7 ms·

Teenage hackers are offered a second chance under European experiment

97 points by ga-vu 7y ago

icu 7y ago
I think this is a great idea, young people will always push the envelope in terms of risky behaviour. A 'scare' with a structured process that includes mentorship could harnesses a young hacking talent and be positive outcome for the youngster and society in general. Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US?
- adventured 7y ago
  > Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US? No. The headline is misleading. This isn't "Europe" doing it (as though Europe were uniform, rather than wildly different from Germany to Lithuania to Bulgaria to Russia to Italy to Spain to Belarus). The article is pitching an artificially wide premise, as a form of clickbait. It's not "European authorities," it's police in the UK and Netherlands. It won't make any consequential difference at a global industrial scale. $1 trillion in venture capital - leading to the creation of the largest cybersecurity tech companies - every 10 years and paying extremely high salaries to attract the best talent, is all that moves the needle on cybersecurity. Everything else is a blip at best. On what matters, Western Europe - Europe as a whole in fact, the rest of Europe is even further behind - can't or won't compete, save for a few rare exceptions. Only the US and China are on the field. Everybody else is watching from the sidelines.
  - yowlingcat 7y ago
    Not sure why you're getting downvoted, I think you have a point. Perhaps it's because folks could be skeptical that $1T will lead to the the creation of next gen good cybersecurity tech companies rather than abject cash grabs that ultimately fail. Regardless, infrastructural tooling for usable organizational and societal level security is still not where it could be, and I don't know what it will take to get it there. Just throwing a wild gut feeling out there, it feels a bit like healthcare to me. There needs to be some kind of standardization and some kind of a standards body (likely governmental) that coordinates security as if it's an existential societal risk if done poorly, in the same way that epidemiology is done with respect to public health. Security hygiene and literacy needs to become a basic part of societal culture for any of this to change; not just that, but catastrophic adverse events that occur as a result of infosec braches ought to be rectified more thoroughly, and insurance taken out to fully indemnify against them. I don't see any of that happening, so I don't really see the foundation for any change towards a more digitally secure society. I hope I'm wrong.
  - jplayer01 7y ago
    > Only the US and China are on the field Is this really the case? Most of what I see in US news is how yet another adolescent or teenage hacker was caught and faced stiff penalties and consequences, far out of balance to what the hacker actually did to make an example of him. If there's a thriving cybersecurity scene in the US, I'd say it's largely due to the private sector and not anything the US government or any of its institutions (on a federal or state or local level) have done to encourage exploration into hacking. Which is unfortunate, because it's increasingly an important topic in the modern environment.
  - saagarjha 7y ago
    So you’re looking into investing at a rate equal to the total VC funding in Silicon Valley?
- microcolonel 7y ago
  As far as I'm aware, a lot of former black hats who are not sociopaths end up in the private sector.
- alt_f4 7y ago
  > Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US? It won't because the article is misleading wrt to the "European" approach, in that, there is no such agreed EU-wide approach. For example, this bit below: > Bulgarian police last week released a 20-year-old security specialist accused of hacking the country’s National Revenue Agency, and accessing information about 5 million people, most of Bulgaria’s population is actually just false. Bulgarian police released the guy on bail and then proceeded to charge him with cyber terrorism (15 years in prison). They also arrested his supervisor, issued a European Arrest Warrant for owner of the company he works for (who is apparently abroad on unrelated business) and raided the offices of the company, taking all computers and IT equipment and essentially destroying the business. It's currently unclear on what evidence they decided to nuke the company.
- tootahe45 7y ago
  The people this has been aimed at are those who pay $10 a month to boot someone's ip offline or to buy some half-assed malware program (most don't manage to even do the payment without getting caught, see link), so it's not exactly Einstein we're saving from prison time here. https://www.cbronline.com/news/webstresser-arrests-interpol https://www.cbronline.com/news/webstresser-arrests-interpol
yorwba 7y ago
