Clean Needles for Hackers

scubacuda writes "Jon Lasser of the Register opines that we should "give up on the notion that computer security can be improved by putting more people in prison." He argues that a "harm reduction" approach (similar to that of "clean needle" campaign in the War on Drugs) might be more productive. If we, say, wrote in safer programming languages, used tools like Immunix's StackGuard, ProPolice, or OpenBSD 3.3, chroot and UML, we could reduce the damage a malicious hacker might do without damaging our civil liberities."

Comments

What???

[madman101]

How does punishing people who commit crimes reduce our civil liberties?

Re:What???

[pubjames]

How does punishing people who commit crimes reduce our civil liberties?

It depends on what is defined as a crime, and what the punishment is.

Law is all about drawing lines - what is acceptable and what isn't. At what point does a particular act become unacceptable. If, for instance, saying things that were "unamerican" became a crime, then that would clearly be a reduction in our civil liberties.

Re:What???

[Enry]

The focus should be on preventing crime in the first place, not punishing someone after the fact.

Spending $10k to have someone go to AA to treat his alcoholism is a whole lot less than the $40k/year when he's in jail after beating his wife in a drunken rage, no?

Same idea here. You prevent the ability to commit a crime, and it can't happen (or the results are less severe). If you let them happen, you often times get an overraction from the authorities.

Re:What???

[satch89450]

How does punishing people who commit crimes reduce our civil liberties?

Define "crime" as "harm to society" and you start to see that many of the "crimes" on the books are not true harm, but rather annoyances on the order of "disturbing the peace." The thicker the statutes become, the more likely you will run afoul of them. (Some people claim that LEOs like this, because it lets them engage in selective enforcement to punish those people doing things said LEOs don't like.)

"I didn't know about that law!" is not a defense; as you pile on more laws, though, the chance that you didn't know about that law rises to unity. Using firearm laws as an example, the laws on the books since we were children were not being enforced, so the "popular" answer was to pass new laws! Some of those new laws made sense, some of them just warmed over what was already on the books.

The problem is that a legislature is sorely tempted, at some point, to stop telling us prohibitions and start telling us permissions. At that point, civil liberties are out the windows.

Re:What???

[gricholson75]

The focus should be on preventing crime in the first place, not punishing someone after the fact.

No. This way leads to madness. This is how police states get started. If we had armed guards and cameras on every corner, I'm sure there would be less violent crime, but I wouldn't want to live here. The best defense to lower crime AND protect liberties, is to have STRONG deterents to commiting crime. The problem in modern america, is that if you commit a crime, even if you're caught, likely you won't serve very long because we have a wussy legal system. As far as I'm concerned, if you kill someone while robbing them, and if can be proved beyond reasonable doubt, you should be put away forever. Now, the bleeding hearts will tell that young kids who do that sort of thing shold get a second chance. And I might even agree. But, if it was a well known fact that if you did the crime you WOULD do the time, I think there would be alot less of it.

Re:What???

[ratamacue]

Law is all about drawing lines - what is acceptable and what isn't.

That's exactly the sort of thinking that got us into this mess of huge, bloated, corrupt, oppressive government in the first place -- the idea that government's function is to tell us what's "acceptable" and what's not. The idea that government -- or a majority -- knows what's best for an individual better than the individual themselves. This is a very dangerous mode of thinking.

Government's function is to protect us against the initiation of force -- to secure our property rights. Everything beyond that is arbitrary by definition, and necessarily screws over somebody for the benefit of somebody else.

Re:What???

[calvinthorne]

I often ponder on the "ignorance is not a defence" topic. Do you think at some point we could fight back with a class action lawsuit claiming that there is no way for a typical human to be sure that s/he is in compliance with all the local laws? If someone actually tried to memorize every law that applied to them it would be quite a task. And, of course, some of them change when you go to work in a different city/county/state.

Is this guys on drugs?

[www.sorehands.com]

Why not just have police stop arresting criminals so that the number of resisting arrest charges get reduced.

Drug addition is a physical additiction. The idea of the needle exchange program is to prevent reduce the spread of a FATAL disease. The purpose of the laws against needles is to cut the use of drugs, but the drugs are still illegal.

