Date: July 31, 1991 From: jthomas@well.sf.ca.us Subject: File 4--Reply to Tom Forester Article The post by Tom Forester is surprising both for its strident tone and ill-conceived agenda. Normally, there will be consistency between scholars' findings and the pronouncements they make derived from such findings. This is not simply an intellectually ethical practice, but responsible discourse as well. We all succumb to occasional hyperbole, factual faux pas, or miswordings that create ambiguity or misunderstandings--a gap between what we intend to say and what we actually do say. However, the Forester article is recklessly flawed and is compounded by the fact that his errors are in an area in which he claims special expertise. His claims require a detailed response lest his readers grant the post more credibility than is justified. It appears that the letter is quite at odds with his book, (co-authored with Perry Morrison). It is always possible that the co-author wrote the passages cited below, but when any work is co-authored, the norm is to assume joint responsibility for the entirety unless otherwise indicated. There is no indication that Tom Forester detached himself from any of the book's contents. What is troublesome is not that Forester seems to disassociate himself from passages in the work, but that he actually seems unaware of arguments that bear his name. The post, as it appeared publicly in several sources on the net, began as follows: >A colleague recently published this article in the computer section >of 'The Australian' newspaper last week. He thought it might interest >newspaper form. > >George Bray [posting for Tom Forester] > > > >Opinion: "Hackers: 'Clamp Down Now' " > >The Australian, 2 July 1991, page 34. > Forester's point is quite clear: >It's about time we got tough with hackers and exposed them for >the irresponsible electronic vandals they really are. > >Jailing a few of these malicious meddlers would set an example to >other would-be data thieves and help stem the tide of >computerized anarchism which is threatening to engulf the IT >industry. In the space of a few sentences, Forester categorically reduces the meaning of the term "hacker" to one denoting "vandals," "meddlers," "data thieves," and "anarchism." "Hackers" is a broad term referring on one hand to what Bob Bickford describes as "any person who derives joy from discovering ways to circumvent limitations" to, on the other, the cybervandals who trash systems. The broad use of the term to define any computer behavior that displeases us contributes to public misunderstanding and to law-enforcement excesses by expanding categories of people eligible for prosecution. For example, if I have committed no violation of law, but publicly call myself a "hacker" in Bob Bickford's sense, such a claim could be adduced as evidence against me in the event I were to come under investigation. No definitions are written in stone. However, words have meanings, and meanings connote images and metaphors. Forester's metaphors reinforce the ill-considered images reflected in the most abusive search warrants in several 1990 raids in the U.S. (e.g., Craig Neidorf, Steve Jackson Games, Len Rose, Ripco BBS). The hacker imagery painted by Forester has no hues or shades--only black and white icons reflecting the ancient battle between the forces of light and darkness. Most hackers aren't "meddlers" or data thieves. Like most crimes, there is a continuum ranging from simple curiosity to harmful intrusion. Forester also fails to mention that, whatever the excesses of even the most malicious intruders, "hackers" are not responsible for the bulk of computer crime. According to virtually all studies, most "computer crime" is done from the inside (estimates range from 60-80 pct). A significant proportion of the remainder is done by computer literate rip-off artists whose purpose is larceny rather than exploratory curiosity or illicit--but still relatively benign--behavior. One need not approve of intrusions to recognize that there are differences between types of abuse and methods of responding to these different types. In his article, Forester makes no distinctions between categories of "hacker" or types of hacks. He refers simply to "electronic vandals," hardly a value-neutral (or accurate) label. This is a radical departure from _Computer Ethics_ (pp 40-44), in which clear distinctions are made, an even-handed treatment of the risks and problems is presented, and "hacking is explicitly distinguished from computer crime, something not done in his article. >Breaking into a computer is no different from breaking into your >neighbour's house. It is burglary plain and simple--though often >accompanied by malicious damage and theft of information. >Sometimes--as in the case of stolen credit card numbers--it is >followed by fraud. > >The essence of hacking is that it is about gaining unauthorized >access to other peoples' systems. It is an activity which has not >been sanctioned by or approved of by the