More information on "Hack_Right" in Dutch: https://magazines.openbaarministerie.nl/opportuun/2018/02/hackright https://magazines.openbaarministerie.nl/opportuun/2018/02/ha... Google Translate seems to do a reasonable job: https://translate.googleusercontent.com/translate_c?depth=2&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=https://magazines.openbaarministerie.nl/opportuun/2018/02/hackright&xid=17259,15700021,15700186,15700191,15700256,15700259,15700262,15700265&usg=ALkJrhiqHh7nlScakVIZpw53RP3tNoCAvA https://translate.googleusercontent.com/translate_c?depth=2&...
o_p 7y ago
Wageslaving is better than prison, I guess.
- Avamander 7y ago
  The program doesn't even guarantee that, the Dutch article has a sentence like "With Hack_Right, other punishments, such as imprisonment, are not excluded." There's a chance Google Translate got the sentence wrong but I doubt it.
- pvaldes 7y ago
  In many countries a 12 years old is not eligible for prison. All minors do silly things. It is expected. If they tell to the child that can put him/her in prison they are lying and they parents must talk with a lawyer ASAP.
contravariant 7y ago
It's worth pointing out that the Netherlands already had programs and the legal foundations for more lenient punishments for 12~23 year olds, which I imagine might be why this experiment started in the Netherlands (with, by the looks of it, support from some EU agency). I hope it succeeds.
- coretx 7y ago
  One word: Kapotgepolderd.
LifeLiverTransp 7y ago
Teenagers prosecuted less hard for finding out the software foundations of society are build out of the equivalent of jello. Law to protect cooperations from fiscal fallout due to prevent tech debt and finance proper security made more lenient.
Avamander 7y ago
I know kids will be just guilt-tripped admitting menial stuff like "you looked at how your teacher peck-typed her password and changing her wallpaper", "you found out that the school Administrator account has the password `admin`" or "you downloaded a movie", I've seen such nasty manipulation happen. A lot of adults are really petty when their incompetence is revealed, due to that they probably have no proof and this "Please confess for less punishment" lie is their only way in actually messing up kid's lives. This only feels like a weak attempt at making gullible young people make a mistake (from their perspective) by admitting they've done something illegal (from the accuser's perspective). Especially given there's no legal protection and there's condescension and prejudiced when whitehat ways are picked, that should be fixed first. I hope this endeavor fails because it's just nasty.
- yorwba 7y ago
  > this "Please confess for less punishment" lie is their only way in actually messing up kid's lives. There's no indication that the intervention is predicated on confessing. I think you might be looking at this from the perspective of a legal system where plea bargains are a thing. In most of Europe, promising less punishment for a confession doesn't work, because the prosecutor doesn't have the right to interfere with the judge's decision, and therefore can't credibly promise that the punishment will be less. E.g. the Dutch article I linked in another comment mentions the following case: The police expected to roll up a large criminal organization, but eventually ended up in a boys' room somewhere in the Netherlands. “We noticed from cyber crime officers that they often saw things like this, in which the young people did not realize how serious the fact is that they were committing. The officers did not know which intervention would be best for them. After all, the perpetrators have done something very serious, but they are still young and often deviate from the traditional perpetrators, "explains Van Dijk. Dows that sound like petty adults using nasty manipulation to mess up kid's lives?
  - Avamander 7y ago
    > There's no indication that the intervention is predicated on confessing. The article basically says that an admission of guilt is required. Otherwise the person would stay a suspect not a participant of the program. > the perpetrators have done something very serious And what is "the perpetrators have done something very serious"? By law piracy is very serious, changing a wallpaper can be very serious (there's a nice US case about that, but that's not incredibly relevant). > Dows that sound like petty adults using nasty manipulation to mess up kid's lives? It isn't maybe written like that, but it's going to be like that. Especially given the concerns I raised in the original comment, for example the issue of laws criminalizing menial things.
solotronics 7y ago
If the US wanted to take the cyber battlefield seriously they would recruit all these kids and put their skills to work.
- pvaldes 7y ago
  This is just fearshopping. Why to pay, when can scare them, coarce and make them fix their stuff for free or a candy? Laws are not the same for a minor.
bkohlmann 7y ago
All for this - and if it’s successful, I wonder if cybercrime will increase in this region as folks with few prospects take a shot at getting a good job via “non traditional” means
