Hacking, the Law, and Ethics
© Mason Cash 
Dept. of Philosophy, UCF

Moral disagreements: 
•	Rational disagreement about priority of ethical principles and of basic goods?
•	 “Culture clash”?
•	Differences in the basic conceptualization of the nature of an activity 
•	Disagreements about computer hacking take the latter form
•	 The metaphor “hacker is burglar” has an interesting role in this debate.
Features of Human Moral (Social) Psychology:
•	Conformism
•	The tendency to conform to the practices and beliefs shared by our community 
•	Provincialism
•	The tendency to value the practices and beliefs of one’s community 
•	Partisan mind-set
•	The tendency to favor beliefs and attitudes we already strongly hold
•	Identity
•	I construct my self concept, in part, as a person with particular beliefs and practices
Implications of these features:  
•	Socialization is a powerful force
•	Especially by co-participants in activities
•	Can be more powerful than explicit rules.
•	Teens respond well to peer socialization 
•	Concerns in domains (like use of computers) where “older and wiser” can’t model appropriate behavior
Features of computer mediated interactions:
•	Abstraction from human effects of actions 
•	Perception of anonymity
•	Perception of safety
•	Perception of lax enforcement
•	Insular “Communities of Agreement”
•	Create and maintain an alternate view of “normal” and of what is “appropriate”.
Socialization On-line
•	Paucity of feedback on appropriateness of actions.
•	Absence of body-language, etc.
•	Feedback via a “machine” is easier to not care about, dismiss or ignore.
•	A general attitude of toleration of different perspectives and attitudes
•	Less challenges issued
•	Produces an on-line culture with a prevalent attitude of individualist relativism
•	This all means that the group that can often have the strongest influence on on-line actions is the on-line peer group.
Hacker Socialization
•	It’s easiest to pay attention to the actions that get a lot of publicity (the really bad ones), about which there is:
•	usually tacit admiration (posting on “info-war”) and 
•	often explicit admiration by at least someone.
•	Bolstered by the displayed attitudes of other peers to on-line actions
•	The attraction of hacking is reinforced by the perception that hacking is both 
•	a form of “rebellion” and 
•	that it is perceived as “cool” by one’s peers
Features of Metaphor in Cognition
•	Most of human thought and language is fundamentally metaphorical
•	Most metaphors are so “dead” (tacit, habitual) that we forget their metaphorical roots
•	Up is good (things are looking up today)
•	Similarity is closeness (it’s a close match)
•	Important is big (today is a big day)
•	Affection is warmth  (a warm greeting)
Metaphor:       (Black 1955) 
•	We use the metaphor subject (“burglar”) as a conceptual filter or lens to view the metaphor target (“hacker”)
•	Subject’s “system of implications” applied to target
•	Emphasizes some features of target, de-emphasizes other features
•	Makes the abstract and distant more concrete and familiar 
•	Apply to target habits of thinking, seeing and judging ingrained through experience with metaphor subject
•	E.g. Internet worm as “virus”
C. S. Lewis (1939): 
•	Master’s Metaphor 
•	Issued by someone who understands the phenomenon well, 
•	Used to explain the phenomenon to those who do not understand it well
•	Pupil’s Metaphor
•	Pupil does not understand the phenomenon
•	Metaphor enables “pupil” to understand a particular aspect of the phenomenon
•	The system of implications applied to the target phenomenon will be constrained by the metaphor subject’s system of implications
