Internet Hackers and Crackers
Introduction
When you hear the word hacker, you probably think of a nerdy, teen-aged boy sitting behind a computer with sinister plans for his attack flowing through the keystrokes of his fingers. You probably think of a techno-criminal defacing websites, shutting down computer systems, stealing money or confidential information-basically a threat to society. But these descriptions may describe someone else enterely. Many in the computer community contend that this criminal description defines crackers. Hackers, on the other hand, are actually people who enjoy learning how computer systems work, and bettering themselves and the computer community with the information that they gain from their learning. So if there are non-criminal (hackers) and criminal hackers (crackers), is it fair to label both hackers and crackers as hackers?
It is important to address this question because the identity of a culture in our society-the hacker culture-is being challenged. It is being defined as good or bad. This good or bad status affects the way Americans use the Internet, the way the government controls or does not control the Internet, and the way technology will grow in the future.
Some people say that there is no difference between hackers and crackers; they are both criminals. Others say that there are major differences between hackers and crackers. This paper addresses whether hackers and crackers really are two separate identities and whether it is right for society to define both hackers and crackers as hackers.
This paper discusses
* The people who believe hackers and crackers are two different groups of people and should be treated as such.
* The people who believe there is no difference between hackers and crackers, so it does not matter that they are both categorized as hackers.
* Whether or not it is fair for society to lump both hackers and crackers into the same category.
Definitions
* Hacker/cracker-Throughout this paper, I use the terms hacker and cracker to describe the "good" and "bad" hackers respectively. But there will be times when hacker will mean good-when discussing that there is a fundamental difference between hackers and crackers-and when hacker will mean bad-when discussing that there is not difference between hacker and cracker. Because it is confusing to understand which hacker I am talking about, I will denote the hacker-the non-criminal who is different from crackers-as a (true) hacker. When you only see the term hacker, you will know that this refers to the combination of hackers and crackers.
* Networked systems/computers-Computers that are able to communicate with one another. They are technologically connected to one another.
Secondary Issues
While addressing whether (true) hackers and crackers should or should not be categorized as hackers, some other issues come into play. The following are the secondary issues:
* Privacy-Do (true) hackers or crackers invade the privacy of networked computers?
* Legality-Is hacking in the broadest sense of the term legal?
* Freedom of the Internet-During the process of trying to protect against hacking and trying to prevent it, will freedoms be lost on the Internet?
* Unfair laws-Are the current laws pertaining to hacking unfair?
* Protection of information-Do (true) hackers, as opposed to crackers, really help protect information on networked computers?
These issues are addressed throughout this paper. Both sides of the naming issue have opinions on these secondary issues.
Hackers and Crackers Are Different
This section discusses why (true) hackers and crackers should be treated as separate groups with separate names. Specifically, this section covers the following topics:
* Introduction
* (True) hackers' viewpoint
* Businesses' viewpoint
* In general
Introduction
(True) hackers and crackers are fundamentally different:
Hackers (as opposed to crackers) are basically thrill-seekers who use information technology rather than fast cars or bungee cords. They spend their time learning how systems work at a deep level and exploit this information to roam the information highways seeking out adventure. They have bulletin boards for sharing information, regular meetings (Hayward 59) . . . .
This quote states that (true) hackers are "thrill-seekers" (59), they learn how computer systems work (59), and they are adventure-seekers. But there are other interpretations of hackers as well:
* "people who love to explore the hidden depths of computing systems" (Grossman)
* "Hackers are defined as computer enthusiasts who have an ardent interest in learning about computer systems and how to use them in innovative ways." (Rosteck)
* "A diffuse group of people often called 'hackers' has been characterized as unethical, irresponsible, and a serious danger to society for actions related to breaking into computer systems . . . . hackers are learners ad explorers who want to help rather than cause damage, and who often have very high standards of behavior. (Denning)
Even though there are many definitions of what a (true) hacker is, there is one universal belief of what hackers are not: criminals.
The people who support the belief that (true) hackers and crackers are two separate groups who should be treated as such, are generally (true) hackers-the non-criminals-some American businesses, and some of the general computer community. In general, they find it offensive that people want to group (true) hackers with their criminal counterparts.
