Immunizing the Internet

jonny4001 writes "The Harvard Law Review has published a student-written article that argues that hackers, worms, and viruses are good for network security and that the law and public policy should encourage 'beneficial' hacking. From the article: 'Exploitation of security holes prompts users and vendors to close those holes, vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security [...] Current federal law, however, does not properly value such strategic goals.'"

Comments

PDF WARNING!

[Maelwryth]

The link is directly to a .pdf file. This should link to the Google html cache.

Re:Student from where ?

[OverlordQ]

Taking 2 seconds to view their hompages tells you this:

The Harvard Law Review is a student-run organization whose primary purpose is to publish a journal of legal scholarship. ... The organization is formally independent of the Harvard Law School.

What's with people being lazy? Or is it just an attempt at some karma whorage?

Parallels in Biological Systems

[D.A. Zollinger]

From another perspective, the author's ideas have some merit. In biological systems, it is only after one has been infected and their immune system fights off a disease that they are impervious to repeat infections. In this way entire societies build up resistances to deadly diseases. For example, Jared Diamond believes 95% of Native Americans were killed off by diseases carried by European settlers who were largely immune to said diseases. (link)

In a way, as different portions of the computer systems and software are attacked, the flaws that allow for such attacks are, in general, corrected. Problems identified in one attack can be applied to other areas, and as such, can affect system-wide changes toward a better system (think buffer overruns), as well as more security-minded design (think security developments in IE7 and Vista).

I'm not advocating that the world governments should let virus writers and crackers have free reign of the Internet. A balanced response would allow for leniency for those who have no malice in their intentions. Of course, this is difficult to prove, and from personal experience, I have yet to meet a virus writer with purely altruistic intentions. Also there are corporate interests to deal with as well. How embarrassing must it have been for Symantic to have their flagship product meant to help secure a computer be the source of insecurity? While Symantic handled the situation extremely well, many other companies do not have a large security minded staff on hand to deal with security problems. For them it is easier to accuse the attacker than acknowledge a problem they cannot deal with.