Some Family-Oriented Advice about Internet Safety, Ethics, and Law
Dr. Michael Covington
Former chairman (1994-99), Computer Security and Ethical Use Task Force
The University of GeorgiaJune 1999; minor revisions, February and April 2000, July 2001; February 2003
The opinions expressed here are those of the author and are not necessarily policies of The University of Georgia, though they are consistent with University policy as far as possible.
ContentsWhat is the Internet?
Who controls the Internet?
What kind of people use the Internet?
Is the Internet having growing pains?
What are the most dangerous misconceptions about the Internet?
What is a "clueless newbie"?
Is the Internet good for children?
Is the Internet safe for children?
Will people kidnap my children over the Internet?
What else can I do to protect my children?
What about pornography?
Is it possible for pornography to show up on my screen even though I didn't go looking for it?
Are my credit card numbers going to get stolen?
Is my PC going to get broken into through the Internet?
What is a "hacker"?
What should I do to protect myself against crackers?
But I don't have anything valuable stored on the password-protected system.
What is a computer virus?
How can I protect myself against computer viruses?
Should I use my real name on the Internet?
But I don't want bad guys to know who I am!
I get ads for pornography in my e-mail. Does that mean someone in my house has been viewing pornography?
What else should I know about "spam" (annoying e-mail)?
Why should "spam" be banned?
Somebody sent me e-mail and said to pass it along. Should I?
Should I keep my e-mail address (or other information) secret?
What should I know about choosing an online name?
What's the easiest way for e-mail to fall into the wrong hands?
What are some important safety tips for the World Wide Web?
Does the Internet waste time in the workplace?
Are University of Georgia employees allowed to use the Internet for personal purposes in the workplace?
What about "Internet addiction"?
Did anybody's computer (or car, etc.) stop running on on January 1, 2000?
What is the Internet?
As its name implies, the Internet is a network of networks. It is not a company and has no central headquarters. Instead, thousands of separate computer networks, owned by different companies or institutions, have voluntarily linked together.The main services that the Internet offers are:
- the World Wide Web, a huge bulletin board system on which anybody can publish anything;
- various kinds of online discussion groups (newsgroups);
- electronic mail, which nowadays usually reaches its destination within minutes, anywhere in the world;
- file transfer (FTP) to transmit data from one computer to another.
To get on the Internet you need an account with a service provider, which is a local company such as NEGIA, a national company such as Mindspring or AOL, or an institution such as the University of Georgia.
You connect your computer to theirs over phone lines by modem. Their computer has a high-speed cable connection to many other sites and can reach the entire Internet.
Who controls the Internet?
Nobody!Unlike TV, radio, or newspapers, Internet communication is not controlled by any central site. Anybody can transmit anything they want to.
Think about that for a moment. Newspapers and book publishers are controlled by editors. Radio and TV broadcasts are controlled by the management of stations and networks. Until the Internet came along, the only way to get information was to get it through some kind of professionally run source. Nowadays anybody can publish anything, instantly.
This has its good and bad sides. Obviously, lots of bad things get transmitted through the Internet that would never appear in ordinary mass media. On the other hand, lots of good also gets done that Hollywood or Madison Avenue would never allow.
Because of its inherent freedom, the Internet is a powerful force for democracy in countries that presently have oppressive governments. It is physically impossible to censor the contents of the Internet, since a message could be going from any computer to any other one over hundreds of possible routes. Thus, the Internet provides a way to get outside information and opinions into Serbia, China, and other places where world news media are blocked or unavailable.
What kind of people use the Internet?
It's extremely important to realize that, from the 1970s to 1993, the Internet was a network of universities and research labs. Much of its culture took shape during that time. In particular:Both of these points are often lost on beginners who think the Internet is a game for hobbyists.
- Many of the people on the Internet were, and still are, very highly educated and very intelligent.
- The Internet community expects everyone to be honest and cooperative.
