Text File

RISKS-LIST: RISKS-FORUM Digest Monday, 1 February 1988 Volume 6 : Issue 19

FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Contents: No Time like the Present for Old Timers (Scott Dorsey) More software future shock (William Smith) TV Remote controls (Richard Dervan) Hertz Computer Hertz Repairees (Dave Wortman) Blowing Whistles or Blowing Smoke? (Guthery) Your SideKick may not be on your Side! (Scott M. Martucci) Re: Library Privacy -- the backup system (David Collier-Brown) Virus anxiety expressed in NY TIMES (Jon Jacky) Re: A feedback loop in tax preparation algorithms (Les Earnest)

The RISKS Forum is moderated. Contributions should be relevant, sound, in good taste, objective, coherent, concise, nonrepetitious. Diversity is welcome. Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM. > > > > > > > > > PLEASE LIST SUBJECT in SUBJECT: LINE. < < < < < < < < < For Vol i issue j, FTP SRI.COM, CD STRIPE:<RISKS>, GET RISKS-i.j. Volume summaries in (i, max j) = (1,46),(2,57),(3,92),(4,97),(5,85).

----------------------------------------------------------------------

Date: Fri, 29 Jan 88 22:59:50 EST From: kludge@pyr.gatech.edu (Scott Dorsey) Subject: No Time like the Present for Old Timers (Re: RISKS-6.16)

In Risks 6.16, John McLeod from Right Here at Tech writes: >I was told by a professor recently that Nobody should have any money in a >bank between december 31 1999 and jan 1 2001. As there are so many >cobol programs in existence with a two character year field.

I worked at one point for a mental hospital which had a lot of long-term patients. The patient's year of birth was represented as a 2-digit number, and any patients with negative ages (who had been born before 1900) had 100 added to their age whever ages were calculated. This worked quite well for several years, until one of the patients in the geriatric unit passed age 100. Now anyone who is less than 10 years old is assumed to be a rollover, as there were no patients under 14 years of age at the time the patch was made.

Scott Dorsey Kaptain_Kludge SnailMail: ICS Programming Lab, Georgia Tech, Box 36681, Atlanta, Georgia 30332 uucp: ...!{decvax,hplabs,ihnp4,linus,rutgers,seismo}!gatech!gitpyr!kludge

------------------------------

Date: Sat, 30 Jan 88 00:24:27 CST From: wsmith@b.cs.uiuc.edu (William Smith) Subject: More software future shock

If you aren't tired of problems with regards to time functions, here is another:

In the version of Ultrix from 2 years ago, ctime() returned garbage characters in the year field if the date was past the year 1999. I haven't used that system for 2 years, so the bug may have been fixed by now, but I wouldn't bet on that.

Bill Smith, wsmith@a.cs.uiuc.edu, pur-ee!uiucdcs!wsmith

------------------------------

From: ccoprrd@pyr.gatech.edu (Richard Dervan) Date: Sun, 31 Jan 88 12:44:45 EST Subject: TV Remote controls

> ... great possibilities for unscrupulous TV station programmers...

Well, this is possible, but how are you going to know which frequency or harmonic to include in your commercials? What might change one TV to the channel the commercial is being broadcast on, might change another TV to a different channel. I have never known of a standard for sonic remote controls. -Richard Dervan

Richard B Dervan - Office of Computing Services | Go you fuzzy | Georgia Insitute of Technology, Atlanta Georgia, 30332 | Bees | uucp: ...!{akgua,allegra,amd,hplabs,ihnp4,seismo}!gatech!gitpyr!ccoprrd ARPA: ccoprrd@pyr.gatech.edu BitNet: ccoprrd@gitnve2.gatech.edu

------------------------------

Date: Sun, 31 Jan 88 18:26:16 EST From: Dave Wortman <dw%csri.toronto.edu@RELAY.CS.NET> Subject: Hertz Computer Hertz Repairees

Last week the NY Times Service reported that Hertz Corp is cooperating with the Justice Dept in an investigation of allegations that Hertz fraudulently overcharged customers who damaged rental cars and were liable for repair charges. Hertz apparently bought repair parts and services at discount rates but billed customers and insurance companies at a higher rate. Hertz has already issued refunds of about $3M and it is estimated that they may have collected $13M through these questionable practices.

Hertz's computers were in on the fraud. In some parts of the U.S., company computers generated two estimates, one for the actual repairs and one with higher prices which was sent to customers and insurers.