Here, this guy is proposing something along the lines of eliminating car locks so that noone will be arrested for carrying burgulary tools.

Horrible Analogy

[ratamacue]

People who break into other people's computers are trespassing. This represents an initiation of force -- a "natual crime" if you will -- because there is an actual breach of property rights. There is no question whether it is just to take action against these people.

People who use or trade drugs, on the other hand, have initiated no force. There is no breach of property rights. Drug "crimes" represent, at best, a breach of government-mandated conformity -- an "artificial crime" if you will.

To compare the two is not only illogical, but dangerously misleading.

Re:Horrible Analogy

[Bendebecker]

there is an actual breach of property rights
That is highly debatable. I agree that hacking is not ethical, but it would be better if you dealt with as a violation of privacy. Technically, no ever enters your computer (assuming they don't physically come into your house and open the box) and so property law doesn't really hold true. My computer sends requests to your computer, your computer sends replies. It is the same as yelling at you from across the street. If I trick you into getting you to yell sensitive information back at me, I have not tresspassed and yet I have, in a manner of speaking, hacked into you. This is not a pefect analogy, but it holds the same weight as your analogy of thinking of cyberspace as real space (and hence tresspasable.) No matter what analogy you use though, hacking does not necessarily fit the old norms of property law. The fact remains that cyberspace property and real space property are fundementally different and so you cannot simply assume that the old laws of property cover this new type of medium, especially considering that real space property laws were written to protect only real space property. As such, discussion must be held to determine how we will view this new type of 'property'. You see regulation of it as an extension of the values that influence real space property law. However, the concept of seeing regulation of cyberspace as being similiar to the regulation of drugs is also a valid viewpoint. An example of such an argument would be that: hackers have chosen not to conform to the norms of what most people would consider to be ethical conduct on the net; whether this is illegal or not is as artificial as the computer networks cyberspace exists on. In the end, comparing computers and drugs is as logical as comparing cyberspace to property; if your final line holds true for one, it holds true for your comparing cyberspace to real property as well. You, accidently I assume, allowed your analogy of seeing cyberspace as property to cause a myopic effect that blinded you to seeing cyberspace regulation from a different viewpoint (the greatest danger of analogies.)

Not right, or feasible

[voice of unreason]

Firstly, I doubt this is entirely workable. There's too much unsecured legacy code that no one's going to want to rewrite.

But mainly, this is simply the wrong attitude. If someone breaks into your house, it is the burglar's fault. It isn't your fault for not surrounding your house with barbed wire and a pack of rabid dogs. While I agree that penalties for hackers are often overly harsh, that doesn't change the fact that they knowingly committed a crime of their own free will, and should be punished for it. Hackers are responsible for their own actions. It's that simple.

disturbing trends

[pubjames]

I find it disturbing the number of people that are posting saying things like "but these people break the law, so they deserve what they get".

Come on Americans, what's happened to you recently? Where's your spirit gone? The spirit of justice, fairness, freedom? Is it right that teenagers get sent to jail for "hacking" when the state of IT security is so poor? If your bank left sacks of money outside it's doors, when they got stolen by a couple of kids would you think it was the kids were guilty of a crime, or the bank?

In the old America, the kids would get a stern telling off and the bank manager would be accused of negligence. These days the kids would be looking at a long jail sentence, and the bank would be pressing the government to pass laws waiving them of any responsibility.

Re:disturbing trends

[SteveDob]

> Is it right that teenagers get sent to jail for "hacking"

That was a good question, and you were doing fine up until

> when the state of IT security is so poor?

Where on earth did you pick up that warped morality? Surely we don't have to explain what is wrong with "I didn't rape her, she was (drunk/dressed provocatively/in the wrong area/whatever)"? Although the gravity of the offences are on completely different levels, there is no difference in the crassness of the proposed defences.

Re:disturbing trends

[tgrigsby]

Is it right that teenagers get sent to jail for "hacking" when the state of IT security is so poor? If your bank left sacks of money outside it's doors, when they got stolen by a couple of kids would you think it was the kids were guilty of a crime, or the bank?

Wait a minute, Sparky, your analogy isn't working. I agree that not relying on security-friendly tools is almost criminally niave, but let's review for a minute.