Is the Internet having growing pains?
Definitely. I think most of the present problems with fraud, obnoxious behavior, and unethical practices result from the following facts:
- Law enforcement has not yet caught up with the Internet (although they're getting there). Some people still think the Internet is a sanctuary where they can conduct blatantly illegal activities.
- The Internet community, and society as a whole, still hasn't quite developed the protective measures that it needs. Remember that the Internet was designed for use by professional scientists. It still doesn't have enough built-in safeguards against deliberately uncooperative behavior.
- Because it was developed for non-profit research labs, the Internet doesn't have enough mechanisms to track costs and impose them on the right people. For instance, the cost of delivering e-mail is paid mostly by the recipient's ISP, not the sender's.
- People are doing lots of work, for the fun of it, that they won't be able to keep doing forever. Either the World Wide Web will shrink or people will have to be paid to write material for it.
- The Internet still has a steady supply of naive newcomers who think it's something it isn't.
What are the most dangerous misconceptions about the Internet?
- That it is all produced and controlled by some central authority and you can trust them.
(It's not. It's the most public place in the world. There's no editor, publisher, producer, or whatever... Anybody can say anything on the Internet.)
- That all the information on the Internet is reliable.
(The type on your screen looks the same whether it's coming from a reliable authority, an honest but misguided person, or a con artist. It's extremely important to learn to evaluate sources of information. Medical quackery is common on the Internet; so is bad legal advice.)
- That the purpose of the Internet is to make you rich, and that you have a right to try to make money even if it means breaking rules and making a pest of yourself.
(I'll talk about "spam" shortly. People with dollar signs in their eyes are the plague of the Internet -- especially people who think they're the first person to come along with a clever idea.)
- That the Internet is a game or fantasyland in which your real-world responsibilities don't apply.
(Young people are especially vulnerable to this one; in my experience it's associated with the desire to be known by a fantastic name such as Dragonslayer rather than your real name or an appropriate nickname. When you log onto the Internet, remember that there are real people on the other end and you're still subject to the laws of the land. The Internet is no more a game than the telephone is.)
- That computer crime is glamorous.
(Every high-school student seems to have heard legends of people who broke into other people's computers, tampered with them, and as a result were hailed as geniuses and given high-paying jobs. That is fiction. Tampering with other people's computers is just as wrong, and just as illegal, as tampering with their cars or telephones.)
What is a "clueless newbie"?
A "newbie" is a newcomer to the Internet. A "clueless newbie" is one who makes a minor pest of him/herself because of ignorance and misconceptions.It's what you won't be by the time you finish reading this web page.
"Clueless newbies" generally know nothing about the Internet except that it is very, very glamorous. They tend to think all Internet users have unlimited leisure and want to be entertained with pointless e-mail.
And, most importantly, "clueless newbies" believe gossip but don't believe information from reliable sources. So they're always circulating misinformation and getting angry at the people who try to correct them.
Is the Internet good for children?
Well, it's a mixed bag, but it can have some very positive influences. My daughters have benefited from it in at least two ways:
- It encourages them to pursue specialized interests and to develop their talents.
- It protects them from peer pressure by letting them choose their peers. On the Internet, it is relatively easy to find people who share your interests and values; you don't feel pressured to fit in with the crowd in your immediate environment, nor to adopt the value systems of Hollywood and Madison Avenue.
Is the Internet safe for children?
Not inherently. The Internet is a city street, not a school library. It's a forum where anyone, good or bad, can communicate.At the same time, it's so valuable, as an educational resource, that we'd be fools to keep children off it entirely. That would be like not teaching them to read.
The most basic thing I do to keep my children safe on the Internet is to put the networked computer in a shared area of the house, where other family members will see what's going on, rather than in the child's bedroom.
I have taught my children how to use www.yahoo.com to search for what interests them. Surfing at random, in search of adventure, is a bad idea; it is also an ineffective way to see the Internet, since you'll miss the good stuff.
