|
Paul Taylor's Forthcoming Hacker Book (excerpt),
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
Computer underground Digest Sun July 27, 1997 Volume 9 : Issue 59
ISSN 1004-042X
Editor: Jim Thomas ([email protected])
News Editor: Gordon Meyer ([email protected])
Archivist: Brendan Kehoe
Shadow Master: Stanton McCandlish
Shadow-Archivists: Dan Carosone / Paul Southworth
Ralph Sims / Jyrki Kuoppala
Ian Dickinson
Field Agent Extraordinaire: David Smith
Cu Digest Homepage: http://www.soci.niu.edu/~cudigest
CONTENTS, #9.59 (Sun, July 27, 1997)
File 1--Paul Taylor's Forthcoming "Hacker" Book (excerpt)
File 2--Chapter 6 of P. Taylor's book - "Them and Us" (part 1 of 2)
CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION APPEARS IN
THE CONCLUDING FILE AT THE END OF EACH ISSUE.
---------------------------------------------------------------------
Date: 18 Jun 97 17:25
From: [email protected]
Subject: File 1--Paul Taylor's Forthcoming "Hacker" Book
((MODERATORS' NOTE: A few years ago, Paul Taylor solicited
information on "hackers" in a CuD post for his Phd dissertation.
He completed it, and it will soon be published by Routledge and
Kegan Paul. The publication date is anticipated to be in early
1998, and the tentative title: HACKERS: A STUDY OF A
TECHNOCULTURE, although Paul is still searching for (and is open
to) suggestions. Sadly, though, publishers usually suggest the
final title and their choice usually prevails. The estimated
price for the paperback version should be about 15 pounds, which
would make the US version about $20.
CuD will run a chapter, which will be divided into two sections
of this CuD issue because of length)).
------------------
Jim has kindly agreed to put up on CuD an excerpt from my
forthcoming book on hackers. Its present form is straight from
my PhD thesis but I would like to use peoples' feedback to help
me up-date my work prior and to make it more accessible to a
non-academic audience. If you have any comments or views on my
portrayal of hacking then please contact me -
[email protected].
The reason for putting up the posting is
a) to thank and give something back to the original people who
contributed.
b) to stimulate further interest that will help in the up-dating
of the original work - specifically ...
i) what do people think are the major developments in the CU over
the last 3/4 years?
ii) what do people think are the major differences (if any)
between the CU scene in the US as compared to Europe/rest of the
world?
There's an open invite for people to contact me and discuss the
above and/or anything else that they think is relevant/important.
Below is a brief overview of
the eventual book's rationale and proposed structure.
Hackers: a study of a technoculture
Background
"Hackers" is based upon 4 years PhD research conducted from
1989-1993 at the University of Edinburgh. The research focussed
upon 3 main groups: the Computer Underground (CU); the Computer
Security Industry (CSI); and the academic community. Additional
information was obtained from government officials, journalists
etc.
The face-to-face interview work was conducted in the UK and the
Netherlands. It included figures such as Rop Gongrijp of
Hack-Tic magazine, Prof Hirschberg of Delft University, and
Robert Schifreen. E-mail/phone interviews were conducted in
Europe and the US with figures such as Prof Eugene Spafford of
Purdue Technical University, Kevin Mitnick, Chris Goggans and
John Draper.
Rationale
This book sets out to be an academic study of the social
processes behind hacking that is nevertheless accessible to a
general audience. It seeks to compensate for the "Gee-whiz"
approach of many of the journalistic accounts of hacking. The
tone of these books tends to be set by their titles: The Fugitive
Game; Takedown; The Cyberthief and the Samurai; Masters of
Deception - and so on ...
The basic argument in this book is that, despite the media
portrayal, hacking is not, and never has been, a simple case of
"electronic vandals" versus the good guys: the truth is much more
complex. The boundaries between hacking, the security industry
and academia, for example, are often relatively fluid. In
addition, hacking has a significance outside of its immediate
environment: the disputes that surround it symbolise society's
attempts to shape the values of the informational environments we
will inhabit tomorrow.
Book Outline
Introduction - the background of the study and the range of
contributors
Chapter 1 - The cultural significance of hacking: non-fiction and
fictional portrayals of hacking.
Chapter 2 - Hacking the system: hackers and theories of technological change.
Chapter 3 - Hackers: their culture.
Chapter 4 - Hackers: their motivations
Chapter 5 - The State of the (Cyber)Nation: computer security weaknesses.
Chapter 6- Them and Us: boundary formation and constructing "the other".
Chapter 7 - Hacking and Legislation.
Conclusion
Paul Taylor
------------------------------
Date: Mon, 16 Jun 1997 14:05:55 +0100
From: [email protected]
Subject: Preview of "Hacker" book: THEM AND US (Part 1 of 2)
Chapter 6 - 'Them and us'
6.1 INTRODUCTION
6.2 BOUNDARY FORMATION - 'THEM AND US'
6.2.1 The evidence - Hawkish strength of feeling
6.3 REASONS FOR 'THEM AND US'
6.3.1 Ethical differences between the CSI and CU
6.3.2 The fear of anonymity
6.4 THE ETHICAL BASIS OF THE 'THEM AND US' SCENARIO
6.4.1 Blurred and vestigial ethics
6.4.2 Industry examples of blurred ethics
6.4.3 Technology and ethics
6.5 BOUNDARY FORMATION - ROLE OF THE MEDIA
6.6 BOUNDARY FORMATION PROCESS AND THE USE OF ANALOGIES
6.7 THE PROJECT OF PROFESSIONALISATION
6.7.1 Creation of the computer security market and professional ethos
6.7.2 Witch-hunts and hackers
6.7.3 Closure - the evolution of attitudes
6.8 CONCLUSION
6.1 INTRODUCTION
Hackers are like kids putting a 10 pence piece on a railway line to see if
the train can bend it, not realising that they risk de-railing the whole
train (Mike Jones: London interview).
