Peter Wayner
Should hackers spend years in prison?
Stiff penalties for computer trespassing could create a broad new class of criminal -- including you and me.
The FBI recently declared war on those pesky hackers — again. The news is filled with the story of some group known as Global Hell that is breaking into Web sites and causing mayhem. The FBI is cracking down, confiscating computers and taking names; and some hackers are actually fighting back and shutting down some government Web sites.
The press loves hackers because computer crime is something new. (I’m using “hackers” the way the media does, to describe those who get their kicks breaking into computer systems, rather than the older usage describing those who delight in difficult software coding work.) Murder, rape, drug dealing, theft and fraud continue as always, with ups and downs in their rates — but teenagers breaking into Web sites is something no one has seen before.
The problem with the war against hackers is that most of what the hackers are supposedly doing would be trivial if it weren’t happening on the Internet. The typical hacker attack on a Web site isn’t much different from scrawling graffitti on the outside of a building. Many attackers are just poking around — like suburban teenagers who hop a fence to jump into a pool.
All of this would be great theater and a nice distraction from the war in Kosovo if it weren’t inspiring some serious reprisals in the courts — and some ominous inflation in sentencing that could wind up affecting everyone who uses computers in his or her daily life.
Wars on hackers are usually followed by calls for legislators to “do something!” and campaigns for new laws to crack down on the bad guys. The problem is that “doing something” often produces laws that treat the same action much more harshly in cyberspace than in “meatspace.”
The archetype of the demon hacker is Kevin Mitnick, a young man who has spent more than four years in jail waiting for his trial. When he was arrested, Monica Lewinsky was in her last year of college. During this time, Mitnick and his attorneys have jousted with government lawyers in endless pre-trial maneuvers that seem to have ended recently when Mitnick decided to plead guilty, probably hoping to receive a sentence that would be limited to time served. But even that deal is uncertain and taking forever to evolve; meanwhile, for Mitnick it’s just prison without a trial and with no bail.
Many, no doubt, see the crackdown on folks like Kevin Mitnick as a great deal for society: Information can be stolen just like anything else; surely the thieves who traffic in such goods should be locked up, just like car-jackers and muggers.
But there’s also a hidden danger. The precedents that the courts set now for dealing with demons like Mitnick will also apply equally to everyone who follows. And it’s not clear that the world is ready for Mitnick-like sentences for the crimes he might have committed, which remain murkily defined.
Think about it: Someone who reads another person’s Rolodex is just a snoop, but someone who clicks through somebody else’s Palm Pilot is hacking a computer database.
It’s easy to see just how slippery the calculus of evil gets on the cutting edge of technology. 2600 Magazine, The Hacker Quarterly, recently posted letters from computer manufacturers like Sun and Motorola estimating their losses to Mitnick’s alleged theft of computer source code. After Mitnick’s arrest, he was said to have stolen billions of dollars of information. Some companies calculated their loss by simply listing the hundreds of millions of dollars in development cost of the software affected — that is, the cost of all the programmers, their computers and other overhead. Other companies were a bit more careful and noted that the value was difficult to judge, but that recalls of products like cell phones could be costly.
The problem is, the price tag of information is almost impossible to determine. If Mitnick did take a copy of these companies’ source code, the companies weren’t denied the use of it, as when a mugger steals cash. Mitnick’s lawyers seem ready to point out that the companies involved didn’t bother to announce an official price on what they lost to Mitnick — something that the Securities and Exchange Commission requires public companies to do if the losses are significant enough. That would have required strict accounting measures.
To make matters even cloudier, in the meantime, Sun Microsystems began giving away the source code to its operating system to students around the world. In other words, if Mitnick had only waited a few years, enrolled in a university and asked nicely, he might have been a poster boy for Sun’s charity instead of a prisoner. Today, Sun is even circulating the source code to products like Java in hope of recruiting customers and snagging bug fixes. The company is practically begging people around the world to come take a look at its code.
This big change in the customs and attitudes of the software industry
strains the arguments against hackers. If giving away the source code is now a “good thing” for corporations, did Mitnick and the other hackers do a smaller good thing by grabbing it ahead of time? Is Mitnick now a bit closer to being a Robin Hood instead of a demon? If Linux triumphs, will children be told tales of the dark days when the Sheriff of Notingham sat on the boards of all of the corporations and forced them to keep their source code proprietary so
only the nobles could enjoy its bounty? Is it true that begging forgiveness is always easier than asking permission?
Such questions may be impossible to answer, but they illustrate just how confusing it can be in the nether-netherworld of information’s hall of mirrors.
As a commodity, information is fundamentally different from objects, and society has always graced it with special respect. The journalists who printed the stories about the allegedly racist words that appeared on a secret audio tape of Texaco employees looked like crusaders. But if it had been a digital tape, the reporters could be painted as hacking data compiled by a Texaco employee on Texaco time.