Dave Wortman, Computer Systems Research Institute, University of Toronto

------------------------------

Date: Mon, 1 Feb 88 06:36 EDT From: "guthery%asc@sdr.slb.com" <GUTHERY%asc.sdr.slb.com@RELAY.CS.NET> Subject: Blowing Whistles or Blowing Smoke?

I agree with Nancy Leveson and have argued previously that the quality of our systems won't improve until we are willing to accept personal and financial responsibility for that quality. However, I seriously question the contribution of whistle blowing to this process.

First, it seems to me that the very last thing a whistle blower is interested in is accepting responsibility. What a whistle blower is saying to me is "Something is wrong here and rather than fix it and risk being held even partially responsible, I'll make sure I'm perceived as being wholly blameless by being a really Good Person and blowing this whistle and pointing my finger at everybody else in sight". In other words, encouraging whistle blowing provides a DISINCENTIVE to the acceptance of personal responsibility and accountability. Do you want to risk your family's financial security to a guy who's going to start lobbing fault grenades at the first sign of difficulty or something unexpected?

Secondly, while I certainly haven't compiled a definitive body of cases, it always seems that most whistle blowing has to do with how the papers where shuffled and the most predictable aftereffect of whistle blowing is still more bureaucracy. Now anyone who thinks that bureaucracies are good at engendering a sense of personal responsbility hasn't dropped by City Hall and tried to explain that the car was in the garage when the ticket was issued. And anyone who thinks that bureaucracies build safe, reliable compuer systems should visit the Social Security Administration's data processing center or their favorite nuclear reactor project.

I don't think we know enough about building computer systems to build good systems without making mistakes. Indeed, it is exactly the process of making mistakes that will teach us how to build good ones and avoid building bad ones. Whistle blowers would deny us this learning and condem us to building with our current and quite incomplete state of knowledge. In the main, they are 20th century Luddites blowing smoke not whistles.

------------------------------

Date: Mon, 1 Feb 88 14:29 EST From: "Scott M. Martucci" <Martucci@DOCKMASTER.ARPA> Subject: Your SideKick may not be on your Side!

While using the calculator option on SideKick, an error was discovered in a particular calculation. The simple division of 25963 by 25454 resulted in 1.014 (The actual answer is approximately 1.02). After calculating variations on the two numbers (i.e., dividing each by 10) and performing the division, the correct answer was displayed for that division. Other numbers in the range of the original numbers were used with no problems. I don't believe this problem is isolated to a particular version, as two different versions were tested with the same results. Scott

------------------------------

From: daveb@geac.uucp.fri.jan.29.08.12.37.1988 From: geac!daveb@uunet.UU.NET (David Collier-Brown) Subject: Re: Library Privacy -- the backup system (Michael Wagner, RISKS-6.10) Date: 29 Jan 88 13:12:35 GMT

To my (slight) surprise, the Geac library systems used worldwide provides considerable protection against undesirable recreation of data from backup tapes.

As it happens, the material on the tapes are images of bit-aligned, n-bit-character, variable-length-pointer information.

To read them one needs either: 1) a very good understanding of the system storage compression mechanisms, or 2) an unused library to use to restore each backup, run your searches and then go on to the next backup.

The net result is that trying to get around the normal security protection against linking from patron to returned books may take an arbitrarily long time and arbitrary amounts of a scarce resource.

It is trivially true that any backup system can "be (mis)used to recreate the data in other situations", even if one is running a B2 Multics machine. One can, however, make it impractical.

dave (as much by good luck as by good management) collier-brown

David Collier-Brown. {mnetor yunexus utgpu}!geac!daveb Geac Computers International Inc., | Computer Science loses its 350 Steelcase Road,Markham, Ontario, | memory (if not its mind) CANADA, L3R 1B3 (416) 475-0525 x3279 | every 6 months.

------------------------------

From: jon@june.cs.washington.edu (Jon Jacky) Subject: Virus anxiety expressed in NY TIMES Date: Sun, 31 Jan 88 18:56:10 PST

There is a big story on the front page of the business section (section 3) of the Sunday, Jan 31, 1987 NEW YORK TIMES: "Computer systems under seige," by Vin McLellan. Most of the incidents reported there will be familiar to RISKS readers, but what is notable is the prominence given the article, and the interest and worry apparently abroad. In particular, there is a lot of concern about the political and military implications. The story comes with a big illustration of a centipede-like critter seated typing at a PC, surrounded by a sea of PC's, each screen displaying an illustration of that same creature. Some excerpts (my comments in parentheses):

"The dangers of viruses and some of these other computer attacks are just unbelievable," says Donald Latham, executive vice president of the Computer Sciences Corporation and former Assistant Secretary of Defense who ran a Reagan Administration program to increase security in civilian and government computer systems. "The threat is more serious than most people think; no one can say enough about it."

