The RISKS Digest
Volume 5 Issue 74

Monday, 14th December 1987

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

Rounding error costs DHSS 100 million pounds
Robert Stroud
Computers' Role in Stock Market Crash
Rodney Hoffman
The Infarmation Age
Ivan M. Milman
Virus programs and Chain letters
David G. Grubbs
Baby monitors can also be very efficient "jammers", too.
Rob Warnock
The Saga of the Lost ATM Card
Alan Wexelblat
Interchange of ATM Cards
Ted Lee
PacBell Calling Card Security (or lack thereof)
Brent Chapman
IBM invaded by a Christmas virus
Franklin Davis
Info on RISKS (comp.risks)

Rounding error costs DHSS 100 million pounds

Robert Stroud <robert%cheviot.newcastle.ac.uk@NSS.Cs.Ucl.AC.UK>
Mon, 14 Dec 87 09:45:00 GMT
This is an extract from a front-page report in the Independent (12 Dec 1987).
It would appear that for over a year, due to a programming error, the
government have been underestimating inflation by 0.1%. The cumulative
effect of this error on index-linked payments such as pensions amounts
to 100 million pounds which they have a statutory obligation to pay back.

The interesting question this poses is what level of error would be considered
reasonable in calculating inflation. Even a 0.001% error would cost 1 million
pounds by this reckoning, and yet averaging the price of commodities introduces
spurious accuracy when in practice prices will be to the nearest 0.5p.

Robert Stroud, Computing Laboratory, University of Newcastle upon Tyne.
UUCP ...!ukc!cheviot!robert

  "DHSS in 100m pounds inflation blunder - pensioners to get payment after
  computer error" by Steve Levinson and Colin Hughes

  Reproduced without permission from The Independent (Sat 12th Dec 1987)
  Copyright (c) Newspaper Publishing PLC 1987

  More than nine million pensioners are shortly to receive a tax-free lump sum
  bonus of between 7.50 and 12.00 pounds after the Government yesterday
  admitted that a computer error had led to publication of incorrect inflation
  figures for the past 21 months.

  The pay out to pensioners will cost an estimated 100 million pounds, but
  other social security recipients, who include some of the poorest, will not
  be reimbursed for the error which has meant that benefit increases have not
  kept pace with inflation.

  [... Lots of stuff about how the government will only reimburse those
  benefits for which it has a legal obligation or has made a pledge to keep
  pace with inflation, despite the fact that most other forms of benefit are
  usually raised in line with inflation, and how this is likely to cause a
  political row(!) ...]

  Although the computer error at the Department of Employment has meant an
  understatement of only 0.1% in inflation, it is difficult to conceive of a
  more embarrassing mistake or one that affects more people. Pay negotiators,
  taxpayers, savers, and pensioners are all caught up in its implications.

  The department does not intend recalculating past inflation figures,
  but says that yesterday's 4.1% rate for the year to November is correct.
  The error itself is put down to a mistake made early last year when a
  programmer, seeking to speed up the process of analysing each month's
  prices, entered details for household goods which omitted everything
  after the decimal point. [I assume this means pence rather than pounds!]

  Nobody noticed and from January this year the new program was given wider
  application to other goods, including clothing. The effect was that all
  Retail Price Index numbers [the official measure of inflation] between
  February 1986 and January 1987 were 0.06 points too low, and after January
  1987, a further 0.09 understatement was added. The error was spotted
  purely by chance only last month when a new attempt was made to speed
  up the process of analysing price information.


Computers' Role in Stock Market Crash

Rodney Hoffman <Hoffman.es@Xerox.COM>
13 Dec 87 22:05:59 PST (Sunday)
The Friday, Dec. 11 'Wall Street Journal' ran a story headlined "Were Computers
a Help or a Hindrance?  Securities Industry Asks After the Crash" by Michael W.
Miller.  It was one of several articles trying to put the recent crash in
perspective.  What's particularly interesting is that the piece is not narrowly
focused on the role of computers in the crash.  Instead, it's a thoughtful
questioning of "the ways computers changed Wall Street".  The whole article is
well worth reading.  A few edited excerpts:

   Portfolio insurance, index arbitrage and other modern Wall Street 
   trading innovations that depend on ever speedier and more complex 
   trades ... wouldn't have been possible with the more than 200 Tandem 
   TNX and TXP computers of Securities Industry Automation Corp. (SIAC), 
   run by the New York and American stock exchanges.... SIAC's system is
   one of the biggest collections of computer power gathered under a
   single roof.  Its workings have grown so vast that today SIAC uses
   computers to keep track of all its computers.  