This challenge is not just over the semantics of the names-hackers and crackers-but the values attached with the names:
This distinction between the two reflects a long-term, ongoing effort on the part of some hackers to distance themselves from their malicious colleagues and to emphasize the positive aspects of their subculture: insatiable curiosity, fierce independence, and total, hands-on knowledge of how technology works. A recent article on the "News for Nerds" site Slashdot proposed a search for a completely new word of "hacker," since the old one had been dragged through the mud so often by the media. Here are some of the nominees: ethical hacker, white knight hacker, code poet, technophile, geek, volunteer programmer, grokker, bithead, codesmith, and digerati. Other posters proposed trying to take back the word "hacker," the way the gay community has reclaimed the once-derogatory word "queer." (Grossman)
The popular society identifies (true) hackers with criminals, but a lot of the computer community contends that (true) hackers are good, while crackers are the criminals:
During the past few years, hacking has irreversibly become equated with criminality and malicious damage to IS systems. Hackers have been mythologized, demonized, and blamed for a spectacular range of cybercrimes and invasions of privacy. (Hayward)
Because most of the public believes that (true) hackers are criminals, it makes the (true) hacker's life and work difficult.
Hackers' Viewpoint
(True) hackers believe that there is a fundamental difference between hackers and crackers, and that they should be identified as two separate groups.
(True) hackers value
* Being recognized as an important part of the computer world.
* Knowledge.
Their most important value is that of knowledge. In their culture, knowledge is the key to what they do and who they are. And they strongly believe in sharing their knowledge.
(True) hackers believe that hacking into systems is not wrong. They do it for the intellectual challenge, to gain knowledge of how things work. And they share this knowledge.
When (true) hackers hack into systems, they are very careful not to change anything; they only want the technical knowledge of the hack:
It is against hacker ethics to alter any data aside from the logs that are needed to clean their tracks. They have no need of desire to destroy data as the malicious crackers. They are there to explore the system and learn more. The hacker has a constant yearning and thirst for knowledge that increases in intensity as their journey progresses. ("Is There a Hacker Ethic for the 90s Hacker?")
Often, if a (true) hacker accidentally or intentionally changes something while they are in a system, they are shunned by their peers.
The (true) hacker community is not just a bunch of loners as the popular belief contends. Many of them hack in groups. Many of them form their own "study" groups. And in this community a hierarchy exists-a hierarchy based on knowledge (Taylor):
Hackers want to become elite. Everyone wants high status, and in hacker culture high status is measured by the amount of information one has. Since, in this culture, information is the key to status, and information is also a means to get power (the old adage knowledge is power is very true in hacker circles), an information economy has developed. Hackers trade information in hopes of getting more information and thus becoming more elite. Eliteness/high status is based in information. (Blake)
The more understanding and expertise you have, the more well-respected you are in the (true) hacker community.
(True) hackers not only educate their peers, but their counterparts as well-the network security technicians. The network security technicians use different tools and methods to protect networks from cracker attacks. Because (true) hackers are not malicious and do not approve of crackers, they are more willing to help out their counterparts, and in turn, the general computer community as well. And who better to do this than the true networking experts?
(True) hackers work hard to build these relationships and portray themselves as helpful experts. They want to be recognized as an important part of the computer community:
Hackers wish to change the attitudes of the mass public towards technology, and believe above all that knowledge is power . . . . Hackers want their motivations and ethics to be viewed as legitimate, or at least understood, instead of being simply written off as devious teenagers who have nothing better to do than crash every available computer. (Rosteck)
(True) hackers want to be respected.
If (true) hackers were categorized with crackers, the effects would be terrible. All (true) hackers would be seen as criminals. And because they would all be seen as criminals, just about anything that they would do would be seen as illegal.
If they hacked into a system, even if they did not change anything, steal anything, destroy anything, it would be seen as a criminal offense. And now, because there is no good (true) hacker, they would have no defense against the law.
If (true) hackers gained technical knowledge, they could not share it with their counterparts. Whey would and, legally, how could network security technicians accept information from the criminal hackers?
Businesses' Viewpoint
Some businesses believe that there is a fundamental difference between (true) hackers and crackers, and that they should be identified as two separate groups.
The businesses who acknowledge the difference between (true) hackers and crackers value
* Company image.
* Profit.
Their most important value is that of profit. In their business culture, only the most profitable companies survive.
