventions cause network outages, terminal crashes (S 18 3:A4)

f/h? ADP flubs cause wrong shareholder votes, wrong labor stats (S 18 3:A4)

Vh "Buffer overload" crashes network bridge: floor buffer! (S 22 1:19)

$e Oklahoma computer system upgrade foulup delays payroll (S 15 5)

f$ Washington State unemployment checks "delayed" (S 22 2:20)

hi Larger type font causes key sentence at bottom of the page to be omitted from Queen Elizabeth's speech in Poland (R 17 95, 18 01)

S PostScript printer chip Trojan horse? Password changed (S 15 5)

$SHi Eugene Smith, 33, legally dead after impostor dies in accident (S 17 4)

$h Customer declared dead by bank computer; effects propagated (S 11 3)

$h Vancouver woman, dead to revenuer database, can't collect refund (S 13 4)

$i Dutchman's death masked for 6 months by automatic payments (S 16 2)

$i Computer-paid bills mask death of Swedish woman for 3 years (S 19 1:2)

fi Kindergarten recruiting for born-in-'88 invites 104-year-old woman (S 18 3:A3)

fi Insurance co. requests first-year checkup for 101-year-old woman (R 16 32)

$f Auto insurance rate triples - man turns 101 (= 1 mod 100) (S 12 1)

$h Auto insurance program misses 18,000 bad-driver surcharges (S 15 1)

$ Montreal life ins. company dies due to SW bugs in integrated system (S 17 2)

$f Comm delays: $1100 debit for aborted withdrawal, side-effects (S 12 1)

fh New computer system duns students for loans not due (S 18 2:9)

$i Keystroke "record" and "replay" accidentally reissues old orders (S 17 1)

$f Swedish union fees miscomputed when salary over 32767 crowns (S 18 1:14)

$h Tampa electric issues bill for $5M instead of $146.76 (S 13 4)

$h $63 data entry converted to $6.3M electric bill (S 16 1)

$h Wrap-around problems in meter reading cause erroneous bills (S 13 4)

$h $22,000 water bill for almost 10M gallons; new_meter < old_meter! (S 16 4)

$hif Another enormous water bill due to new meter installation (S 20 2:8)

ef$ Water company software upgrade results in monster water bill and threats of penalties and interest (R 20 12)

f British Gas blames SW for sending 15,000 customers false warnings (S 19 2:4)

$f Marks&Spencer Visa charges in Paris accidentally multiplied by 100 (S 17 3)

$f NCStateUniv computer mismatches names, addresses on 6000 bills (S 13 4)

$SH Blue Cross/Blue Shield victim of computer generated prank letter (S 13 1)

$f Democratic National Committee thank-you mailing mistitled supporters (The New York Times, 16 Dec 1984)

f British NHS computer sent out letters to males with female names (S 12 4)

eh Automated postal canceller blurts out unfortunate test message (S 17 1)

f Red valentine envelopes unreadable by automated mail sorters (S 18 2:6)

m Earthquakes: 3 of 5 reported never happened; microwave static (S 11 5)

h Query of vacationing programmer starts beer panic (S 11 5)

hi German parking violators falsely accused of war crimes (S 20 1:17)

$fi Chicago cat owners billed $5 for unlicensed dachshunds. Database match on DHC (dachshunds, domestic house cats) with shots but no license (S 12 3)

h Mass. state budget plan 50-page loss attributed to "Virus"! (S 16 2)

fh Mass. jury selection computer issues multiple summonses (S 15 2)

fi 8-year-old called for jury duty (R 17 91,92,94)

$h Computer program misdirects 30,753 Minneapolis school children (S 12 4)

$hr 887 Boston school assignments botched; lost tape, no backup (S 14 6)

f/h? Newark NJ high school computer breakdown mangles class schedules (S 17 1)

h Indian program to reroute bus lines trounced (S 11 5)

$m Microwave oven erases comic's 3 years of personal computer data (S 12 2)

fi System deletes a file; each step makes sense, but the result is broken (R 19 57)

- Beware of bogus diploma mills on the Net (R 19 52)

h Univ. Central Florida did not cut off student registration (S 12 3)

SH On-line class registrations deleted by other students at UBC (S 18 1:19)

fh "Computer error" affects hundreds of UK A-level exam results (R 19 40)

f British school examination program gave erroneous grades (S 11 5)

f Faulty computer program blocks promotion of fifth grader (S 12 2)

h Computer gives law student wrong exam, passes him, after disk fix (S 12 2)

f Four students victimized by grade spreadsheet error (R 19 89)

hi Danville CA students expelled due to misinterpretation of overloaded database fields (R 17 87-89)

h Svensson's Tennis rankings affected by name confusion (S 16 2)

m PC EncROACHment: advice on roaches invading PCs (S 15 5)

mi "My DOS ate my homework" (Blame it on the computer!) (S 13 3)

h? Saudi Arabian uses computer to organize harem; it runs him ragged (S 13 2)

f Computer error blamed for French diplomatic fiasco (S 13 2)

- Computer service selects ex-wife as "ideal" mate for divorced man (S 12 1)

H Stolen disk and digital audio equipment affects Stevie Wonder concert (S 13 4)

H Bogus messages inserted in bank statements, TELEXes, prescriptions (S 13 2)

$f British Customs computer `loses' 35.6 million bottles of wine (S 14 6)

$f Automated Maryland food stamp computer overloads, jams many stores (S 17 3)

f Overly clever failsafe system shuts down Australian TV transmission (S 17 3)

h Washington Post runs OLD stock prices; file-name confusion (S 20 2:11)

fhi MIME-Messages: quoted-printable characters mess up URLs (R 20 40)

$h Hot-metal print supervisor uses mallet on computerized typesetter (S 15 2)

$h Closed-fist-like pattern observed in damaged keyboard (S 15 2)

+ In-flight PC battery recharging leads to shaver outlet disabling (S 17 2)

fm Apple PowerBook portable computer battery problem (R 17 36)

+/-? Sabbath restrictions bypassed by using extensive autotimers (S 15 3)

- Effects of deaths of Tamagotchi virtual e-pets; more than just a game? Counseling available (R 19 20,36,37)

hi Risks of PostPet Japanese game (R 20 28); MS Outlook 98 has similar risks (R 20 29)

@- Various cases of gobbled bank cards noted above.

@* Various false arrest cases noted below.

Calendar/Date/Clock Problems including Y2K

..... Y2K Manifestations: approaching 1/1/00

$rfed Many of the following Y2K problems are the result of decades of collossal short-sightedness, in requirements specification in the first place, as well as throughout the development process. Note that in 1965 the Multics development effort recognized the 35-year-away Y2K problem and addressed it quite constructively, using a 71-bit date-time field lasting long after Y2K. The costs are staggering. The lessons that should be learned from this experience are profound. It is not just the Y2K remediation that is relevant - it is the entire software development process. [I have not even bothered to insert the new "r" descriptor in those cases below in which faulty requirements are obviously implicated!]

f Discussion of date and century roll-over problems: Fujitsu SRS-1050 ISDN display phones fail on two-digit month (10); 1401 one-character year field; COBOL improvements; IBM 360 (S 20 2:13)

f Year 2000? Don't forget 1752 and 30 February 1712; two references (S 20 5:11)

$f Estimated costs of 1999-to-2000 date fix (S 21 2:16)

$f When the Clock Strikes 2000: U.S. Fed Govt cost $30 billion? Only 70% to be fixed in time? (S 21 5:18)

f$ More Y2K problems: Visa credit-card expiration-date problem and legal liabilities (R 18 63,74,75) $ Lawyers look forward to the year 2000 (S 22 2:23)

f$$ Lots more on Y2K (R 18 74-80,82,83-84,87-88), including the unforesightful use of "12/99" as an out-of-band date flag (R 18 88); more on Y2K and other date/calendar/daylight arithmetic problems (R 19 02,03,06,08-12); costs to reprogram in UK (R 19 07); Y2K cost estimates worldwide now up to $600 billion (R 19 10)