   Did electronic analysis and trading produce a whole new breed of 
   high-tech investors whose criteria have nothing to do with the 
   traditional corporate and economic forces behind stock movements?  
   "I think there is a tendency today to substitute trading for 
   investment," says former U.S. Attorney General Nicholas deB. 
   Katzenbach, who was commissioned last spring to study program 
   trading for the Big Board.  "Computers are an element of that, 
   sure.  but I don't think it's just because of computers."  Which 
   came first?...

   One way or another, the computer has transformed the stock market 
   in ways unimaginable even a few years ago. ... The volatile growth 
   is "a real monster, and it's obviously one that we cannot control," 
   a top SIAC official says.  In many ways, Wall Street was an unusually 
   ripe target for computerization.  Nowhere does faster, better 
   information command such a high premium....

   In hindsight, it seems that computers on Wall Street created an  
   appetite they ultimately couldn't satisfy.  Following the classic 
   addicts' pattern, each time investors got more powerful computers,  
   they developed investment techniques that needed even more powerful 
   computers....

   A rethinking of computer-aided trading in inevitable... But curtailing
   powerful technology already in wide use isn't easy — as any arms 
   negotiator can attest.... Moreover, Wall Street is worried about 
   what the Japanese may come up with.  A state-of-the-art futures 
   market is scheduled to open in Tokyo in March.  Observes Ramon Villareal 
   or Tandem:  "Once you've got the tools, if you don't use them, someone 
   else will."


The Infarmation Age

Ivan M. Milman <ivan@sally.utexas.edu>
Mon, 14 Dec 87 23:00:50 CST
The business section of the December 14th (Monday) edition of the Austin
American-Statesman had a 4-column feature article entitled "Modern farmers
plow profit with computers."  The article discussed at great length all the
benefits farmers are receiving by using computers.

Directly below the article is a section called "In Brief", and the first
headline is "Computer Trouble."  The paragraph described how the report of
humidity and soil temperatures provided every week by Blackland Research
Center was interrupted due to computer troubles.

Ivan Milman
                    [Perhaps the computer was affected by humidity?  PGN]


Virus programs and Chain letters

David G. Grubbs <dandelion.CI!dgg@husc6.harvard.edu>
Sun, 13 Dec 87 20:50:57 est
When do we start treating these foolish, destructive, puerile acts as they
deserve?

Virus programs and Chain letters are not harmless pranks, as most of the
comments I've read lately seem to imply.  They waste immense amounts of our
two most precious resources: time and effort.  And they are, to my mind,
evidence of an anti-social behavior which deserves to be actively suppressed,
even attacked.

Persons caught sending a chain letter should have their mail privileges
suspended for some period, as a first offense, then removed entirely if the
idiocy continues.

Persons writing or distributing Virus programs should be warned, then kicked
out of whatever organization is affected, from a place of employment to
whatever social group is involved.  A prank without an appreciative and
approving audience is an anomaly.  Remove the audience and the act becomes
meaningless.

It is not possible to legislate maturity, termperance or responsibility, but
it IS possible to influence one's peers through social pressure.  These acts
are intolerable and it is up to YOU to do something about it.  Stop chuckling
at juvenile acts of destruction.  Let the perpetrators know they are out of
line, take steps to stop them and share the ideas that work with the rest of
us.

"If you aren't part of the solution, you will become part of the precipitate."