(Latham was chief of C3I at the Pentagon, and was always testifying to Congress about command and control of nuclear forces, launch-on-warning, and things like that.)

(There is the interesting news that the Israeli virus might have been politically motivated: )

"One of the most troubling reports has come from Israel, where an infectious virus code was spread widely over a two-month period last fall and was apparently intended as a weapon of political protest. The code contained a "time bomb" that on Friday, May 13, 1988, would have caused infected programs to erase all stored files, according to Yuval Rakavy, a student at Hebrew University who first discovered, then dismantled the virus code. May 13 will be the 40th anniversary of the last day Palestine existed as a political entity; Israel declared its independence on May 14, 1948. ... Israeli officials suggested a "Friday the 13th" coincidence, but Mr. Rakavy said the virus was coded to ignore Nov. 13, 1987."

"Concern about the viruses has spread well beyond the computer industry. Officials at several affected colleges said they had been contacted by a representative of the National Security Agency, the Pentagon agency responsible for the security of classified Government computer systems and electronic spying abroad, and asked for details about viral codes. Since 1985, the NSA and various military groups have sponsored several unpublicized and often-classifies conferences about risks of virus attacks at Government computer installations."

"Digital Dispatch Inc. of Minneapolis ... developed Data Physician, which identifies and removes viruses on IBM PC and Unix systems. Since 1985 it has sold 500 copies, over half to American military buyers. ... 'We would have dropped it long ago if we didn't get a couple calls from US military sites every month, urging us to keep it available," (a company spokesperson) said.'"

- Jon Jacky, University of Washington

[Vin McLellan actually sent me the whole text on line BEFORE it appeared (THANKS!), and several others sent me the text as it appeared. There is enough repetition with previous issues that I decided to go with Jon's abridgement. But, for those of you who missed it, the entire text is also available for FTPers as RISKS-6.19V. PGN]

------------------------------

Date: 01 Feb 88 0450 PST From: Les Earnest <LES@SAIL.Stanford.EDU> Subject: re: A feedback loop in tax preparation algorithms

[In response to RISKS Wednesday, 27 January 1988 Volume 6 : Issue 16]

Lawrence Bernstein of the S.F. Chronicle, author of the tax article you cite, seems to have confused himself -- the alleged recursion in the tax forms does not exist. While there _is_ a coupling between state and federal tax payments for those who itemize their federal deductions, the task of determining the optimum payment strategy involves no recursive calculations.

In fact, there has been no structural change in the relationship between California and federal tax calculations this year or any recent year, other than knocking out some deductions and fiddling some tax rates. There is no basis for claiming that the basic structure of this calculation has changed.

Given that state income tax payments made during the tax year can be deducted from federal income, there _is_ a degree of freedom that you can fiddle within limits, namely the amount of state tax that you choose to pay during the year. If you choose to leave that quantity "free," then your tax calculations are not recursive, they are undefined! In order to resolve how much to pay, you must choose a financial objective.

Suppose that your goal is to exactly pay both the state and federal taxes that you will owe by the end of the tax year. In this case you should use the following procedure:

1. Shortly before the end of the tax year, estimate the state taxes that you will owe and adjust your state withholding payments to meet this goal.

2. Taking into account the state tax payments determined in step 1, compute the federal tax that you will owe and adjust your federal withholding rate to meet this goal.

While the income tax forms of California and some other states use numbers from the federal tax form, such as adjusted gross income, in no case does the amount of the state tax depend on the amount of federal tax owed or paid in the current year. In other words, there is no recursion in this calculation.

While some people feel good about paying their taxes as exactly as possible by the end of the year, most people prefer a strategy that maximizes net income. Taking into account the value of money (i.e. the value of hanging onto it as long as possible and investing it so as to realize additional income), the following tax payment strategy is optimum for those who do NOT itemize deductions on their federal tax.

1. At the beginning of the tax year, set both your state and federal withholding rates as low as legally permissible.

2. Near the end of the year, estimate what you will owe in state and federal taxes and arrange to underpay these amounts by the maximum amounts that do not incur penalties. If adjusting the withholding rates is insufficient for this purpose, you may arrange to give your employer a supplementary payment, to be deposited with your withholding payments.