Vf More on Y2K: sliding window approach, year-2069 problem (R 19 13); (R 19 14); year 2106 and 2038 problems in Unix (R 19 15); year 65,536, leap seconds, UTC vs TAI (R 19 16); DEC OpenVMS expired on 19 May 1997 (R 19 18); clock synchronization (R 19 18); Java Y2K problem arises in the year 292271023 (R 19 21)

$f Y2K problem blocks UK divorcing couples from splitting pensions (S 22 1:19)

? Millenium fears lead to Virgin Birth insurance policies (in addition to alien impregnation policies) (S 22 1:19)

SH Nasty scam exploiting Y2K authorization expirations (R 18 68)

fde Y2K: Tcl 8.0 bytecode compiler Y2K risks; 00-38 now 2000-2038 (R 19 35-37); Y2K and C (R 19 37-38,40); non-Y2K problems with Java Date classes (R 19 38)

Vfe DoD Global Command and Control System (GCCS) fails Y2K test (R 19 38)

$ Y2K lawsuit: Produce Palace International sues Tec-America (R 19 29)

- American Megatrends: "Year 2000 compliance means that the internal BIOS date and time clock will continue above the date 1999. It will not reset itself after 1999 to the date of 1980. It will continue to the date of 2099 before resetting to 1980." (R 19 60)

H Y2K spam scam: jobs offered with no experience required (R 19 46)

- Ottawa firm registers "Y2K" as trademark (R 19 47)

f Freecell degenerates on erroneous date: Y2K and random numbers (R 19 48)

f Potential risks of backup and recovery after Y2K (R 19 55)

Vf PDP-11 Y2K leap-year bug with German clock board (R 19 56)

f Risks of testing Y2K by setting clocks ahead (R 19 56)

fe IRS Y2K fix threatens 1,000 taxpayers erroneously; IRS needs to check at least 62M lines of source code for Y2K (R 19 57)

$f More on Y2K lawsuits: North Carolina contemplating suing computer industry (R 19 57); California legislation proposed to limit Y2K liability (R 19 59)

f Canned-goods rejected with Y2K expiration dates (R 19 47,48)

f Miniature Enthusiasts with Y2K expiration dates deleted from address DB (R 19 57)

f Canadian guaranteed investment certificates with Y2K maturity vanish from DB (R 19 58)

e Euro changeover makes Y2K bug look easy! (S 23 4:23, R 19 69)

fh Gore congratulates 71-year-old Senator on birth of twins (S 23 4:23, R 19 64)

$ffffe... As of March 1998, only 35% of Federal Agency computer systems checked for Y2K compliance, 3,500 systems remain (R 19 64); IRS to spend $1B (R 19 68); Effects on the aviation industry (R 19 64); Financial risks (R 19 69); Y2K in Britain (R 19 64); Y2K in China (R 19 65); Australian simulated results of effects on public health and public infrastructure (R 19 71)

f Testing bugs that result from trying to test Y2K compliance, particularly when setting dates back to their correct value! (R 19 71)

f Report that only 1/3 of popular Microsoft apps are Y2K compliant (R 19 68) with further clarifications (R 19 69-70)

f Leap years: MS Excel 6.0 Office 95 version and 7.0 Office 97 version believe 1900 is a leap year (R 19 64)

Vf Summer time: in Britain (R 19 64), voicemail backup system fails (R 19 67); in Germany, Deutsche Telekom adjusted clocks twice in Lübeck (R 19 65)

f Year 2100 problems (AMI BIOS, R 19 60), IBM PCs and Network Time Protocol balk at 2100-Feb-29 (R 19 61,62);

? Fable of Y2K and 1979 Toyotas: shutdown if 00 in year field? (R 19 69,71); Computer insists on cataloguing Chateau Margaux 1900 as Ch. Margaux 2000 (R 19 67); Y2K and tombstones (R 19 61); Eagle Talons alleged Y2K problem (R 19 68) bogus (R 19 69)

- Need for contingency plans, not just questionable remediation (R 19 85,88-89)

fh$, etc. CIA worries about Y2K as an opportunity for hostile intent (R 19 84); Senate considers need for martial law after Y2K breakdowns (R 19 78); Potential Y2K railroad problems, with no more manual backups (R 19 84); Y2K risks to world shipping (R 19 82); Senate Y2K committee suspects power grid could collapse (R 19 82); Wells Fargo study shows millions of small firms at risk (R 19 77); Y2K insurance and financial risks (R 19 79); Swedish corporate insurance explicitly excludes Y2K (R 19 78); Y2K problem in Swedish personal identification numbers (R 19 74); Microsoft Y2K (non)compliance; Excel believes in 29 Feb 2000 and 29 Feb 1900, for Lotus 1-2-3 compatibility (R 19 73); More on Y2K forced-upgrade strategies (R 19 73); 102-yr old gets a birthday card for 2-yr olds (R 19 73)

f$ SIR-C processor Y2K problem in shuttle imaging (R 19 81) and its economic implications (R 19 83)

- Y2K priorities delayed security upgrades at bombed U.S. embassies (R 19 93)

*$fd UK Railtrack (former BritishRail) has no safety-critical computer systems, because of past underfunding! Y2K preparations simplified by delaying upgrades! (R 19 90); UK Railtrack online timetable information has errors for holiday weekend schedules Xmas 1999 and NewYear 2000 (R 20 67); Railtrack running a year behind and £3 billion over budget in rebuilding London-Glasgow line, with workers being sent to Army training for discipline! (R 20 84)

f Sloppy date handling in Perl scripts (R 19 88)

+ Wall Street test simulation gives good marks to 29 brokerage firms (R 19 89)

$ No UK Y2K insurance for household electrical items (R 19 89); Canadian insurance not likely to pay off; also another 100+ year anomaly, from Rob Slade! (R 20 03)

+ Canadian RCMP blocks vacations to ensure Y2K emergency coverage (R 20 02); Wisconsin National Guard mobilizing (R 20 03)

- White House calm, DoD nervous about Y2K (R 19 90)

f Win98 date problem detected (R 19 91) occurs in 5-second window when booting around midnight (R 19 92)

f Internet Explorer 4.0 instructions on how to bypass firewalls! (R 20 01-02)

f Y2K risk in Javascript cookies despite 4-digit standard (R 20 01)

Vf Consignment of corned beef with intended expiry 2001 rejected as too old: appears as 1901 (R 19 92); cf. the leap-day Xtra supermarket meat problem, below! (There's more than meats the eye.)

