4 ms·

Is Computer Hacking a Crime? (1989) [pdf]

70 points by solomonb 3y ago

NoMoreNicksLeft 3y ago
I thought the CFAA was 1986ish. That anyone could believe it up for debate in 1989 is a little silly... or did it take a couple decades of case law to give CFAA teeth?
- tptacek 3y ago
  This is a normative discussion, not a positive one.
barbariangrunge 3y ago
Not since the hackers discovered you could just put up a eula or privacy policy first
- Terr_ 3y ago
  "By continuing to use this Awesomely Pwned Machine you agree to hold blameless and indemnify Leet Haxor from any past inconvenience..."
factorymoo 3y ago
Interesting to see the perspectives from early hacking pioneers. Seems like some things haven't changed much - debates over ethics of unauthorized access, whether it's criminal, free speech implications, etc. But more nuance now as hacking's gone more mainstream. Biggest change is probably threat models. In 1990 main concern was individuals hacking systems for challenge, curiosity, etc. Today it's nation-states and organized crime using hacking for financial gain, espionage, even kinetic attacks. Other change is commercialization/professionalization of hacking. Now huge industry around cybersecurity, ethical hacking, bug bounties. Hacking skills lead to lucrative careers, not just hobby or activism. More diversity today too - no longer just male techies. But part of cyberpunk spirit remains, even as hacking's become bigger business and political issue.
tptacek 3y ago
John Perry Barlow, from this transcript: "Driving 110 miles per hour on Main Street is a common symptom of rural adolescence, publicly denounced but privately understood."
- Loughla 3y ago
  Out of context, That is wildly accurate. Older people will tsk tsk when they hear about that kind of thing, but most people in rural areas use it as an excuse to recount their dumb teenage stories. When I got a speeding ticket was when I found out my father got a ticket when he was riding a piece of waxed cardboard behind a car on a snowy highway. No hacker context, but a truism.
  - karatinversion 3y ago
    My dad also grew up in a rural area, and he tells the story of how all the teenage moped drivers wore helmets for a few years after one of them died
forinti 3y ago
They still hadn't had to ponder the possibility of it being illegal to hack stuff (you think) you own. The law expands to allow capitalism to grow.
solomonb 3y ago
In Fred Turner's "From Counterculture to Cyberculture", Turner contrasts the perspectives of John Perry Barlow and Lee Felsenstein as the old guard of cybernetic counterculturalists versus Acid Phreak and Fiber optik as the new guard of modern hackers: > When they joined the discussion on the WELL, Phreak and Optik immediately set off a culture clash. The conflict could be seen clearly in the edited version of the forum eventually printed in Harper's. Like the online forum, and like it's predecessor, The Hackers' Conference of 1984, the conversation opened with a discussion of the hacker ethic. WELL regulars described the ethic in cybernetic and countercultural terms familiar to their online colleagues. Lee Felsenstein compared hackers to the "Angelheaded hipsters" of Allen Ginsberg's poem "Howl." John Perry Barlow described them as solitary inventors designing a system through which humans woule acquire the simultaneous unity of other "collective organisms." Acid Phreak would have none of it. "There is no one hacker ethic," he wrote. "Everyone has his own. To say that we all think the same way is preposterous." Among WELL regulars like Felsenstein and Barlow, hackers were cybernetic counter-culturalists, creatures devoted to establishing a new, more open culture by any electronic means necessary. For Acid Phreak, the hackers were break-in artists devoted to exploring and exploiting weaknesses in closed and especially corporate systems. I would be really interested to hear how the perspectives of the surviving participants in this conversation have evolved.
xwdv 3y ago
I’d argue that if computer hacking wasn’t treated as a crime but rather just a natural occurrence we’d have a much more robust security culture today. It would also be a lot more fun to be a hacker.
- Izmaki 3y ago
  Agreed. What is holding a LOT of people back from doing even kind-hearted hacking (i.e. "grayhat" activities with the purpose of helping the victim) is the fact that a criminal record can break your career entirely. Bug bounty programs only get you that far, and some I believe (I have very limited experience with bug bounty hunting) have a strict scope. It's not worth the risk.
  - ransackdev 3y ago
    Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface. That’s not illegal What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway). I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.
aaron695 3y ago
[dead]

