Conference 7.286::dcu

It is written in several places in this file that DCU is not given
direct access to the Easynet because they are not DIGITAL Employees
and thus not permitted access.  With my "right thing to do" hat on,
its always surprised me that DCU couldn't be given a single,
supervised, mail-only account somewhere.  Some group in the company
would have to support it on their budget, but it could be the same
group that provides the space for their on-site branches (e.g., plant
management), and DCU could pay the costs in increased "rent". 

Anyway, .0 has an excellent point.  Easynet is easily accessed by
non-DIGITAL groups like universities.  DCU could easily and
inexpensively establish a usenet node, and trade mail with all DEC
Employees who have access to any in-house networks.   This will cost
DCU money, but you have to wonder if there will be an corresponding
(or increased) savings from having to support less telephone and US
Mail customer service activity. 

I propose that DCU buy an IBM-PC (I think that's all you need) and
give it a try? 


Are you listening DCU (you certainly were when you were running for 
election).

    There is a DIS policy (6.14) which covers giving electronic mail
    accounts on Digital systems to non-Digital people.  All it requires is
    a Digital employee who is, or represents, a company officer to approve
    an application made by a sponsor.  The sponsor (requesting manager)
    cites the relevant business need.  A non-disclosure agreement needs to
    be signed by DCU. 
    
    Once this is done, the routing tables could be set up so mail could be
    addressed as simply as DCU @PKO. 

    {brief editorial} 
    
    DEC is always "trying to the right thing". However, this approach ends
    up with policies and procedures that can (and are) sometimes "bent".
    Such liberties (an important part of a creative environment) cause
    implementations that can be (and are) contradictory. 
    
    {end editorial}
    
    I have made several attempts to solve the direct connection issue
    discussed. The DIS policy (6.14) Paul spoke of was one I looked at. Can
    anyone suggest a DEC "relevant business need" I can use to sell to some
    manager? 
    
    I tried the employee benefit approach. I asked my local personnel group
    to help. They did not see this conference as a "relevant business
    need", ie. an employee benefit. 
    
    My next approach was to try to find out under what agreement, contract,
    etc. DCU was given access to the DTN (falls under same DIS policy?).
    DCU is trying to help here. 
    
    The external network connection is a possibility (CSNET, ARPA, UUCP,
    etc.). However, DCU software/hardware skills would have to be up to the
    task. Past DCU problems with inflexible software and hardware
    (discussed in other entries in this conference) would make me wonder if
    DCU could pull it off. 
    
    The crux of the DIS policy is that the identity of the DEC employee and
    the Enet node is "protected" internal information. The present method
    of sending (see note 2.0 and its replies) information to/from DCU meets
    this requirement. That is the replies to the DCU are stripped of the
    user's name and node before it is sent to DCU by the DCU board chair
    (who is a DEC employee). 
    
    Anyone want to volunteer to modify the Mail_Vaxnotes.com utility
    (written in DCL) in the SOFTWARE_TOOLBOX so that the utility does not
    include this information in the extraction? The utility should still
    function the same otherwise. Any takers? 
    
    Still to be worked, is the permission of the moderator and the
    notesfile "members" to make the direct link (abet one-way to DCU). Also
    to make the path two-way, another utility would be needed to take mail
    and enter it in the notes file (the mail message having to follow some
    flexible format to identify the note for the reply). 

    {Sorry for the long winded monologue... must have been that vacation...}
    
    Carl
    {maintainer-of-the-batch-mailing-of-new-entries-to-dcu-chair}
    {and not the moderator of this conference!}

    Today, we can E-MAIL requests to Investor Services to sell
    shares of stock (and other things?).  It seems reasonable to be
    able to have the same service for DCU - whatever magick is involved
    should be reproducible.
    
    BobW

                Re .4 - Investor Services is PART of Digital, the DCU is
        NOT. Therefore, any "magic" to be applied does not apply here.
                