$SPH Business Software Alliance finds 1400 unlicensed software copies in Los Angeles Unified School District, valued at $5M? (R 19 92)

$ Clothing retailer sues for cost of non-Y2K-compliant 1991 system (R 19 94)

Vf$ Product Palace settles with Tec America over Y2K-noncompliant software: entire system crashed on single 00 credit-card (R 19 96)

fe Saga of another Y2K bug, after being "fixed", a letter dated 3 Aug 2098 sent mistakenly to half-million recipients (R 19 95)

+ Y2K problem resolved that had threatened the production of scotch whiskey (R 20 03)

f New Vancouver Hospital pathology system default misses updates to patient files for many months (R 20 23); CORRECTION (R 20 30)

- 400-year-old time machine (in Liverpool museum) to suffer from millennium bug: time runs out at year 2000! (R 19 79,81)

+ Memo on Y to K conversion: Januark, Februark, ... (S 20 23:, R 20 21)

*$ Y2K-related panic may be more serious than Y2K computer problems (R 20 11)

fH DoD Special Weapons Agency falsely claimed successful Y2K tests on 3 or 5 critical systems (R 20 10)

$(f?) Hospital spends $700K on new digital nuclear medicine machine because vendor would not certify Y2K compliance of well functioning analog machine (R 20 10)

*f UK MoD admitted that Rapier anti-aircraft missile was not Y2K compliant (R 20 13)

$f 1 Jan 1999: Y2K hits Singapore and Swedish taxi meters (R 20 15)

f Windows/Visual C++ daylight saving cutover one week early on 1 Apr 2001 (no fooling!), affecting 95,98,NT (R 20 15-16)

ef Enator AdeEko Y2K update turns Malmo Sweden seriously disrupts city's bill paying (R 20 18)

+? China contemplating making all airline executives fly on Y2K boundary (R 20 17)

fm Store Baelt Bridge not Y2K-safe (R 20 22-23)

h 2,000 Texans get false overdraft notes from Bank One in Y2K test (R 20 13)

h Y2K "fix" test results in traffic offenses dated 2097 (R 20 21)

$h PSE&G Y2K test of billing program results in false billing (R 20 23)

- As of early 1999, GAO report says U.S. states lagging in Y2K readiness (R 20 20); CIA predicts serious Y2K problems around the globe (R 20 23)

*h VPA's Peach Bottom nuclear-power Y2K-check crashed monitoring systems (R 20 24)

fh Boston bank's Y2K problems blamed on IE5, but apparently not! (R 20 25)

+? Sri Lankan Banks to close on 31 Dec 1999 for Y2K tests (R 20 25)

SH Scam using Y2K bank problems as bait

eh Pilgrim nuclear plant Y2K readiness questioned by NucRegComm (R 20 40)

+ Standards needed now for Y10K? (not April Foolery) (R 20 30)

RECENT ADDITIONS:

f Nottingham weather images dated "FEB 28 2000, 2330" and "FEB 28 2000, 2400": Y2K leap-testing? (R 20 42)

Vf Y2K test knocks out Fiji's telecommunications (R 20 43)

f Downloading Y2K fixes to Internet Explorer leads to clock problem (R 20 42)

*f Y2K test sends sewage flowing in Los Angeles (R 20 46)

S Another Y2K scam (R 20 51)

Vfe* London Electricity Y2K upgrade left 2000 customers without power for days (R 20 54)

+P Canadian govt recommends encrypted e-mail (R 20 54)

? Y2K in China (R 20 55); Indonesia: wait to see what happens in New Zealand and fix it quickly (R 20 58); Iraq decides to wait and see on Y2K oil disruption; concerns that oil nations are not ready (R 20 62)

f$ Northwest Metrology stung by Y2K bug (R 20 56)

f? Unix needs 10th decimal digit for timestamp on 9 Sep 2001; risks of format problems? (R 20 58)

f Bank switch to 4-digit years blows up on 1 Oct 1999, with 10/01/1999 truncated to 0/01/1999 (R 20 59)

SHf FBI warns some Y2K fixes may be suspect (R 20 61); general concerns over Trojan horses in Y2K-remediated code

fe NT, SP5, SP6 Y2K problems (R 20 62)

f Maine year-2000 vehicles classified as "horseless carriages" from 1900 (R 20 63-65)

f Cornell University registration system welcomes students to the spring 1900 semester (R 20 64)

$? Businesses could owe millions for Y2K sliding-window fix if 1998 patent holds up, despite this being an old technique (used at least in the 1960s) (R 20 65)

$ Microsoft Y2K liability claim: "... Microsoft does not warrant or make any representations regarding the use or the results of the use of any Microsoft Year 2000 statement in terms of its correctness, accuracy, reliability, or otherwise." (R 20 65)

$efh Irish telephone network upgrade failed, backup failed, caused domino propagation in Dublin; independent cell-phone system failure; outage brings Y2K fears of lack of disaster recovery (R 20 66-67)

efh $.5M fire-station fire blamed on Y2K computer fix; breaker disabled due to Y2K incompatibility (R 20 66)

efh IEEE standard Y2K compliance attained by rendering software unusable (R 20 67)

SH Flagrant antisocial behavior of Y2K virus competitions promotions (R 20 68)

SH Y2K-related viruses: Worm.Mypic (R 2067), W95.Babylonia and others (R 20 69)

fm Y2K test takes out all power in German Department of Justice, 11 Dec 1999 (R 20 69)

$H Y2K fears lead Philippine man to withdraw his life savings, then robbed of everything (R 20 69)

fff Australian Y2K readiness news page clock sticks at 31 Dec 1999 23:56:15, then 15 Dec 1999 00:23; New Zealand airport Web site update time-stamped 1 Jan 100; in Y2K test, Henderson NZ clock flashed "GAME OVER" at midnight; 20,000 UK credit-card machines incapable of coping four days before Y2K, with settlement date in 2000; Pentagon DefenseLINK Y2K info site accidentally disabled; Oakland CA 911 system not Y2K compliant, prioritizes earliest calls (seemingly from 1900); glitch with NIST's Automated Computer Time Service; Wells Fargo CD renewal notices dated 1900; many digital certificates expire with Y2K because old browsers could not accept 2000; date field called Shirley harder to detect; risks of last-minute FAA HOCSR patch; more on risks of leap-second corrections at Y2K (R 20 71)

..... Y2K Manifestations: on and after 1/1/00

f,h,e Y2K dates: Numerous cases of 1 Jan 100, 1 Jan 19100, Jan 1 2100. An Australian online media news gateway had 3 Jan 3900 on 2 Jan 2000, while appple.com and happypuppy.com should get a prize for year 20100, which beat out the U.S. Naval Observatory calendar with the year 19,000 and others with 19100. Amazon announced a Sonic Youth CD would be available on 10 Oct 2011. Startrekcontinuum.com noted the next Voyager episode would air on 1 Jan 1900. *The New York Times* Website said 1 Jan 1900. Compaq sites said it was 2 Jan on 1 Jan. Several counts of time until Y2K went negative in funny ways. An old 486 PC reset its clock to 4 Jan 1980. The atomic clock at UK's NPL read 31 Dec 1999 27:39 UTC at 2:39am GMT (off by an hour, at that). Various Web sites were hacked. www.2600.com had a humorous spoof. Toronto abandoned its on-line bus information service at midnight because it was not Y2K compliant. (R 20 72)

feh A Pentagon computer system processing satellite intelligence data lost its capabilities at midnight GMT, for 2.5 hours, due to preventive human mistake (R 20 72); data from 5 satellites was reduced to a trickle for several days (R 20 75)

f Automated New Zealand radio station repeats 31 Dec 1999 11pm news hourly, due to 99 > 00; Nokia phone not Y2K compliant?; effects on mobile and phone nets; more on cost of Y2K fixes vs. preventive measures; Filemaker Pro; Word Perfect 5.1 and medical transcription; lots more on bad arithmetic date programs, including Javascript problem; X-10 controller; New York Times correcting 102-year-old issue number glitch; nuclear-power glitches; Win95 Y2K bug?; California DMV snafu; ftp date problems; Talking Clock; count-down to Y2K programs go negative (R 20 73)

f Y2K: repeated billings result from uninstalled fix; Bills for 100 years back interest; Sprint PCS network problems at Y2K; MKS Toolkit Y2K glitch: next backup 9 Jun 2005!; Barbara's Cereal expires July 1900; driver's license expires in year 1000!; NTSB website has Y2K test data mixed in with real data; Bogus message in live service for Quicken 2000; With stepped-up Y2K wariness, NAI WebShield blocks RISKS issues (R 20 74)

f Newborn Y2K baby birth certificates dated 1900 (R 20 76); Satellite orbit predictor software fails (R 20 76); Flight Sim 2000 Professional Edition (R 20 76); abcnews.com continued copyright year of 1999 (R 20 78)

