Web Security and Commerce

Preface

In the early morning hours of Saturday, August 17, 1996, a computer system at the U.S. Department of Justice was attacked. The target of the attack was the Department of Justice’s web server, www.usdoj.gov. The attackers compromised the server’s security and modified its home page—adding swastikas, obscene pictures, and a diatribe against the Communications Decency Act (which, ironically, had recently been declared unconstitutional by a federal court in Philadelphia).

The defaced web site was on the Internet for hours, until FBI technicians discovered the attack and pulled the plug. For the rest of the weekend, people trying to access the Department’s home page saw nothing, because Justice didn’t have a spare server.

The defaced web server publicly embarrassed the Department of Justice on national radio, TV, and in the nation’s newspapers. The Department later admitted that it had not paid much attention to the security of its web server because the server didn’t contain any sensitive information. After all, the web server was simply filled with publicly available information about the Department itself; it didn’t have sensitive information about ongoing investigations.

By getting on the Web, the Department of Justice had taken advantage of a revolutionary new means of distributing information to the public—a system that lowers costs while simultaneously making information more useful and more accessible. But after the attack, it became painfully clear that the information ...