•	Unless the Pupil learns more, the pupil’s concept of the phenomenon will be limited to the system of implications provided by the metaphor.
Role of Metaphor in Communities:
•	Shared Metaphors define a shared reality
•	Create and underlie “intimacy” in a community
•	Create and delineate communities.  
•	Become a “common currency” for a community
•	Have “a life of their own”.
•	They become “ingrained” easily
•	Impede acceptance of conceptions of phenomena that don’t fit the metaphor
Tension between Hackers and Security community: 
•	A Culture Clash resulting from incompatible metaphors
•	Security community: Hacker is Burglar
•	Eugene Spafford “Are Hacker Break-ins Ethical?” 
•	Almost every Computer Ethics textbook uncritically repeats and endorses his arguments
•	Example: http://www.viruslist.com/ 
What is “Hacking”?
•	Not originally malicious.
•	“A good Hack”: 
•	a clever piece of code, displaying insight into a programming language or operating system
•	Making a system do things it was not designed to do
•	Popular media: 
•	gaining unauthorized access to computer systems and their data.
•	Computer Ethics Textbooks: 
•	a species of computer crime
Types of “hack”
•	Security monitoring.
•	Gaining access just to poke around, disturbing little or nothing.  
•	Looking for security problems.  
Possibly causing small annoyances, leaving warning messages. Publicly announcing holes if nothing done.
•	Causing damage to others’ systems (“Cracking”?)
•	Creating hacking tools and making them available.
•	Writing viruses and worms, and “releasing” them.
•	Phishing —setting up fraudulent web sites to harvest information (?)
•	Using someone else’s wireless connection.
Hacking as burglary: 
Legal Context
•	See http://www.ncsl.org/programs/lis/CIP/hacklaw.htm
•	"Unauthorized access”: without consent
•	to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.
•	Florida Law:
•	Crimes against Intellectual Property (815.04)
•	Third degree felony
•	With attempt to defraud: second degree felony
•	Crimes against Computer Users (815.06
815.04  Offenses against intellectual property
Willfully, knowingly, and without authorization:
(1) modifies data, programs, or supporting documentation
(2) destroys data, programs, or supporting documentation
(3)… (b) discloses or takes data, programs, or supporting documentation which is a trade secret… or is confidential as provided by law 
	If that data program or documentation resides or exists internal or external to a computer, computer system, or computer network. 
815.06  Offenses against computer users.--
(1)  Whoever willfully, knowingly, and without authorization:
(a)  Accesses or causes to be accessed any computer, computer system, or computer network;
(b)  Disrupts or denies or causes the denial of computer system services to an authorized user of such computer system services, which, in whole or part, is owned by, under contract to, or operated for, on behalf of, or in conjunction with another;
(c)  Destroys, takes, injures, or damages equipment or supplies used or intended to be used in a computer, computer system, or computer network;
(d)  Destroys, injures, or damages any computer, computer system, or computer network; or
(e)  Introduces any computer contaminant into any computer, computer system, or computer network,
commits an offense against computer users. 
Federal crimes:
•	Federal law applies if criminal activity stretches over state lines. 
•	Unlawful access to stored communications 
•	For the first offense 
•	maximum fine of $250,000 and 
•	prison sentence of one year. 
•	For each additional offense, add up to $5,000 and up to six months in prison.