$f New Y2K Tulsa County Court computer system fails for weeks thereafter (R 20 81)

$f Nevada man registered his car late, billed for $378,426.25, accrued interest since 1900 (R 20 84)

f Commentary on Lessons of Y2K by Toby Gottfried (S 25 3:18-19, R 20 77)

*fm Berlin Fire Department dispatching system Y2K problem (R 20 75) also a Leap-Day problem; caused by faulty network cards (R 20 82) Y2K bug as well? (R 20 84); Yes, Y2K fix failed: date incompatibilities because of leading zeros (R 20 93; S 26 1:)

f Fax driver/app "Delrina WinFax Lite 3.0 Fax Administrator" can't recognize years 00 to 09 as the send date; Starfish Sidekick98 Y2K bug; Kremlin press office cannot send e-mail after Y2K (R 20 75)

f Yet another Y2K bug in Jun 2000! (R 20 91)

..... Leap-Year Problems:

f Clock problems - Leap Day, end of century, etc. (S 13 2)

f 1988 leap-year: Xtra supermarket fined $1000 for one-day overage on meat due to program skipping 29 Feb

f 1992 leap-year problems: 29 Feb invalid but 1 Mar gets correct day; Prime's MAGSAV fails, probably because one-year expiration date 29 Feb 93 invalid; Imail dies worldwide; UUPOLL on MS-DOS due to bug in Borland C++ 2.0; Windows 3.0 locks up on mktime call; glitches in watches; Iowa state liquor licenses expired on 28-Feb, new ones started 1 Mar; leap day waivered. (S 17 2)

f Airport parking bill for $3771 at $11/day with time-in 30 Feb 92 (S 17 2)

$Vf 1992 leap-year-end clock bug blocks ATM machines on 1 Jan 1993 (S 18 2:11)

f Many more calendar, date, and time problems - particularly surrounding Leap-Day 1996 and 1/1/00; Arizona lottery downed, insurance policy problem, leap-year algorithms, Excel 5.0, WIN95, and lots more; Persian gulf support problem; the business of fixing the year 2000 problem The length of the tropical year at present is about 365.24219 days. The present algorithm (not if divisible by 100 unless divisible by 400) works out to 365.2425 days, with an error of three days every 10,000 years. Expect a closer approximation in another few thousand years. (S 21 4:15-16)

$Vf Leap-Year software bug at Tiwai Pt aluminum smelter halts potlines, costs NZ$1M (S 22 4:29, R 18 74)

f time_t offset from 1900 in C led to leap-year mistake on 2000 in Plan 9 (R 20 31)

f Leap-day 2000: Digital Casio wristwatch changed from 29 Feb to 30 Feb; Sony SLV-940HF VCR (which picks up date/time via cable) showed Tue 29 Feb 2000 as Monday 28 Feb; Washington Checkbook magazine sent out erroneous subscription renewals to subscribers on 29 Feb 2000 (R 20 83); bank fails to post check on 29 Feb 2000, even though it honored it (R 20 85)

..... Summer Time (and the livin' is queasy):

@$fe GTE Sprint billing errors from botched daylight savings cutover (S 11 5)

@Vhf Daylight savings time changeover halts train for an hour (S 15 3)

f Hawaii not on daylight time; off-island program messes up rush-hour (S 17 3)

i Some UNIX systems missed daylight savings end (US/Pacific-New) (S 18 1:5)

f More daylight savings time problems (R 18 02-05)

fi Windows 95 daylight saving confusion in Sweden (R 18 50)

*f Summer-time cutovers splatter molten ingots, down police system (S 18 3:A4)

f Daylight-savings: falling back 1997 - VCRs, Interac ATMs, Win95 (R 19 43,44)

f New remote-synch radio clock blows daylight savings changeover (R 20 03)

f Another VCR Summer Time screwup (R 20 29)

!h Terrorist bombing botched due to daylight time difference between Israel and Palestine (R 20 58)

..... Other Calendar-Clock Problems:

???? TEASER: Akin to the Y2K problem, are we anticipating an IPv16 problem? (There is one hex-character field for the IP version number.)

Vf GPS will roll over to 6 Jan 1980 at the end of 21 August 1999 [after 1024 weeks of counting] (R 18 24); More on older GPS receivers with 10-bit week-counter rollover on 21 Aug 1999 (R 19 73); Pioneer recalling GPS receivers (R 19 80) British Civil Aviation notice on GPS receiver rollover on 22 August 1999 after 1024 weeks (R 20 07) GPS clock rollover affected Tokyo taxicabs (R 20 55), the yacht Tam-o-Shanter (R 20 55), and some DoD weapons systems (R 20 62). Pioneer adapted or replaced 210,000 of 270,000 GPS receivers (R 20 55); GPS Selective Availability for degraded precision no longer in use, announced 1 May 2000 (R 20 88)

$h Human input error on year causes $49-million error for NJ food stamps (S 24 4:27, R 20 28)

Vf Swedish passport system and Swedish Giroguide both fail on "99" (R 20 14)

fh Y2K-like problems include stop-codes such as 9999 (9 Apr 1999 is the 99th day of "99"), 99999999, etc. (R 20 14)

f$ 9/9/99 was mostly a non-event, although it resulted in a non-critical medical app failure (R 20 55) and an accidental deposit of $160K (R 20 60)

hm Japanese MARS rail-ticket system crashed due to customers wanting tickets bearing an 11/11/11 11:11 time stamp on 11 Nov 1999, year Heisei 11 of the current emporer (R 20 65)

Vf Swiss hospital computers crash on 1/1/1999 (R 20 16)

f Quicken'99 divide-by-zero bug on Jan 1999 dates in Auto category (R 20 16)

f Clock-setting algorithm gets wrong time; other clock problems (S 11 2)

f Hidden horrible bug in Grapevine mail system lurks for 5 years (S 12 1)

f Democratic bug in AppleLink in Chile, reserved word "General" (S 15 3)

f Apollo workstation date bug coming soon (S 22 4:30, R 18 78)

Vf Windows 95 will crash in 2038 (R 18 84)

f Microsoft Outlook e-mail Word problem (R 19 23)

f Thanksgiving misplaced in Microsoft Outlook 97: better check your calendar! (S 23 3:24, R 19 46:47)

f Microsoft Outlook 98 reschedules Memorial Day 1999 (R 20 30) and 2 UK bank holidays (R 20 32); not Y4.501K compatible (R 20 31)

fi Design flaw in MS Outlook/Word save procedure? (S 23 3:26, R 19 55)

f Outlook Express date parsing problem: 2099 by mistake, but displayed as 1919 (R 20 24)

fi Confusion of Microsoft Outlook shifting times with timezones (R 20 11-12); Windows 95 changes date without confirmation (R 20 13)

V Multics crashes on Bernie Greenberg's 45th birthday; Bernie never anticipated Multics would still be running! (S 20 5:11)

ehi Dartmouth Time Sharing System: Beware the Ides of March, 1970s (S 21 2:16)

Vf Misdeclared variable type overflows term program on 26 Oct 1993 (S 19 1:4)

Vf Microcode bug downs Tandem CLX clocks at 3pm 1-Nov-1992; detected in New Zealand/FarEast, fix available before it could hit Europe, US (S 18 1:5)

Vf Every MTS shuts down: 2**15 days from 1 Mar 1900 to 16 Nov 1989 (S 15 1) @*f 100 hospital computer systems die; 2**15 days after 1 Jan 1900 (S 14 6)

f National Semi chip flaw persisted, 1987-1990; skips a day (S 16 1)