                Re an earlier comment - Digital DOES allow employees to
        send mail to people in other companies via the USENET, ARPANET,
        et al. We can also participate in what are known as Newsgroups
        on these networks (a very poor precursor to notes in concept).
        Both of these cause our names and nodes to become known to
        outside persons. I would think that the DCU would be much less
        risky (assuming that there is a risk - which many people do not
        agree with, while others do) than the above communications. In
        fact, it could be made much less risky to Digital (again,
        assuming that the risk exists) than any of the above situations.
                
                /s/     Bob

    This is an official response by Mary Madden of the DCU. The portion of
    that response, dated 15-SEP-1988, that applies to this note topic is
    included below. See note 2.22 for more information. 
    
    Whether you agree or disagree with the response from the DCU, please
    either direct your comments to the DCU directly (dtn-223-6735) or
    post your comments as a REPLY to this entry in this conference.
    
    Carl Leeber
******************************************************************************
    
******************************************************************************
        (Response to Note 116.0 to 116.2)
        
        3.  DCU's Easynet Access
        
        Digital Equipment Corporation's security precautions prohibit 
        DCU from directly accessing the VAXnote files.  We have 
        contacted DEC officials to see if we could have access to this 
        "notes" conference.

I think she misunderstood the question.

Among other things, we were interested in one-to-one one or two way 
mail access between DIGITAL and DCU, possibly through an external 
network (USENET, etc).

    Would such access be fair to those who do not have such access?
    (e.g. spouses, ex-employees, children).  
    
    I think any personal access for private communications should only
    be provided if it can be provided equally.
    
    	Rick
    	Merrill
    

        Re: .7
        
        No more so than it is to allow this conference to exist, since all
        DCU members cannot access it. Electronic mail is nothing more than
        a (hopefully) faster / cheaper method of communication. Telephone
        and US Mail are still available to every DCU employee. 
        
        I would argue strongly that DCU not use electronic mail as the
        "official" method of communicating policy to the members, but for
        personal communications between members who do have access to the
        net and DCU itself, there is nothing wrong with using any meduim
        that may be available. 

        
        Re: .6
        
        There are procedures for entities outside Digital who have valid
        business needs to get connected to the Enet. I've dealt with law
        firms, contractors, OEMs, etc. who have all had access to the net.
        Sagans of folks with access to USEnet, ARPAnet, BITnet, etc. can
        at least send and receive mail between their sites and DEC.
        Appropriate connections and perhaps a non-disclosure agreement are
        needed. 

        Clearly, any DCU board member who is also an employee of Digital
        Equipment Corporation and has a VAX account with access to NOTES
        and the Easynet can access this conference. 
        
        Whether there is any business reason for DCU employees in general
        to be able to access this conference is an interesting question.
        
        Tom

>        Clearly, any DCU board member who is also an employee of Digital
>        Equipment Corporation and has a VAX account with access to NOTES
>        and the Easynet can access this conference. 
                         ===

maybe one day <can> will equal <does> WHEN NOT(re-election time)

    
    I came to know about this notes file only yesterday. Actually I
    was in DCU getting information on my mortgage loan. I asked the
    loan officer how competetive their rates are, and what is their
    track record in approving the loans. 
    
    He exploded stating you guys discuss this all the time in Notes file.
    Check it out at Beirut::DCU. Then went on to add " I wish I can get
    the access to those DCU notes file, which will give me chance to know what
    bad things you guys are saying about us..
    
    When it comes to various activities, DCU maintains that they are
    not part of Digital and they are seperate company etc etc. if that
    is the case, I don't understand why they should be given access to
    VAX notes... ( Only to hit back at people who expose DCU's out dated
    rules and their attitudes/inefficiency ??? ).
                                                                             
    

They have access - I believe copies of all entries are sent to the DCU 
BOD - tell your loan officer to get them from the BOD 


(thanks again to Carl Leeber for doing the service of forwarding this 
data - wish there was some feedback to indicate that DCU actually 
reads it).

I would like to receive all of my statements except the year-end one over
E-Net.  I have a low-activity DCU account, which usually balances easily.
I understand that the E-Net is not secure (if somebody cared, they could
set up a node called ENZYME and an account called HAINSWORTH and intercept
my mail), but I don't care about spies as long as they can't steal my money.