system's owner, be they >private or public. The phrase "plain and simple" usually reflects an attempt to silence differing views by rejecting at the outset any possibility of alternative meanings or points of view. The complexity of computer abuse and the failure of law to catch up with rapidly changing technology and the problems this creates for law enforcement and others is plainly obvious but hardly simply resolved by crude categories and retributionist thinking. Forester forces extreme examples of disparate behavior into neat bundles, forces a metaphor (breaking and entering) onto them, and then argues from the metaphor, not the original behavior. This is legitimate when metaphors are used to make something unfamiliar more understandable, but when the metaphor is flawed, or when the metaphor becomes the thing itself, distortion results. Computer invasion, even in the worst case, is not analogous to home invasion. Physical presence of an offender and the corresponding dangers it poses is absent. A better analogy would be a kid setting up a lemonade stand on your yard when you weren't looking, or somebody peeking through your window from their own property across the street with binoculars. The problem with viewing all inappropriate computer behavior as of the same magnitude is that it leads to silly analogies. Consider "automotive technology." We don't have a general category of crime called "auto crime" and argue that we should lock "auto offenders up." There are many "auto offenses," ranging from parking tickets, moving violations, auto-theft, burglarizing autos, using autos in the commission of another crime, stealing the trade-secrets of auto manufacturers, and as most teenaged minors know, getting it on in the back seats of them. Some of these auto-related acts are simply nuisances, others are quite serious. We distinguish between them and don't call for "setting examples" by jailing young lovers in a back seat *as well as* drunk drivers or auto thieves. Instead of the term "hacker," Forester's argument would be better served by term "computer intruder," which would allow him to make distinctions between kinds of intrusion. In law, there are similar distinctions, and there is nothing *PLAIN AND SIMPLE* about such acts. Computer intrusion is *NOT* burglarly, even if information is copied. Forester's inaccurate analogy reflects either the incompetence of one ignorant of law--rather strange for a self-styled expert on "computer ethics"--or a cavalier disregard for accuracy which is anathema to responsible scholarship. Forester again seems to ignore his own book, which explicitly challenges such a "plain and simple" analogy: "Unfortunately, the legal basis of system break-ins languishes in the dark ages of real locks and doors and physical forms of information such as blueprints and contracts. Equally, the law as it applies to breaking and entering--the destruction of physical locks--and the theft of information a it exists in paper form, IS A POOR ANALOGY WHEN APPLIED TO THE ELECTRONIC LOCKS THAT MODEMS AND PASSWORD SYSTEMS PROVIDE AND THE HIGHLY MUTABLE FORMS OF INFORMATION THAT COMPUTER FILES REPRESENT . After all, when one 'breaks' into a system, nothing has been broken at all--hence there is no obvious intent to cause harm (p. 60)." Forester's intent here is hardly to justify hacking, but in context, he is attempting to raise questions by showing the complexity of computer intrusion and the gap between law and new technology. By contrast, his letter reflects the reverse. Which Tom Forester should we take seriously? The one who writes thoughtfully for academics, or the one who incites the public with supercilious rhetoric that is totally at odds with his scholarly discourse? >Hackers are often portrayed as 'brilliant' or glamourized in the >media as 'whiz-kids,' but often they are only mediocre >programmers. Most 'great' hacks have in fact involved very little >in the way of intellectual ability--you don't have to be an >expert to work an autodialler and Unix systems--a favourite >target of the hacker--have notoriously poor security. > >Far from being budding computer geniuses, hackers are often so >incompetent and clumsy that they frequently cause more >unintentional damage than intentional damage when blundering >around inside someone else's system. > >Far from being heroes of the computer revolution, hackers are >little more than common thieves. Their modus operandi involves >stealing log-in names and passwords and then stealing information >expensively collected by the victim. The author confuses the term "hacker" with "phreaks," those who attempt to avoid toll charges. The author displays no knowledge of his topic or of the diversity of hacker activities, and seems totally unaware that "hackers" who explore systems generally oppose predatory behavior of any kind. Further, in his book, Forester does not equate "great hacks" with auto-dialing or mundane incidents, as he does in his letter. By "great hack" he seems to mean "publicized