faissaloo 7y ago
'Hack_Right', really? That's the best they could come up with?
lone_haxx0r 7y ago
I wonder if someday laws will be based on a formal moral foundation instead of making things illegal just because 80% of people don't like those things. I think hacking is one of those things that are illegal because people don't like them. Ultimately, hacking is just sending messages through a wire. Objectively speaking, it isn't much different from hitting the like button on a Youtube video. Formally speaking, all messages sent over the Internet are numbers, so "anti-hacking laws" are essentially laws that make some arbitrary and undisclosed set of numbers illegal to send.
- vkou 7y ago
  Shooting people is just pulling a small lever. Objectively speaking, it's not much different from driving a car. Formally speaking, it's the same as making physical labor illegal. Just because you can do something doesn't mean you should. Just because you can pick the lock on my apartment door, doesn't mean that I shouldn't have an issue with it. Just because lockpicking is technically just sticking a 'key' into a lock, and turning the bolt doesn't mean it's the same bloody thing. Intent matters. Outcome matters. Somebody lockpicking my door, to save my cat from a fire, or to deal with a burst pipe, or to respond to an emergency call is one thing. Somebody lockpicking my door, to have a look at my stuff, can, and should fuck off straight to prison. Or, at least, a couple of hundred hours of community service.
  - lone_haxx0r 7y ago
    I never said that anything we can do should be legal. I said that there should be a consistent moral framework upon which all laws should be based. And I think that laws should be defined objectively, not based in intent or outcome, but in facts. > Shooting people is just pulling a small lever. Objectively speaking, it's not much different from driving a car. Shooting people is more like throwing stones at them. If you own a gun, you're responsible for knowing that pulling the lever implies shooting projectiles at them. I think throwing projectiles at someone should be illegal (above some reasonable threshold of momentum. e.g (5 g * 2 m/s)). Picking someone's lock can be considered handling someone else's property without permission. (Physically) handling someone else's property without permission should also be illegal. All of these things are physical actions. The state should care about the physical actions of their citizens, but not about ideas, concepts, intent, or arbitrary abstractions. Those abstractions are the citizen's business, and legislating them is arbitrary and unfair. If I have a mental breakdown every time someone says hello to me, then should we make it illegal to say hello to me? After all, they're causing me severe mental distress and maybe I could lose my job because of these people. In my opinion, it would be unfair to ban "hello" because one person doesn't like it. It's my problem to have a mental breakdown because of specific messages, not yours or the state's. Same principle applies to software. If your website has a breakdown every time I send specific IP packets, that's your problem, not mine or the state's.
Waterluvian 7y ago
If anyone can remind me of the name of this software used to lock down windows 98 machines I'd appreciate it. It was IBM I think. Blue background for student. Green for teacher. Red for admin. I learned how to bypass it and discovered winpopup. I messaged every computer in the school district with my account like an idiot 9th grader. I then learned a lot about getting caught, punished, and second chances. I was lucky that the powers that be didn't overblow what I did.
- coretx 7y ago
  That was called various names, winnuke being one of them. It was nothing but a manually crafted TCP or UDP packet causing winsock to segfault.
dawhizkid 7y ago
I wonder if the US will ever release Ross Ulbricht...no way it will happen under Trump but possibly at the end of an 8-year term for a Democrat...
thomasfedb 7y ago
The concept here is crucial — respond to adventurous behaviour with clear-headed guidance. I 'hacked' my school as a teenager and disclosed my findings — I received a 'thank you' and a free pass to skip the helpdesk and talk to the sysadmins whenever I wanted.
throwaway3627 7y ago
Wasn't there a similar program long-ago in the US where the FBI/DOJ/USDC diverted first-time offenders into working with US-CERT instead of Aaron Swartzing them?
siruncledrew 7y ago
It seems like it would make sense to list the crimes that would fall under the "second chance" agreement to provide more information. Like, some dingus 'hacking' into their school to change their sick days is very different than the criminal context of a 16 year old buying stolen credit cards online and using them to sell stuff on Instagram. The type of kid that would fall into the police's 'naive-idiot' hacker criteria for this program is also probably not someone that would fare well in prison either.