I think that this can be done practically.  Here's how:

     1. DCU sets up a send-only network node address on either internet 
	(outside DEC) or ENet (inside DEC).  This protects their security -- 
	nobody can send any commands in to mess up their machines.

     2. Each DCU member who wants an on-line statement signs a form waiving his
	or her right to account privacy on the network (thus absolving DCU of
	responsibility for network eavesdroppers), and gives DCU an ENet
	account address.

     3. The last Saturday night of each month, DCU plugs a computer into their
	node address, mails out all statements for all accounts on which they
	have privacy waivers, and then immediately unplugs their computer.

     4. DCU does not send out paper statements to anyone who got an on-line
	statement.

PROs and CONs:

DCU
	PRO:  Save lots of money on printing, envelope-stuffing, and mailing.
	CON:  Probably need a dedicated computer, a dedicated system manager,
		dedicated phone lines, and some new software.  
		Look for help from DEC (especially DEC sales).
	CON:  Network access will cost some money.
	PRO:  More control over the process of sending out statements.
	PRO:  A competitive advantage over other banks.

DCU USERS
	PRO:  Convenience.  Speed.

DEC
	PRO:  A significant employee benefit for a relatively minor cost.
	CON:  Personal use of resources by employees:  network time, employee
		work (coffeebreak?) time, and printer paper.
	PRO:  Increased interaction between employees and computers.  The more
		we use them, the better we become at building them.
	PRO:  A knock-your-socks-off demo for sales if it works!

What do DCU users think of this idea?
What does DCU think of this idea?
What does DEC think of this idea?

Please respond, one and all!

Thanks,
John

Personally I wouldn't use it.  I would only want to be able to get my 
statements from the Bank system.  That way I could control who might be 
able to read them.  Anything transfeered to my E-NET home has the 
possibility of being seen.  I know that this could also happen with the US 
mail but at least there are laws that prohibit this and could be used to 
prosecute.

My $.02

I suppose I would be a bit worried about eavesdroppers too.  However, while
we're dreaming, I would like to have dial-in access to DCU so that I could
get on-demand statements, balances, check clearing information, etc.  Perhaps,
even transfers, withdrawals, etc.  And while I'm at it, it would be nice
to have ATM's and the touch-tone system (which I don't use) deal with
family accounts so that I can transfer money from one family account to
another.

- Jeff

    If it would speed up the delivery of my statement to me, I'd be
    all for it.  Here we are, Dec. 9th, and I still haven't received
    my statement.  .-1's solution might be ideal - it would allow users
    to be proactive in terms of getting their information.   
    
    - Chris
    
   

    I think it's a terrible idea.  There would have to be two systems:
    a paper system for people (like me) who don't want their statement
    online, and a new online system.  How will people who don't have a
    printer in their cubicle prevent others from looking at their
    statement as they go through printer output?

    BTW, if your accounts have low activity and are easy to balance,
    why are you so anxious to see your statement?  I think it's reasonable
    to get a monthly statement on the 8th or 9th of the month (I got mine
    yesterday, and our mail service is horrendous).

    	Quarterly statements.  That's the answer.  Why bother the DCU
    to get out statements every month?  Getting paid monthly is great,
    too, like in France, but that's another subject.  If you want your
    balance you can always (providing your country has the correct type
    of phone system!!) call and get it on the touch tone type system.
    We don't have it but the DCU is so nice servicing the people in
    the foreign services.
    
    Keith

    Yuck. I for one would never want quarterly statements. That is far
    too much of a time span to keep an accurate balance on your money.
    I wish it weren't true, but I tend to make 3 or 4 arithmetic mistakes
    in my "checkbook" each year; if I had to wait 3 months to completely
    balance the checkbook, I'd be in trouble. You see, one of the purposes
    of balancing your records with a statement is to see if you or the
    "bank" has made any mistakes.
    
    I never could understand why people think they can call up to get a
    "balance" of their checking account. This doesn't give you a balance in
    the sense of how much money you have available, it just gives you the
    balance of all the transactions the "bank" has handled so far. It
    doesn't tell you outstanding transactions (like checks, etc.). With,
    say, 15 checks outstanding, the so-called "balance" that the Easy Touch
    system gives you is pretty worthless. 
    
