Dr. Schiano Interview

C: Great. I just wanted to talk with you a little bit today about the project that I’m doing and a few things that I wanted to fill in that I couldn’t without some input about your OAC, or I guess it’s called NACS now, is that right?

S: Yeah we just changed it…ah…4 days ago.

C: Okay, did I make sense when I explained what our project was about, or would you like to hear more…?

S: Little bit–you’re doing a research project on, what is it, computer ethics?

C: Yeah, it’s going to be–well it already is a website, but there is going to be a lot more…

S: Okay, well I haven’t seen the website, but I’ll take a look at it.

C: Oh, that’s okay, it doesn’t matter–the website it going to be used in computer science classes by professors to teach their students about ethical and social issues in computing. The way that they’re going to learn is through all these different cases that we’re presenting, and the one that I’m working on mostly is Richard Machado.

S: Okay.

C: So, Sara Kiesler over at Carnegie Melon was nice enough to give us 4 huge binders of all the different information–exact testimony, and things about the case, and so there’s a lot that I know already–but…

S: Have you talked to anyone here at UCI?

C: I haven’t.

S: Okay, because I talked to my boss Dana Roode who was more closely–actually, we both were–but he was the one who did official things about it. The other person’s name is John Ward. He’s the system administrator who testified as to the steps we took to identify him.

C: Okay…see that part’s missing from our…

S: Yeah well, and since I don’t know what you have, I was involved in the background…and…I remember parts of it, but it’s been a long time…so, I may have forgotten all sorts of parts (laughter)

C: That’s okay…There are certain parts of the case that I’m interested in, but there are actually things that I’m especially interested in just about your computer center there…so, I did e-mail Dana Roode and Liz Doan who was a student at the time, and you, and I heard back from you…so…

S: Okay, who’s the other person you e-mailed?

C: Umm, Liz Doan–

S: Liz Doan, right–she was one of the recipients of the e-mail…works for us…

C: Yeah…Well, one of the things I was interested in was just understanding your network on campus a little better, your e-mail system, because I was reading through the description on the web, and it sounds like you guys have a lot of options for students.

S: Okay, you wanna know at the time that this occurred, right?

C: Yes, and now–I want to know both, because I want to know what’s changed.

S: Okay. Umm…about 1990 or maybe even earlier, I don’t know, I’ve been here since 1990–somewhere along in there, we’ve always had e-mail accounts for students available…at the time when we first started this, the students would sign themselves up, they would fill out a menu on a terminal that would basically ask them questions and they would be assigned an initial password and they’d have an account on the computer.

C: Okay. So was it like UNIX, or Eudora…

S: Ah, in the background it’s always been a UNIX computer–in the front what they were seeing, initially, was a program named PINE.

C: PINE, okay we have that here too.

S: Okay, so they’re seeing a little program that has little menus. We basically wanted to go with something that was not too complicated for them–not too many options and whatnot.

C: Right, so that’s what Machado was using?

S: No, haven’t got there yet…ahh, that’s what we started out with. Over time the demand kept going up and there started being instructional uses for such, we moved to a model where all students were assigned information based on what the registrar would give us, that’s what we’re currently doing at this point. And same thing with faculty and staff through different data bases.

C: Yeah, that’s what I got out of it…

S: Right, so we would assign an ID to all of them, and underneath is a thing called "curburos" [phon], which a lot of places use, which basically assigns them a password in a central location and based on that we would then create the UNIX computers essentially that would manipulate their e-mail. And then what people would use to access that e-mail over the years has migrated as more and more people use PCs. So using ah, Eudora, Netscape, Outlook, lots of different ways to get e-mail. But then down below is a series of UNIX computers that are using local passwords, ah excuse me, passwords and logins that are maintained elsewhere. Okay, so that’s part of the e-mail. The other part is where do they go to actually see this e-mail, and there are computer labs all over the campus, and there are computers in people’s offices…generally the students go to the labs or they log on from home. So in his case, his use of e-mail was in our labs, and maybe elsewhere, I don’t know…I don’t remember…that he would be using PCs that we owned and using Netscape.