The technical objections of the hawks to hacking, which reject the argument
advocating cooperation with hackers, are supplemented by their ethical
objections to the activity, explored in this chapter. Previous chapters
have shown that there is some interplay and contact between the hacker
community and the computer security industry, as well as the more
subsidiary group: the academics1. The much more common relationship
between hackers and the computer security industry, however, is the
thinly-veiled or open hostility evident in the opinions of the hawks.
This chapter examines the basis of this hostility. The groups' contrasting
ethical stances are highlighted, and their origins explained. The
technical evolution of computing is shown as creating new conditions that
demand ethical judgements to be made with respect to what constitutes
ethical use of computer resources. The CU and the CSI have different
ethical interpretations that are expressed in a process of debate. This
debate then becomes part of a boundary forming process between the two
groups. Two identifiable influences upon such ethical judgements are the
age of the person making the judgement, and the extent to which technology
plays a part in the situation about which an ethical judgement has to be
made.
Elements of the CSI and the CU stand in identifiable opposition to each
other. This chapter shows how this opposition is maintained and
exacerbated as part of a boundary forming process. Ethical differences
between the two groups are espoused, but examples are given of the extent
to such differences are still in a process of formation within computing's
nascent environment. Thus the type of mentality within the CU that fails
to accept any ethical implications from phone-phreaking or hacking is
sharply opposed by the CSI, whose typical sentiment is that computer users
such as hackers have forgotten "that sometimes they must leave the playpen
and accept the notion that computing is more than just a game" (Bloombecker
1990: 41). This contention that hackers have failed to psychologically
"come out of the playpen" is illustrative of some of the marked ethical
differences between the two groups.
This chapter, however, draws attention to examples of the more ambiguous
and blurred ethical situations within computing, and how an on-going
process of negotiation, group differentiation and boundary formation, is
required to maintain such differences between the groups. The ethical
complexities surrounding computing are becoming increasingly important as
it becomes a more prevalent aspect of everyday life. The CSI, as a part of
a dominant social constituency of business and political interests, is
involved in a process of attempting to impose its interpretation of such
ethical issues upon computing. Advocates of different ethical approaches
find themselves increasingly separated by moral boundaries that have become
codified into professional regulations and government legislation.
The "them and us" scenario caused by the contrasting ethical stances is
fuelled by the media's portrayal of hackers as unethical outsiders. The
most obvious manifestation of this is the evolution of attitudes held
towards hackers by the dominant social constituency. The 'true hackers' of
MIT were active from the late 1950's and were instrumental in the
development of both hardware and software, whereas hackers are now largely
perceived as a problem to be legislated away. This evolution in
perceptions is simultaneously a result of the emergence of the CSI as a
constituency, and a causal factor in that development. To illustrate the
process of boundary formation we note comparisons of the debate surrounding
Robert Morris Jr's intrusion into the internet system with the language and
attitudes displayed during the Salem Witch trials (Dougan and Gieryn 1988).
The press, in particular, has been particularly active in the process of
stereotyping and sensationalising hacking incidents, the process helping to
produce a deviant group status for hackers.
The chapter also includes analysis of one of the most interesting aspects
of the boundary forming process between the CSI and the CU, namely, the way
in which physical comparisons are made between situations that arise in
computing and the real world. These metaphors are used as explanatory
tools and also in the production and maintenance of the value systems that
separate the two groups. The physical analogies used seem to fulfil both
of these functions. They allow what would otherwise be potentially
complicated technical and ethical questions to be approached in a more
manageable and everyday manner, yet they also contribute directly to the
formation of ethical boundaries due to their particular suitability as a
means of sensationalising hacking issues.
Public commentators such as Gene Spafford have made various polemical
statements of what hacking and its implications are: employing a hacker, is
like making 'an arsonist your fire chief, or a paedophile a school
teacher.' The actions of hackers are thus forcefully taken out of the
realms of 'cyberspace' and reintroduced into the concrete realm of
threatening real world situations. If the comparison is accepted, then the
danger and harm to be suffered from such actions are more readily
understood and feared, and hackers as a group may then be effectively
viewed as moral pariahs. With reference to Woolgar's (1990) attempt to
link computer virus stories with the prevalence of 'urban/contemporary
legends', it can be pointed out that the physical analogies used by the CSI
in discussions of computer ethics emphasise the transgressive 'breaking and
entering' qualities of hacking2. In contrast, the CU reject such dramatic
analogies and prefer to emphasise the intellectual and pioneering qualities
of hacking which we will subsequently analyse with respect to their chosen
analogies: comparisons of hacking's intellectual nature and frontier ethos
to a game of chess and the Wild West, respectively.
