By Brian McWilliams

02:00 AM Nov. 11, 2002 PT

The U.S. State Department says Saddam Hussein's oldest son is a murderer, rapist, torturer and smuggler. He has also been known to send death threats by e-mail.

So why is Yahoo apparently providing Uday Saddam Hussein with a free e-mail account, and why has Microsoft granted him a .NET Passport?

The website of Iraq's Babil newspaper, which is controlled by 38-year-old Uday, informs visitors that they can contact the publisher by e-mail at udaysaddamhussein@yahoo.com.

In providing e-mail service to Saddam's son, Yahoo is likely in violation of U.S. trade sanctions against Iraq, according to Rob Nichols, a spokesman for the U.S. Treasury Department, which enforces trade sanctions against Iraq through its Office of Foreign Assets Control.

"It is against U.S. law to provide services to residents of Iraq, even if it is a free account. And the provider should cut off the account," said Nichols, who noted that a 1990 executive order prohibits U.S. firms from exporting "goods, technology or services" to Iraq, with the exception of controlled food and medical supplies.

Citing the company's privacy policy, Yahoo officials declined to comment on the e-mail account registered in Uday's name. Spokeswoman Mary Osako said Yahoo is "aware of and respects U.S. trade law" and cooperates with law enforcement when asked.

Rather than moving to shut down the address, however, U.S. intelligence officials are "almost certainly" monitoring the account, said Robert David Steele, a former CIA officer and founder of Oss.net, a cyberdefense think tank.

"I would say that the U.S. government is probably reading everything in that account and is quite happy that Uday has that e-mail," said Steele.

Like his father, Uday is clearly in the cross hairs of the White House. A profile on the State Department website says Uday has a "history of extreme violent behavior including murder, torture and rape of women and girls." Uday is also "heavily involved in Iraq's smuggling against U.N. sanctions, and in illicit financial dealings," the profile says.

Messages sent to udaysaddamhussein@yahoo.com were not immediately returned.

Last year, using a different e-mail address, Uday reportedly sent a death threat to a British journalist. According to an article on KurdishMedia.com, a message from babil@uruklink.net signed by Uday warned reporter R.M. Ahmad that "we have been able to allocate your current residency" and "our brave (young) agents are able to stop people like you in the time and the place that we will determine."

KurdishMedia.com founders did not respond to e-mail interview requests, and the phone number listed on the newspaper's site was not in service.

In October, Uday's babil@uruklink.net account was found to have the same security problem as that of his father: an easily guessable password. Like Saddam's press@uruklink.net address, Uday's Babil inbox was protected by a five-letter password that matched the account name.

The registration record for Uruklink.net, the domain used by Iraq's government-controlled ISP, lists ama_72@yahoo.com as its contact address.

Unlike Saddam Hussein's Uruklink account, however, Uday's inbox contained very few messages aside from viruses, spam and e-mails from distribution lists.

Included in the Babil inbox was an Oct. 1 message from Microsoft confirming the successful registration of a Microsoft .NET Passport for Babil@Uruklink.net. Passport is Microsoft's online authentication and electronic wallet system.

A Microsoft representative would not comment on the issuance of a Passport to Babil@Uruklink.net but said Microsoft complies with all trade laws.

"Many Arabs believe U.S. intelligence is largely incompetent in cyberspace," and they underestimate current U.S. government efforts to gather information on Iraq, said Oss.net's Steele.

As a result, Uday probably does not expect that his account would be monitored, he said.

The Yahoo account is "not high value" and it is not likely to prove a fertile source of intelligence for U.S. terrorist trackers, Steele said. Just as with telephone wiretaps, "the returns just aren't there" in monitoring e-mail.

-- Anonymous, November 11, 2002