4 ms·

We need better protection for whitehats. Every government is anti-hacker at some level.

selectodude 6y ago
On its face, hacking, even the white hat kind, is no different than saying we should allow trying to steal from stores to check if their loss prevention functions are working. As far as the government is concerned, people shouldn’t be trying to steal or hack to begin with. Obviously, if a company hires somebody to try and steal to check their LP, or if a company hires somebody to break into their network, it’s different (and I know there have been issues with one part of a company trying to prosecute somebody that another part tried to hire, but that’s just stupid corporate governance).
- yakkomajuri 6y ago
  Hm, yes and no. Ethical hacking is bounded by "scope". Organizations specify exactly what is allowed and what isn't. Also, the general guideline is that you must stop once you reach data. An ethical hacker will find out your door is open and warn you without going inside. If they go in and steal, they're not a white hat hacker. And if you have an open door with something interesting inside, a black hat hacker will eventually find it anyway.
  - wizzwizz4 6y ago
    An ethical cracker might take a CD box with one of those radio tags and wave it at the bleepy scanner thing to check if the scanner's working, but they wouldn't walk out the door with a fridge under their coat.
  - lr4444lr 6y ago
    What a white hat hacker does in many (not all, maybe not even a majority) of instances is the equivalent of trying new lock picks in the door, watching them swing open, and then reporting dutifully on it. "Not going inside" and "not stealing" aren't sufficient defenses in the eyes of the law for this behavior any more than attempted burglary.
- numpad0 6y ago
  This comment is kind of eye opening for me, so most people understand instances of software as manufactured tangible items that has manufacturing variances! You know, software is more like criminal laws interpreted by an instant judging robotic courthouse, so you absolutely don’t want bad precedents and loopholes, or do we? Because tests are sparse events but if it becomes real world applications it will be dense and miserable...
- Avamander 6y ago
  In a sense, corporate whistleblowing is the distribution of corporate secrets, illegal if it weren't for the protections. Is that protection bad? I don't think so. We can just look at what Volkswagen did. Point being, I'm sure there are companies out there that do the same but digitally, either willingly or accidentally. Reporting that however, is illegal in oh so many jurisdictions, that's not okay.
- AnthonyMouse 6y ago
  There are multiple reasons why computer security is nothing like "trying to steal from stores to check if their loss prevention functions are working." To start with, loss prevention is the store's problem. They have all the incentives they need to do it themselves. With data it's completely the opposite. They have your data and it costs you, not them, when they secure it poorly. Many of the entities with poor security are effectively judgment proof, so legal liability is ineffective. The users are really the only ones with the right incentives to poke around and make sure their data is secure. It's like storing your valuables at a bank, but if you notice a security vulnerability in the bank, not only is reporting it or informing their other customers likely to get you arrested, they're not even required to let you remove your valuables from the bank. (Try to get Equifax to delete your data.) Then, the scope of what's considered "hacking" extends far beyond things that cause actual harm. The sort of things investigative reporters have long done to humans with a telephone are a felony if you do them to computers with an internet connection, even if no "harm" is done to the target other than to reveal their misconduct to the world. Then, the penalties are unconscionable. If an investigative reporter goes past the "employees only" door to take some pictures, that's illegal, but the most common result is only that they'll be removed from the property, and even if charges are pressed it's only a misdemeanor in most places. Do the same thing with a computer and you can expect federal prison. It discourages people from testing the fences, even though you want them to.
yakkomajuri 6y ago
Agreed. This can be both bottom-up with more Responsible Disclosure programs, as well as top-down (i.e. via the legal system), making sure to take intent and actual harm caused into greater consideration when seeking to prosecute a white hat.
- yakkomajuri 6y ago
  Bottom-up is perhaps the best approach, however. I mean, if an organization doesn't want white hats snooping around, then that's up to them, period. So should be a matter of more organizations actually putting out some guidelines. Top-down would be important for accidental discoveries though. It's quite problematic to go after someone that accidentally finds an issue in your service.
  - mycall 6y ago
    Top-down is how governments work. Policy first, technology third.
- jlgaddis 6y ago
  s/Responsible/Coordinated/g