6.2 BOUNDARY FORMATION - 'THEM AND US'
Dougan and Gieryn (1988), like Meyer and Thomas (1990), have compared the
process of boundary formation within computing with the historical examples
of formalised witch trials. This is an extreme process of 'boundary
formation' whereby groups differentiate themselves by marginalising other
groups thereby establishing their own identity. "Witch hunts" occur in
periods of social transition and we have seen in Chapter 3 that IT is
undergoing a period of social change. The economic order is attempting to
impose property relations upon information, yet its changing nature
undermines its properties as a commodity.
Computer counter-cultures are increasingly perceived as a threat to the
establishment's ability to control technology for its own purposes. The
initial awe and even respect with which hackers were originally viewed as
'technological wizards' has given way to the more frequent hawkish
perception that they are 'electronic vandals'. Dominant social groups
initially mythologise and then stigmatise peripheral groups that do not
share their value-structure. In the case of hackers, this tendency has
been exacerbated by the fear and ignorance encouraged as a result of
hacking's covert nature and the difficulties of documenting the activity.
Dougan and Gieryn (1988), amongst others, point out that such concepts of
deviancy have a function. Put simply, a community only has a sense of its
community status by knowing what it is not. Distancing themselves from
outsiders helps members within that group feel a sense of togetherness.
Furthermore, cultures that emphasise certain values over others will tend
to label as deviant those activities which threaten its most prized value.
In the particular case of hackers, their stigmatisation and marginalisation
has occurred because they have threatened, with their information-sharing
culture, one of the basic crutches of the capitalist order: property
rights. The facilitating feature of the boundary forming process between
the CU and the CSI is the sense of otherness and lack of affinity with
which they confront each other: the "them and us" scenario.
6.2.1 The evidence - hawkish strength of feeling
Direct access to the debate between the CSI and CU can be obtained by
looking at examples of e-mail correspondence known as 'flames'. These are
strongly worded, and often insulting electronic mail messages. They serve
to illustrate the antagonism that exists between the CSI and CU. The
following are examples of the expressions used on e-mail to describe
hackers and hacking:
I am for making the penalties for computer trespass extremely painful to the
perpetrator ... Most administrators who've had to clean up and audit a
system of this size probably think that a felony rap is too light a
sentence. At times like that, we tend to think in terms of boiling in oil,
being drawn and quartered, or maybe burying the intruder up to his neck in
an anthill (Bob Johnson: RISKS electronic digest, 11:32).
electronic vandalism (Warman: e-mail interview).
Somewhere near vermin i.e. possibly unavoidable, maybe even necessary pests
that can be destructive and disruptive if not monitored (Zmudsinki e-mail
interview).
Mostly they seem to be kids with a dramatically underdeveloped sense of
community and society
(Bernie Cosell: e-mail interview).
Opposition to hacking practices has become increasingly non-specific and
moralistic, an example being Spafford's argument that using hackers'
knowledge on a regular basis within the computer security industry is
equivalent to employing a known arsonist as your fire-chief, a fraudster as
your accountant, or a paedophile as your child-minder. The technical
insights that they could provide or could be derived as a by-product of
their activities become subordinate to the need to express opprobrium
against the morality of the actions themselves. The language of blame and
morality is consistently used by hawkish members of the CSI to refer to
hackers in what they would argue is a process of 'blame displacement'. The
CSI are accused of using moral condemnation as a means of deflecting any
responsibility and blame for security breaches that might be attached, not
just to the perpetrators of intrusions, but also their victims. As
Herschberg said:
The pseudo-moral arguments and the moralistic language certainly cloud the
issue in my view. I think it obscures the fact that system owners or
system administrators have a moral duty to do at least their level best to
stop penetrations. They are very remiss in their duty, they couldn't care
less and therefore at least, there is quite an understandable tendency to
blame the penetrator rather than blaming themselves for not having taken at
least adequate counter measures, in fact in some cases counter measures
have not been taken at all ... if it is proved to you that you haven't done
your homework, then you almost automatically go into a defensive attitude
which in this case, simply amounts to attacking the hacker, blaming him
morally, heaping opprobrium on his head ... yes, the fear factor is
involved (Herschberg: Delft interview).
This undercurrent of moral censure was a recurrent quality of the
field-work interviews with members of the CSI, for example:
I've been in this game ... this is my 36th year, in the interests of hacking
as a whole I think hacking is something which is derogatory; to be played
down, to possibly in fact, be treated as a minor form of criminal activity
... the last thing you want to do is to make hackers into public figures;
give them publicity. I think it needs to be played down when it occurs,
but it shouldn't occur ... I wouldn't have them, no, under any
circumstances (Taylor: Knutsford interview).
Dr Taylor and others interviewees, involved in the provision of computer
security, had had surprisingly little direct contact with hackers. I asked
him about this lack of direct contact/interplay and his perceptions of the
motivations of hackers:
Well, there shouldn't be [any interplay] because the industry doesn't want
to hear about hackers and certainly doesn't want to see the effects of what
they do ... To me I'm not concerned with what the hacker does, I'm more
concerned with keeping him out to start with ... You've talked to what are
called the more ethical members of the hacking community for whom it's an
intellectual challenge, but there are in fact people who are psychopaths,
and Doctor Popp3 is one of these, where they just want to level a score
with society which they feel has been unfair to them ... A chap called
Whitely has just gone to prison for four years for destroying medical data
at Queen Mary's hospital, London. He just destroyed utterly and he wasn't
just a hacker that was browsing, he was a psychopath almost certainly
(Taylor: Knutsford interview).