Some more rules that I've made for my children are:
- No participation in chat rooms or other forums where people normally conceal their identity. You should always know who you are talking to, by e-mail address if not by name. Chat rooms may be safe for adults, but in my opinion they are not a safe environment for children.
- The Internet is not for filling up the idle hours. ("Get a life!") Your Internet usage should be purposeful. This is another reason I don't like chat rooms -- they waste time. With less effort you can communicate with more people, and get better answers to your questions, through a newsgroup or e-mail discussion list.
- No computer games that involve realistic violence, whether they involve the Internet or not.
- No associating with people who glamorize illegal or malicious acts.
Will people kidnap my children over the Internet?
Only if they're eager to get kidnapped!Kidnapping of children by strangers is an extremely rare crime in the United States. The "missing children" that you see on milk cartons are either runaways or victims of custody disputes.
What has happened on the Internet is that strangers sometimes lure teenagers into running off with them in search of romantic adventure.
Note that they do this of their own free will. The Internet isn't the problem here -- the problem is the child who wants to run away, and who believes everything a stranger says, without checking it out.
I advise everyone -- child and adult -- that if you go to meet someone you've met online, you should do it in a safe place with other trustworthy people along.
What else can I do to protect my children?
You can buy software, such as Surfwatch, that tries to prevent your computer from accessing obnoxious sites. You can also subscribe to a filtered service provider, such as "Rated G Online" (www.erlc.com), which won't connect you to obnoxious sites.However, all of this assumes somebody can pick out the obnoxious sites, and that's not an easy thing to do. Anybody can change the contents of his or her web page at any time. Nobody can guarantee that someone has looked at web pages prior to letting you or your child see them. So these filtering sites also use software that looks for certain words (such as "sex" or "naked") -- and that can backfire. You may find yourself unable to read about animals or even astronomy (because of the phrase "naked eye").
You also need to make sure that the filtering is done by people whose values agree with your own. For example, some filterers object to sites that promote homosexuality, and others object to sites that oppose it!
What about pornography?
There is a lot of pornography on the Internet, but (with two exception to be mentioned below) you have to go looking for it; it doesn't get in the way of other activities.Remember that the purpose of pornography is not sexual pleasure; it's money. The main function of (free-of-charge) pornographic web sites is to get people "hooked" so they will pay money for more porn.
I would like to see much more consistent enforcement of obscenity laws on the Internet.
Even more importantly, Internet pornographers are often con artists. One major site (XPICS) was shut down for producing too many spurious credit card charges. I would like to see much more of this.
[Late news flash: We are seeing more of this. In mid-May, 1999, the FTC got a major Los Angeles pornography site, charging them with 45 million dollars in credit card fraud.]
I have personally had my credit card number forged by another pornography site, which I immediately reported to police. I say "forged" rather than "stolen" because it was a newly issued number which I had not used very much; I think they simply made up a number at random and it happened to be mine.
[Late news flash again: Yes, that was them, and that's how they did it.]
Is it possible for pornography to show up on my screen even though I didn't go looking for it?
[Revised 2003]Unfortunately, this is becoming a problem. You may get unsolicited e-mail advertisements ("spam") that contain indecent material.
Spam is universally hated for other reasons also. Because e-mail costs money to receive, legitimate Internet service providers do not allow unsolicited mass mailings. Thus, spammers often use illicit means to access the Internet, and they always give a false return address.
Many Internet service providers offer spam filtering, where bulk advertisements are filtered out before they reach you. Although not 100% effective, this greatly reduces the problem and you should use it if it's available.
Also write to your Congressman and ask for laws to be passed against:
The reason an earlier attempt to prohibit indecent e-mail failed (Communications Decency Act, 1996) was that it tried to impose liability on the Internet service providers rather than just the senders of the indecent messages. Since Internet service providers do not control what is sent through their machines against their wishes, that made no sense.
