IP: Forged e-mail thrown out of court

[Dave Farber <farber () central cis upenn edu>]

> From RISKS Digest:


----------------------------------------------------------------------


Date: Tue, 23 Apr 96 17:58:50 PDT
From: "Peter G. Neumann" <neumann () csl sri com>
Subject: Former Oracle worker charged with perjury: bogus e-mail


Adelyn Lee had won a $100K out-of-court settlement for wrongful termination
from Oracle in February 1995, claiming that she had been fired for refusing
to have sex with Oracle president Larry Ellison.  She had apparently used as
evidence a piece of e-mail from her boss VP Craig Ramsey to Ellison,
confirming that Lee had been terminated as per Ellison's request.  To make a
long story short, San Mateo County Deputy District Attorney Paul Wasserman
said that their investigation has now come to the conclusion that Ramsey
could not have sent the e-mail (because he was driving in his car at the time
according to cell-phone records) and that, as Ramsey's executive assistant,
Lee knew his passwords (and indeed had been responsible for changing them for
him periodically).  Lee has now been charged with felony perjury for lying
and sending false e-mail.  [Source: *San Francisco Chronicle*, 20 Apr 1996,
D1-2]


What are some of the conclusions for RISKS readers (not new)?


  1. Don't believe e-mail FROM: headers accurately represent the sender.
  2. Don't believe the content of e-mail, whether or not the headers
     are correct.
  3. Don't share your passwords overtly with anyone, or let someone else
     be responsible for your passwords.
  4. Don't use covertly compromisible reusable fixed passwords; how often
     you change them is more or less irrelevant.
  5. Use one-time nonreusable authentication tokens instead of fixed passwords.
  6. Even if you use PEM, PGP, stronger-crypto e-mail, or whatever, you
     cannot ensure authenticity, because of untrustworthy operating systems
     and untrustworthy users.
  7. Beware of trying to use e-mail as nonrepudiatable court evidence.
  8. HOWEVER, don't believe that cell-phone records are valid as court
     evidence; they too could be bogus or altered.  If someone drags you
     into court, find someone who can demonstrate how easily those records
     could have been altered!
  9. Etc., etc., etc.