hacks," because the examples of "great hacks" in the book (p. 51-52) refer to Marcus Hess and the Chaos Computer Club, and a group of British hackers who penetrated a license centre. These would hardly be described as "great hacks" by most observers, although they did captivate media attention. I can recall no media story in the U.S. in recent years that has portrayed hackers, as a category, as uniformally "brilliant" or as "whiz kids." This claim is simply a straw icon Forester sets up for purposes of hacker-bashing. Further, Forester is as guilty as those he criticizes for alluding to the "brilliance" of hackers. In his book, he attempts to account for the shift from licit to illicit computer activity by "THE BEST AND THE BRIGHTEST" (p. 43) and suggests the emergence of value conflict that the current breed of hacker as made more sinister. Granted, Forester was alluding to a different crop of computerists with his term, but so to are most others who have used that description in the past. Forester seems to want to hold others responsible for past laudatory language, but is unwilling to hold himself to that same standard. With the expansion of computer users, some hackers, like some scholars, will be bright, principled, and imaginative. Others won't. As in any distribution of valued characteristics, there will be far more of the latter than the former. If Forester's point is that we should not romanticize predators, then he should be willing to provide examples and examine his own role in perpetuating those images he criticizes. If, however, he merely intends to say that most "hackers" possess modest talent, then this is a truism that few would dispute and one wonders: So what? >Some hackers have even become infamous by betraying their >country. Members of the Chaos Computer Club of Hamburg, in then >West Germany,were caught selling United States military secrets >to the KGB--the charred body of one of their number, Karl Koch, >was later found in a forest outside Hanover. If Forester refers here to Pengo, Hess, and the others, this claim is false. Despite the espionage element, there was no evidence that this group betrayed its country, Germany, by selling German military secrets. Nor is there evidence that they sold U.S. military secrets. In fact, I can think of no "hacker" known to have sold military secrets in the U.S. According to the Hafner and Markoff book, _Cyberpunk_, the Soviets received commercial software and some relatively inconsequential other files, and according to one source they cited, the Soviets "got rooked." The author's statement is pure hyperbole. While it is fully appropriate to identify the dangers of computer intrusion to national security, to raise it as a way of stigmatizing all forms of intrusion and to justify a "crackdown" by incarcerating a few examples moves from reasonable concern to unthinking hysteria. And, what is the point of mentioning Hagbard's charred body? Is this apparent suicide supposed to show that hacking leads to violence? To murder? Hagbard, according to all accounts, was a psychologically unstable substance abuser. Images of violence make good copy, no matter how irrelevant, and perhaps charred bodies just go with the territory. Forester's swipe at Chaos Computer Club also seems at odds with his book (p. 49), in which he, with seeming approval, observes: Indeed, we now know that at the time of the Chernobyl nuclear power station disaster in the Soviet Union, hackers from the Chaos COmputer Club released more information to the public about developments than did the West German government itself. All of this information was gained by illegal break-ins carried out in government computer installations. >Other hackers, such as the group that infiltrated six London >banks in 1989, have swiftly turned to blackmail. Yet some >misguided persons have sought to justify this despicable crime by >claiming hackers are really only helping 'test system security.' Can Forester name anybody who claims that blackmail, ripping of money from banks, or similar kinds of behavior is justifiable as a security test? I have never heard a single instance of such a justification of this type of predatory behavior, other than, perhaps, by the culprits as a defense during trial. But, then, I've also heard murderers claim that junkfood made them kill, a defense hardly supported by "some misguided persons". Some may attempt to justify computer intrusion by appealing to "security interests," "freedom of information," or other grounds. But there is near universal loathing for predators of this type. Forester moves from justifying computer intrusion to justifying bank robbery quite easily, proving that the shallower the water, the quicker the pace. >A second justification of hacking is that hackers safeguard our >civil liberties by keeping a check on the activities of >governments. I know of no cases where revealing the contents of a >state database has done good rather than harm. Is this the *same* Tom Forester who wrote: "We might