- Spamming (bulk unsolicited advertising by e-mail);
- Sending unsolicited indecent e-mail;
- Sending e-mail that solicits business from a false address.
Note that by "spam" I do not mean advertisements from legitimate businesses to whom you have given your e-mail address. Some businesses are quite aggressive and will bombard you with e-mail for a long time after you do business with them. Read the fine print on web pages, and never give anyone permission to do this.
Are my credit card numbers going to get stolen?
Everybody's afraid to use credit cards online, but nobody is afraid to give their credit cards to total strangers in stores and restaurants.You are more likely to have your credit card numbers stolen by a store clerk or waiter than by an Internet site. Secure web pages (the usual communication medium for Internet commerce) are safe enough; I wouldn't worry.
It's up to the credit industry to verify that the person using your card number is really you. If a thief makes an unauthorized charge to your card, you don't have to pay it. In my opinion some banks are far too lax about this.
Card-number forgery does occur. Credit card numbers have an arithmetic code built into them so that randomly made-up numbers generally won't be valid. However, this code can be cracked, and some particularly stupid thieves have been forging credit card numbers. These thieves are very easily caught because (1) they can't identify themselves or display the actual credit card, and (2) lots of spurious charges come from the same place at the same time.
Is my PC going to get broken into through the Internet?
[Revised 2003]This is very uncommon with a personal computer used by one person, unless the owner can be persuaded to download and install a virus; then the gates are wide open. Do not open files that are sent to you by strangers (or even by people you know, if the messages that arrive with them could be fake). Do not click on web pages that pop up and offer to do something to "improve" your computer.
Even if you have been fastidious, it is important to keep your operating system up to date to correct any vulnerabilities that have been discovered. Use the "Windows Update" button on your Start menu, or under MacOS or Linux, download and install the latest patches often.
The risk is relatively small unless your computer is on line all the time (which is may be if you have a DSL or cable modem). The risk becomes much greater if you are running a web server or other remotely accessible service, or you have turned on remote access to one or more of your disk drives.
If you run Linux, you must take security precautions. Even when running on a $500 PC, Linux is a multi-user operating system designed to be operated remotely. In my experience, Linux gets broken into more often than other operating systems, because more "crackers" are interested in it.
What is a "hacker"?
Different people use the word differently. It originally meant someone who programs computers for the joy of it. In that sense I'm a hacker.However, nowadays, petty computer criminals often call themselves hackers. These are people who trade stolen passwords and credit card numbers, try to break into computers and tamper with owners' data, and say -- all along -- that they didn't mean any harm.
The rest of us call these people "crackers." Their knowledge of computers is usually rather shallow.
I've dealt with "crackers" professionally. Typically, they are seriously out of touch with reality and think they are exempt from society's rules, or even that they will be rewarded for doing damage. "I got your password, so I'm a genius, right?" (No; you're on the same moral level as a shoplifter.)
What should I do to protect myself against crackers?
Protect your passwords. You may use password-protected computers at school or at work; you also have a password for your Internet service provider account. (It may be stored in your PC so that you do not have to type it, but it's still a password.)
- Choose a password that is not easy to guess. Don't use your initials, your phone number, your girlfriend's initials, or a recognizable word in any language. (Crackers have software that will automatically try all the words in a large dictionary.)
- Never give your password to other people. Many sites have suffered serious damage when employees gave their passwords to their friends or children, who then put them into circulation.
Giving a password to an unauthorized person can be illegal under Georgia law.
- Keep your operating system up to date. Use Windows Update or download and install the manufacturer's latest patches. Do this at least every two weeks.
But I don't have anything valuable stored on the password-protected system. There's not much to lose if my password gets loose, is there?
Yes, there is. Crackers are eager to get hold of your password, no matter how innocent or trivial, so they can use your account as a stepping stone. If nothing else, they'll rig it so you get punished for their activities.
What is a computer virus?