    No, the answer isn't quarterly statements. They must stay at monthly
    intervals to be of any use.
    
    Any other ideas?
    
    -Glenn-

Here is an FYI about a non-DEC group that has an account on the ENET.
    
    	- mark
    
    
>(B)0 lqwqwqwqwqwqwqkqqrrsssrrqq
 xdxixgxixtxaxlx                News Flashes              LIVE WIRE
 mqvqvqvqvqvqvqjqqppoooppqq

	      American Express ALL-IN-1 Account Established 

  For the next six months, the American Express Business Travel Centers
  serving Digital in New England will be accessible via ALL-IN-1 for 
  customer service issues.  Corporate Travel and American Express Business 
  Travel established the accounts to ease communication and to resolve 
  business travelers' customer service issues. This service is for employees 
  who use the American Express Business Travel Centers in Merrimack, Maynard, 
  Marlboro.

  The address is AMEX_CS@NRO.  Reservation requests, cancellations and high 
  priority issues should be handled by telephone.

    
    It would be nice for DCU to have an ENET MAIL account that people could
    ask questions to, send information from etc...
    
    We have other non-DEC groups on the ENET.
    
    If this were to occur, what would be the gain?  Pro's? Cons?
    
    	- mark

   I don't think that it would be possible to use such a gateway to transact
   any business. It is far too easy to pretend to be another person or node...
   
   It would be convenient just as an answer desk, just as Mary Madden does
   now, but with out the obvious delays in interaction because of the
   mechanism used.
   
   
   q
   

   >I don't think that it would be possible to use such a gateway to transact
   >any business. It is far too easy to pretend to be another person or node...
    
    It is far to easy to what???  Please back this up with facts.  I
    disagree.
    
    It woudl allow better communication between DCU employees and the
    owners of DCU.  This benifits all involved.  DCU needs a lot of help in
    the communication department.
    
    Invester services uses mail VERY well to DECs and our benafit.  It
    would be nice to see DCU get in line.
    
    	- mark

   Mark, taken at it's most simple approach. I could create a ::Buda account
   on j random workstation and send mail from there, telling DCU to dump all
   of your money into my account. (Which DCU doesn't handle, but that's
   another point.)
   
   Basically, there are two workable co-options. 1. That DCU have a machine on
   this side of the net, that has captive accounts that allow transactions to
   be placed. This is, in theory, no more or less secure than the DECtalk
   dialin service, and is relatively easy to implement in a secure fashion.
   
   2. Have DCU Mailing points would be great. Send mail to DCU::VISA or
   DCU::RSVP. to get info. I just get a little nervous about financial
   transactions occuring on my behalf in an environment that I know has the
   potential to compromised. However, I am sure that the DCU, is willing to
   listen to any input.
   
   why don't you write up a proposal to the DCU, suggesting what things a
   gateway could be used for, shouldn't be used for, what risks are involved
   etc. I like the idea of better communication, and I love the idea of
   simplified electronic banking, but the DCU like any other financial
   organization will not delve into technology unless they can see the
   benefits and are comfortable with the risks.
   
   Peter Q.
   

	Well,  the  way  I  see it, it wouldn't be proper for DCU to have
	an email address available directly from Digital (as in,  on  the
	easynet).  Remember that, technically speaking, DCU is a separate
	entity from Digital Equipment Corporation.  Investor Services  is
	part and parcel of Digital, DCU is not.  I was somewhat surprised
	to find a DCU notes file.

	As for the technical/security merits  of  doing  transactions  by
	email,  the  idea  is  pretty  frightening.   Too  many potential
	security problems exist.  A far  better  idea  would  be  to  use
	telephone  banking.   I've  seen  several  banks do this, and the
	approach varies from site-to-site.  Some places use  touch  tones
	and work similarly to ATMs, with the obvious exception being that
	you can't deposit or withdrawal.  Other places simply record your
	voice (while you're guided through transactions by a computer) to
	determine what you want done.   Someone  then  listens  to  these
	tapes and "does the right thing for you" during the same business
	day.
	