Businesses, in particular network security business, make quite a profit off of (true) hackers. Network security businesses benefit from (true) hackers in two ways:
* Information
* Employable expertise
When (true) hackers hack into a system, they have demonstrated that there are security holes in the system.
Hacking helps security . . . . It is useful and courteous to find security holes, and then tell people how to fix them. Hacking is a positive force, because it shows people how to mend weak security, or in some cases to recognize and accept that total security is unattainable, without drastic sacrifice. (Mizrach)
(True) hackers will either notify the security administrator of the system, or publish their findings on a public bulletin board, such as BUGTRAQ, where the majority of network security experts go to learn about the latest network security holes, and cracker attempts and tools.
Many network security businesses and non-network security businesses hire (true) hackers to perform network security functions.
Non-network security businesses hire (true) hackers, who are employed through a reputable network security business to perform a network security vulnerability analysis of their business network. This is often called a "tiger team" (Mizrach).
Non-network security businesses also hire (true) hackers to run their personal network security.
Network security businesses hire (true) hackers to form tiger teams, which they can hire out to customers. They also hire (true) hackers to develop and implement network security solutions such as encryption, firewalls, intrusion detection systems, virtual private networks, and vulnerability scanners.
If (true) hackers were categorized with crackers, the effects would be terrible. All (true) hackers would be seen as criminals. If they are seen as criminals, it would hurt them as well as the businesses who employ them.
First, what company would want to hire a criminal to work for them? If they did hire hackers anyway, many of their customers would stop doing business with them. The businesses would lose profits, and they'd lose their good company image.
Second, could (true) hackers ever really be employed again? Only if they hide the fact that they are (true) hackers.
Summary
The people who do not want the term hackers to mean criminals, who want hackers and crackers to be two separate groups, acknowledge the good that (true) hackers bring into the computer community:
* The desire for knowledge: "'We could all learn a valuable lesson from hackers: that intellectual hunger and the quest for knowledge should be central in our society.;" (Rosteck)
* The sharing of knowledge
* The protection they can provide to the public from crackers
These people also agree on who the primary enemies of the (true) hacker are
* The government
* The media
The government is seen as punishing hackers too harshly.
We need statutory schemes that address the acts of true computer criminals (such as those who have created the growing problem of toll and credit-car fraud) while distinguishing between those criminals and hackers whose acts are most analogous to non-criminal trespass. And we need educated law enforcement officials who will be able to recognize and focus their efforts on the real threats. (Kapor)
The government does not distinguish between (true) hackers and crackers. And because of this, they don't they do not scale their punishments accordingly.
The media is seen as sensationalizing the world of (true) hackers and crackers.
For those who don't know better, the news media . . . have blown it way out of proportion. A hacker, by wrong-definition, can be anything from a computer-user to someone who destroys everything they can get their evil terminals into. (Dissident)
They, too, do not differentiate between (true) hackers and crackers. The media is also seen as not giving the (true) hackers a chance to explain themselves.
Hackers have always been considered an "out group," in schools (where the hackers are simply "nerds") and in larger society (where they are labeled "criminals"). They are not considered part of any social institution. In addition, they are often denied their own voice in the mass media, which often leaps at changes to discredit and undermine members of the hacking community. (Vatis)
(True) hackers are indiscriminantly labeled as criminals.
Hackers, some businesses, and some of the computer community believe that (true) hackers have good things to offer to the computer community. They believe that (true) hackers have received negative connotations from the government and the media. They believe that if (true) hackers are not kept separate from crackers, then the (true) hackers' life will become truly unbearable and difficult.
Hackers and Crackers Are the Same
This section discusses why hackers and crackers should be treated the same and defined as hackers. Specifically, this section covers the following topics:
* Introduction
* Government's viewpoint
* Businesses' viewpoint
Introduction
The people who support the belief that (true) hackers and crackers are both criminals and belong in the same group, hackers, are generally the government, some American businesses, and some of the computer community. In general, they believe that all hacking activity is illegal.
The Government and Businesses' Viewpoint
The United States government and some American businesses believe that there is no need to make a separation between hackers and crackers; they're both criminals who engage in criminal activity.
The American government and network security businesses value protecting the American citizens and protecting information. Hackers are a threat to both people and information.