therefore ask ourselves whether, for the sake of balance, a truly democratic society should possess a core of technically gifted but recalcitrant people. Given that more and more information about individuals is now being stored on computers, often without our knowledge or consent, is it not reassuring that some citizens are able to penetrate these databases to find out what is going on? Thus it could be argued that hackers represent one way in which we can help avoid the creation of a more centralized, even totalitarian government (p. 49). . . . Given this background and the possibility of terrorist acts becoming more and more technologically sophisticated, perhaps we can look to hackers as a resource to be used to foil such acts and to improve our existing security arrangements. TO SOME EXTENT, THIS IS ALREADY HAPPENING: (p. 49). Poor Tom. He doesn't seem to be able to figure out what position he wants to take. The danger is not that he selects one over the other, but that he seems to continually contradict himself. The contradictions lead to public statements that do no service to clarifying the issues in ways that result in resolving the risks of computer intruders in a just, yet effective way. >If hacking cannot be defended, then virus creation is wholly >unforgivable. Enormous time and effort has been spent in recent >years making good the damage caused by the pranksters who gave us >the 'Stoned,' 'Bouncing Ball,' 'Pakistani Brain' and 'Israeli' >viruses, to name but a few. > >Such computer anarchists have caused mayhem in recent years in >the US. The famous Internet worm let loose by Cornell University >student Robert Morris in late 1988 infected no less than 6,000 >systems and cost thousands of dollars to contain. In his book, Forester offers a defense of hackers as well as posing some of their dangers. As a consequence, his "if-then" logic seems odd. Has he recanted? Has he elsewhere offered a reasoned treatise defending the "if" premise? Nobody defends viruses, a very special and destructive form of computer intrusion. His statement is analogous to saying, "If trespassing cannot be defended, then arson is unforgivable." Trespassing can be forgiven (if we are in metaphysical, rather than legal mode), but arson cannot be. Whether hacking is defensible or not, it has no bearing on the claim that computer viruses are indefensible. To say that we should jail hackers because those who spread computer viruses are highly destructive is a major non sequitor. They are different sorts of acts with different consequences. Viruses are made for one purpose only: To disrupt or destroy. The Morris worm, although disruptive and totally irresponsible, was not so-intended, and it was hardly the result of a "computer anarchist." Forester seems to be grabbing any and all examples to justify his claim that hackers should be jailed. No matter that these examples reflect behaviors ranging from benign innocence to conscious malice. Just lump 'em all together in a barrel and chuck 'em into the fire. >Last year, the so-called 'Legion of Doom' managed to completely >stuff up the 911 emergency phone system in nine US states, thus >endangering human life. They were also later charged with trading >in stolen credit card numbers, long-distance phone card numbers > >In another case, Leonard DeCicco was charged with stealing US $1 >million worth of security software from Digital Equipment >Corporation. Leonard Rose Jr. was charged with selling illegal >copies of a US $77,000 AT&T operating system. > >One group of phone hackers was charged with stealing more than US >$1.6 million worth of free long-distance phone calls, while >another group was caught manipulating voice-mail boxes and 008 >toll-free numbers to the tune of millions of dollars. These claims are totally false. As Mike Godwin (above) notes, the "Atlanta 3" were not charged with "stuffing up" the E911 system, period. Nor were they charged with the other allegations. Leonard "DeCicco" presumably refers to Kevin Mitnick's confederate described in the Hafner/Markoff book who cooperated with the FBI in apprehending Mitnick. Spokespersons at DEC had no knowledge of any such infraction by DiCicco. Los Angeles U.S. Attorney's Office spokesperson Carole Levitzky indicated that there were no such federal charges against him, and that if he were involved in a subsequent offense of such magnitude after the Mitnick affair, it would show up in their records. DiCicco pleaded guilty on Nov. 29, 1989, to one count of aiding and abetting Mitnick's theft and was sentenced to five years probation, 750 hours of community service, and restitution of $13,000. If Forester refers to the DiCicco of the Mitnick and DiCicco incident, this claim is blatantly false. If there is a similarly named "Leonard DeCicco" who has stolen $1 million from DEC, Forester seems to be the only one who knows about it. apprehend Kevin Mitnick and they make no mention of Forester's charges, nor have such charges been made public. Leonard Rose was not charged