2003 IMTA Proceedings - International Military Testing Association

In about 60% of these recorded events the offender demonstrated malicious
or criminal intent.
Not withstanding this fact, nearly 30% are not motivated by malice. Too often, as
in the previous case, an offender has a sense of ownership of a system that leads him to
believe that he can use it for personal gain or convenience and, in doing so, will neither
be criticized nor jeopardize the integrity of the government system. In these cases there
appears to be no intent to damage or destroy the system or to seek revenge on another
employee. Approximately a third of the events in the Insider Events Database fall into
this category. At one U.S. facility in Korea, for example, four service members actually
set up their own business web site on the government server, apparently thinking that no
harm would be done.
However, in some cases non-malicious behavior can result in serious trouble for
the offender. One example is the case of Michael Scott Moody, who at the time of the
offense was an Airman First Class with 90th Fighter Squadron, Elmendorf, Alaska. 2 In
November, 1998, information was received from the Air Force Communication
Emergency Response Team (AFCERT) that two computers at Elmendorf Air Force Base
had been illegally accessed. The intrusion was traced to a home computer owned by
Moody who had set up NetBus 3 on two workstations in his office so that he could operate
them remotely. A search of his personal computer revealed evidence of hacking, software
piracy, and possession of child pornography. In May, 1999, Moody was discharged from
the service so that he could face charges in a Federal court. He pleaded guilty to illegal
access to government computers and possession of child pornography. Moody was
sentenced to 10 month in prison.
According to a media account of the trial, Moody told the judge, “Honestly, at the
time, I didn’t consider it hacking. I thought of it more as a prank…I was curious to know
if I could access the computer at work. Being a government computer, I considered it a
challenge. I worked. I didn’t mean to hurt no one” (“Hacker gets time,” 1999)
As is often the case, the accused claimed to have been wrongly misled by chatroom
acquaintances who not only sent him child pornography but provided him with
NetBus software over the Internet. However, once the software was installed by Moody,
it allowed anyone with the knowledge of NetBus to access the Elmendorf AFB
computers, which contained personnel records and maintenance records for an F-15
squadron.
2
This case summary has been developed from numerous media reports published at the
time of Moody’s arrest.
3
NetBus is one of several software systems that permits control of a workstation from a
remote location. It may have legitimate uses, but its illicit use as a Trojan horse requires
the loading of a program on a targeted workstation usually via an attachment to an email
message. The unwitting user of the workstation is unaware that by opening the
attachment NetBus is loaded and the system made available to the remote intruder.
Hackers usually send NetBus to unsuspecting computer owners by e-mail and disguise it
in the attachment of a computer game or graphic file.
291
45 th Annual Conference of the International Military Testing Association
Pensacola, Florida, 3-6 November 2003