The U.S. Senate on Feb. 24 approved a bill that would give prosecutors powerful new tools to fight child pornographers. The bill aims to help authorities track down internet pedophiles while avoiding free-speech concerns that toppled a similar law last year.

The measure makes it harder for producers of computer-generated child pornography to evade prosecution, creates new crimes aimed at those who would entice minors into sexual activity, and requires greater proof from pornographers that they are not using children.

“We have a compelling interest in protecting our children from harm,” said Senate Judiciary Committee Chairman Orrin Hatch, R-Utah, who sponsored the bill along with the panel’s top Democrat, Patrick Leahy of Vermont. “The ‘Protect Act’ strikes a necessary balance between this goal and the First Amendment.”

The Senate bill, which passed on an 84-0 vote, grew out of a Supreme Court ruling last April that struck down most of a 1996 law to ban “virtual,” or computer-generated, child pornography. The court, in its 6-3 decision, said the law was unconstitutionally vague and overreaching because it prohibited images that only appeared to, but did not actually, depict children engaged in sex.

The Hatch-Leahy bill was written with that decision in mind, and the Bush administration said it strongly supports the revisions. Passage “would be an important step in protecting children from abuse by ensuring effective child pornography prosecutions,” a White House statement said.

There was no indication how quickly the measure would be taken up in the House.

Child pornography has become more widely available in recent years as pedophiles worldwide sign up for internet chat groups and visit web sites featuring child porn.

Specifically, the bill prohibits the pandering or solicitation of anything represented to be obscene child pornography. Responding to the court ruling, it requires the government to prove beyond a reasonable doubt that a person intended others to believe the material was obscene child pornography.

The bill also plugs a loophole where pornographers could avoid prosecution by claiming that their sexually explicit material was computer-generated and involved no real children. Under an “affirmative defense” provision, the defendant would be required to prove that real children were not a part of the production.

The bill narrows the definition of “sexually explicit conduct” for prosecutions of computer-created child pornography and requires people who produce sexually explicit material to keep more extensive records so that they can prove that minors were not used in making it.

It also creates a new crime—the use of child pornography by sexual predators to entice minors to engage in sexual activity or the production of new child pornography—and increases penalties for child pornographers.

Still, Leahy said he was worried that some provisions of the bill would be challenged in court. “The last thing we want to do is to create years of legal limbo for our nation’s children,” he said.

Leahy mentioned language that would allow prosecution of anyone who “presented” a movie intended to cause another person to believe that a minor was engaging in sexually explicit conduct. By that definition, he said, a movie theater presenting the movies Romeo and Juliet or American Beauty would be guilty of a felony.

Youthful sexuality is a venerable theme in art, from Shakespeare to Academy Award-winning movies, the Supreme Court ruled in striking down key provisions of the 1996 law. That law would call into question legitimate educational, scientific, or artistic depictions of youthful sex, Justice Anthony M. Kennedy wrote in the majority opinion.

Another section of the 1996 law was not challenged and remains in effect. It bans prurient computer alteration of innocent images of children, such as the grafting of a child’s school picture onto a naked body.

Bill Lyon of the Free Speech Coalition, an adult entertainment trade group that challenged the 1996 law, said the Hatch-Leahy bill appeared “much more confined to the specific area of child pornography.” The original bill, he said, “went way beyond protecting kids and was really a covert attempt to destroy the entire adult entertainment industry.”

The Senate bill is S. 151.

Links:

Sen. Orrin Hatch
http://hatch.senate.gov

Sen. Patrick Leahy
http://Leahy.senate.gov

After a two-week delay, a federal computer system designed to track international students in the United States went online Feb. 15, despite lingering concerns.

Reaction among foreign students has been mixed, and some critics have complained the program is too intrusive. Even the program’s supporters say the electronic tracking system has loopholes that could allow foreign students to escape detection.

The internet-based system—called the Student Exchange Visitor Information System, or SEVIS—was announced in May 2002 by U.S. Attorney General John Ashcroft.

The system links U.S. consulates with every immigration port of entry and all 74,000 educational institutions eligible to host foreign students.

SEVIS is meant to be a faster-moving version of long-standing procedures that require colleges to monitor the academic status and addresses of foreign students. Elementary and secondary schools do not participate in the program.

Instead of maintaining the files on campus, SEVIS requires colleges to forward this information to a national computer database. The program actually was authorized in 1996, but implementation gained momentum in the wake of the Sept. 11 terrorist attacks. Some of the terrorists entered the country on student visas.