with stealing but with possession of unlicensed UNIX software, not uncommon among some programmers. Phone phreaks and others have, indeed, freely utilized illicit means of avoiding long distance charges. Such acts are wrong, but, as Gail Thackeray, a prosecutor of computer crime, has convincingly argued, jail is not necessarily the best sanction for these delinquents. What's troublesome here is that Forester seems to have no grasp of facts and is not troubled by generalizations based on inaccuracies. He nonetheless calls for changes in public policy on the basis of his errors. If Forester were a common citizen, these flaws would be understandable. But, because he claims to be knowledgeable in the area of computer ethics and crime, his misinformation borders on professional negligence. These are not just small matters of detail: His errors reflect consistent lack of knowledge of the most basic information accessible in media and across the nets. >Unfortunately, attempts by US authorities to nail these delinquent >nerds have not always been successful. This is because the law is >unclear, and police lack the expertise in dealing with the >crimes. > >For example, last year's Operation Sun Devil, which involved >raids in 14 cities and the seizure of 42 systems and 23, 000 >disks, has yet to result in any major prosecutions. > >Robert Morris, who launched the disastrous Internet worm, got a >mere slap on the wrist in the form of a US $10,000 fine and 400 >hours' community service Only in Britain--where the >Computer Misuse Act became law in 1990--do the authorities seem >to winning the war against hackers: 'mad' hacker Nicholas >Whiteley was recently jailed for four months for a series of >malicious attacks on university computers. Perhaps in Forester's logic a single example of a four month sentence for attacks on university computers signifies "winning a war" in a country with a much smaller population and proportionately fewer personal computers. Perhaps he actually believes in the power of such a superficial example, or perhaps he is just an Anglophile who is too lazy to ferret out the successful intervention of law enforcement and others in responding to "hacking" related crimes in the U.S. That quibble aside, Mike Godwin (above) addressed the Morris sentence. Operation Sun Devil was not successful largely because it was ill-conceived, poorly executed and misdirected. By contrast, prosecutors such as Gail Thackeray, Ken Rosenblatt, and Don Ingraham have all had considerable success prosecuting computer crime. Forester also fails to explain how a single example of a four month jail sentence, relatively short, reflects more success than the sentences of imprisonment given to Riggs, Darden, Grant, Rose, Zinn, and others, the imprisonment of non-hacking computer criminals, and the substantial probations given to many, many others (including Mitnick, Majette, DiCicco, Morris, Goldman, and countless others). Whether we agree with each individual indictment or sentence, the fact is that U.S. law enforcement is prosecuting and prosecuting successfully in most cases. The trend also seems to be that U.S. law enforcement, thanks largely to the efforts of EFF and prosecutors such as Don Ingraham, Gail Thackeray, and others, are--despite whatever other criticisms some may have--demonstrating an explicit willingness to move away from the Draconian measurese espoused by Forester and balance the needs of law enforcement and security with those of Constitutional protections against First and Fourth Amendment abuses and "justice as fairness." It is true that law enforcement is not particularly knowledgeable and that laws are vague, but they are vague on the side of over-criminalization. Nonetheless, the primary answer to resolving the problem of computer abuse does not lie in strengthening law enforcement, but rather in expanding public education and awareness. There are an overwhelming number of cases in the U.S. in which computer and telephone abusers have been apprehended, either by law enforcement or by other officials. Forester's implied claim that somehow law enforcement needs to be tougher, rather than wiser, is--like the rest of his article--totally inaccurate. >To some extent hacking has attracted individuals who are not at >ease socially--the classic "nerd," if you like. They may relate >better to machines than other humans. > >One image of the hacker is of an adolescent male, who, for >reasons of shyness or "spots" does not get on with girls. > >Instead, he tends to spend his time with the computer, rising at >2pm, then working right through to 6am,, consuming mountains of >delivered pizza and gallons of soft drink. > >Some suffer from what Danish doctors are now calling "computer >psychosis"--an inability to distinguish between the real world >and the world inside the screen. > >For the hacker, the machine becomes a substitute for human >contact, because it responds in rational manner, uncomplicated by >feelings and emotions. Again, Forester is at odds