C: That’s what I thought…okay…Because they had mentioned in the documents that he had used the "finger" command to determine who he would send this e-mail to…and I’ve played around a little bit with that…

S: Yeah…what he had done, what we’d determined–but like I said I wasn’t involved in the court proceedings at any time, except that my employee John Ward was there, testifying and providing information to the FBI, and DA and whatever–what we determined was that he had been a user of these systems for a long time like all students, and he possibly could have used IRC, Internet Relay Chat, which is a chat-room program, that’s available to them, although we don’t really like it–people to use it–to identify some people. He had used finger to figure out who was logged on. So he knew a little bit about the access he could get through a UNIX shell–which is what the students have access to, and of which they can use PINE, or IRC or type finger, things of that sort–so he was getting info about who was logged on about the people that he was talking to in e-mail, or in the chat room. So he had done that and he was using the labs at the same time to be sitting in front of and to be running these programs. He apparently had determined how to use Netscape–in fact some of the early messages that he sent were tests–to show that he could forge an identity.

C: Yeah, that was my next question–he changed his address field, right?

S: Right, he changed his address field in Netscape, which you can do, and use Netscape to talk via POP, to our mail servers, changed his name and called himself something else. He also included himself on the "To:" list, and there were lots of funny things…He had included a person on there at our medical center that he had found whose name was I think "Korea" or something, who turned out not to be Korean at all. So he was basically pointing out Asians of various kinds, and he had found them, and he had tried a couple tests, and then he sent out the message, and then he sent out a follow up one to the same group saying "I just got this, isn’t this bad??"

C: (laughter) Yeah, "he thinks I’m Asian," or something like that…

S: Right, so he tried to distance himself, so that’s what he initially did. While we were, what had happened at that point was that he’d sent this message out to 50 or 60 people, some of them were our employees. Liz Doan is one, she’s the one who actually testified, there were a couple others as well who didn’t really want to get too involved, so there was a lot of apprehension of actually getting involved in it. But some of our employees got the e-mails, and one of them worked in fact for one of the system administrators we have, and he was quite good about this, and he started figuring out where it came from…The computers, the way e-mail works, the computer that you sit in front of, and the Netscape session that this occurred from pointed to a particular PC in the lab. So he didn’t know it was R. Machado, but he knew it came from that machine. Then he was very resourceful and figured out who at the same time had logged into the computer running finger and whatnot, because he [Machado] didn’t have to do that, he could’ve just gone to Netscape, unaffiliated himself, unlogged in to any other accounts on the computers, and just run Netscape and we wouldn’t have known much more about it. But the fact that he was also logged on to the UNIX box at the same time, we put two and two together figured out it was that computer, and that ID–we call it the UCI net ID–of that person, sitting in that spot, with that name! (laugher) So at the point he [the employee] came upstairs and said "there’s someone down in here that’s sending hate-mail, sending mail of some sort" — so I’ll take a break here and describe something else…we have a policy like most universities who’ve run into any problems like this or anything much more minor than this, ah, a computer use policy.

C: Yeah, I was going to ask about that too.

S: And we have developed one from other universities’ that have developed, and what we’ve been hearing about lawsuits, what laws should be, etc, so we developed a policy about usage. It specifically says a variety of things–it may have been in fact in the documents you have, and it’s online, it hasn’t changed…

C: Yeah, I think I do have that…

S: And it basically says "Thou shalt not do certain things" or you’ll run into all sorts of problems. And we worked that out with our campus Dean of Students, as to–that’s our way of doing the Dean of Students’ work for these things–basically our equipment that we have…it’s up to us to decide what inappropriate use is, of the systems themselves, like someone running a program we don’t want them to, that we told them not to, but we also have the responsibility to work with the Dean of Students and the campus judicial sects when there are things that occur that go beyond that, like ah, public indecency--We’ve just been dealing with a case of public indecency in the laboratory, so that goes beyond campus to criminal law, so we have to, we help them with that job and they’ve assigned us the ability to do that job of, when someone does something wrong it’s equivalent to someone cheating on an exam or…ah…handing in somebody else’s homework, we basically could say "these are the penalties." So having said that, when the student came up and in fact talked to me first saying "someone’s sending me hate-mail, and I know who it is" we identified the system administrator and I’d gone down with him to point out where the person was. And at first I thought it was essentially just someone sending an, ah, annoying e-mail of some kind–"I don’t like you," you know or ah some poor language which is something part of our policy that is not allowed. Profane language, how’s that? I thought it was just profane language. And so, ah, at that point, I went with him and saw where the person was, and at that point, also other people had started coming upstairs and saying "I’m receiving this as well," and my boss at that point, Dana Roode and I went downstairs and Dana talked to Richard Machado and asked for his ID, and there’s a video tape of this because we have surveillance tapes…ah, asked him who he was, etc, and said, you know, "you’ve been using this equipment wrongly, breaking our computer use policy," — at that point neither one of us actually had read the e-mail. What we had heard was, you know, "using derogatory terms, sending bad-mail" or whatever. We didn’t actually sit down and read it. That was, in hindsight, one of our mistakes. We should have looked at it more carefully, but we basically told him to leave the building and he left. After that, the e-mail started getting around and over the weekend my boss read the e-mail in detail, Dana did, and on Monday morning we called the campus police.