Vf NOS/BE clock failed after 2 years when the system 1st was up 24 days! (S 16 2)

VSf Security bug hung Tandem systems worldwide 27Aug91, 4:22pm local (S 16 4)

f Errant `timed' propagates effect, wrong date then skips 2.8 years (S 17 2)

f AT&T PC date problem in AT&T 6300; 5-year max lifetime assumed! (S 17 2)

Vf MOSS graphics systems crash on 15 Jul 1993 worldwide (S 18 4:3)

f Ball Aging Analysis SW clock bug prevents plotting of new data (S 19 2:2)

ehi A glitch in time shaves U.S. Naval Observatory (S 21 2:16, errata R 17 65)

hh Erroneous bank-clock coincidence puts wrong photo on Crimestoppers (S 21 2:16)

@M Clocks leap forward gradually. Power line interference! (S 16 2)

Vf Hospital computer crashes every midnight at midnight until 00:15 (R 19 25)

mfe AOL off line for two hours 29 Oct 1997 (R 19 44); AOL e-mail outage due to software, 3 Nov 1997 (R 19 45); more AOL e-mail outages, 18 Nov 1997, Internet outages 19 Nov (S 23 3:24, R 19 47,49)

Vf Windows 95, Windows 95 OEM Service Release, Windows 98 hang after 49.7 days (= 2³² milliseconds, Vtdapi.vxd problem) (R 20 24)

f Overzealousness problem in Access on location-dependent date interpretation (R 20 31-32)

The Game of Chess:

SP Sealed chess move disclosed? Karpov-Kasparov authentication glitch (S 16 1)

mi Deep Blue, Deep Trouble: ACM Chess Challenge glitch (S 21 4:14)

hi Deep Blue in Deep Foo in first Kasparov match; chess board position A3 fat-fingered and interpreted as command `3', necessitating reboot and loss of 20 minutes (transcript in R 18 78);

+-? Deep Blue beats Kasparov in second match (11 May 1997); long-term risks to the sanity of chess masters and the future of mankind?

Further Miscellaneous Hardware/Software Problems

f "My Hairiest Bug War Stories" (Communications of the ACM, April 1997, pp. 30-37) on debugging, including a program that worked correctly only on Wednesday, because the overwritten 9th byte was supposed to contain a `y'! (R 19 09); more examples in (R 19 10,11)

h More computer-is-never wrong tales (R 19 07,08); mad-cow disease database trusted more than reality (R 19 11)

P? Private Dead Sea Scrolls computer-reconstructed from concordance (S 16 4)

f IBM de Mexico pays Mexico City for failed database system (R 19 89)

$f Microsoft, IBM dispute faults in each other's products (S 16 4)

fe Defects in Microsoft Word for Windows remained unfixed (S 17 4)

f Windows 3.11 data loss problem in vcache (R 17 80)

f Risk of 16-bit MIS-Access installed on WFW or Windows 3.1 (R 18 65)

fe Risks of installing old SW on new systems in Microsoft Windows (S 20 3:10)

Vf Windows 95 late-night sales cause midnight cash-register crash (S 20 5:11)

f WinWord 6 "feature" and discussions of compatibility problems (R 18 70,71,72)

f(*) File-conversion errors between WordPerfect and Word: 1/4 becomes 3; two problems involved, discovered at Hanford (R 20 35)

h Inconsistent reception of e-mailed MS Word documents causes problem (R 20 03)

Vm Microsoft TerraServer unavailability ("The world's largest online database!") (S 23 3:26, R 19 84)

f Microsoft Web site denies access based upon Windows regional settings (R 20 03)

f Side-effects of installing Microsoft's Media Player (R 20 03-04)

f C compiler vs editor compatibility: WYSI not always WYG; different definitions of "newline" (20 39-40)

- Risks of PC changes without changed model numbers (R 18 70,71)

Vfi Quark XPress trims Unix >> to >, overwriting the file (R 20 13)

Seh Risks of upgrading a UNIX system without rebuilding privileged apps (R 20 39)

f Insidious SQL interpreter bug messes up files; don't forget patches (R 20 03)

hi Discussion of = vs == (R 20 18,21-22)

fi MapQuest Do-What-I-Think-You-Mean risk (R 20 37)

f AutoRoute Express 2000 Weekend Watchdog problems (R 20 39)

Sfi Extensive discussion on inconsistencies in context-sensitive wildcard interpretation, special characters, and file-name conventions (R 17 73-79)

i Confusion in page layout commands (R 20 14-18)

fhi Risks in incorrect software warnings and alerts (R 20 13)

f McAfee's PC Medic 97 Deluxe QuickBackup incompatibility (R 19 91)

..... Computation problems:

f Harvard Mark I register least-significant digits interchanged on input AND output, no effect unless carry propagated; not caught for MANY years.

$fm Flaws reported in Intel 486 chip (COMPAQ found it) (S 15 1)

$f Three flaws in Advanced Micro Devices 29000 32-bit RISC chip discovered only in revision D: problems in instruction burst mode, exception handling priority, data-access exception. Workarounds were found. (S 15 1)

$f Pentium FDIV bug discussed in RISKS-16.57-69,81, summarized in SEN; flaw in table, not algorithm (S 20 2:9)

$f Time-bomb ticks in noncompliant no-name Pentium motherboards (R 19 13); further flaw detected in Pentium II and Pro - approximately 140,739,635,839,000 floating-point numbers affected (R 19 14); (R 19 18)

m New Pentium flaw enables user-mode program to lock up the system (R 19 45); preventive fixes in operating systems, software (R 19 46,47)

- Centaur IDT-C6 Pentium-compatible: "exacting proof of correctness" results from tests on PC OSs because of their complexity! (R 19 25)

f$ Microsoft Excel linked-spreadsheet bug blows balances (S 20 2:8)

f New Microsoft Excel math bug (feature?): 1.40737488355328 = 0.64 (S 20 5:11) and still more in (R 17 38,39,40); floating-point problems consequence of IEEE standard (S 21 2:17)

fhi Space character in number causes overzealous Excel miscalculation (error of US$19,130) (R 20 30)

f Microsoft Excel 97 re-exhibits ghost of Pentium FDIV bug (R 19 04,05)

f Risks of Microsoft's self-extracting files: no file integrity... (R 19 92)

f Side-effects of IE4 (R 20 03)

f IE5 under Windows 98 multiwindow cache consistency problem (R 20 28)

f/m Bill Gates demo of Windows 98 crashed at Comdex (R 19 70)

f Microsoft software blocks copy of file with name of "sensitive country", and subsequent copies (R 20 19-20)

f Windows 95 error message pops up on Swedish bank ATM screen (R 20 19)

f Risks of Windows NT Blue Screen of Death requiring reboot (R 20 20-21)

fh Outlook 98 filters RISKS-20.32 as junk! (R 20 33)

rf Inmos T800 floating point used formal methods for analysis, but the specification was wrong (according to Bill Kahan) (S 20 2:10)

f VAX 11-780 floating point and early-production GE 635 floating-point truncation problem (noted by Jim Haynes) (S 20 2:10)

f 5 equivalent floating-point formulae give very different results (S 19 2:4)

f Intel chip flaw in Orion 82450 reduces I/O bus throughput (S 21 4:13,R 17 83)

f DEC Alpha bug: pow(1.234567, 7.654321) may not give 5.017... (R 19 24-26)

m Real `bug' in Alpha VAX (S 21 4:14)

f Faster Mac reveals lurking flaw (R 19 38,40)

f 2-user login max due to HW floating-point flaw used by PW encrypt.(S 15 1)

f Bug in zipcode catalog adds an extra decimal digit to invoice (S 22 1:19)

fi When is -32768 not equal to -32767-1 ? (R 18 48-49, 55,57,58,60,61)

f Software math errors also discussed: BASIC on TI 99/4A (S 20 2:11)

f Accounting system claims quota exceeded at number approaching 2³² copies (R 20 20)

f ping program gives negative round-trip times; useful for time travel? (R 20 21)

f UK supermarket customers can double their accumulated points due to synchronization flaw (R 19 82)