70 points by solomonb 3y ago

I thought the CFAA was 1986ish. That anyone could believe it up for debate in 1989 is a little silly... or did it take a couple decades of case law to give CFAA teeth?

tptacek 3y ago
This is a normative discussion, not a positive one.

barbariangrunge 3y ago

Not since the hackers discovered you could just put up a eula or privacy policy first

Terr_ 3y ago
"By continuing to use this Awesomely Pwned Machine you agree to hold blameless and indemnify Leet Haxor from any past inconvenience..."

factorymoo 3y ago

Interesting to see the perspectives from early hacking pioneers. Seems like some things haven't changed much - debates over ethics of unauthorized access, whether it's criminal, free speech implications, etc. But more nuance now as hacking's gone more mainstream. Biggest change is probably threat models. In 1990 main concern was individuals hacking systems for challenge, curiosity, etc. Today it's nation-states and organized crime using hacking for financial gain, espionage, even kinetic attacks. Other change is commercialization/professionalization of hacking. Now huge industry around cybersecurity, ethical hacking, bug bounties. Hacking skills lead to lucrative careers, not just hobby or activism. More diversity today too - no longer just male techies. But part of cyberpunk spirit remains, even as hacking's become bigger business and political issue.

tptacek 3y ago

John Perry Barlow, from this transcript: "Driving 110 miles per hour on Main Street is a common symptom of rural adolescence, publicly denounced but privately understood."

Loughla 3y ago
Out of context, That is wildly accurate. Older people will tsk tsk when they hear about that kind of thing, but most people in rural areas use it as an excuse to recount their dumb teenage stories. When I got a speeding ticket was when I found out my father got a ticket when he was riding a piece of waxed cardboard behind a car on a snowy highway. No hacker context, but a truism.
- karatinversion 3y ago
  My dad also grew up in a rural area, and he tells the story of how all the teenage moped drivers wore helmets for a few years after one of them died

forinti 3y ago

They still hadn't had to ponder the possibility of it being illegal to hack stuff (you think) you own. The law expands to allow capitalism to grow.

solomonb 3y ago

In Fred Turner's "From Counterculture to Cyberculture", Turner contrasts the perspectives of John Perry Barlow and Lee Felsenstein as the old guard of cybernetic counterculturalists versus Acid Phreak and Fiber optik as the new guard of modern hackers: > When they joined the discussion on the WELL, Phreak and Optik immediately set off a culture clash. The conflict could be seen clearly in the edited version of the forum eventually printed in Harper's. Like the online forum, and like it's predecessor, The Hackers' Conference of 1984, the conversation opened with a discussion of the hacker ethic. WELL regulars described the ethic in cybernetic and countercultural terms familiar to their online colleagues. Lee Felsenstein compared hackers to the "Angelheaded hipsters" of Allen Ginsberg's poem "Howl." John Perry Barlow described them as solitary inventors designing a system through which humans woule acquire the simultaneous unity of other "collective organisms." Acid Phreak would have none of it. "There is no one hacker ethic," he wrote. "Everyone has his own. To say that we all think the same way is preposterous." Among WELL regulars like Felsenstein and Barlow, hackers were cybernetic counter-culturalists, creatures devoted to establishing a new, more open culture by any electronic means necessary. For Acid Phreak, the hackers were break-in artists devoted to exploring and exploiting weaknesses in closed and especially corporate systems. I would be really interested to hear how the perspectives of the surviving participants in this conversation have evolved.

xwdv 3y ago

I’d argue that if computer hacking wasn’t treated as a crime but rather just a natural occurrence we’d have a much more robust security culture today. It would also be a lot more fun to be a hacker.

Izmaki 3y ago
Agreed. What is holding a LOT of people back from doing even kind-hearted hacking (i.e. "grayhat" activities with the purpose of helping the victim) is the fact that a criminal record can break your career entirely. Bug bounty programs only get you that far, and some I believe (I have very limited experience with bug bounty hunting) have a strict scope. It's not worth the risk.
- ransackdev 3y ago
  Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface. That’s not illegal What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway). I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.

aaron695 3y ago

[dead]