Chris Bentley, a spokesman for the Immigration and Naturalization Service (INS), said 3,907 colleges and universities were ready to participate when SEVIS went live, and 1,941 more have applications pending. Originally scheduled to be operational on Jan. 30, INS delayed the rollout to resolve last-minute problems with the system and to allow the participation of more schools.

Colleges lacking INS approval to participate in the system will be prohibited from enrolling new foreign students.

Schools must notify the INS if an international student fails to enroll or is arrested. Students are responsible for reporting status changes—such as a new address—to their respective schools. The INS may share its data with the Department of Homeland Security, the FBI, and the Central Intelligence Agency.

“If it works seamlessly, the foreign students shouldn’t know it even exists, unless a fee is imposed to finance SEVIS,” said Victor Johnson, the executive director of the National Association of Foreign Student Advisers.

“It’s information they’ve already supplied to international offices anyway,” he said.

Bentley said foreign students will not be penalized for system glitches or reporting delays from colleges.

“As for individuals who do something to jeopardize their immigration status, yes, they could be held accountable for that,” he said. Penalties include deportation.

Michael Ivy, the director of International Programs Information Technology at Purdue University in West Lafayette, Ind., said the school’s 5,015 international students participated in the SEVIS program without hesitation.

“We have had some curiosity, but we’ve assured them that we’ve done everything we could to protect their privacy,” Ivy said.

Jun Yoshizaki, a doctoral student and president of the Japanese Scholar and Student Association at North Carolina State University, said foreign students have accepted SEVIS as a condition for attending college in the United States.

“The people in this country are more sensitive about those things,” said Yoshizaki.

But Rebecca Thornton of the Lawyers Committee for Human Rights said SEVIS is “just another instance of the government collecting massive information, trying to get leads for terrorism suspects by really casting a broader net than is effective.”

Although the system tightens the restrictions on who gets student visas, some educators say it has loopholes that could allow foreign students to escape detection.

If they wanted to, foreign students could enroll in classes at the beginning of the semester, drop out, and—most of the time—they would go unnoticed until the end of a semester, some SEVIS proponents say.

Participating institutions have systems in place to monitor excessive absences by students; however, the integrity of the program depends on the faculty’s diligence in reporting absences.

At the University of Oklahoma, the amount of time it would take to report a foreign student with excessive consecutive absences to the school’s SEVIS coordinator is yet to be determined, said Joanna Snyder, the university’s assistant director of international student services.

“Because we have not had to practice this yet, I don’t know the exact time line,” Snyder said. “But we have a system in place.”

The university reports an enrollment of about 1,730 international students from 110 countries.

Keeping track of student address changes is also a challenge in the system.

Under SEVIS guidelines, a foreign student is expected to contact the school or INS when he or she moves, said Margaret Lee, director of counseling and testing at Tulsa Community College’s Northeast Campus.

That means that a student could move without notifying the school or immigration authorities.

The next deadline for schools is Aug. 1, when they will have to re-enter detailed information for existing foreign students enrolled before Sept. 11, 2001, said Tim Huff, manager of international students at Oklahoma State University.

OSU has 2,177 foreign students and must re-enter detailed information for an estimated 1,900 students.

When the system is fully implemented, INS and the Justice Department will be able to monitor a student’s enrollment status, residential information, and country of origin.

Students must be enrolled in 12 hours of classes to remain eligible. Graduate students must be enrolled in nine credit hours.

Links:

Immigration and Naturalization Service
http://www.ins.gov

Department of Homeland Security
http://www.dhs.gov/dhspublic

National Association of Foreign Student Advisers
http://www.nafsa.org

Lawyers Committee for Human Rights
http://www.lchr.org

School buildings in which every locked room is accessible through the use of a single master key are vulnerable to serious security breaches, owing in part to the simplicity of a little-known lock-picking technique that allows master copies to be made in minutes.

Law enforcement agencies are being warned the technique could be used to defeat locks in most schools, dormitories, offices, and apartment buildings, which raises the question: Should school leaders consider alternative locking systems, such as computerized locks and swipe cards, that use technology to secure their students and their valuables?

A cryptographer working for AT&T stumbled upon the secret, which primarily had been known only by locksmiths and a handful of criminals: Anybody with a key to a building whose locks have a master key can create their own master copy.

“Creating such a key requires no special skill, leaves behind no evidence, and does not require engaging in recognizably suspicious behavior. The only materials required are a metal file and a small number of blank keys, which are often easy to obtain,” said the researcher, Matt Blaze of AT&T Labs.