with his own work, where he indicates that there are different types of hackers and motivations. He seems to draw from Sherry Turkle's _The Second Self_, in his cartoon depiction of hackers. Turkle's data were limited to MIT students and a few interviews from Internet users. Turkle's study, published in 1984, well before the "hacking craze" of the late 1980s, was more a study of computer enthusiasts rather than "hackers," and her descriptions were partly ironic and hardly "scientific," although this did not undermine the value of her book. The "hackers" depicted in in _Cyberpunk_ range from seemingly normal (whatever that might mean) to certifiably loony, much as participants in any other collection of avid enthusiasts, including sports fans or researchers. From our own (Gordon Meyer and Jim Thomas) studies of the computer underground, "hackers" are a diverse lot, and Forester's grotesque imagery is as simplistic as would be dismissing his article because of Australian inbreeding from the days when it was a penal colony. Psychological explanations for any behavior can be helpful in contributing to our understanding, but data-free generalizations that reduce complex behaviors to simple-minded categories, especially when done by one who makes a living as a scholar, do a disservice to the scholarly community. >In some senses, one can't help but feel sorry for hackers, but by >taking out their hang-ups on society they do enormous damage and >we all end up paying for their anarchic antics. > >One day, these meddlers will hack into a vital military, utility >or comms system and cause a human and social catastrophe. It's >time we put a stop to their adolescent games right now. > >TOM FORESTER > > > >*Tom Forester is co-author, with Perry Morrison, of Computer >Ethics: Cautionary Tales and Ethical Dilemmas in Computing >(Blackwell / Allen & Unwin, 1990,). Hollinger and Lanza-Kaduce argued in their 1988 article in _Criminology_ that legislative testimony leading to anti-computer abuse law relied heavily on anecdotal evidence, hyperbolic assertions lacking empirical support, and media accounts. For this reason, Forester's letter, which fits all three categories, subverts the problem-solving process and hampers effective legislation and sanctions intended to address the problem of technologically-created offenses. Few people justify indiscriminate computer intrusions, so the question does not center on a defense of computer abuse. The issue is what do we do about it. Forester argues for increased criminalization and incarceration. There is little evidence that incarceration deters crime. It is unlikely that "setting examples" will resolve anything. Those most likely to be deterred those not engaged in serious misbehavior and are therefore the least risk to society. In the US, at least, sentencing is supposed to be "offense-drive," not "policy-driven." We sanction on the basis of an act, not on the basis of establishing social a political policy. "Setting examples" is not justice, but a political policy. Neither Forester's call for heavier example-setting sanctions nor the logic of his call serve the debates surrounding the problem of computer abuse. He muddies the waters, inflames the passions of the non-computer literate public with false information, and apparently fails to recognize the lesson of his own writing, which is that reasoned dialogue rather than strident demagoguery is the ethical approach to problem solving. This seems a rather glaring lapse for one who writes on computer ethics. Former prosecutor Gail Thackeray, in an interview with NEWSBYTES, offered a sound justification for temperance in incarceration to explain her reasons for opposing a five year prison sentence for "Doc Savage:" "Usually computer hackers who get into trouble for activities of this nature are kids or young adults who are not the type to be in trouble for any other criminal activities. The point of sentencing in these cases should be rehabilitation. If we can break the pattern of illegal behavior, society will benefit from Majette's participation. If we simply locked him up for 5 years, neither he nor society would benefit." None can doubt her passion for deterring computer abuse, but she also recognizes the complexity of the problems and the value of social responses that benefit society, set *productive* examples, and simultaneously improve the security and harmony of the nets. The views reflected in the Forester post would return us to the dark ages of repression based on ignorance. Perhaps somebody should send Forester a copy of _Computer Ethics_ along with the suggestion that he read it. Jim Thomas is a professor of sociology/criminal justice at Northern Illinois University. With Gordon Meyer, he has conducted research on the computer underground culture. His specialty is the culture of the dreadful enclosures that we call prisons, where some feel hackers belong. ------------------------------ End of Computer Underground Digest #3.28 ************************************