David G. Grubbs, Cognition Inc., 900 Tech Park Drive, Billerica, MA  01821
UUCP:  ...!{mit-eddie,talcott,necntc}!dandelion!dgg     (617) 667-4800


Baby monitors can also be very efficient "jammers", too.

Rob Warnock 7 Dec 87 20:25:16 GMT
I was recently involved in helping with the logistics and security for
a large (several K people) outdoor event in Vermont, and we decided to
use a bunch of those Radio Shack "bug ears" short-range FM transceivers
for communications among monitors who would be spaced throughout the crowd
to handle medical emergencies, lost children, etc. Well, everything worked
just fine, until some VIPs started showing up a day or two ahead of the main
event. Suddenly, the 49 MHz band that the transceivers use began to be jammed
with a strong carrier, with a lot of 60 Hz "hum" and no (apparent) modulation.
The "jamming" came and went at various times, for several hours at a time.
We began to be worried that our careful public safety plan was going to be
destroyed by this "jamming"!

Finally, during a period of "jamming", we heard a loud baby cry, followed by
a door opening and the soothing tones of a mother.  Problem solved! (...after
some diplomacy, that is.) We were able to recover our public safety plan by
convincing the parents (who were fortunately part of the sponsering group)
to leave the baby monitor "off" during our practice drills, and during the
entire day of the main event.

What's the "Risk"? Both the short-range transceivers and the baby monitor
use the 49 MHz "public domain" band, which is the same band used by many
cordless telephones. (We had in fact thought that the "jamming" was a
cordless phone.) Who is to adjudicate conflicts when they arise? The
FCC regulations specifically state that any such device "(1) May not
cause any harmful interference to any other service; and (2) Must accept
whatever interference [that arises] from any other [licensed] service."

As more and more "deregulation" occurs and more and more "consumer" R.F.
(and infrared) devices show up on the market, conflicts of this type will
increase. I only know that not all of them will be settled so amicably as
the one described above.

Rob Warnock, Systems Architecture Consultant

UUCP:     {amdcad,fortune,sun,attmail}!redwood!rpw3
ATTmail:  !rpw3
DDD:      (415)572-2607
USPS:     627 26th Ave, San Mateo, CA  94403


The Saga of the Lost ATM Card

Alan Wexelblat <wex%SW.MCC.COM@MCC.COM>
Mon, 14 Dec 87 10:06:09 CST
Last week, I went to my bank to order a new ATM card.  Here's why:

First, some background.  Austin is served by two major ATM networks, Pulse and
MBank.  Each accepts the others' cards for purposes of withdrawals and
transfers, but not deposits.  Very convenient - Pulse is a national network and
friends from Philly have been able to get cash while in town.

Saturday night I was in a supermarket buying food to bring to a friends'
dinner.  I realized I didn't have enough cash, so I used the ATM.  It was
MBank, but it had a big sticker indicating it would accept my Pulse card, so I
tried.  I got the cash and the receipt, but the machine didn't return my card.
I went to the supermarket service desk.

They helpfully informed me that they had no way of retreiving my card, but if I
was willing to hang around for a while "...the machine will probably spit it
out."  Does this happen often, I asked.  "All the time.  Usually the card comes
back in less than 10 minutes.  Sometimes it comes back when the next person
tries to do a transaction."

Well, I'm late for dinner, so I can't wait around.  Fortunately, I'm with a
friend and he has bank cards.  First, he tries one for an account he knows is
defunct.  The machine rejects it.  Then he tries his MBank card (brave fellow -
how does he know his card won't get swallowed, too?).  Both are returned by the
machine, but my card stays gone.

After a useless call to the MBank service number (answered by a security guard
who knows nothing) we leave.  I'm told that they empty the machines first thing
Monday morning, and I should get a phone call then.

When Wednesday rolls around and I haven't heard, I put in a call to MBank's
service number.  I explain my situation to a service rep who, upon finding that
I'm not an MBank customer clams up.  I have to call *my* bank, she says, and
get the card back from them.  Can she check and see if my bank has the card?
No.  Does she care that her bank's machine is regularly eating cards and
spitting them back at random intervals?  No.