	Just my 0.02,

		chris


	

    Peter,
    	Have you taken a look how Investor services processes the selling
    of stock through mail?
    
    You will see that your point is not valid.  Investor servies allows me
    to send mail, not caring what machine (not sure about username) and I
    can sell all my stock or various other options.
    
    Spoofing mail is simple, but people can get fired for it.  It is quite
    easy to trace for the person who wants to.  Somewhere in the future
    this problem will disappear anyway.
    
    Initially, aall I would want is a way to GET information and ask
    questions.  Start simple and let people get comfortable with it.
    
    	- mark
    

    >	Well,  the  way  I  see it, it wouldn't be proper for DCU to have
    >	an email address available directly from Digital (as in,  on  the
    >	easynet).  Remember that, technically speaking, DCU is a separate
    >	entity from Digital Equipment Corporation.  Investor Services  is
    >	part and parcel of Digital, DCU is not.  I was somewhat surprised
    >	to find a DCU notes file.
    
    
    This USED to be true.  Take a look at .21 and explain this to me.
    I think you missed out on the precident.
    
    	- mark

    Regardless of Digital corporate policy, it would be premature for DCU
    to provide electronic banking access through the E-Net.  It's all too
    easy for a malicious workstation to create bogus transactions that the
    DCU would be unable to detect until after the fact.
    
    The sheer size of the E-Net (and the extensive use of Ethernet links in
    local area subnets) makes it VERY DIFFICULT to secure.  There's light
    at the end of the tunnel (and it's not even an oncoming train 8^), but
    a great deal of work remains before we can consider the E-Net to be
    trustable for banking transactions.

    
    RE: .29
    
    	Your missing the point!
    
    	He's nmot asking to conduct banking transactions access over the
    net, just to be able to send mail to say Mary Madeen or others in HQ.
    
    

   Why do I get the feeling that we are all arguing from the same side...
   
   Direct Network Communications with DCU is feasible, practical, and easy to
   implement. 
   
   Electronic Banking from within E-net is feasible, practical, and has some
   percieved risks involved that it is probably best left to experts to
   analyze.
   
   If DCU wants to expand it's services to include better electronic access,
   then I will gladly offer my services to advise... 
   
   q
   

    	I think a major point is being overlooked when discussing 3rd-party
    	accounts on the e-net.  Such accounts are for the benefit of
    	Digital, the corporation, not DEC's employees.  If DEC's employees
    	derive some benefit that's a plus, not an intent.
    
    	Yes AMEX Travel has such an account.  They have such an account for
    	benefit of Digital Equipment Corporation, not DEC's employees.  AMEX
    	is Digital's provider of travel services.  That's the reason they
    	have an e-net account.  I'm certain that some employees have used
    	AMEX ant it's e-net access for personal travel arrangements. 
    	That's merely a side benefit.

    >	I think a major point is being overlooked when discussing 3rd-party
    >	accounts on the e-net.  Such accounts are for the benefit of
    >	Digital, the corporation, not DEC's employees.  If DEC's employees
    >	derive some benefit that's a plus, not an intent.
    
    Please show me a document that says this.  I have never seen/heard of
    this angle.
    
    The above logic makes it heard to understand how DCU was able to get
    DTN's, also.
    
    	- mark

DCU got several 11-70s and other hardware such as printers , tapes and 
disks.  Free office space (when they started, don't know about now) and
other things to help them get off to the right start.   They got DTN 
access at "cost".  It made sense then and now because people are going
to call during work hours and it is cheaper for DEC to pay for a DTN call 
that if they had to call using the PSTN.

RE: .33

I offer the following in support of 116.32.

Please note the pertinent phrases:


RE: AMEX's E-net account (I'll bet it's really a captive ALL-IN-1 account)

	"to facilitate communication .... affecting business travel"


RE: 3rd Party connection to E-net

	"Application for such connections must contain a business
	 justification ...."


RE: E-mail accounts for non-Digital employees.