In contrast, and as an illustration of the negative perceptions each groups
has of the other, a hacker, Mofo, argues that psychotic tendencies are not
the sole preserve of the hacking community:
my experience has shown me that the actions of 'those in charge' of computer
systems and networks have similar 'power trips' which need be fulfilled.
Whether this psychotic need is developed or entrenched before one's
association with computers is irrelevant. Individuals bearing such faulty
mental health are present in all walks of life. I believe it is just a
matter of probability that many such individuals are somewhat associated
with the management of computers and networks [as well as intrusion into
computer systems] (Mofo: e-mail interview).
Taylor is wary of the damage to computing that greater publicisation of
hacking could cause, yet as the above reference to Dr Popp and Nicholas
Whitley shows, ironically, he seemed to be dependent upon the most
publicised cases of hacking for his perceptions of hackers. A further
argument that prevents the CSI accepting hackers as potentially useful
fault-finders in systems is the simple charge that without the existence of
hackers in the first place, there would be very little need for extensive
security measures. Even if hackers are of some use in pointing out various
bugs in systems, such a benefit is outweighed by the fact that a large
amount of computing resources are 'wasted' on what would otherwise be
unnecessary security measures. For example, Dr Taylor's view is that:
hacking is a menace that stops people doing constructive work ... A lot of
money get's spent today on providing quite complex solutions to keep ahead
of hackers, which in my view should not be spent ... They're challenging
the researchers to produce better technical solutions and they're
stimulating the software service industry which provides these solutions
and makes money out of it. But you answer the question for me, what's that
doing for society? (Taylor: Knutsford interview).
Thus one reason for the use of moral language is in order to displace blame
from those in charge of the systems where security is lax, to those who
have broken that lax security. Irrespective of the state of security of
systems, there is a project of group formation whereby those who implement
computer security wish to isolate and differentiate themselves from the CU,
in a process that highlights the inherent differences that exist between
the two groups. This project is vividly illustrated in the following
excerpt from the keynote Turing Award acceptance speech given by Ken
Thompson:
I have watched kids testifying before Congress. It is clear that they are
completely unaware of the seriousness of their acts. There is obviously a
cultural gap. The act of breaking into a computer system has to have the
same social stigma as breaking into a neighbor's house. It should not
matter that the neighbour's door is unlocked. The press must learn that
misguided use of a computer is no more amazing than drunk driving of an
automobile (Thompson 1984: 763).
This degree of sentiment was consistently expressed amongst some of the
most prominent and accomplished of those figures from the computer security
industry who were generally opposed to hackers:
Unfortunately ... it is tempting to view the hacker as something of a folk
hero - a lone individual who, armed with only his own ingenuity, is able to
thwart the system. Not enough attention is paid to the real damage that
such people can do...when somebody tampers with someone else's data or
programs, however clever the method, we all need to recognise that such an
act is at best irresponsible and very likely criminal. That the offender
feels no remorse, or that the virus had unintended consequences does not
change the essential lawlessness of the act, which is in effect
breaking-and-entering. And asserting that the act had a salutary outcome,
since it led to stronger safeguards, has no more validity than if the same
argument were advanced in defense of any crime. If after experiencing a
burglary I purchase a burglar alarm for my house, does that excuse the
burglar? Of course not. Any such act should be vigorously prosecuted
(Parrish 1989).
Several of the above quotations are notable for their heavy reliance upon
the visual imagery of metaphors comparing the ethical issues arising from
computing with real-world situations, a topic that will be looked at
shortly.
6.3 REASONS FOR 'THEM AND US'
6.3.1 Ethical differences between the CSI and CU
Having identified the strength of feeling of hawkish views of hacking, this
section explores the ethical basis of that antagonism. The following
quotation from a member of the CSI illustrates the stark difference between
the ethical outlooks of certain members of the computing constituency.
Elements of the CSI vehemently oppose the "playpen attitude" advocated by
elements of the CU. Presupposing that no harm is done, hackers tend to
believe that it is not wrong to explore systems without prior permission,
whilst those concerned with the security of those systems would
characterise such a belief as offensive:
Just because YOU have such a totally bankrupt sense of ethics and propriety,
that shouldn't put a burden on *me* to have to waste my time dealing with
it. Life is short enough to not have it gratuitously wasted on
self-righteous, immature fools...If you want to 'play' on my system, you
can ASK me, try to convince me *a priori* of the innocence of your intent,
and if I say "no" you should just go away. And playing without asking is,
and should be criminal; I have no obligation, nor any interest, in being
compelled to provide a playpen for bozos who are so jaded that they cannot
amuse themselves in some non-offensive way (Cosell CUD 3:12).
When we examine the factors underpinning the CSI's and CU's contrasting
ethical interpretations we find an important feature is the tendency of the
CSI to denigrate, or devalue the ethics articulated by hackers. Bob
Johnson, a Senior Systems analyst and Unix System Administrator at a US
military installation criticises the justifications used by hackers as an
example of the modern tendency to indulge in "positional ethics".
Referring to the Internet worm case he states:
The majority of people refuse to judge on the basis of "right and wrong".
Instead, they judge the actions in terms of result, or based on actual
damages, or incidental damages or their own personal ideas. In my mind,
Morris was WRONG in what he did, regardless of damages, and should
therefore be prepared to pay for his deeds. Many others do not suffer from
this "narrow frame of mind". By the way, positional ethics is the same
line of reasoning which asks, "When would it be right to steal a loaf of
bread?" I believe that the answer is "It may someday be necessary, but
it's never right" (Bob Johnson: e-mail interview).