Security experts say the vulnerability should prompt school building managers to consider switching to “control key” systems, which use blanks that are not sold to the public, or adding alarms or video surveillance.

“We have to realize that the term ‘key control’ in many schools is an oxymoron,” said Kenneth Trump, president and chief executive of Cleveland-based consulting firm National School Safety and Security Services. “There is very limited control of keys.”

According to Trump, the threat that master keys might be forged often is compounded by the reckless disregard with which school administrators often treat their security systems. Many officials, he said, are too willing to lend their keys to volunteers. Others don’t move quickly enough to replace locks when keys are reported lost or employees turn over. With so many potential security breaches, Trump warned, imposters likely could target schools with relative ease.

Some school leaders already were turning to technology to tighten their building security, even before Blaze’s findings became public. Several companies—such as Locknetics, a Connecticut-based division of Ingersoll-Rand—now manufacture electronic key and security systems designed specifically with the needs of schools in mind.

Little Falls Community Middle School in Minnesota, for instance, currently uses one of Locknetics’ magnetic swipe-card locks to control access at its main entrance. Principal Bill Turk said officials settled on the computerized locking system after realizing the number of building keys in circulation presented a security risk.

“The building is 40 years old,” he said. “Obviously there are a lot of those keys out there.”

Currently, Little Falls employs the electronic system only to control traffic at its main entrance. But Turk said officials are considering outfitting all of its locks with similar devices.

“The [computerized] system keeps track of who goes in and who comes out, and at what time,” he said. “If a card is lost, all you have to do is change the code. It’s not a perfect system, but it’s better than a key system.”

The locks, which can be activated by push-button keypad or magnetic swipe card, can cost more than $1,000 a piece, according to Locknetics’ catalog. Turk said Little Falls paid approximately $800 for its single-entrance swipe-card system.

At those prices, security expert Trump said a transition would be out of the question for most schools.

“In an ideal world, we would turn to technology to address the problems associated with key control,” he said. But as schools nationwide continue to suffer from shrinking budgets, funding for massive security overhauls is virtually nonexistent.

For that reason, Blaze’s findings probably will have only a modest impact on the lock industry.

“There’s been an ongoing trend toward key control. He’s moved the ball forward a little bit,” said Lloyd Seller, senior training manager for Schlage Lock Co. of Security, Colo.

Each year, about 20,000 people learn of the technique to defeat master key locks in locksmith training provided by private companies, the military, and law enforcement, Seller estimated.

Blaze, 40, usually works on codes to protect computers and other systems, and on finding weaknesses that hackers exploit to break into networks.

Last year, he examined whether codes can protect other things and turned first to locks. After months of reading, he found the vulnerability, he said in an interview with the Associated Press.

“This technique has been discovered and rediscovered over the years by locksmiths, and probably criminals,” Blaze said. “I may be the first to work out all the details.”

Among them: It usually takes less than 50 “probes” of a lock to gain enough information about the master key to create a copy.

The vulnerability stems from the design of basic master key systems. Pins in the lock cylinder, which are pushed to different positions by the teeth of the key, have two positions that allow the lock to open—one for its individual key, the other from the master key.

“Since this research was completed last fall, we have been quietly circulating details of the vulnerability to the lock, law enforcement, and security communities,” Blaze wrote in a summary of his findings on the internet. “However, there is some evidence that the details are now circulating in the underground world.”

He added: “We believe that it is no longer possible to keep the vulnerability secret and that more good than harm would now be done by warning the wider community.”

Marc Webber Tibias, a former prosecutor and author of “Locks, Safes, and Security,” agreed that few people would change their locks after learning of the vulnerability.

“The majority won’t, because they’ll say they haven’t had any problems to date,” said Tibias, of Sioux Falls, S.D.

He said he tested Blaze’s technique by providing a 15-year-old boy with the instructions, a file, and blank keys. The teen crafted a master key in 15 minutes.

Blaze’s paper “certainly does raise an ongoing question with respect to security in schools,” said Sandra Becker, director of technology for the Governor Mifflin School District in Pennsylvania. “As in network security, the biggest risks are internal. Responsibility and loyalty are key.”

Links:

National School Safety and Security Services
http://www.schoolsecurity.org

Locknetics
http://www.locknetics.com

Blaze’s summary
http://www.crypto.com/masterkey.html

Blaze’s paper
http://www.crypto.com/papers/mk.pdf

Associated Locksmiths of America
http://www.aloa.org