Colleges, Universities Present Ripe Target for Computer Hackers.

Byline: Ernest Holsendolph

May 27--Colleges and universities battle hackers and viruses every day as a matter of course, not unlike the way hospitals try to eradicate health-threatening germs and killer viruses to save lives.

Neither colleges or hospitals can live apart from the pests and parasites.

And the problem is growing.

Last year some 52,000 attacks on computer networks were reported to a Carnegie Mellon University center that coordinates emergency responses in the computer world.

Many of these attacks happen on college campuses, involving thousands of academic sites across the country.

"We get attacks every day," said John Mullin, chief information officer at Georgia Tech. "Hackers are running continuous sweeps for targets, and universities like us are a primary target."

There are attacks of many kinds but few like the break-in on March 10 at Georgia Tech. Hackers burst into the business network of the university on that Sunday night and dumped 350 gigabytes of information, including sensitive credit information.

They replaced it with 150 gigabytes of their own data -- bootleg movies.

"In retrospect, I guess we can say that was an innocent attack," said Wayne Clough, president of Georgia Tech. "Innocent," he said, because the marauders seemed uninterested in the financial information, which could have been used to fabricate identities or create charges.

No information has been exploited so far, campus officials said.

The hackers were fixed on their mission, evidently simply desiring to create a trading post for their movies.

The scary break-in, in an institution that prides itself as a bastion of technological knowledge and prowess, has sounded alarms at all colleges.

Now, all institutions are more wary than ever and busy trying to establish safeguards.

In a survey by the Chronicle Of Higher Education, college officials said the threats are not just from smart and sophisticated pranksters and criminals but even come from mischievous teens who have figured ways to capture computers and turn them into system attackers.

Called "Script Kiddies," they are able to use programs that easily break into unsecured computers, capture them and the mobilize them to do further mischief on cue.

They trade these zombie machines like baseball cards, said Robert Mahoney, a network engineer at the Massachusetts Institute of Technology.

In chat rooms they talk about trading "10 machines at MIT for some at the University of California," he said.

College administrators throughout the country are carefully examining their operations, setting up emergency responses and struggling for ways to inoculate themselves and put up walls against hackers.

So far, online learning systems like Georgia Globe report no similar hacker problems but are on alert.

Colleges and universities are the better, more inviting target -- partly because of the way they operate.

"Universities, like the Internet itself, have been traditionally been based on openness," said Clough, "and the idea of building walls runs against the idea of freedom, free inquiry and all the other elements that contribute to research and learning."

But the colleges have what the hackers want -- and in abundance.

"We have thousands of machines and computers, huge amounts of data storage capacity and high bandwidth pipelines for fast distribution," said Mullin, the information chief at Georgia Tech.

Reluctantly, university officials have had to establish firewalls and other security measures to limit access to campus systems, and they have had to increase monitoring, educate users and impose restrictions.

Things are changing.

Michael A. McRobbie, vice president for information technology at Indiana University, said the campaign to keep order will be costly and will reduce productivity.

In a speech to colleagues recently he said:

"In the present climate of cyber-threats, somebody in the university has to step forward and take responsibility to remediate the threats and say what the risks are."

There's a new public awareness of the problem. Within hours after a Webmaster discovered the Georgia Tech break-in when he noticed unusual patterns in the activity logs for the night before, university officials decided to tell members of the campus community what happened, cancel student and staff credit card and debit cards and throw up the protective gates.

"We took a number of steps," said Mullin. "We changed the architecture of the business networks, set out on a program of education and awareness, drew up security policies for the various departments and updated our emergency responses."

Officials of federal agencies have insisted on strict security systems to protect high priority research and have threatened to cut off funding if institutions of higher learning don't cooperate.

The whole process of adapting to the new and higher levels of threats puts a crimp in plans, Clough said.

"Our aim in developing bigger and more usable networks was to keep reducing paperwork," said Clough, "and also to enhance lifestyle, by allowing more staff to telecommute or do their work and draw on campus resources even if they are away. Now we are having to look again and find what restrictions are necessary."

The attacks and the kinds of response now needed have underlined even more heavily the relation between security and economy, Clough said.

"For that reason, these network security issues are being studied by a number of national panels, including the Task Force for Security and Information and the U.S. Council on Competitiveness," he said.

The gist of the problem, Clough said, is the realization that if you do not have secure boundaries, you cannot have a robust economy.

Like shock waves, the terrorist events of Sept. 11 -- and other invasions of various impacts -- all affect the psychology, he said.

"That's the reason why so many people are now studying security so intently, and in the light of its effect on the economy and the way we work," Clough said.

To see more of The Atlanta Journal-Constitution, or to subscribe to the newspaper, go to http://www.ajc.com

(c) 2002, The Atlanta Journal-Constitution. Distributed by Knight Ridder/Tribune Business News.