The "hawkish" elements of the CSI are unequivocal in their condemnation of
hacking and its lack of ethics. They argue that the lack of ethics shown
by hackers is indicative of a wider societal decline. Thus Smb
characterises the alleged degeneration of the average persons ethics, not
as a breakdown in morality, but rather as a spread of amorality: "I'm far
from convinced that the lack of ethics is unique to hackers. I think it's
a societal problem, which in this business we see manifested as hacking.
Amorality rather than immorality is the problem" (Smb: E-mail interview).
Similarly, Bob Johnson argues that:
In a larger sense, I view them [hacking and viruses] as part of the same
problem, which is a degeneration of the average persons ethics - i.e.
integrity and honesty. There's a popular saying in America - 'You're not
really breaking the speed limit unless you get caught. I believe an
ethical person would neither break into systems, nor write viruses (Bob
Johnson: e-mail interview).
Cosell takes this argument further, the "degeneration of the average
person's ethics" is applied to a loss of respect by hackers for property
rights:
The issue here is one of ethics, not damages. I'll avoid the "today's
children are terrors" argument, but some parts of that cannot be avoided:
the hackers take the point of view that the world at large OWES them
amusement, and that anything they can manage to break into is fair game [an
astonishing step beyond an already reprehensible position, that anything
not completely nailed down is fair game] (Cosell: e-mail interview).
A study into social and business ethical questions was carried out by
Johnston and Wood (1985, cited by Vinten 1990) for the British Social
Attitudes Survey. Apart from their major conclusion that the single most
important factor influencing the strength of people's ethical judgements
was age, it seems difficult to point to clear ethical boundaries and
guide-lines in relation to many of the situations that arise in the modern
world, especially in the realms of business. Thus in his summary of the
report Vinten describes how: "In situations ranging widely from
illegitimate tipping of dustmen to serious corruption, no clear-cut
boundaries emerged as between 'right' and 'wrong' ... Sub-group variation
was greatest where situations were complicated by motivation questions, and
by being remote from everyday experience" (Vinten 1990: 3). Hacking
fulfils both of these criteria.
The advent of "virtual reality" or "cyberspace" tends to divorce computing
from "everyday experience". This leads directly to an ambiguous ethical
status for many computing situations and a concomitant need to assert
ethical standards by the dominant social constituency if it is to succeed
in exerting control over computing. Vinten's study of computer ethics
(1990) points out that ethical judgements tend to be harsher, the older the
person making the judgements. Members of the CSI consistently have
strongly critical views of the ethical stance taken by hackers. They tend
to be older than hackers, having been involved with computers, as a career,
for many years. Hackers, in contrast, tend to use computers more as a
hobby and may hack in order to gain access to systems which their youth
precludes them from obtaining access to by legitimate means. This age
difference is perhaps one reason why there are such fundamental differences
in the ethical outlook of members of the CSI and CU4.
6.3.2 Fear of Anonymity
One of the common themes that stems from the CSI's perception of hackers is
their tendency to assume the worst intent behind the actions of intruders,
a tendency encouraged by the fact that hacking is intrinsically anonymous:
There is a great difference between trespassing on my property and breaking
into my computer. A better analogy might be finding a trespasser in your
high-rise office building at 3 AM, and learning that his back-pack
contained some tools, some wire, a timer and a couple of detonation caps.
He could claim that he wasn't planting a bomb, but how can you be sure?
(Cosell: e-mail interview).
Another vivid example of the doubt caused by the anonymity of hackers is
the comparison below made by Mike Jones of the DTI's security awareness
division. I pointed out that many hackers feel victimised by the
establishment because they believe it is more interested in prosecuting
them than patching up the holes they are pointing out with their activity.
Jones accepted that there was prejudice in the views of the CSI towards the
CU. That prejudice, however, is based upon the potential damage that
hackers can cause. Even if there is no malicious intention from the
hacker, suspicion and doubt as to what harm has been done exists:
Say you came out to your car and your bonnet was slightly up and you looked
under the bonnet and somebody was tampering with the leads or there looked
like there were marks on the brake-pipe. Would you just put the bonnet
down and say "oh, they've probably done no harm" and drive off, or would
you suspect that they've done something wrong and they've sawn through a
brake-pipe or whatever... say a maintenance crew arrived at a hanger one
morning and found that somebody had broken in and there were screw-driver
marks on the outside casing of one of the engines, now would they look
inside and say "nothing really wrong here" or would they say, "hey, we've
got to take this engine apart or at least look at it so closely that we can
verify that whatever has been done hasn't harmed the engine" (Jones:
London interview).
These two quotations proffer an important explanation of the alleged
paranoid and knee-jerk reactions to hacking activity from the computing
establishment. The general prejudice held by the CSI towards the CU is
heightened by the anonymous quality of hacking. The anonymity encourages
doubts and paranoia as a result of being unable to assess the motivation of
intruders and the likelihood that any harm that has been committed will be
difficult to uncover.