C: Okay–that’s something we were confused about, because we knew that he been asked to leave on Friday and then nothing else…

S: Right, no one had really read the e-mail. It went by wild-fire over the weekend–people had received it and said "this is more serious"–in fact someone had talked to me, one of my staff, who’s background is Japanese-Hawaiian was very offended that this had occurred, and then we called the campus police. They then called the DA and it went from there.

C: Okay, so it was kind of just more that nobody understood how serious it was when it happened?

S: Yes, yes. The people who received it, ah, some of them didn’t pay much attention to it, some of them got very concerned. The person who had come to us first–it was one of our employees, and it wasn’t Liz–essentially just thought this was just within in reason or whatever. When the people who normally–ah, John Ward who was applying the policy and monitoring the usage at that time–by the time on Monday we all got together and realized it was much more serious. So the delay was over the weekend and the fact that we didn’t read the message. We get a lot of people saying "Yeah someone sent me mail with curse words in it," and that’s what it was assumed to have been. But when we actually read the threats–you know, "I’m gonna kill you," and the fact that he had sent it to 40 specific people, the details are important too, it wasn’t just sent to a newsgroups anonymously and whatever…

C: Yeah, he’d taken great care…

S: In hindsight, I never met him, but this was very foolish and stupid. He didn’t know what he was getting himself into at all. Then if you read the rest of the things that were going on in the community, I have to describe UCI a little bit–UCI is about 30-40% Asian-American or actually Asian nationals coming here for instruction. So there’s a large Asian contingent at the University. Orange County itself has a large Vietnamese ethnicity–several hundred thousand people–and a comparable size of other Asian cultures in the county. So it hit in an area where there was a lot of sensitivity to anything like this. So that caused campus and communities groups to get up in arms–the fact that it went to 60 people, and the local FBI got a hold of it very quickly, and it seems to us in hindsight that they were looking for, they had seen lots of hate-mail incidents in the LA area, and they were very attune to such things. This one was just unusual being an e-mail. So it basically mushroomed in a hurry! (laughter)

C: Yeah…Would you mind if I asked you a couple questions just about your procedure in general?

S: Sure.

C: So it sounds like there’s not really...ah…you don’t go to the Dean then?

S: Well, let’s say–let’s get a better example. Ah, we find out–we get a complaint that someone has received an e-mail from an account or an account seems to be in a weird state. So, we will then ask the person responsible to come here, or in e-mail, "did you send this e-mail?" — usually we ask them for an interview, and how we get them in an interview, we lock their account to get their attention, because they basically work with e-mail only. University students don’t usually give us access to their home phone numbers, we don’t use that information, so we use their e-mail account, locking it to get their attention, we have essentially what amounts to a hearing, to figure out what has occurred, and it’s to find out if something serious has occurred, like an account has been broken into…

C: Now is this a hearing within the computing…

S: Within, yes, with the system administrator and maybe a few staff at most here, acting as lieutenants to the Dean of Students. Our job is essentially to find out what did they do to the equipment that we’re responsible for? We often get people who will, say, share a password, and that’s a definite no-no. But they do it, you know…so we try to determine if it was something where they violated policy, or is it something more serious, like did someone break in, or did they break in? Based on that, we make a judgement, "Well, you shared your password, you should have known better, you didn’t read the rules" — We force them to read the rules when they log on–they can’t get an account unless they physically read it and answer a few questions. If it’s a sort of moderate level case like I said, with the password being shared, we say "well, no account access for two weeks" or something. If it’s more serious than that, then we advise the Dean of Students, and they’re usually, they’re pretty draconian of making people doing community service–they’re used to people stealing things. So they’re going one step before calling the police. Or they’ll call the police, and sometimes we’ll do it directly ourselves. But most of the time, it’s essentially an internal hearing, making sure they’ve read the policy, they understand, at the same time try to figure out exactly what the incidents were.