On its face, hacking, even the white hat kind, is no different than saying we should allow trying to steal from stores to check if their loss prevention functions are working. As far as the government is concerned, people shouldn’t be trying to steal or hack to begin with. Obviously, if a company hires somebody to try and steal to check their LP, or if a company hires somebody to break into their network, it’s different (and I know there have been issues with one part of a company trying to prosecute somebody that another part tried to hire, but that’s just stupid corporate governance).

yakkomajuri 6y ago
Hm, yes and no. Ethical hacking is bounded by "scope". Organizations specify exactly what is allowed and what isn't. Also, the general guideline is that you must stop once you reach data. An ethical hacker will find out your door is open and warn you without going inside. If they go in and steal, they're not a white hat hacker. And if you have an open door with something interesting inside, a black hat hacker will eventually find it anyway.
- wizzwizz4 6y ago
  An ethical cracker might take a CD box with one of those radio tags and wave it at the bleepy scanner thing to check if the scanner's working, but they wouldn't walk out the door with a fridge under their coat.
- lr4444lr 6y ago
  What a white hat hacker does in many (not all, maybe not even a majority) of instances is the equivalent of trying new lock picks in the door, watching them swing open, and then reporting dutifully on it. "Not going inside" and "not stealing" aren't sufficient defenses in the eyes of the law for this behavior any more than attempted burglary.
numpad0 6y ago
This comment is kind of eye opening for me, so most people understand instances of software as manufactured tangible items that has manufacturing variances! You know, software is more like criminal laws interpreted by an instant judging robotic courthouse, so you absolutely don’t want bad precedents and loopholes, or do we? Because tests are sparse events but if it becomes real world applications it will be dense and miserable...
Avamander 6y ago
In a sense, corporate whistleblowing is the distribution of corporate secrets, illegal if it weren't for the protections. Is that protection bad? I don't think so. We can just look at what Volkswagen did. Point being, I'm sure there are companies out there that do the same but digitally, either willingly or accidentally. Reporting that however, is illegal in oh so many jurisdictions, that's not okay.
AnthonyMouse 6y ago
There are multiple reasons why computer security is nothing like "trying to steal from stores to check if their loss prevention functions are working." To start with, loss prevention is the store's problem. They have all the incentives they need to do it themselves. With data it's completely the opposite. They have your data and it costs you, not them, when they secure it poorly. Many of the entities with poor security are effectively judgment proof, so legal liability is ineffective. The users are really the only ones with the right incentives to poke around and make sure their data is secure. It's like storing your valuables at a bank, but if you notice a security vulnerability in the bank, not only is reporting it or informing their other customers likely to get you arrested, they're not even required to let you remove your valuables from the bank. (Try to get Equifax to delete your data.) Then, the scope of what's considered "hacking" extends far beyond things that cause actual harm. The sort of things investigative reporters have long done to humans with a telephone are a felony if you do them to computers with an internet connection, even if no "harm" is done to the target other than to reveal their misconduct to the world. Then, the penalties are unconscionable. If an investigative reporter goes past the "employees only" door to take some pictures, that's illegal, but the most common result is only that they'll be removed from the property, and even if charges are pressed it's only a misdemeanor in most places. Do the same thing with a computer and you can expect federal prison. It discourages people from testing the fences, even though you want them to.

yakkomajuri 6y ago

Agreed. This can be both bottom-up with more Responsible Disclosure programs, as well as top-down (i.e. via the legal system), making sure to take intent and actual harm caused into greater consideration when seeking to prosecute a white hat.

yakkomajuri 6y ago
Bottom-up is perhaps the best approach, however. I mean, if an organization doesn't want white hats snooping around, then that's up to them, period. So should be a matter of more organizations actually putting out some guidelines. Top-down would be important for accidental discoveries though. It's quite problematic to go after someone that accidentally finds an issue in your service.
- mycall 6y ago
  Top-down is how governments work. Policy first, technology third.
jlgaddis 6y ago
s/Responsible/Coordinated/g