In addition to these points, the anonymity afforded by Computer Mediated
Communication (CMC) encourages hackers to project exaggeratedly threatening
personalities to the outside world and media. Barlow (1990) describes
meeting some hackers who had previously frightened him with their
aggressive e-mail posturing. When Barlow actually came face to face with
two of the hackers they:
were well scrubbed and fashionably clad. They looked to be as dangerous as
ducks. But ... as ... the media have discovered to their delight, the boys
had developed distinctly showier personae for their rambles through the
howling wilderness of Cyberspace. Glittering with spikes of binary chrome,
they strode past the klieg lights and into the digital distance. There
they would be outlaws. It was only a matter of time before they started to
believe themselves as bad as they sounded. And no time at all before
everyone else did (Barlow 1990: 48).
The anonymity afforded by CMC thus allows hacking culture to indulge in
extravagant role-playing which enhances the perception of it in the eyes of
outsiders as being a potentially dangerous underground movement. Hacking
groups generally choose colourful names such as "Bad Ass Mother Fuckers,
Chaos Computer Club, Circle of Death, Farmers of Doom"5, and so on.
6.4 THE ETHICAL BASIS OF THE 'THEM AND US' SCENARIO
6.4.1 Blurred and vestigial ethics
Cracking, virus writing, and all the rest, fall into the realm of
possibility when dealing with intelligent, curious minds. The ethics of
such things come later. Until then, users of computers remain in this
infancy of cracking, etc. (Kerchen: e-mail interview).
The ethical edges demarcating legal and illicit acts have a higher tendency
to be blurred whenever technology has a significant presence in the context
of the act. The acts of such figures as Captain Crunch have been received
with a combination of admiration and condemnation. Opposition to attempts
to commodify and institutionalise informational property relations can
exist in such rebellious manipulations of technology; but also more
'respectably' in the intellectual and political platforms of such figures
as Richard Stallman and the League for Programming Freedom. Activities
involving the use of computers have given rise to a number of qualitatively
new situations in which there is a debate as to whether the act in question
is ethical or not. These activities tend to centre upon such questions as
whether the unauthorised access to and/or use of somebody's computer,
system, or data can be adequately compared to more traditional crimes
involving the physical access or manipulation of material objects or
property.
An example of such ambiguity is the fact that whereas the idiosyncratic
behaviour of the early hackers of MIT was benignly tolerated now hacking is
portrayed in the press as having evil associations and is subject to legal
prosecution. This apparent change in social values has occurred despite
the fact that the motivations and lack of regard for property rights
associated with hacking have remained constant over time. Examples of the
previously ad hoc morality with respect to computers abound. The first
generation MIT hackers engaged in such illicit activity as using equipment
without authorisation (Levy 1984: 20), phone phreaking (pg 92),
unauthorised modification of equipment (pg 96) and the circumvention of
password controls (Pg 417)6. Bloombecker gives the example of how
authority's reaction to the behaviour of small school children may
represent society's ambivalent response to the computing activities it
originally encourages. Definitive ethical judgements can prove difficult
to make in certain situations:
Think of the dilemma expressed unknowingly by the mathematics teacher who
spoke of the enthusiasm her 9 and 10-year-old students exhibited when she
allowed them to use the school's computers. "They are so excited" she
said, "that they fight to get onto the system. Some of them even erase
others' names from the sign-up lists altogether". The idea that this was
not good preparation for the students' moral lives seemed never to have
occurred to her ... Unfortunately, both for society and for those that need
the guidance, there is no standard within the computer community to define
precisely when the playing has got out of hand. If a student uses an hour
of computer time without permission, one university computer department may
consider it criminal theft of service, while another views it as an
exercise of commendable ingenuity (Bloombecker 1990: 42).
This ambiguous ethical status of some computing activities is due to the
relatively recent advent of computing as an area of human endeavour; this
has led to a lack of readily agreed-upon computing mores: "Indeed, if we
were to devise a personality test designed to spot the computer criminal,
the first and most difficult task would be to create a task that did not
also eliminate most of the best minds who have made computing what it is"
(Bloombecker 1990: 39). There is the further complicating factor, that to
some extent at least, society encourages "getting hooked" upon computing,
since it is perceived as representing a beneficial outlet for intellectual
endeavour. We now turn to more specific examples of computing's ethical
complexity.
6.4.2 Industry examples of blurred ethics
There is often a lack of agreement even amongst computer professionals as
to what constitutes the correct procedures with which to confront certain
research and educational issues within computing. A specific example of
this lack of agreement is the debate caused by the publication of an
article by Cohen, entitled "Friendly contagion: Harnessing the Subtle
Power of Computer Viruses" (1991). In the article, Cohen suggests that the
vendor of a computer virus prevention product should sponsor a contest
encouraging the development of new viruses, with the provisos that the
spreading ability of the viruses should be inherently limited, and that
they should only be tested on systems with the informed consent of the
systems owners. Spafford responded with the charge that: "For someone of
Dr Cohen's reputation within the field to actually promote the
uncontrolled writing of any virus, even with his stated stipulations, is to
act irresponsibly and immorally. To act in such a manner is likely to
encourage the development of yet more viruses "in the wild" by muddling the
ethics and dangers involved" (Spafford 1991: 3). Furthermore, even the
publication of "fixes" can be viewed in certain instances as an unethical
act, leading to what has been previously described as the phenomenon of
"security through obscurity". Spafford argues that: "We should realize
that widespread publication of details will imperil sites were users are
unwilling or unable to install updates and fixes. Publication should serve
a useful purpose; endangering the security of other people's machines or
attempting to force them into making changes they are unable to make or
afford is not ethical" (Spafford 1990:12).