C: I think that sounds like a really beneficial procedure…

S: Well, there are still lots of pieces that people have difficulty with–universities have this problem–getting all the info out to all the students, that this is the responsibility, it’s not for free that they have a right to it, that they have responsibilities not to do a lot of things; people believe that anything’s okay on the web or an e-mail, and it’s not.

C: Right, that’s part of what we’re trying to target.

S: Yes. Not everything is okay, and a lot of things cross the boundary to criminal activities, and the FBI are very interested in such these days, and I think in the case of Machado, he had no clue. He added to his misery–they probably would have let him get off with some probation or whatnot, but he skipped bail, went to Mexico, they found him again as a fugitive, that added to his woes, but because now he was in jail, when they finally found him guilty, it was essentially "well, you serve time"–and we haven’t heard from him since! I don’t know what happened to him…Umm, it’s the worst case we’ve had in terms of dealing with, following this through, but we’ve had hacking incidents where we’ve traced it and had the police come in, students have been expelled–not many–but, people have been suspended, but…it’s equivalent on a college campus…the same thing as people cheating on tests, the worst cases you have…it’s very similar.

C: So policies and penalties are pretty case-specific then, right?

S: Well, we have a list, it’s not public, but it’s something we share with the Dean of Students and the people coming along, essentially a penal code as to what we do--

C: Oh, okay.

S: --and some of the things are just administrative–if we don’t want you to write a file in a particular area because it causes trouble, we tell you don’t do it, and if you do it once, it’s a warning…If you do it many times you’re not paying attention and we lock your account, take away privileges. So getting access is a privilege, not a right. The basic description that the Dean of Students will say–these are UCI rules–that, ah, once their students are admitted to the college, then they have rights like any other students to the various things on campus, unless they get themselves in a situation where they’re basically denied those privileges. If they break a rule that we set, it’s our responsibility to say "No, you don’t need this" — where it comes up very difficultly in an academic setting is more and more instructors are using the web and e-mail and whatnot to communicate with their students, and in those cases what it ends up being is students have been told they no longer have an account, and you need to tell your instructor ahead of time, and they’ll need to do something else.

C: So then, what is the liability for the NACS?

S: Well, you mean if they’re being sued by the people or something?

C: Yeah.

S: Well, again we’re representing the University and the policies we set, we have to be specific about writing the policies we use, and we have to follow a due process where we allow the student to say what’s going on…We have to communicate that to the Dean, so the Dean knows that’s what we decided upon, and that about covers it. The various things that we give out are not any kind of rights, as I said, the services we provide–in terms of something like the Machado case, we generally will just turn it all over to the campus police, and the Dean, who basically take it from there, so we’re representatives mostly to the Dean but not to the police dept., but it just goes off. So our liability is not necessarily to us identifying them, but the steps we have to take are that we’re not discriminating against them, that we’re applying the same rules to everyone, and that we’re stating what those rules are, and that’s what they sign-off at the beginning, saying "yes I have read this policy." Ah there’s one other thing–I talk too much, I need to let you ask some more questions–the other one that we’re trying to do is, we’ve sort of stream-lined this a bit, to make the people who actually investigate a lit more formal, with a penal code and a set of rules. In the past in was little bit more informal–the system administrator would write these things down, but they’d be like the only agent. They’d come to their manager if there was someone who wanted to talk to the management or something like that. The other thing that we’re doing that’s maybe kind of interesting and unique is, we realize a lot of these issues are minor. There are things like "even though I gave my friend my login," we’re worried more about it’s consequences more than the actual act. So we’ve set up what I’ve called a "Computer Traffic School," which is essentially–all the things that are minor we make the students go back and go through and read questions related to the computer use policy and answer them appropriately, or if they don’t, keep answering them until they get it right–so it forces them to sit down for maybe a half hour in our areas, going through this again.

C: I think that’s a really good, good idea.