	"Such circumstances occur if a Digital line manager is convinced
	 that the oeration of his business will be significantly
	 enhanced by permitting the person not employed by Digital to
	 have such an account."



From the May edition of Digital Travel Magazine:



                     Digital Travel Magazine - May, 1990

       ALL-IN-1 Mail for AMEX Customer Service 

       Corporate Travel and American Express Business Travel are pleased
       to announce that for a 6 month trial period the American Express
       Business Travel Centers servicing Digital in the New England Area
       will be accessible via ALL-IN-1 mail for customer service issues.
       The account has been established to facilitate communication and
       resolution of customer service issues affecting business travel.        
       
       PLEASE NOTE:  Reservation requests, cancellations, and high priority
       issues should be handled by telephone.  American Express Supervisors
       and Customer Service Reps will be responding to your ALL-IN-1 mail.
	
       The account is available to employees who use the American Express 
       Business Travel Centers in Maynard, Marlboro, and Merrimack.

	   Please direct all mail via ALL-IN-1 to:  AMEX_CS @NRO

Excerpts fron DIS P&P's

                           DIS Policies and Procedures
Policy 6.13						Revised 15-Feb-88

CONNECTION OF EXTERNAL TERMINALS, COMPUTER SYSTEMS, AND NETWORKS 
TO DIGITAL'S INTERNAL SYSTEMS AND NETWORKS


BACKGROUND: 

There is often strong business justification for those applications that
depend upon external communication links with Digital's internal computer
systems and data networks. Examples of such applications include electronic
mail, Electronic Data Interchange (EDI), electronic stores, Videotex, computer
conferencing, customer Quality Assurance Reporting (QAR), remote diagnostics,
and trade shows. 


	[section deleted]

POLICY: 
 
An external access connection to Digital's internal systems and networks
requires review and approval from the following parties: 

      o Corporate Security.

      o Corporate Law Department.

      o DIS Management Committee member having jurisdiction over the
	application or system(s) involved, or the DIS Management Committee
	member's delegate.

      o Geography Telecommunications Manager (Europe, GIA, NNE, US).

      o Manager, Digital Telecommunications.

      o Others as may be required by the Digital Telecommunications Manager. 

Such approvals shall be for a term of one year, at which time the connection
must be reviewed for reapproval. 

Applications for any such connections must contain a business justification, a
support plan, a description of the hardware and software configuration
(including block diagram), documented security measures, and audit plan, and
names of designated individuals who will be held accountable for ensuring
adequate information protection and security. 


	[section deleted]


A request for an external connection must include the following information: 

      o Business Justification -- Describes the business activity and
	relationships to be supported by the requested connection and the
	marketing advantage or cost avoidance to be gained.  Also describes
	Digital's electronic data involved and the data's security
	classification as defined by Corporate Security Proprietary
	Information Standard.  The Business Justification must be approved by
	the Area or Group level Business Manager, or equivalent. 


	[section deleted]


                           DIS Policies and Procedures
Policy 6.14							01-Mar-85

ELECTRONIC MAIL SYSTEM ACCOUNTS FOR THOSE
WHO ARE NOT DIGITAL EMPLOYEES					Page 1 of 5


OBJECTIVE:

The primary concern relating to the granting of Electronic Message System
accounts to persons not employed by Digital is to safeguard sensitive
information that may reside in Electronic Message System databases.


	[section deleted]


POLICY:

Under ordinary circumstances, only Digital employees will be authorized to
have accounts on Electronic Message Systems, to have access to group accounts,
or to access Electronic Message System databases.

Under no circumstances will any person not employed by Digital be allowed
access to the account of any other person or group.  This is particularly
important since such access could lead to the undiscovered disclosure of
proprietary information.

Under certain circumstances, Electronic Message System accounts can be given
to those who are not Digital employees with proper approval from company
officers or their representatives.  Such circumstances occur if a Digital line
manager is convinced that the operation of his business will be significantly
enhanced by permitting the person not employed by Digital to have such an
account.  To maintain appropriate security, accounts given to those not
employed by Digital must be separate and must not share databases with Digital
employee accounts.