The disagreement over some of the ethical questions thrown up by hacking
was also in evidence in the aftermath of the Internet Worm when a debate
raged amongst computer professionals as to the ethical and technical
implications of the event. The debate tending to support the above
argument positing ethical sub-group variation and a general lack of
clear-cut moral boundaries as typical of the modern ethical environment,
especially when there are contrasting opinions as to the originating
motivations behind specific acts. Such a debate was reflected in the
"Communications of the Association of Computing Machinery (ACM)" Forum of
Letters, where even the ACM's president received quite strident criticism
for his position indicated in the title of his letter: "A Hygiene Lesson",
that the Internet Worm could be viewed as beneficial in so far as it
increased awareness of security practices. The president's view was
described by one contributor to the forum as, "a massive error in judgement
which sends the wrong message to the world on the matters of individual
responsibility and ethical behaviour ... [it] is inexcusable and an
exercise in moral relativism" (Denning, Peter 1990: 523). Similarly,
another writer illustrates the disparate nature of the feelings produced by
the Internet Worm incident when he pointedly remarks:
while Spafford praises the efficacy of the ''UNIX 'old boy' network" in
fighting the worm, he does not explain how these self-appointed fire
marshals allowed such known hazards to exist for so long ... If people like
Morris and people like him are the greatest threat to the proper working of
the Internet then we face no threat at all. If, on the other hand, our
preoccupation with moralizing over this incident blinds us to serious
security threats and lowers the standards of civility in our community,
then we will have lost a great deal indeed (Denning, Peter 1990: pp 526
+7).
6.4.3 Technology and ethics
Underlying some of these problems with ethics has been the tendency
identified by Spafford (1990) to "view computers simply as machines and
algorithims, and ... not perceive the serious ethical questions inherent in
their use" (Spafford 1990: 12). Spafford points to the failure to address
the end result of computing decisions upon people's lives, and hence the
accompanying failure to recognise the ethical component of computing. As a
result, he argues, there is a subsequent general failure to teach the
proper ethical use of computers:
Computing has historically been divorced from social values, from human
values, computing has been viewed as something numeric and that there is no
ethical concern with numbers, that we simply calculate values of 0 and 1,
and that there are no grey areas, no impact areas, and that leads to more
problems than simply theft of information, it also leads to problems of
producing software that is also responsible for loss and damage and hurt
because we fail to understand that computers are tools whose products ...
involve human beings and that humans are affected at the other end
(Spafford US interview).
This is due to the fact that often the staff of computer faculties are
uncomfortable with the subject, or don't believe it's important. Their
backgrounds are predominantly in mathematics or scientific theory and hence
they don't adequately understand how practical issues of use may apply to
computing. Spafford suggests that engineering provides a more appropriate
model of computing than science in so far as it addresses the human as well
as the scientific dimensions.
Computer science is really, in large part an engineering discipline and that
some of the difficulties that arise in defining the field are because the
people who are involved in computing, believe it's a science and don't
understand the engineering aspects of it. Engineers, for a very long time,
have been taught issues of appropriateness and ethics and legality and it's
very often a required part of engineering curricula ... computing is more
than just dealing with numbers and abstractions, it does in fact have very
strong applications behind it, a very strong real-world component (Spafford
US interview).
The extent to which computing has a non-material dimension, however,
constantly mitigates against Spafford's desire for computing to be
ethically approached in a similar manner to an engineering discipline.
There is a fundamental difference between the 'real world' and the 'virtual
world' of computing, and it is this difference which makes the literal
transposing of ethical judgements from the former to the latter, difficult,
if not untenable. The correct balance with which to transpose ethical
judgements from one realm to another is debateable.
6.5 BOUNDARY FORMATION - ROLE OF THE MEDIA
This section debunks some of the sensationalising, demonising, and
mythologising of hacking that has occurred with the recent spate of books,
articles and television programmes dealing with the issue. It also
corrects the overwhelming tendency of most of the writings on the subject
of hacking to concentrate on the minutiae of the activities and life
histories of hackers or their adversaries. Frequently, but superficially,
deep-rooted psychological abnormalities are offered as explanations for
hacking activity, whilst ignoring the ethical and political implications of
those acts. The overall effect of the media portrayal of hacking, it could
be suggested, is a continuation by other means of the CSI's project of
stigmatisation and closure.
(i) 'Hacker best-sellers'
Two examples of the tendency towards sensationalism are The Cuckoo's Egg by
Clifford Stoll and Cyberpunk by Hafner and Markoff. An example of the many
uses of hyperbole in their choice and tone of language is their
consideration of the issues at stake in the hiring of a hacker for security
work. "But hire such a mean-spirited person? That would be like giving
the Boston Strangler a maintenance job in a nursing-school dormitory"
(Hafner and Markoff, 1991: 40). Both of these books made a large impact on
the computing public and yet both seem self-indulgent in their reliance
upon trivial and tangential details in the narration of different hacking
episodes. In The Cuckoo's Egg, for example, we are given various
descriptions of the author's girlfriend and seemingly irrelevant details of
their shared Californian lifestyle. In Cyberpunk, many unsubstantiated
conjectures are made as to the state of mind of the hacker. Thus the
authors write about Kevin Mitnick:
When Kevin was three, his parents separated. His mother, Shelly got a job as
a waitress at a local delicatessen and embarked upon a series of new
relationships. Every time Kevin started to get close to a new father, the
man disappeared. Kevin's real father was seldom in touch; he remarried and
had another son, athletic and good-looking. During Kevin's high school
years, just as he was getting settled into a new school, the family moved.