A computer virus is a computer program that does some kind of deliberate harm that involves making more copies of itself.Computer viruses are not a natural phenomenon. They are created by people who know exactly what they are doing. There have been recent efforts to prosecute virus authors, and once a couple of these cases are concluded successfully, I expect viruses to be a lot less common.
How can I protect myself against computer viruses?
A virus normally gets into a computer when either of two things happens: you try to boot from an infected diskette, or you run a program (an .exe, .bat, or .vbs file) that contains a virus. The latter is nowadays much more common.So don't run programs that are of unknown origin. Don't "open" files that arrive unexpectedly in e-mail. Be very wary of e-mail that claims to be from a friend but is vague as to exactly who.
Don't use software that was passed along to you by a friend of a friend, i.e., a stranger.
It's OK to download software from legitimate web sites, of course. There is a lot of good, free software in the world; I'm the author of some of it.
You should also install a virus-checking program and let it run continuously. I recommend Norton Antivirus.
And above all, run "Windows Update" regularly (if using Windows 98 or later). Microsoft regularly releases security updates to protect against known viruses.
Should I use my real name on the Internet?
Yes, of course! Do you use your real name on the telephone?Outside of chat rooms, using a "handle" or made-up name is bad form. It makes people think you are untrustworthy, that you have something to hide, or at least that you are not taking responsibility for your behavior.
The Internet is not a game for children. It is part of adult society. If you conceal who you are, people won't trust you. They'll have no way to check whether you are who you claim to be. (See the question about kidnapping, earlier.)
If you don't want to say who or where you are, then don't, but never give a false name, address, or telephone number. You could be sued as well as charged with fraud. Remember that if you make up an address or telephone number at random, it's somebody's, even if it's not yours. More importantly, you're acting like a criminal.
But I don't want bad guys to know who I am!
If you really don't want to communicate with other people, don't use the Internet! If you choose to join the Internet community, please do it as an honest citizen. People who conceal their identity are almost always up to no good.Think about it. You don't become safe by hiding. You become safe by having your neighbors know you. It's the same way on the Internet. Needless secrecy doesn't protect you from anything; it only inspires suspicion. People won't trust you unless they can confirm who you are.
I get ads for pornography in my e-mail. Does that mean someone in my house has been viewing pornography?
No.Obnoxious advertising ("spam") presently gets sent to every e-mail address that the advertisers can find or guess. The fact that you get porn ads does not mean you have been targeted in any way. The advertiser almost certainly has no idea who you are and isn't even sure you exist.
What else should I know about "spam" (annoying e-mail)?
Do not answer unsolicited ads. Do not click on web links that appear in unsolicited ads.I say this because 99% of the "spam" that I receive is obviously fraudulent, with forged addresses or the like, and is advertising disreputable things -- either pornography or get-rich-quick schemes.
If you answer an unsolicited ad (even just to say "take me off your mailing list"), you are thereby confirming that the advertisement actually reached someone. They won't take you off their list. If they were courteous and honest, they wouldn't have sent you unsolicited advertising in the first place.
For details on how to trace spam to its source and complain effectively, click here.
Why should "spam" be banned?
Actually, a good crackdown on fraud would get rid of most "spam."But there's a more basic reason to ban it: The cost of e-mail is paid by the recipient, not the sender. The spammer who sends out a million ads is not paying the postage; he's making a million victims pay it.
In my opinion, you should lobby Congress to ban (not just restrict) unsolicited e-mail advertising. It is not a legitimate way to advertise. If it were, we'd be getting e-mail ads from General Motors and Intel, not just con artists.
Somebody sent me e-mail and said to pass it along. Should I?
No! Do not pass along any e-mail message -- no matter what it says -- unless you can personally take responsibility for it. After all, it's going out with your signature on it.Plenty of e-mail hoaxes are circulating: "A dying boy wants postcards." "The FCC is about to ban religious broadcasting." "Bill Gates will give you a thousand dollars if..."