Where hackers claim that hacking into systems is perfectly fine because they are doing it to learn and they aren't damaging things, the government and some businesses do not see it that way:
Moreover, the problem is exacerbated by our continued romanticization of hackers as technical whizzes who are not really doing anything wrong but are actually providing a service by pointing out the vulnerabilities in an individual's or a company's or government agency's system. But do we praise the burglar for demonstrating the vulnerability of our home security by breaking in and stealing our cash or jewelry? Even if he does not steal or break anything, the simple invasion of our private property causes a feeling of violation and vulnerability that would send chills down all our spines. (#67)
The government and businesses do not thing it is funny when e-mails are intercepted or information in computer files are looked at-even if it is not damaged or destroyed:
"In general, all hacking involves changing something. Those changes all have the potential for harm, so I'd argue that a harmless hack is, in fact, a 'null-hack,' one that does nothing," argues Neil Barrett, a former hacker now employed by Groupe Bull as a senior security consultant. "Whilst a harmless hack exists in theory, the hacker would have to ask himself what the point of it all was." (Hayward)
The question is, is nothing really changed or damaged when a hacker hacks into a system? To get out of the system without leaving a trace, the hacker must delete his footsteps. This is changing the system. (Mizrach)
Statistics
Who are Hackers?
Hacker Incident Examples
Summary
Base on the previous descriptions of hackers and examples of what they have done, the government does not like hackers. They believe that we, as a nation, should fear hackers. They believe that all hackers are criminal; hacking into a site is illegal, even if it is for intellectual reasons. Because of all of this, the government believes that there is not a difference between hackers and crackers, so they do not need to have two separate names.
Conclusion
Works Cited
1. Cohen, Frederick B. Protection and Security on the Information Superhighway. New York: John Wiley & Sons, Inc., 1995.
2. Hayward, Douglas. "Hackers: Friends or Foes?" TechWeb September 15, 1997. February 20, 2000. http://www.techweb.com/wire/news/1997/0915hackers1.htm
3. Kapor, Mitchell. "Civil Liberties in Cyberspace: When Does Hacking Turn From an Exercise of Civil Liberties into Crime?" Scientific America. September, 1991. February 24, 2000. http://www.eff.org/pub/Legal/cyberliberties_kapor.article
4. Rosteck, Tanja S.. "Computer Hackers: Rebels With a Cause." Honors Seminar, Concordia University. 1994. February 14, 2000. http://www.eff.org/pub/Net_culture/Hackers/hacker_with_cause.paper
5. Blake, Roger. "Hackers in the Mist." Anthropology Independent Study Northwestern University. December 2, 1994. February 5, 2000. http://www.eff.org/pub/Net_culture/Hackers/hackers_in_the_mist.article
6. Dissident. "The Ethics of Hacking." February 28, 2000. [On-line.] Available: http://www.attrition.org/~modify/texts/ethics/the.ethics.of.hacking.htm
7. Mizrach, Steve. "Is There a Hacker Ethic for the 90s Hackers?" 1997. February 28, 2000. http://www.attrition.org/~modify/texts/ethics/is.there.a.hacker.ethic.for.90s.hackers.html
8. Grossman, Lev. "Hackers Try to Clear Their Good Name: Not All Hackers Are Interested in Electronically Sabotaging Your Credit." Digital Daily June 8, 1999. February 28, 2000. http://www.time.com/time/digital/daily/o,2822,26529,00.htm
9. Taylor, Paul. "A Sociology of Hackers." The University of East London, United Kingdom. February 16, 2000. http://www.job.am/inet98/2d/2d_1.htm
10. Denning, Dorothy E.. "Concerning Hackers Who Break Into Computer Systems." 13th National Computer Security Conference October 1? 4, 1990. February 22, 2000. http://www.swiss.ai.mit.edu/6095/articles/denning_defense_hackers.txt
11. Vatis, Michael A. "Cybercrime, Transnational Crime, and Intellectual Property Theft." Before the Congressional Joint Economic Committee March 24, 1998. March 1, 2000. http://www.fbi.gov/search?NS-search-page=document&NS-rel-doc-name=/pressrm/congress/congress98/vatis.htm&NS-query=hacker&NS-search-type=NS-boolean-query&NS-collection=FBI_Web_Site&NS-docs-found=34&NS-doc-number=1Partner sites: Rottweiler, Spanish immersion program Spain, and Free Death of a Salesman Essays