..... Other problems:

hi Harmful puns on input: "EDIT" (Everything Deleted Insert T), "<cr>aboRT" See Inside Risks, CACM, 33, 9 (Sept 1990), p. 202.

i Y=Yes, 9=No(nein auf deutsch) in control system operator interface (S 16 1)

hif Hartford jurors uncalled; letter "d" interpreted as "deceased" (S 18 1:7)

i Atari prompt is READY; editor cursor on prompt read as READ Y (S 17 3)

ifh System uses "$" to return to main menu; havoc results (S 17 3)

h Celsius-to-Fahrenheit conversion: 2.5C increase becomes 36.5F! (S 20 3:11)

f Standard deviation in Lotus 1-2-3 uses wrong number in computation (S 17 3)

f Microsoft and Lotus spreadsheet errors (base conversion, roundoff)(S 20 3:9); similar Fred Brooks tale retold, on pipeline billing (S 20 3:9)

h Spreadsheet Research documents enormous operational error rates (R 19 24)

hi? New York Times computer typesetting problems (S 17 3)

m Single-bit errors in DQ-11 partition the network (S 14 1)

f Windows open and close for runaway mouse in Word 4.0 (S 13 4)

fm Toshiba DOS 3.3 Backup deletes files (S 14 5)

fi Printer-truncated pathname causes directory overwrite on retrieval (S 17 1)

f Domain name service meltdown due to cache corruption (R 18 38)

$mfh $150 printer hangs up $0.5M VAXcluster (S 17 4)

$f Tape unit caught on fire from repeated reading of tape section (S 5 1)

fm 63,000 Dell monitors too hot to handle: overheating, fires (S 19 4:11)

m(i) Stretching cat loads CDROM in Macintosh; interface misleading (S 15 2)

h Incidents on people's willingness to trust computers (S 11 5)

f Program works fine in debug, fails in live execution (S 12 4)

fe Anaesthetist trainees fail exam because of computer roundoff (R 17 25)

f Pseudo-randomly generated bridge hands identical except for suits (S 14 1)

i German FORTRAN "unit" and "device" both translated to "Einheit" (auf deutsch) (S 17 1)

fi Discussion of handling of null variables in programs (R 19 58,59)

m Memory parity error corrupts nonwritable shell file (S 19 2:4)

h French card tricks: customs agent "samples" cards [old] (S 20 5:9)

h Program fails when blank card jams, is removed [old] (S 20 5:9)

S/f/m An early collection of risk-related anecdotes was presented at the ACM Symposium on Operating Systems Principles, SOSP 7 (S 5 1:30-35), with follow-on (S 7 1). The former collection includes the repeated dunning notices for a debt of $0.00, responded to by writing a check for $0.00, which results in an angry letter that the check had crashed the computer system;

Other Computer System Development Difficulties

$rdef... The Software Bloatware Debate (S 24 1:32, R 19 92-93); Extensive discussion of bloatware, why it occurs, what its consequences are: less adaptability, interoperability, ...; examples (R 20 35-38); revisited (R 20 91-92,98, R 21 08)

$drf Difficulties in developing large systems: IRS TSM ($4 billion), FBI (fingerprint system and NCIC upgrade), California (welfare database, BART, DMV) (S 22 4:25, R 18 81)

@$drS IRS computer project a four-billion-dollar fiasco (S 21 4:12); IRS drops Internet Cyberfile tax filing plan (S 22 1:19)

$df HUD fires contractor over program error costing $3.8 million (S 23 1:10, R 19 43)

$rf GAO report says Pentagon overpaid contractors by $millions because different accounting systems could not interoperate (R 19 14)

$d Medicare computer project terminated (S 23 1:10, R 19 38)

$rd California child-support deadbeat dads/moms database flawed; project overrun from $99M to $300M (S 22 4:25, R 19 12); Lockheed-Martin IMS Contract CANCELLED (S 23 1:9, R 19 43); State of California and Lockheed Martin IMSC suing each other over contract cancellation (R 19 82)

$df Virginia State child-support payments halted: software problems (S 12 3)

$drfh $4.5M Virginia child-support system scrapped; bad management (S 14 2)

$ef Software upgrade glitch snares the Social Security Administration; $478.5 million in underpayments detected years later (S 20 2:8, R 16 67, 23 Dec 1994), subsequently reported as $850 million, affecting almost 700,000 people (S 21 1:20, R 18 51)

$d Congress' report Bugs in the System attacks waterfalls, procurement (S 15 1)

$d GAO report on effects of IS technology (S 15 1)

$d Congress repeals catastrophic insurance, SSA gets premiums anyway; too difficult to make the software modifications (S 15 1)

$drfh Summary of several `runaway' computer software projects - Allstate, Richmond utilities, Business Men's Assurance, Oklahoma WorkComp, Blue Cross/Shield of Wisconsin (S 14 1)

@$drf California DMV system upgrade botched; $44.3M deadend (S 19 3:5)

@Vef NJ DMV computer system upgrade crashes on first live use (R 19 80)

@$dh BofA MasterNet development blows $23M; backup system gone (S 12 4) Two BofA executives leave after DP problems costing $25M (S 13 1); $60M more spent in botched attempt to fix it (S 13 2)

$df Los Angeles hospital billing system bugs; delays cost up to $16M (S 19 2:3)

$rd Greyhound computer reservation system development problems (S 20 1:18)

$f System to prevent gov't bond auction bid-rigging `deeply flawed' (S 18 3:A5)

$df Software failures in Britain estimated at $900M per year (S 13 4)

$rd Comvor: Hamburg police computer system development problems (blamed on "complexity") (S 23 4:22; R 19 68)

$dfh $5.4M Canadian computerized taxi system won't work (S 14 2)

$rd Ontario toll-road system six months late at twice the cost (R 19 24)

$dfm $800,000 computerized cab service system fouls up (S 15 2)

$dfh $15M strip-mining violation computer system deficient (S 14 2)

rdf New Notre Dame de Paris organ software development disaster (S 20 3:10)

- Douglas Adam's `Mostly Harmless' quoted on repairability (S 18 2:5)

@$def $18M new system hinders collection of $10M in L.A. taxes (S 16 2)

@$df New French reactor's distributed computer system abandoned (S 16 2)

@$dhff Salvage Association awarded £662,926 from CAP Financial Services after badly botched accounting system was scrapped (S 18 1:8)

@$hd DoD criticized for software development problems (S 13 1)

@$d ADATS tank-based anti-copter missile system development problems, $5B overrun, unreliability (S 16 1); others: C-17, London Ambulance,

$dr Discussion by Lauren Weinstein on technology deterioration resulting from cutting corners during system development (R 17 94,96)

$d New £300 million UK air-traffic control system confronts complexity (S 22 1:18)

$d Software problems with NATS new-generation air-traffic control center (R 19 18,23)

$de New Zealand's INCIS Crime Information System (S 25 3:17, R 20 83)

Achieving Better System Development and Operation

+ Numerous articles on software development, specification, formal verification, safety, reliability, security, etc. (S 1 1 to the present)

+ Barclays Bank success story in cutover to client-server system (S 20 1:18)

+ Discussion on the need to certify computer professionals (S 16 1)

+ More on Proper British Programs - the MoD standard (S 14 1)

+ Updated UK Interim Defence Standards 00-55/56 on software safety (S 16 3); Comments on Revised 00-55/56 by Stavridou and Ravn (S 16 4); Progress on adopting DefStan 00-55 (S 17 1)

@*$ EC Machine Safety Directive enables suits over unsafe HW/SW (S 18 1:26)

+ Australian Software Quality Management Standard AS 3563-91 (S 17 1)

- Risk Management: Books by Brian Wynne, Lorraine Daston noted (S 18 2:8)

+ IEC TC4 WG3 International Standard on industrial machines safety (S 16 3)

+ NewSpeak, a safer programming language (S 13 2)

+ Spark, an attempt at a "safe" Ada subset (S 14 1)

+ Viper and formal methods used in Australian railroad switching (S 14 5)

+ Benefits of computer technology, particularly safety, discussed (S 14 6)

+ DoD Software Master Plan [preliminary draft released [9Feb1990] (S 15 2) + Flogging as an ancient method for assuring software quality? (S 16 3)

+ Scents increase productivity of Russian computer operators! (S 17 2)

+ Scents [androstenone] give 14% increase in bill-payment rate (S 18 2:5)

The Proper Role of Technology?