It wasn't surprising that Kevin looked to the telephone for solace (Haffner
and Markoff 1991: 26).
This somewhat arbitrary assignation of motivation leads the authors to
label Kevin Mitnick as the "dark-side" hacker, whereas their analysis of
Robert Morris, author of the Internet Worm, is much less condemning despite
the fact the latter was responsible for much more damage and man-hours of
data-recovery time.
(ii) Press and Television
The media faces, in its reporting of computer security issues, the
perennial problem of how to report technical issues in a both accurate and
entertaining manner. Generally, the media has tended towards reporting
those stories that contain the highest degree of 'electronic lethality' and
it has exaggerated the 'darkness' of hacking motives. For example, a
Channel Four television documentary "Dispatches" entitled its investigation
of hacking "The day of the Technopath", whilst the February 1991 edition of
GQ magazine concerned the growth of virus writers in Bulgaria and was
called "Satanic Viruses".
Along with the above two treatments of the computer security issue I will
also look at a Sunday Correspondent article of the 17th December 1989
entitled "A Bug in the Machine" and part of the transcript of an episode
of the U.S. current affairs/chat-show programme, "Geraldo", for a sample of
media treatments of the hacking issue. The television portrayals of the
problem of computer security seem to be the most superficial and dependent
upon sensationalising techniques. Newspaper and magazine articles to give
relatively thorough and accurate technical descriptions of what it is to
hack/write viruses but still make disproportionate use of 'dark-side'
imagery7.
"A Bug in the Machine"
This article is an example of the tendency of the press to concentrate upon
the "sexy" elements of computer security stories. It contains a cynical
description of Emma Nicholson M.P.'s unsubstantiated claims that hacking
techniques are used for terrorist purposes by the European Green movement
amongst others and her emotive description of hackers as: " ... malevolent,
nasty evil-doers who fill the screens of amateur users with pornography"
(Matthews 1989: 39). Yet whilst dispelling some of the alarmist tendencies
of such claims, the example of a hacker chosen by the journalists is that
of the "computer anarchist Mack Plug". Apart from making their own
unsubstantiated claim that "Nearly all hackers are loners" (a contention
refuted by my interviews with groups of Dutch hackers), their description
of his hacking activity seems to deliberately over-emphasise the more
"glamorous" type of hacking at the expense of describing the more mundane
realities and implications of everyday hacking:
At the moment he is hacking electronic leg tags. "I've got it down to 27
seconds" he says, "All you have to do is put a microset recorder next to
the tag and when the police call to check you're there, you tape the tones
transmitted by the tag and feed them on to your answering machine. When
the cops call back again, my machine will play back those tones. I'll have
a fail-safe alibi and I can get back to hacking into MI5 (Matthews 1989:
39).
Geraldo Programme8
On September 30th 1991, the Geraldo chat-show focused on hacking. It
involved a presentation of various hacking cameo shots, one of which showed
Dutch hackers accessing US Department of Defense computers with super-user
status. The studio section of the show involved an interview with Craig
Neidorf (alias Knight Lightning), who underwent a court case in the U.S.
for having allegedly received the source code of the emergency services
telephone computer programs. Also interviewed was Don Ingraham the
prosecuting attorney in Neidorf's case.
Below I include excerpts from the dialogue that ensued as an example of the
extent to which hacking is presented in the media in a superficial,
trivialised and hyperbolic manner. In the introductory part of the show,
excerpts from the film "Die Hard II" are shown in which terrorists take
over the computers of an airport. The general tone of the show was
sensationalistic with one of the guest hackers Craig Neidorf being
repeatedly called the "Mad Hacker" by Geraldo and Don Ingraham consistently
choosing emotive and alarmist language as shown in the following examples:
Geraldo: Don, how do you respond to the feeling common among so many hackers
that what they're doing is a public service; they're exposing the flaws in
our security systems?
Don: Right, and just like the people who rape a co-ed on campus are
exposing the flaws in our nation's higher education security. It's
absolute nonsense. They are doing nothing more than showing off to each
other, and satisfying their own appetite to know something that is not
theirs to know.
And on the question of th
give, in 30 seconds, a worst case scenario of what could result from the
activities of hackers. To which he replies: "They wipe out our
communications system. Rather easily done. Nobody talks to anyone else,
nothing moves, patients don't get their medicine. We're on our knees."
Dispatches - "the day of the technopath"9
Emma Nicholson M.P. interviewed in the Dispatches programme, states, "A
really good hacker could beat the Lockerbie bomber any day, hands down"
and, "Perhaps only a small fraction of the population dislikes the human
race, but they do, and some of them are highly computer-skilled".
The following is another example taken from the programme's voiced-over
commentary:
Until now the computer hacker has been seen affectionately as a skilled
technocrat, beavering away obsessively in his den, a harmless crank
exploring the international computer networks for fun. But today it's
clear that any computer, anywhere, can be broken into and interfered with
for ulterior motives. The technocrat has mutated to the technopath ...
government and business are reluctant to admit that they're fragile and
vulnerable to such threats, frightened of either the loss of public
confidence or of setting themselves up as targets for the technopaths who
stalk their electronic alleyways.
(End of Part one of Chapter 6; Part II follows)
------------------------------
End of Part 1 (of 2) Computer Underground Digest #9.59
************************************
|
|