In the long run, society is going to have to think differently about hackers and the crimes with which they are charged. Taking information when it’s printed on paper is not always bad, and there’s no reason we should change this rule just because the information is stored on a computer disk. The intent of the criminal and the extent of the malice has always played a crucial role in our system of criminal justice. Many owners of things will forgive a theft if the “borrower” merely returns it unharmed. Crimes like trespassing are rarely prosecuted if someone just hops a fence and does no damage.
Computers and the Internet continue to frighten people, but prosecuting hackers runs the danger of setting nasty precedents that will begin to snare regular people, not programmers. Many convicted hackers are released from prison only to be denied the ability to use a computer or the Internet. In the past, this made it impossible for a person to get work as a programmer; today, they can’t even push the order screen at McDonald’s. After all, it’s hooked up to a central database — who knows what havoc a hacker could wreak while punching up an order of fries?
One of the best ways to put this all in context is to take yourself back in time 100 years to the turn of the last century, when auto racing was just beginning to roar across the scene. The machines were grand in size and sound if not in speed — Emile Levassor won the 1895 Paris-Bordeaux race with his four-horsepower jack rabbit that covered the distance at an average speed of 14.9 mph. Feats of technical prowess like that frightened the world, and by 1903 the French government was shutting down auto races — or restricting the death-defying machines to a bearable 20 mph.
A few decades later, James Dean became a rebel automobile hacker who scared parents around the globe. Today, he’s just another cutie pie
competing with Hanson for poster space on dorm room walls. One era’s demon is another’s icon. Is teen idol the next stop for Kevin Mitnick?
The end of the road for Pascal?
A venerable language falls victim to changing programming fashions.
The life cycles of programming languages are like those of political movements: They begin when a bright-eyed idealist dreams of changing the world. A few lucky projects turn into bandwagons that prosper. Then another bandwagon comes along, leaving the idealists to retreat to their collectives in the hills.
This week, the once great Pascal moved a giant step closer to the retirement commune when one of the major compiler manufacturers, Metrowerks, announced it was phasing out its commitment to the language.
Continue Reading CloseHow can they patent that?
The torrent of patents for e-commerce schemes raises new questions about an old-fashioned system.
Hey you, downloading audio or video clips from the Net — yeah, you! Drop that animated GIF. Put down that QuickTime movie. Forget about those MP3 files. Didn’t you know that buying copies of those things over the Internet is patented? If someone doesn’t pay royalties, someone’s going to be liable.
Patent fear is gripping the Net these days, as media coverage highlights new patents covering the flow of multimedia, music, money and whatnot over the Internet. In the past, news stories about patents were tales filled with strange chemicals, weird industrial processes, arcane contraptions with odd levers or microscopic things. To get a patent in the old days, you couldn’t be just any schmoe — you needed horn-rim glasses and a white lab coat.
Continue Reading CloseGlory among the geeks
For serious programmers, contributing code to Linux pays off not in dollars but in respect.
In December, I stopped by to see some old friends and colleagues at Group Logic, a software firm in Virginia. After a few minutes of chatter, Derick Naef, the director of project development, asked, with a bit of excitement, “Hey, did you hear? Rob Newberry got his code in the Linux kernel.”
He said this with an amount of pride roughly equivalent to announcing that someone hit a hole in one, had a child accepted to Harvard, ran a marathon in under three hours or got the city council to stop development of a chemical plant in your backyard. His voice made clear that this was a major event that was worth bragging about — perhaps not in the same league as hitting 70 home runs, but equivalent to getting drafted by a major sports team.
Continue Reading CloseThe ecology of Java
It's not just Sun vs. Microsoft anymore -- as the success of little Transvirtual shows.
Most readers will know the Java programming language as Sun Microsystem’s baby — its biggest weapon against Microsoft’s world domination. The media have been filled with stories of Sun and Microsoft battling over Java. First Sun sues Microsoft for trying to “pollute” the Java language with Microsoft-only features; then Microsoft counters with claims that it makes the best and most compatible version of Java. On the season’s fight card, this press release and lawsuit extravaganza is second only to Microsoft’s battle with the Justice Department.
Continue Reading CloseThe copyright boomerang
A new copyright law bans tools that "circumvent" copy protections. Does that make cutting and pasting illegal?
The end of this legislative year was a great time for Hollywood studios, recording companies and similar big corporate content mills. At the end of October, the White House and Congress finally approved a controversial new copyright law called the Digital Millennium Copyright Act that includes changes the so-called content industry has long lobbied for: Among other things, the law makes it illegal to “circumvent” copyright controls. The ban covers not only the making of an illegal copy, but also the creation of tools that might help you make such copies.
Continue Reading Close