+- Winter 1991 issue of Whole Earth Review questions technology; articles by Jerry Mander, Howard Levine, Langdon Winner, Patricia Glass Schuman, Linda Garcia, Gary T. Marx, Ivan Illich, Amory and Hunter Lovins (S 17 2)

+- Fujitsu probing brain-wave detecting interface; risks suggested (S 18 3:A10)

fh Discussion of expectations of technology: Chase Manhattan Bank fire, 911 cell phone identification (S 23 5:25, R 19 83)

Reference Materials

If you are interested in further details, pursue the back issues of SEN, the on-line RISKS archives, and Neumann's Computer-Related Risks, Addison-Wesley, 1995 (ISBN 0-201-55805-X) and ACM Press (ACM Order 704943).

Books

The following books may also be of interest.

· Frederick P. Brooks, Jr., The Mythical Man-Month (2nd edition) Addison-Wesley, 1995.

· David Burnham, The Rise of the Computer State, Random House, New York, 1982.

· Steven M. Casey, Set Phasers on Stun, and Other True Tales of Design Technology and Human Error, Aegean, 1993.

· Robert N. Charette, Software Engineering Risk Analysis and Management, McGraw-Hill, New York, 1989.

· Robert N. Charette, Application Strategies for Risk Analysis, McGraw-Hill, New York, 1990.

· Robert N. Charette, Frances Scarff, and Andy Carty, Introduction to the Management of Risk, HMSO (Her Majesty's Stationary Office), 1993 (ISBN 0 11 330648 2).

· David Clark et al., Computers at Risk: Safe Computing in the Information Age, National Research Council report of the System Security Study Committee, National Academy Press, December 1990.

· Ken Dam et al., Cryptography's Role In Securing the Information Society (a.k.a. the CRISIS report), National Research Council report of the Committee to Study National Cryptography Policy, National Academy Press, 1996. Executive summary is available at http://www2.nas.edu/cstbweb .

· Mark Dery, Escape Velocity: Cyberculture at the End of the Century, Grove Press, 1996.

· Dietrich Dörner, The Logic of Failure: Why Things Go Wrong and What We Can Do to Make Them Right, Metropolitan Books (Henry Holt), New York, 1996.

· John H. Fielder and Douglas Birsch, The DC-10 Case: A Case Study in Applied Ethics, Technology, and Society, State University of New York Press, 1992.

· John Gall, Systemantics : the underground text of systems lore : how systems really work and especially how they fail, General Systemantics Press, 3200 W. Liberty, Ann Arbor 48103, 1986. (The first edition was printed by Pocket Books in 1975 and Quadrangle/NYTimesBookCo in 1977.)

· Robert Glass, Software Creativity, Prentice-Hall, Englewood Cliffs, New Jersey, 1995.

· Karla Jennings, The Devouring Fungus, Tales of the Computer Age, Norton, 1990.

· Deborah G. Johnson and Helen Nissenbaum, Computer Ethics and Social Values, Prentice Hall, Englewood Cliffs, New Jersey, 1995.

· Rob Kling, Computerization and Controversy: Value Conflicts and Social Choices (2nd Edition), Academic Press, San Diego, February 1996.

· Nancy G. Leveson, Safeware: System Safety and Computers, Addison-Wesley, Reading, Massachusetts, 1995.

· Jerry Mander, In the Absence of the Sacred: The Failure of Technology & the Survival of the Indian Nations, Sierra Club Books, 1991.

· Steven E. Miller, Civilizing Cyberspace: Policy, Power and the Information Superhighway, Addison-Wesley Publishing Co. and ACM Press, 1996.

· Charles Perrow, Normal Accidents, Basic Books, NY, 1984.

· Ivars Peterson, Fatal Defect: Chasing Killer Computer Bugs, Times Books (Random House), New York, 1995.

· Henry Petroski, To Engineer is Human: The Role of Failure in Successful Design, St, Martin's Press, 1985.

· Henry Petroski, Design Paradigms: Case Histories of Error and Judgment in Engineering, Cambridge University Press, 1994.

· Scott D. Sagan, The Limits of Safety: Organizations, Accidents, and Nuclear Accidents, Princeton University Press, 1993.

· Joan Stigliani, The Computer User's Survival Guide, O'Reilly & Associates, Inc., 1995.

· Lauren Wiener, Digital Woes: Why We Should Not Depend on Software, Addison Wesley, 1993

Also, check out Phil Agre's Web site (http://communication.ucsd.edu/pagre/) for a bibliography of recent books on social responsibility, many of which are relevant here.

Computer-Related Risks draws heavily on the listed cases. It also incorporates some material from COMPASS and CACM Inside Risks sources, noted below. "The Computer-Related Risk of the Year" (abbreviated here as CRRotY) series of papers by PGN, in the Proceedings of the COMPASS (Computer Assurance) Conference, held each June, at NIST in Gaithersburg MD:

1987: The N Best (or Worst) Computer-Related Risk Cases.

IEEE 87TH0196-6, pp.xi-xiii.

1988: CRRotY: Computer Abuse. IEEE 88CH2628-6, pp.8-12.

1989: CRRotY: Misplaced Trust in Computer Systems. IEEE, pp.9-13.

1990: CRRotY: Distributed Control. IEEE 90CH2830, pp.173-177.

1991: CRRotY: Weak Links and Correlated Events. IEEE 91CH3033-8, pp.5-8.

1993: Keynote, 16 Jun 1993, Myths of Dependable Computing: Shooting the Straw Herrings in Midstream, IEEE 93CH3291-2, pp.1-4.

1995: Banquet speech on risks in critical systems, 29 June 1995 [no paper]

Inside Risks

See also the "INSIDE RISKS" monthly columns inside the back cover of the Communications of the ACM, since July 1990, written by PGN except for guest columns as indicated. Recent columns are on-line: http://www.csl.sri.com/neumann/insiderisks.html

.....Inside Risks, CACM VOLUME 33, numbers 7 through 12, respectively -

Jul 1990: Some Reflections on a Telephone Switching Problem

Aug 1990: Insecurity About Security?

Sep 1990: A Few Old Coincidences

Oct 1990: Ghosts, Mysteries, and Risks of Uncertainty

Nov 1990: Risks in computerized elections

Dec 1990: Computerized medical devices, Jon Jacky

.....Inside Risks, CACM VOLUME 34, numbers 1 through 12, respectively -

Jan 1991: The Clock Grows at Midnight

Feb 1991: Certifying Programmers and Programs

Mar 1991: Putting on Your Best Interface

Apr 1991: Interpreting (Mis)information

May 1991: Expecting the Unexpected Mayday!