97 points by ga-vu 7y ago

icu 7y ago

I think this is a great idea, young people will always push the envelope in terms of risky behaviour. A 'scare' with a structured process that includes mentorship could harnesses a young hacking talent and be positive outcome for the youngster and society in general. Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US?

adventured 7y ago
> Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US? No. The headline is misleading. This isn't "Europe" doing it (as though Europe were uniform, rather than wildly different from Germany to Lithuania to Bulgaria to Russia to Italy to Spain to Belarus). The article is pitching an artificially wide premise, as a form of clickbait. It's not "European authorities," it's police in the UK and Netherlands. It won't make any consequential difference at a global industrial scale. $1 trillion in venture capital - leading to the creation of the largest cybersecurity tech companies - every 10 years and paying extremely high salaries to attract the best talent, is all that moves the needle on cybersecurity. Everything else is a blip at best. On what matters, Western Europe - Europe as a whole in fact, the rest of Europe is even further behind - can't or won't compete, save for a few rare exceptions. Only the US and China are on the field. Everybody else is watching from the sidelines.
- yowlingcat 7y ago
  Not sure why you're getting downvoted, I think you have a point. Perhaps it's because folks could be skeptical that $1T will lead to the the creation of next gen good cybersecurity tech companies rather than abject cash grabs that ultimately fail. Regardless, infrastructural tooling for usable organizational and societal level security is still not where it could be, and I don't know what it will take to get it there. Just throwing a wild gut feeling out there, it feels a bit like healthcare to me. There needs to be some kind of standardization and some kind of a standards body (likely governmental) that coordinates security as if it's an existential societal risk if done poorly, in the same way that epidemiology is done with respect to public health. Security hygiene and literacy needs to become a basic part of societal culture for any of this to change; not just that, but catastrophic adverse events that occur as a result of infosec braches ought to be rectified more thoroughly, and insurance taken out to fully indemnify against them. I don't see any of that happening, so I don't really see the foundation for any change towards a more digitally secure society. I hope I'm wrong.
- jplayer01 7y ago
  > Only the US and China are on the field Is this really the case? Most of what I see in US news is how yet another adolescent or teenage hacker was caught and faced stiff penalties and consequences, far out of balance to what the hacker actually did to make an example of him. If there's a thriving cybersecurity scene in the US, I'd say it's largely due to the private sector and not anything the US government or any of its institutions (on a federal or state or local level) have done to encourage exploration into hacking. Which is unfortunate, because it's increasingly an important topic in the modern environment.
- saagarjha 7y ago
  So you’re looking into investing at a rate equal to the total VC funding in Silicon Valley?
microcolonel 7y ago
As far as I'm aware, a lot of former black hats who are not sociopaths end up in the private sector.
alt_f4 7y ago
> Over the long term I wonder if this will give Europe an edge in cybersecurity relative to the US? It won't because the article is misleading wrt to the "European" approach, in that, there is no such agreed EU-wide approach. For example, this bit below: > Bulgarian police last week released a 20-year-old security specialist accused of hacking the country’s National Revenue Agency, and accessing information about 5 million people, most of Bulgaria’s population is actually just false. Bulgarian police released the guy on bail and then proceeded to charge him with cyber terrorism (15 years in prison). They also arrested his supervisor, issued a European Arrest Warrant for owner of the company he works for (who is apparently abroad on unrelated business) and raided the offices of the company, taking all computers and IT equipment and essentially destroying the business. It's currently unclear on what evidence they decided to nuke the company.
tootahe45 7y ago
The people this has been aimed at are those who pay $10 a month to boot someone's ip offline or to buy some half-assed malware program (most don't manage to even do the payment without getting caught, see link), so it's not exactly Einstein we're saving from prison time here. https://www.cbronline.com/news/webstresser-arrests-interpol https://www.cbronline.com/news/webstresser-arrests-interpol

yorwba 7y ago

More information on "Hack_Right" in Dutch: https://magazines.openbaarministerie.nl/opportuun/2018/02/hackright https://magazines.openbaarministerie.nl/opportuun/2018/02/ha... Google Translate seems to do a reasonable job: https://translate.googleusercontent.com/translate_c?depth=2&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=https://magazines.openbaarministerie.nl/opportuun/2018/02/hackright&xid=17259,15700021,15700186,15700191,15700256,15700259,15700262,15700265&usg=ALkJrhiqHh7nlScakVIZpw53RP3tNoCAvA https://translate.googleusercontent.com/translate_c?depth=2&...

o_p 7y ago

Wageslaving is better than prison, I guess.