So I call my bank's central customer service number and I'm told that they
still don't have the card.  But even if I did, I'd have to get a new one.
MBank returns them cut up, you see.  Why?  Because they consider it too risky
to mail the cards intact to my bank.  My bank has no trouble mailing the cards
to me.  But I'm a reasonable person, perhaps I can go to MBank and identify
myself and get my card back directly from them?  No... "Customer identification
is the problem of the owning bank."  Not that I can explain to this imbecile
that it doesn't matter whether my bank can identify me, since all they could
give me would be useless plastic scraps...

So now I have to wait 4-6 weeks for the central office to produce another card.
Fortunately, the PIN is not on the card, so my wife's card is still usable.
Anyone want to guess at the number of MBank machines I'll be using in the
future?
                              --Alan Wexelblat

UUCP: {harvard, gatech, pyramid, &c.}!sally!im4u!milano!wex


Interchange of ATM Cards

<TMPLee@DOCKMASTER.ARPA>
Mon, 14 Dec 87 00:32 EST
Although the details, especially the time period, are now fuzzy (perhaps
someone else from Minnesota can fill them in), it seems appropriate to note
that sometime after ATM's and competing ATM networks started to become popular
the Minnesota legislature passed a law REQUIRING that ALL ATM's accept each
other's cards.  The law was virtually unheralded.  I seem to recall being quite
surprised when, either by accident or out of idle curiosity, I first discovered
that the card for one network would work on another.  Most of the machines now
carry notices listing all of the other cards they will take; originally there
was no such notice.


PacBell Calling Card Security (or lack thereof)

Brent Chapman <chapman%mica.Berkeley.EDU@violet.berkeley.edu>
Sun, 13 Dec 87 21:36:14 PST
I just recently got my new Pacific Bell Calling Card.  On the sheet describing
where, how, and why to use your card, there is a section (quoted):

    It's Secure.  Your Calling Card Number is made up of your billing
    number and a four-digit Security Code.  Your Calling Card cannot
    be used without this Security Code, so you are protected from
    unauthorized calling as long as you keep your code safe.

Sounds good, right?  Standard stuff.  _BUT_, elsewhere ON THE VERY SAME PAGE,
in the descriptions of where you can use your card, you find (emphasis mine):

    At Pacific Bell Credit Card Phones:  You'll find new Pacific Bell
    Credit Card Phones at airports and hotels near other Pacific Bell
    coin and coinless phones.  These, which will be appearing at many
    other locations as well, allow you to simply insert your Calling
    Card and press the number you want.  YOU DON'T EVEN NEED TO GIVE
    YOUR SECURITY CODE, BECAUSE THE MACHINE READS IT FROM THE CARD.

Gee, ain't technology wonderful?  Any bets that only PacBell can read the
code from the card?

Brent Chapman                   Capital Market Technology, Inc.
Senior Programmer/Analyst           1995 University Ave., Suite 390
{lll-tis,ucbvax!cogsci}!capmkt!brent        Berkeley, CA  94704
capmkt!brent@{lll-tis.arpa,cogsci.berkeley.edu} Phone: 415/540-6400

    [If your card is lost or stolen, who needs to read the security code?
    By the way, there were several other messages along these lines,
    including one from David Robinson.  PGN]


IBM invaded by a Christmas virus

Franklin Davis <fad@Think.COM>
Mon, 14 Dec 87 09:38:55 est
    This article seems to have a lot of things in it that the reporter didn't
    understand.  I assume that the "terminals" in question are really PC's
    connected to the mainframes; for one thing.

Probably the users were connected by 3270 type terminals (or
emulations on a PC) which use a half-duplex block mode protocol.  If
you turn off such a terminal your session is aborted, and you lose
current edits.  It is also very difficult to interrupt an executing
program, since it "owns" the line.  There is a "system-attention" key,
but a busy system may take literally minutes to respond.  (I'm glad I
don't have to use an IBM mainframe any more!! :-)

--Franklin Davis         Thinking Machines Corp.         fad@think.com     

Please report problems with the web pages to the maintainer

x
Top