3. After the end of the tax year, calculate the taxes you owe and pay them as late as permissible (usually April 15).

The optimum strategy for those who itemize deductions on their federal taxes is the same as above as far as federal tax payments are concerned, but the right strategy for state tax payments at the end of the year may be different because of the deductibility of these taxes.

To my surprise (and contrary to professional advice that I have received), the optimum strategy for most people who itemize their federal deductions is to either substantially overpay their state tax just before the end of the year or to substantially underpay it. In the case where overpayment wins, it is because the interest that they must pay (or give up) on the overpayment during the two months or so that it takes to get a refund from the state is more than offset by the fact that they effectively postpone part of their federal tax obligation into the following year and can thereby earn interest on that saving for about a year. In cases where this situation reverses, underpayment is the best strategy. Interestingly enought, paying exactly the right state tax by the end of the year is almost never optimal!

The balance of this note gives a slightly deeper explanation of how itemizers may optimize their state tax payments.

[It is less relevant to RISKS, but interesting enough in its own right. PGN]

Because of the deductability of state income tax, the federal taxes owed by a given individual in a given year can be expressed as a piecewise linear function of the amount of state taxes paid during the year. For example, if X is the amount of overpayment of state taxes during the tax year (negative if you underpay), then for moderate values of X (i.e. values that do not change your federal tax bracket) the amount of federal taxes that you will owe is exactly T = F - r*X (1) where F is the amount of federal taxes you would pay if your state tax payments exactly matched what you owed the state for the year and r is the income tax rate for your federal tax bracket.

Using (1), it can be shown that the formula for net income (i.e. income less state and federal taxes, taking into account the cost in interest paid or made) can be expressed in the form I = A + B*X if X > 0 (2a) or I = A + C*X if X <= 0 (2b) where A, B, and C are essentially constants for a given individual in a given year. Here, A depends on income and available deductions, while B and C depend on the individual's federal tax rate in the current year and the next one, interest rates for lending or borrowing money, and the timing of state and federal tax filings. The main reason why there are two formulas (i.e. the reason the value of C is different from B) is that the timing of refunds is different from final tax payments and borrowing and lending interest rates may be different. Calculating personal values of A, B, and C is left as an exercise for the reader.

It an be seen from (2) that if both B and C are positive, you will increase your net income by increasing your state tax overpayment, X. Inasmuch as large overpayments of state tax may lower your federal tax bracket, how far you can go advantageously may involve calculations in more than one tax bracket.

If both B and C are negative, you will increase your net income by underpaying your state tax as much as possible. In this case, how far you should go depends on the state schedule of penalties for underpayments.

If B is positive and C is negative, the best strategy may be to either overpay or underpay -- you have to evaluate both. In the opposite case (B negative and C positive), the optimum strategy will be to pay your estimated state taxes exactly (no over- or under-payment).

To facilitate making sample calculations, let us make some simplifying assumptions: (a) lending and borrowing interest rates are the same (e.g. you have a savings account with fixed interest rate that you can push money into and out of), (b) your marginal tax rates will be same next year as this year, (c) you always underpay federal taxes and settle up as late as possible (i.e. you follow the optimum strategy). Then using a simple interest rate model, it can be shown that B = i*(r*Y - R) (3a) C = i*(r*Y - P) (3b) where i is the interest rate that you pay or get, r is your federal tax rate, Y is the length of time you get to keep postponed federal tax payments, namely one year, R is the length of time you must wait for a state tax refund, typically about 1/6 year (2 months). P is the length of time you can wait to make final payment of state taxes, namely 3.5/12 = .29166 year.

Suppose that your federal tax rate r is 15%; then using Y = 1, R = 1/6, and P = .29166, we get B = -.0166*i and C = - .14166*i. It follows that the best strategy is to underpay the state tax, no matter what interest rate i you use.

If your federal tax rate is 35%, then the situation reverses and it becomes advantageous to overpay. In fact the higher your tax bracket, the more advantageous overpayment becomes. This strategy is also more likely to be favorable if next year's federal tax bracket will be lower than your current one, as is true for many people at present.

Note that since P > R in the situation examined here, it follows that if B is negative then C is even more negative. From the analysis above, it follows that it never pays to pay your state taxes exactly by the end of the year -- you should always either over- or under-pay them!

Les Earnest

Disclaimer: I am not a tax consultant, so don't take my advice without verifying it with someone having credentials. Unfortunately, you may have to shop a bit before you find someone who understands the issues.

[I hope this shoots the straw herring in midstream. Thanks. PGN]

------------------------------

End of RISKS-FORUM Digest ************************