Avamander 7y ago
The program doesn't even guarantee that, the Dutch article has a sentence like "With Hack_Right, other punishments, such as imprisonment, are not excluded." There's a chance Google Translate got the sentence wrong but I doubt it.
pvaldes 7y ago
In many countries a 12 years old is not eligible for prison. All minors do silly things. It is expected. If they tell to the child that can put him/her in prison they are lying and they parents must talk with a lawyer ASAP.

contravariant 7y ago

It's worth pointing out that the Netherlands already had programs and the legal foundations for more lenient punishments for 12~23 year olds, which I imagine might be why this experiment started in the Netherlands (with, by the looks of it, support from some EU agency). I hope it succeeds.

coretx 7y ago
One word: Kapotgepolderd.

LifeLiverTransp 7y ago

Teenagers prosecuted less hard for finding out the software foundations of society are build out of the equivalent of jello. Law to protect cooperations from fiscal fallout due to prevent tech debt and finance proper security made more lenient.

Avamander 7y ago

I know kids will be just guilt-tripped admitting menial stuff like "you looked at how your teacher peck-typed her password and changing her wallpaper", "you found out that the school Administrator account has the password `admin`" or "you downloaded a movie", I've seen such nasty manipulation happen. A lot of adults are really petty when their incompetence is revealed, due to that they probably have no proof and this "Please confess for less punishment" lie is their only way in actually messing up kid's lives. This only feels like a weak attempt at making gullible young people make a mistake (from their perspective) by admitting they've done something illegal (from the accuser's perspective). Especially given there's no legal protection and there's condescension and prejudiced when whitehat ways are picked, that should be fixed first. I hope this endeavor fails because it's just nasty.

yorwba 7y ago
> this "Please confess for less punishment" lie is their only way in actually messing up kid's lives. There's no indication that the intervention is predicated on confessing. I think you might be looking at this from the perspective of a legal system where plea bargains are a thing. In most of Europe, promising less punishment for a confession doesn't work, because the prosecutor doesn't have the right to interfere with the judge's decision, and therefore can't credibly promise that the punishment will be less. E.g. the Dutch article I linked in another comment mentions the following case: The police expected to roll up a large criminal organization, but eventually ended up in a boys' room somewhere in the Netherlands. “We noticed from cyber crime officers that they often saw things like this, in which the young people did not realize how serious the fact is that they were committing. The officers did not know which intervention would be best for them. After all, the perpetrators have done something very serious, but they are still young and often deviate from the traditional perpetrators, "explains Van Dijk. Dows that sound like petty adults using nasty manipulation to mess up kid's lives?
- Avamander 7y ago
  > There's no indication that the intervention is predicated on confessing. The article basically says that an admission of guilt is required. Otherwise the person would stay a suspect not a participant of the program. > the perpetrators have done something very serious And what is "the perpetrators have done something very serious"? By law piracy is very serious, changing a wallpaper can be very serious (there's a nice US case about that, but that's not incredibly relevant). > Dows that sound like petty adults using nasty manipulation to mess up kid's lives? It isn't maybe written like that, but it's going to be like that. Especially given the concerns I raised in the original comment, for example the issue of laws criminalizing menial things.

solotronics 7y ago

If the US wanted to take the cyber battlefield seriously they would recruit all these kids and put their skills to work.

pvaldes 7y ago
This is just fearshopping. Why to pay, when can scare them, coarce and make them fix their stuff for free or a candy? Laws are not the same for a minor.

bkohlmann 7y ago

All for this - and if it’s successful, I wonder if cybercrime will increase in this region as folks with few prospects take a shot at getting a good job via “non traditional” means

faissaloo 7y ago

'Hack_Right', really? That's the best they could come up with?