S: Well, I think you’ve got to do that because most of them are in fact minor so you’re worried more about big things happening, but you want to make sure you educate people and you can’t just do things like "Oh, go read this, it’s over there"–they don’t. You’ve got to get them to sign something off–that’s where you get the liability issue as well–you said you read it.

C: You kind of touched on something I was going to ask, you said it’s kind of new, and I was just wondering how much or what in your policy has changed since the Machado case, like penalties and that sort of thing.

S: No, nothing since this is so far outside the range of it–there’s nothing that says "Thou shalt not send hate mail," anymore than it says "Thou shalt not be indecent in the lab"–right now we’re dealing with a situation where someone in the lab was indecent, probably even worse than that, but I’ll leave that to your imagination–and he went off to court and he was tried in court today and found guilty of doing various things in our labs that other students were seeing. Now that’s not something we’re going to write in our policy, you can’t violate the laws of the state of CA in the US penal codes, so we’re not writing down the worst case scenarios, and in the Machado case, there was really nothing to write down. The only thing it taught us is that these things can be more serious than at first, and doing things like reading the message or assuming that the message is of one kind when it could have been something else. And then part of the whole legal case was, is this just a normal flame or is this in fact hate-mail, or a criminal activity? And in fact the actual regulation is quite fascinating, that was used by the federal government on him was a law from 1968, or was it ’63?

C: Oh, I didn’t know that part.

S: Yeah, well the actual part that was used was that in the federal statues–and this comes back from the civil rights era–that no one will have the right to abridge the access of any citizen to public institutions of learning based on sex, race, creed, etc. And what they were saying essentially was that by scaring these students that there was somebody here willing to kill them was abridging their right to come to the University. So that this was a constitutional rights case. And that’s in fact what they tried him on. And that goes back to the 1960’s with the various black students being not allowed to go to Universities in Alabama, Louisiana, being barred by the governor. So it was in fact a very serious law, nothing minor, people were killed over this. So that’s what they had said that he was trying to provide fear and it wasn’t just a flame because he’d picked out particular people, he had looked to see if they were Asians, it wasn’t just a message in a newsgroup that was known for people flaming each other left and right and saying, you know , "I don’t like the Japanese," or "I don’t like the Romanians" and being very bland. This was "You particular, I’m gonna come and kill you," and that crossed that border, and that’s something that, you know, computer folks don’t spend much time on.

C: Right, and that’s another thing–I noticed that when they convicted him that it wasn’t at all, like you said, about anything having to do with e-mail, but something broader, and they applied that law to an e-mail case. I’ve done a lot of looking into laws about e-mail, but like you’re saying, there doesn’t seem to be a lot of concrete stuff about harassment or threats like this, do you know–

S: Yeah, that is in fact why the federal government and the FBI and the US DA were heavily involved in this and I think it went all the way to Janet Reno at some point–it was because they wanted to set law. They still continue to want to, in the justice dept., wants to set definitions.

C: But they haven’t, right?

S: Ah, well I wouldn’t know…I’m not a legal expert, but nothing has come to us. We have a campus e-mail policy now, a UC-wide policy, but it generally deals with things like, who has access to your e-mail if you’re an employee or a staff member. Those are more issues of access because they’re worried about liability again. The actual issue of freedom of speech, as far as I can tell, hasn’t really been defined much more. So what they were applying were existing rules to show that e-mail is no different. And essentially that’s what the sort of policy we follow in general–just because it’s an e-mail conversation of some sort, that’s no different than if it was a personal conversation. You know, that’s like if someone sends you regular mail and you open it up and it’s addressed to you and it says "I hate you, I’m gonna kill you," the post office wants to know. (laughter) So they’ll go and do things about it, and there’s a long tradition of regular mail and regular communication, so they wanted to set policy here that’s saying e-mail is no different. And as far as I can tell no one has made a counter-judgement, but I don’t think it’s gone like to the Supreme Court or anything but I don’t see why it would be judged any differently actually. There’s nothing really different about it–there’s this belief that the Internet is wide-open, but you still don’t go around and flander people or ah threaten them, that hasn’t changed. It’s just that there’s easier opportunity of telling a whole bunch of people through something like your website what you think. So the Machado case hasn’t really affected us, except internally of being more careful.