Should all Computer Hacking be Criminal?
•	Does “Hacker as a burglar” prevent us from seeing ways hacking skills can be legitimately used?
•	Can you think of examples where hacking skills have been used in ways that are not, or should not be, illegal?
•	Pupil’s analysis of school computer’s security?
•	Mark Russinovich’s discovery of Sony’s rootkit?
•	Black Box Voting examining code for Diebold electronic Voting system?
Hackers’ alternative metaphors
•	Privacy and Consumer advocate
•	Investigative Journalist
•	Whistleblower
•	Scientist / Inventor 
•	“White hat” gunfighter
•	Martial Artist
Some “hackers” share some concerns with security industry:
•	Keep private information secure; keep public information free
•	Respect other people’s systems
•	Protect freedom of speech, and freedom from unreasonable search and seizure
•	If you discover security problems, notify those whose job it is to fix them 
•	Help to improve technology
•	Share your discoveries, so that others don’t have to solve the same problem
Some Hackers see themselves as performing useful services on the “Electronic Frontier”
•	Protectors” of the citizenry
•	Providing feedback to businesses 
•	Identifying abuses of power
•	Providing Motivation to improve security
•	Combating the consolidation of power
•	Building Grass roots democracy, 
•	Promoting community-owned resources (open source software) 
•	combating the “digital divide”)
•	Helping educate the “townsfolk” 
•	Socializing aspiring “hackers” 
“Hacker as Burglar”
 is Dangerous
•	 Especially if it is our only metaphor
•	Serves to close off dialogue, and so 
•	Close off possibilities for progress
•	A badly chosen metaphor is “thinking for us”
•	Discouraging us from considering these issues and activities on their own terms
 “Hacker is a Burglar” is as problematic as a racial stereotype.
•	Encourages the (false) belief that there are no differences between groups of hackers 
•	 e.g. some “hackers” want to help people and businesses protect themselves from more malicious “crackers”
•	Closes off dialogue 
•	points of view and lines of argument falsely dismissed as “patently absurd”
•	thus closes off possibilities for improving our society 
False perception of homogeneity
•	Spafford categorizes all hackers together as “burglars” 
•	 They fail to “understand the importance of  respecting the privacy and ownership of data.”
•	Deborah Johnson (echoing Spafford) rebuts hackers’ argument that they expose security flaws, by objecting:
•	“…those who attempt to gain unauthorized access, plant viruses, make denial of service attacks, and so on, compel the investment of time energy and other resources to making the Internet safe, when those resources could be used to improve the Internet in other ways” (p 100).
Closing off Dialogue:
•	“Thanking hackers who violate the privacy of networks or network users for pointing out to us our vulnerabilities is a little bit like sending thank-you notes to burglars for pointing out the infirmity of our physical alarms. That's silly.” 
•	Martha Stansell-Gamm  (US Department of Justice’s Computer Crime and Intellectual Property Section Chief ) 
More Problems with 
“Hacker is a Burglar” 
•	Prevents seeing (some) hackers as potential allies
•	Discourages hackers from helping
•	Often face prosecution if they report discovered problems to those who should fix them 
•	Encourages “less ethical” behaviour from hackers
•	e.g. too quickly “go public” with problems, or to add motivation to fix problems by writing exploits.
•	Pushes out of view many legitimate questions
•	e.g. Should information be seen as “property”? 
If so, whose?
Undermines hackers’ ability to socialize aspiring hackers
•	Many attitudes adopted based on practices displayed by others (role models) 
•	Much socialization is from (on-line) peer group
•	“Ethical” hackers discouraged from making themselves visible, as teachers and role models.
•	“Less ethical” hackers are often easy to find. 
•	E.g. glory-seeking providers of hacking tools
My objective: A community with many metaphors
•	Another alternative Metaphor
•	Hackers as Martial Arts Teachers
•	Aim to teach skill along with “moral culture”
•	A public who does not unthinkingly associate “hacker” with “criminal”.
•	Compare: we don’t usually associate “martial artist” with “thug”
Virtue Ethics model:
•	Develop the wisdom to distinguish situations in which exercise of hacking skills may be warranted.

•	Develop the skill to consider and weigh, when necessary:
•	The (intended and unintended) effects of our actions
•	The ways others’ rights constrain or require our actions
•	Whether we are treating other people with due respect

•	Consider alternative courses of action that may minimize negative effects and unethical actions

•	Understand and consider the legal context, and legal consequences of your actions
Conclusions
•	“Hacker is a Burglar” is dangerous 
if it is our only metaphor
•	Serves to close off dialogue, and unfairly demonize potential allies 
•	Closes off possibilities for progress
•	Undermines hackers’ ability to effectively socialize aspiring hackers into ethically sophisticated communities and practices
•	Better to have many metaphors at play, and to educate the population about the diversity within the hacker community.
•	Make it easier for virtuous hackers to demonstrate appropriate uses of hacking skills.