|
|
 Featured Opinion: Q&A: Is Hacking Ethical
by Marcia J. Wilson, CCSP Staff
Writer
May 08, 2004
"Reprinted from MARCH 24, 2004
"
The definition of hacker has changed radically over the years. With the
aid of the mass media, the word has developed a negative connotation rather than
the positive one it used to have. Add ethical in front of hacker,
and it's even more confusing.
For the purposes of this article, I'll define those hackers with malicious
intent as "crackers." Hackers can be categorized into the following three
buckets:
- Hacktivists: Those who hack as a form of political activism.
- Hobbyist hackers: Those who hack to learn, for fun or to share with other
hobbyists.
- Research and security hackers: Those concerned with discovering security
vulnerabilities and writing the code fixes.
Since The Hacker Manifesto was published in 1986, computer security has
become a national concern, especially after the terrorist attacks of Sept. 11,
2001. The casual hacker no longer has the freedom to poke around public or
private networks without raising the concerns of law enforcement agencies.
Laws have been passed or refined that make it a crime to hack. Many
hacktivists and hobbyists are more careful when pursuing their activities to
avoid being arrested, fined or jailed for their activities. Many have
legitimized their activities and hobbies by taking jobs in the computer security
profession, starting their own security consulting companies, working in the
open-source community or through other openly public and cooperative ways.
The Computer Security Act of 1987 has received more notice since the Sept. 11
attacks. The act is a declaration by Congress that improving the security and
privacy of sensitive information in federal computer systems is in the public
interest. The threat of cyberterrorism has increased focus on this piece of
legislation, as well as the more recent USA Patriot Act.
As a result of increased anxiety over terrorist threats, federal and state
laws have changed to make it an offense to "break and enter" a private or public
network without permission. Federal law has required companies to comply with
privacy requirements, business controls and corporate governance standards.
These laws have brought pressure to bear on our increasing responsibility to
secure the infrastructure and have made it more difficult for hackers to
practice their hacktivism, hobbies or research.
Technology has also affected hacking activities. In response to legislation
about privacy, business controls and terrorism, companies interested in
capitalizing on the opportunities that exist have developed and manufactured
sophisticated security hardware and software. The increased sophistication of
these products has made the job of the hacker more difficult, and the casual
hacker may stupidly get caught when attempting to circumvent a complex security
system.
Education and awareness campaigns have also made an impact on hacking
activities. Companies and government agencies have become more aware of security
issues. Some train their employees on security-conscious use of their computers.
The famous hacker Kevin Mitnick declared that social engineering was his primary
tool.
Where have all the hackers gone? Have they gone more underground or taken
"real" jobs? There is continuing debate over the ethics of hiring a former
cracker, especially one with a criminal record, and placing him in a position of
responsibility in a security capacity. I suspect that this is going to continue
to be a difficult debate. Since the laws have become stricter, hacktivists and
hobbyists are at risk of being labeled crackers.
What should our response be to crackers, who focus on hacking for personal
gain and whose intent is to steal, threaten and destroy? Throw them in jail and
throw away the key! What should our response be to the three categories of
hackers? Do the First and Fourth Amendments of the U.S. Constitution protect
hacktivism? Is there a way that hobbyists can work with the community to serve
their interests, maintain their integrity and gain the trust of the public and
private sector? Can we embrace the hobbyists and separate the crackers from the
mix and treat the two groups differently? Can we educate our children on the
differences, emphasizing right from wrong while supporting and promoting
passion, creativity and freedom?
Is hacking ethical? It is if viewed within the context of the three
definitions offered: hacktivist, hobbyist and researcher. We have the right in
this country to protest, and if our activism takes a digital or electronic form,
we have the right to do so. But don't take my word for it, explore this
excellent article by Dorothy E. Denning at Georgetown University, "Activism, Hacktivism, and Cyberterrorism: The Internet as a Tool for
Influencing Foreign Policy." It will make you think.
We have the right to peaceably assemble, and that may mean "sitting in" on a
Web site or physically locking arms side by side with others in a large city's
downtown intersection.
We have the right to free speech. Researching vulnerabilities and reporting
those vulnerabilities is also our right, even if big companies like Oracle
Corp., Apache Digital Corp., Microsoft Corp. or Hewlett-Packard Co. get angry
and threaten us with lawsuits. That's par for the course.
I would like to see citizens better protected against big business and
government. I don't want a huge company with lots of money to snuff out the
fire, passion or interests in my life, and I don't want the federal or state
government telling me what I can and can't do by broadening their powers via the
Patriot Act.
I believe hackers have a lot to offer. They provide a balance of power by
virtue of their creativity and technical skills. I think we need to protect and
recognize them and find ways of working together.
Yes, I do believe that hacking -- when properly defined -- is an ethical
activity. And yes, I do believe that understanding our freedoms and rights and
protecting all that's good in our society while preventing all that's bad is the
right approach.
*Note: Some links to stories may no longer function or now require you to
register to view.
by
Marcia J. Wilson ComputerCops Staff Writer
Marcia J. Wilson,
holds the CISSP designation and is the founder and CEO of Wilson Secure LLC, a
company focused on providing independent network security assessment and risk
analysis. She is also a free lance columnist for Computer World and Security
Focus.
She can be reached at marcia@wilsonsecure.com. Corporate
website: wilsonsecure.com (see
Prime Choice top left)
Copyright ©Marcia J. Wilson All Rights
Reserved 2004
|
|
|
 |
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 2.66
Votes: 3
|
|
|
