ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator
END OF VOLUME 18 Computer model blamed for $83 Million loss Greenwich Mean Time just changed by one hour GPS glider pilot confused Printing with different resolutions in MS Word 7.0 Re: Crackers Obtained Gulf War Military Secrets Millennium Bug: latest sighting Re: More Y2K Cost Estimations Re: Risks Associated with the Year 2000 Problem Y2K: the revenge of originality / reserved words in Cobol Re: Retiring hardware after Y2K Y2K risks and Cobol The unique risks related to Y2K Info on RISKS (comp.risks)
END OF VOLUME 18The end-volume issue (RISKS-18.97) is available on the ftp site as risks-18.00 in the main directory, and is now also in the new subdirectory 18 as both risks-18.00 and risks-18.97 -- along with the rest of volume 18.
Computer model blamed for $83 Million lossThe *Wall Street Journal*, 28 March 1997, reports that the derivatives trading unit of Bank of Tokyo-Mitsubishi Bank Ltd. has incurred an loss of $83 Million as a result of a computer model that overvalued a portfolio. The problem came to light last summer, when the model was revised. Another model-related loss, $139 Million by National Westminster Bank PLC is also mentioned. The article points out the risks of increasingly complicated derivatives portfolios, which are so complex that traders have no choice but to use computer-based models to evaluate them. But other sources point out that the real risks are the old familiar ones of trusting the computer too much. Thomas Coleman of TMG Financial Products Inc. says, "I've never seen an options model which, when used for the things it was meant to do by people who understood it, has caused a $50 million to $100 Million problem." George C. Kaplan gckaplan@cea.berkeley.edu 510-643-5651
Greenwich Mean Time just changed by one hourOn my Linux machines, I keep the hardware clock on Universal time to avoid time-zone problems. One machine is used for both Linux and MS Win95, so I set the Win95 time zone to "Greenwich Mean Time". At least that's what the map on the Control Panel called it. I'm in the U.S.A. Central time zone, six time zones west of Greenwich. This morning, Monday 31 March 1997, Win95 reported the time had been changed due to Daylight Savings Time. DST doesn't begin in the USA until next Sunday, and I see that I had left the "Adjust for DST" checkbox set on the Win95 Control Panel. I then checked and apparently British Summer Time did indeed start yesterday in England. http://www.greenwich2000.com/timefaqs.htm But Win95 still labels that time zone as GMT, not BST. If you're trying to use Universal time on Win95, check your clocks today. [http typo fixed in archive copy. PGN]
GPS glider pilot confusedWell, our club has now met its first lost pilot who was flying on GPS "lead and follow" when his box went wrong: At our airfield, GPS needs a "watch out for parachutists" function too; Although one might argue that this is not a risk of having the navigational aid, but of using it to the exclusion of all else, the truth is that at our sort of height none of the navigation methods are perfect - maps plus turning points are not that easy to cope with - so the lure of GPS will be hard to resist. When height-capable GPS-based devices begin to drive map displays and provide warnings, there will be real problems if such laptop or instrument-panel-mounted "aids" ever fail. I'm sure gliding clubs will make rules regarding GPS, however will the GPS device manufacturers consider the uses to which their products are being put?. When you buy quack medicines in a pharmacy, there is (in the UK at least...) a warning to "consult your doctor if symptoms get worse" - perhaps there should be a warning on GPS systems to learn navigation before you depend too much on this aid?. Phil Overy Computer security officer RAL, CLRC, UK tel (44) (0)1235 (44) 5834
Printing with different resolutions in MS Word 7.0This story could be interesting for comp.risks-readers. Please note, that it isn't a Y2K-problem :-) I recently installed a new HP LaserJet printer in my father's law office. As most new laser printers it is capable of printing with a 600dpi resolution. One of our secretaries has her own printer connected to her workstation. This printer is an older LaserJet model and has only 300 dpi resolution. Sometimes she prints on her small printer and sometimes (especially longer and double- sided documents) on the new printer. We use Win95 and Word 7.0. After about a week she told me, that the printout sometimes differs a lot between the two printers. It happens quite often that some lines in our documents contain only a few words and the rest of the line is filled with dots or dashes. She knows about the possibility to set tabs with filling characters but doesn't want to use it. So she makes loads of dots and dashes in these lines manually. It happened, that these lines were printed different on the two printers. The printout on her small printer was always correct, but when she switched to the other printer the last dot or dash of the line jumped to the next line and so sometimes changed the whole page. I found out, that this behaviour didn't occur when I set the new printer back to 300dpi resolution (the same resolution the old printer has). I think the problem lies in the "GetTextWidth"-function in the Windows API or the way Microsoft Word uses it. This function returns the number of dots a character (or textstring) needs as an integer value and therefore is only a coarse approximation of the correct value. If the function is called for each character in the line separately a possible rounding error gets multiplied. And I think this happened in our case. Word calculated different textlengths for the same text on different printers. The risks? Sometimes single pages of the documents are printed selectively because of typos or new data. The above mentioned error could have lead to a change in the page layout, maybe moving important parts of the document to another page not included in the new printout. I don't want to imagine the effects :-( I hope this message lets some people take a closer look at their printed documents. Thiemo Sammern, St. Lorenz 444, 5310 Mondsee, Austria-Europe +43/6232/54006 tsamm@ping.at http://members.ping.at/tsamm
Re: Crackers Obtained Gulf War Military Secrets (RISKS-18.94,95)The recent set of news articles and net postings are the result of an interview with BBC late in January 1997 in London. BBC was trying to do a story on breakins into banks in London. They persuaded me to supplement the content with an example of what could happen if security is lax in another arena---the military. I shared with the interviewer, Riccardo Pollack, an account of breakins into U.S. military computers during Operation Desert Shield/Desert Storm. What I told him was that I headed the U.S. Department of Energy's Computer Incident Advisory Capability (CIAC) (which I founded and kept going for 3.5 years despite working in an extremely adverse political and managerial environment that ultimately caused the entire team with the exception of one part-time person to quit). The AP news story that followed somehow distorted this by claiming that I was the head of computer security for the Department of Energy. Actually, I had responsibility for running the CIAC team and for developing the team's procedures and operations was clearly mine -- as the project manager. Second, the AP news story quotes me as saying that top-secret information was stolen. This assertion is totally inaccurate. I would say, however, that a considerable amount of information that was not designated with any sensitivity labels was stolen from U.S. military computers. The fact that so much sensitive/critical information was stored on computers that were so easy to reach and break into is beyond all comprehension. What was perhaps worse, however, was that the U.S. Government didn't really deal with the incidents very well at all. Turf wars between agencies (as well as within LLNL) were a constant problem, for example, and nobody within the Government really seemed to have jurisdiction over the case. One of the main FBI players at one point told all other incident-response teams who were producing information about the attacks to "butt out" because he wanted to work only with the one particular response team he favored. One of the Government agencies ordered that a computer that was being used very productively to monitor the intruders be shut down to avoid further trouble, even though the compromised computer was not a sensitive one. In short, the whole situation was a real "three-ring circus." Some day I hope to document the whole fiasco. Meanwhile, I have already provided a lot of details in my Congressional testimony in November 1991 and also in a paper published in the Proceedings of the 1993 Department of Energy Computer Security Group Workshop. I'd like to help more by providing more information, but I'm off on a three-week consulting stint overseas. Again, I'd encourage those who have so greatly contributed to the confusion surrounding the BBC documentary to simply purchase the tape (videotapes are now publically available) and find out what was really said. Gene Schultz, Program Manager, SRI Consulting
Millennium Bug: latest sighting