*/
> /* actual or intended publication of such source code. */
>
> ...followed by another email with a subset of the same source,
> slightly modified, and the proprietary header stripped out.
>
> I hope it didn't flow past AT&T's ISP connections...
[snip]
********** end excerpt from 'Corruption at Salomon Brothers' **********
This transfer of proprietary source code that USED to be owned by AT&T
did not even qualify for action. Salomon legal stated Salomon has a lower
obligation for third-party copyrights than they did for software they
contracted for themselves, like Sybase. Salomon didn't have a UNIX source
license, so obviously the employee had gotten it elsewhere.
In the following statistic, it was the only non-Salomon source code.
We went from zero monitoring of Internet email traffic to...
> On 3/21/96 we had our first security incident report.
>
> By 3/26/96 we had an astonishing 38,000 lines of proprietary source code
> outbound.
>
> We were mentally unprepared. Figuratively we were pulling our hair out
> wondering when the madness would stop.
>
> It never did.
As I said, the results of keyword monitoring were stunning.
If you look up computer security literature and read up on security incidents,
you'll notice none are more articulate about inside-employee incidents other
than to describe the people as "disgruntled employees".
Wrong.
I'll go over some of the major categories of incidents I encountered.
Keyword monitoring is abstract to most people; these results show
how powerful the technique is.
Here are two from the category:
o People innocently trying to get work done.
This usually happens between the programmer and a third-party vendor.
SISS stands for 'Salomon Inf
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 3.2.5
55aT+pK51XJ7tBDIE7rWfhqJWyAbB9gqDcAJfb9azS/QHfPpb9muQUHUup5ituAe
IkWjPgIHXVjXgisAdgc98MGW1HV+MBg3Ad8NkhYvohTgel5IEKsr0g6xggtsue0x
xrlnibA+w92l5gg2dR99R1q+/HfwZUlh0dwjbeG+WfeXT7sX5II92cP2+F2dc9/7
ejKkdaFno7HH0stYLu64UqCQXGk1l1zrhv==
=eNWX
-----END PGP SIGNATURE-----