It's not like kids get on their computers, log into AOL, and suddenly find themselves looking at a window that contains credit card information with two buttons at the bottom that say, "Steal these numbers" and "No thanks".

You leave your car in the driveway rather than putting it in the garage? Should *you* be held accountable when the radio comes up missing while the police just give the robber a slap on the wrist? I doubt it.

Yes, IT should do its job securing machines. No, crackers shouldn't get a slap on the wrist for breaking into computer systems.

And I don't agree with the author's premise that crackers can't be impressed with jail sentences. Look at terrorists. Rich countries don't generate terrorists. Why? Because people in general have more to lose. Violent religious extremism is the domain of the poor and disenfranchised. They have nothing to lose and they're pissed off about it, and much the way Hitler exploited the frustrations of the Germans, and Milosevich exploited the the frustrations of the Yugoslavs, bin Laden exploited the Afghanis, all for power. But give them a life worth defending and they will be more interested in defending that life than blowing themselves up to get back at their oppressors, real or imagined. Put bin Laden in Oakland and he'd be lost in the sea of 2-bit activists preaching about being put down by The Man. oops.... ok, end of rant....

The same holds for crackers. With the exception of the tiny percentage that are deranged and devoted to harming others for fun, most have lives they'd rather not trade for spending time in jail hoping Bubba doesn't think they're cute.

Think of it this way: if you have a computer to do your hacking on, you probably have enough material items that you'd miss them badly if they were gone. Make jail sentences, fines, and other penalties stiff enough and the overwhelming majority of crackers will find other things to do with their time. As for the rest... Bubba needs love, too.

Re:That's not what this is...

[Shalda]

I'll give up my C compiler when they pry off the platters of my cold dead hard drive.

Seriously, the problem is not insecure systems. The problem is little fucknuts that think they have some god given right to violate my systems. There's really no comparison to be made with the war on drugs. It's much more like burglary. While the vast majority of these obnoxious little h4x0rs would never even think of robbing a bank or burglarizing a house, breaking into a computer is easy to rationalize because they don't see the damage that they're doing (and the odds of getting caught are low).

Solving the problem does not mean closing the security holes, although that should be done. Solving the problem means dipshits don't try to hack.

There are no natural property rights.

[Nindalf]

Let's say a group of men are shipwrecked on an island and one runs out and picks all the fruit from the few life-sustaining trees on the island while the others tend to the wounded. He now insists he owns the fruit, and demands payment of all the tools and materials which washed up from the wreck, plus a year's labor from anyone who doesn't wish to starve. Consider also the case in which he doesn't pick the fruit, but runs out and finds all the fruit trees, blazes the trails to them, and carves his initials in them, then claims perpetual total ownership over the trees.

Now, let's say each person carries a Law Giver weapon, which is perfectly effective, but only when defending natural property. In these situations who will the weapon side with?

Territory - claimed, defended, and expanded by violence and threat of violence - is natural. Claiming territory can be an act of aggression against the common welfare. Property is territory formalized with artificial rules. Rules for transactions of existing property might be considered natural and simple, but rules for the origin of property are entirely arbitrary. No matter how far down the chain of "natural" voluntary transactions, it is anchored in and tainted by an artificial and arbitrary government decision about the allocation of natural capital.

This is how, "securing your property rights screws over somebody for the benefit of somebody else" is true. It's not all of the picture, but it's a significant part of it. Defending the fruitbaskets of the man who runs out and picks all the fruit before anyone else can get to it screws over those who would have picked it themselves. There isn't one man in ten who'd agree that a just government would give this opportunistic weasel exclusive rights to nature's bounty in this situation.

Government's core function is not to secure "natural property rights." It is to minimize violence by easing the pressures that promote it. A large part of this is encouraging stability and voluntary interactions, but it's not the only part. Government is a balancing act, a series of compromises, and couldn't work according to simple, inflexible rules.

An analogy from the "real world"

[Shoten]

Ok, so let me see if I got this right. Current (intensely clumsy) law enforcement deterrents are not working. So we should instead decriminalize hacking, and place the burden upon the victims to mitigate their vulnerability? How much more are you going to burden them than already is the case?

To me this is like responding to a rise in shootings by decriminalizing assault with intent to kill, and instead demanding that doctors and paramedics do a better job.