C: Yeah, sure–umm, one of the last things I was wondering about was that, we, just to understand it ourselves a little bit better we were trying to figure out a little more about his background and we haven’t found much and I was wondering if you knew of anything…

S: Umm, all we knew was what we knew from the registrar and the police–he’d been a student here a couple years already, the Orange County Register put a lot of effort into this and we spent a lot of time talking to their reporters and they’d spent a lot of time trying to figure out his background, why he’d do this, etc, so I’d aim you maybe in their…they have a website as well, I think it should be either ocr or ocregister but they have archives and whatnot. Their reporters there, I can’t remember their names, but they were around quite a bit. But the ah…what we knew from the papers essentially was that he’d been a student here, his grades had been failing a bit, he was depressed about a brother of his who was killed in some event, and those were the things he said in court that affected why he’d want to do this. As I said, the University has a large Asian contingent of students, there’s probably feelings of bigotry on both ends and obviously that came up and that’s why they thought this was a racially motivated hate crime, he picked on this group. This University is a little unusual it got a reputation in the early 60’s–it’s only been here since 1965–St. Olaf’s has been there a lot longer, I know that!–but ah, it’s not been here a long time, it got a reputation for being, ah, it was a new school, so it was less traditional than Berkeley or UCLA and it also started out more of an engineering school and but it isn’t really that way now, so people migrated through this area who were interested in computers and engineering and whatnot and, I don’t know if you want to attach any racial bias to that…and because the community too has a large Asian contingency, it’s not really that unusual for the county or California. So, I don’t know why he came to this University, what his major was…Don’t know what happened to him. It really was sad because he didn’t know what he was getting himself into, this was not a situation where this was developed for years, he wanted to use this as a sounding board for his views, he had apologized profusely in various public events that were staged by the campus to basically try to diffuse the situation, but then the federal government wanted to use this as an example and so the DA just followed along saying "yes, this was a crime."

C: Well, and I think that’s a good point to make, because we are trying to, especially for students, help them understand that exactly–that things like this happen and you don’t realize what you’re getting yourself into when you’re doing with it…

S: Yeah the way we describe the authorization part, the password and login, to students is "This is like your PIN on a credit card"–would you give this out to anybody? Your best friend could get on your account in a few minutes, send mail to the president of the US, saying you personally were gonna come and kill him, and the security would be here in minutes! (laughter) So you don’t want to identify yourself–to give them things like, it came from your account, with your name, your password, you don’t want to give them that. Because people do things like that, and this is no different–it’s not as open as they believe, there’s just as much responsibility as anything else. So that’s the most important thing I think I would tell anyone about this case or this in general is that, you have responsibilities to ah the same way you would do a variety of things for the same reasons for other mediums. It surely allows you to communicate quicker with large numbers of people in a variety of ways, but then there’s even more responsibility. It’s like SPAM–you can easily send mail to hundreds of thousands of people and you may thing "oh that’s no big deal," but then all the computers along the way have to process that, and that slows everybody down and they don’t get something important and it’s all because you played a joke and right now people are–commercial companies are suing people left and right that send huge amounts of SPAM and their winning cases. So there could be serious financial consequences for something as simple as that. A lot of responsibilities.

C: Yeah. Okay…

S: So good luck to ya!

C: Yeah, thanks! Is there anything I didn’t ask that you’d like to touch on–I think that pretty much covers what I had…

S: Umm, no I’d say look at our computer use policy, there are other universities that have them…If you wanted to look some more into this particular case, I’d contact the Orange County Register Newspaper–either ocr or ocregister.com–or use some search engine.

C: Oh great.

S: They’d go into a lot more detail, and in fact maybe even a reporter could talk to you about it. Ah, Dana Roode my boss is out of town for about a week. What he would add to it maybe is his personal interaction because he had to testify and give information. He had dealt with the media–they descended on us like nuts from all over the country. And John Ward would be able to tell you more about the specifics–he’s not back ‘till Monday. You can find all our phone numbers and e-mail on our webpage, so…

C: Okay, well, thank you so much — you’ve been incredibly helpful.

S: Sure well good luck to you–when you write something up tell me about it, love to see what you said.

C: Yes, I will transcribe this too and send it to you on e-mail.

S: Oh okay! Good luck!

C: Thank you

S: Bye-bye.

C: Bu-bye.

General Tools

Case Materials

Site Home