lone_haxx0r 7y ago

I wonder if someday laws will be based on a formal moral foundation instead of making things illegal just because 80% of people don't like those things. I think hacking is one of those things that are illegal because people don't like them. Ultimately, hacking is just sending messages through a wire. Objectively speaking, it isn't much different from hitting the like button on a Youtube video. Formally speaking, all messages sent over the Internet are numbers, so "anti-hacking laws" are essentially laws that make some arbitrary and undisclosed set of numbers illegal to send.

vkou 7y ago
Shooting people is just pulling a small lever. Objectively speaking, it's not much different from driving a car. Formally speaking, it's the same as making physical labor illegal. Just because you can do something doesn't mean you should. Just because you can pick the lock on my apartment door, doesn't mean that I shouldn't have an issue with it. Just because lockpicking is technically just sticking a 'key' into a lock, and turning the bolt doesn't mean it's the same bloody thing. Intent matters. Outcome matters. Somebody lockpicking my door, to save my cat from a fire, or to deal with a burst pipe, or to respond to an emergency call is one thing. Somebody lockpicking my door, to have a look at my stuff, can, and should fuck off straight to prison. Or, at least, a couple of hundred hours of community service.
- lone_haxx0r 7y ago
  I never said that anything we can do should be legal. I said that there should be a consistent moral framework upon which all laws should be based. And I think that laws should be defined objectively, not based in intent or outcome, but in facts. > Shooting people is just pulling a small lever. Objectively speaking, it's not much different from driving a car. Shooting people is more like throwing stones at them. If you own a gun, you're responsible for knowing that pulling the lever implies shooting projectiles at them. I think throwing projectiles at someone should be illegal (above some reasonable threshold of momentum. e.g (5 g * 2 m/s)). Picking someone's lock can be considered handling someone else's property without permission. (Physically) handling someone else's property without permission should also be illegal. All of these things are physical actions. The state should care about the physical actions of their citizens, but not about ideas, concepts, intent, or arbitrary abstractions. Those abstractions are the citizen's business, and legislating them is arbitrary and unfair. If I have a mental breakdown every time someone says hello to me, then should we make it illegal to say hello to me? After all, they're causing me severe mental distress and maybe I could lose my job because of these people. In my opinion, it would be unfair to ban "hello" because one person doesn't like it. It's my problem to have a mental breakdown because of specific messages, not yours or the state's. Same principle applies to software. If your website has a breakdown every time I send specific IP packets, that's your problem, not mine or the state's.

Waterluvian 7y ago

If anyone can remind me of the name of this software used to lock down windows 98 machines I'd appreciate it. It was IBM I think. Blue background for student. Green for teacher. Red for admin. I learned how to bypass it and discovered winpopup. I messaged every computer in the school district with my account like an idiot 9th grader. I then learned a lot about getting caught, punished, and second chances. I was lucky that the powers that be didn't overblow what I did.

coretx 7y ago
That was called various names, winnuke being one of them. It was nothing but a manually crafted TCP or UDP packet causing winsock to segfault.

dawhizkid 7y ago

I wonder if the US will ever release Ross Ulbricht...no way it will happen under Trump but possibly at the end of an 8-year term for a Democrat...

thomasfedb 7y ago

The concept here is crucial — respond to adventurous behaviour with clear-headed guidance. I 'hacked' my school as a teenager and disclosed my findings — I received a 'thank you' and a free pass to skip the helpdesk and talk to the sysadmins whenever I wanted.

throwaway3627 7y ago

Wasn't there a similar program long-ago in the US where the FBI/DOJ/USDC diverted first-time offenders into working with US-CERT instead of Aaron Swartzing them?

siruncledrew 7y ago

It seems like it would make sense to list the crimes that would fall under the "second chance" agreement to provide more information. Like, some dingus 'hacking' into their school to change their sick days is very different than the criminal context of a 16 year old buying stolen credit cards online and using them to sell stuff on Instagram. The type of kid that would fall into the police's 'naive-idiot' hacker criteria for this program is also probably not someone that would fare well in prison either.