Jun 1991: The Risks With Risk Analysis, Robert N. Charette

Jul 1991: Computers, Ethics, and Values

Aug 1991: Mixed Signals About Social Responsibility, Ronni Rosenberg

Sep 1991: The Not-So-Accidental Holist (on critical systems)

Oct 1991: A National Debate on Encryption Exportability, Clark Weissman

Nov 1991: The Human Element

Dec 1991: Collaborative Efforts

.....Inside Risks, CACM VOLUME 35 number 1 through 12, respectively -

Jan 1992: What's in a Name?

Feb 1992: Political Activity and International Computer Networks, Sy Goodman

Mar 1992: Inside "Risks of RISKS"

Apr 1992: Privacy Protection, Marc Rotenberg

May 1992: System Survivability

Jun 1992: Leaps and Bounds (on leap-year problems, distributed systems)

Jul 1992: Aggravation by Computer: Life, Death, and Taxes

Aug 1992: Fraud by Computer

Sep 1992: Accidental Financial Losses

Oct 1992: Where to Place Trust

Nov 1992: Voting-Machine Risks, Rebecca Mercuri

Dec 1992: Avoiding Weak Links

.....Inside Risks, CACM VOLUME 36 number 1 through 12, respectively -

Jan 1993: Risks Considered Global(ly)

Feb 1993: Is Dependability Attainable?

Mar 1993: Risks of Technology

Apr 1993: Using Names as Identifiers, Donald A. Norman

May 1993: The Role of Software Engineering

Jun 1993: Modeling and Simulation

Jul 1993: Risks on the Rails

Aug 1993: Risks of Surveillance

Sep 1993: Animal Crackers

Oct 1993: System Development Woes

Nov 1993: Corrupted Polling, Rebecca Mercuri

Dec 1993: A World Lit by Flame, Peter Denning

.....Inside Risks, CACM VOLUME 37 number 1 through 12, respectively -

Jan 1994: Risks in Aviation, Part One, Robert Dorsett

Feb 1994: Risks in Aviation, Part Two, Robert Dorsett

Mar 1994: Technology, Laws, and Society

Apr 1994: Risks of Passwords

May 1994: Alternative Passwords

Jun 1994: Risks on the Information Superhighway

Jul 1994: Questions About the NII, Barbara Simons

Aug 1994. Friendly Fire

Sep 1994. Expectations of Security and Privacy

Oct 1994. The Verdict on Plaintext Signatures: They're Legal, Benjamin Wright

Nov 1994. Dehumanizing the Workplace, Herb Grosch

Dec 1994. Inside "Inside Risks"

.....Inside Risks, CACM VOLUME 38 number 1 through 12, respectively -

Jan 1995. The Information Superhighway: For the People, Ben Schneiderman

Feb 1995. Computers as Substitute Soldiers, Chris Demchak and Sy Goodman

Mar 1995. Reassessing the Crypto Debate

Apr 1995. Information Superhighway 2015, Peter J. Denning

May 1995. How to Create a Successful Failure, Robert N. Charette

Jun 1995. Computer Vulnerabilities: Exploitation or Avoidance

Jul 1995. My Top Ten E-Mail Hassles, Phil Agre

Aug 1995. Research on the Internet, Joel M. Snyder

Sep 1995. Risks of Easy Answers

Oct 1995. Risks of Social Security Numbers, Simson Garfinkel

Nov 1995. Safety as a System Property, Nancy Leveson

Dec 1995. Reviewing the Risks Archives

.....Inside Risks, CACM VOLUME 39 number 1 through 12, respectively -

Jan 1996. Risks in Digital Commerce

Feb 1996. W(h)ither Research and Education? PGN and Peter J. Denning

Mar 1996. Taking Responsibility for Our Risks, Robert Charette

Apr 1996. A Risks-Related Bookshelf

May 1996. Linguistic Risks

Jun 1996. Securing the Information Infrastructure, Teresa F. Lunt

Jul 1996. Using Formal Methods to Reduce Risks

Aug 1996. Cryptography's Role In Securing the Information Society, Herbert Lin

Sep 1996. Behind the State of the Art, Lauren Weinstein

Oct 1996. Disinformation Theory

Nov 1996. Distributed Systems Have Distributed Risks

Dec 1996. Risks of Anonymity

.....Inside Risks, CACM VOLUME 40 number 1 through 12, respectively -

Jan 1997. Cryptography, Security, and the Future, Bruce Schneier

Feb 1997. Hopes for Fewer Risks?

Mar 1997. Some Observations on RISKS and Risks, Richard I. Cook

Apr 1997. Webware Security, Edward Felten

May 1997. The Big Picture

Jun 1997. Spam, Spam, Spam! PGN and Lauren Weinstein

Jul 1997. Identity-Related Risks

Aug 1997. Crypto Key Management

Sep 1997. Software Engineering: An Unconsummated Marriage, David Lorge Parnas, P.Eng.

Oct 1997. Integrity in Software Development

Nov 1997. Risks of Technological Remedy, Peter Ladkin

Dec 1997. More System Development Woes

.....Inside Risks, CACM VOLUME 41 number 1 through 12, respectively -

Jan 1998. Protecting the Infrastructures

Feb 1998. Internet Gambling

Mar 1998. Are Computers Addictive?

Apr 1998. On Concurrent Programming, Fred B. Schneider

May 1998. In Search of Academic Integrity, Rebecca Mercuri

Jun 1998. Infrastructure Risk Reduction, Harold Lawson

Jul 1998. Laptops in Congress?

Aug 1998. Computer Science and Software Engineering: Filing for Divorce?, Peter J. Denning

Sep 1998. Y2K Update

Oct 1998. On-Line Education

Nov 1998. Toward Trustworthy Networked Information Systems, Fred B. Schneider

Dec 1998. The Risks of Hubris, Peter B. Ladkin

.....Inside Risks, CACM VOLUME 42 number 1 through 12, respectively -

Jan 1999. Our Evolving Public Telephone Networks, Fred Schneider and Steven M. Bellovin

Feb 1999. Robust Open-Source Software

Mar 1999. Bit-Rot Roulette, Lauren Weinstein

Apr 1999. A Matter of Bandwidth, Lauren Weinstein

May 1999. Ten Myths about Y2K Inspections, David L. Parnas

Jun 1999. Risks of Y2K, PGN and Declan McCullagh

Jul 1999. Information is a Double-Edged Sword

Aug 1999. Biometrics: Uses and Abuses, Bruce Schneier

Sep 1999. The Trojan Horse Race, Bruce Schneier

Oct 1999. Risks of Relying on Cryptography, Bruce Schneier

Nov 1999. Risks of Content Filtering, PGN and Lauren Weinstein

Dec 1999. Risks of Insiders

Jan 2000. Risks of PKI: Secure E-Mail, Carl Ellison and Bruce Schneier

Feb 2000. Risks of PKI: Electronic Commerce, Carl Ellison and Bruce Schneier

Mar 2000. A Tale of Two Thousands

Apr 2000. Denials of Service

May 2000. Internet Risks, Lauren Weinstein and PGN

Jun 2000. Internet Voting, Lauren Weinstein

Jul 2000. Risks in Retrospect

Aug 2000. Shrink-Wrapping Our Rights, Barbara Simons

Sep 2000. Missile Defense, PGN

Oct 2000. Tapping on My Network Door, Matt Blaze and Steven M. Bellovin

Nov 2000. Voting Automation (Early and Often?), Rebecca Mercuri

See http://www.csl.sri.com/insiderisks.html for recent columns.

Unfortunate motto for the ages: If it is not now on the Web, it does not exist; what's more, it never existed. (Too bad. A lot of good old stuff gets lost.) At least this file is on-line! And I am trying to get more of the archival stuff on-line as well, including the risks anthology material culled out of Software Engineering Notes.
Beware of geeks bearing gifs.