They all say "Pass this along to all your friends." And they are all inaccurate and a huge waste of time and money.
There are also spurious warnings about computer viruses. If you get one, pass it along to the security department of your Internet provider, but not to anyone else. I have never received an accurate virus warning in a chain letter. If a warning needs to be issued, your Internet provider will send it directly to you; it will not arrive from a friend-of-a-friend.
Pyramid schemes ("send money to the first person on the list, cross his name off, add yours at the bottom and send out copies") are just as illegal on the Internet as anywhere else. Also, they can't work; how can everybody get more money than they send out? When I get one I reply, "That was an intelligence test, and you failed."
The U.S. government is, in fact, cracking down on pyramid schemes and participants can expect to be prosecuted.
Should I keep my e-mail address (or other information) secret?
Of course not! Don't give up your freedom just because there are a few bad guys on the Net. I have my e-mail address on my web page; you probably should, too.At the same time, I don't give out detailed personal information without sufficient reason. In particular, I don't give my e-mail address when filling out forms (on paper or online) that will be used for mailing lists.
What should I know about choosing an online name?
Remember that the Internet is not a game. If you call yourself GODZILLA, you probably won't be taken as seriously as if you call yourself JRSMITH. Maybe you're a hobbyist now, but you'll be using the Internet for work before long.At the same time, don't use a common name (such as JONES) by itself as your online name. If you do, you'll get mail from people who are looking for every other Jones in the world. Something like JONES57 would be better.
Also, don't put tiresome jokes or controversial slogans in your e-mail signature. Remember, what seems funny to you may not seem funny to everybody in the world, especially if you send it to the same person repeatedly. You're likely to forget it's there, and then you'll be annoying people without knowing it.
What's the easiest way for e-mail to fall into the wrong hands?
Remember that whenever you send e-mail, the recipient can easily save copies of it and forward them to anybody, anywhere.Remember also that you yourself may mis-type an address, and when you do, the mail will go to the address you typed, not the address you meant to type! This is the most common way private messages get sent to unintended recipients.
Please use great care when typing e-mail addresses. Don't send e-mail to addresses you're not sure of.
What are some important safety tips for the World Wide Web?
Don't click on (visit) a web address that is given as numbers, such as http://01234567890123. The only reason for giving an address that way is that the person using it has something to hide. In my experience, such sites are almost always pornographic.Don't put anything on your own web page that you don't control. It's OK to link to other people's web pages -- that's what the Web is for. But don't arrange for your page to display a picture or banner that is controlled by somebody else (such as a rotating advertisement), unless you are quite sure the people controlling it are trustworthy. You never know what it could change into when you're not looking.
Finally, don't violate copyright laws. Your web page reaches a potential audience of millions. You're not allowed to scan in yesterday's comics or pick up a picture from someone else's web page. You have the same responsibilities as a newspaper editor, and you are probably reaching a larger audience.
Does the Internet waste time in the workplace?
Yes, in two ways.Plenty of us get too much e-mail and don't really want your latest collection of old jokes, funny pictures, etc. Please do not burden people with needless e-mail.
In particular, please do not e-mail me about your computer ethics or security concerns, unless (1) the University of Georgia incident handling team referred me to you, or (2) you wish to employ me as a paid consultant. Deal with the security department of your Internet service provider instead. At the University of Georgia, contact abuse@uga.edu. I'd like to help everybody personally, but there are far too many people!
And, of course, having a networked computer in your office does not mean you no longer have any work to do. Like the telephone, the Internet is probably not provided for personal use during working hours.
Are University of Georgia employees allowed to use the Internet for personal purposes in the workplace?
For personal financial gain, definitely not. For self-education, maybe, but only when time and equipment are avaiable and the employee's supervisor consents. Just like a telephone, a computer in your office does not necessarily give you the right to use it for personal purposes.
|
nor are they endorsed by, the University of Georgia or the University System of Georgia. |