Sunday 27 November 2011

Hacker Motivations

The IRS has a bad reputation - and it deserves it. Sure, they pretend to play fair (I have a friend who received a refund check from the IRS for one cent; so apparently they can be honest at times), they pretend to do things in our interest, but underneath it all they do a lot of cheating, conniving things.

For instance, the IRS has a computer selection program called the Discriminate Function System. DFS is a system used by the IRS to select over 80 percent of the income tax returns which will'be audited. When the DFS selects a return for audit, it is because the program believes there is a high probability the citizen made
improper deductions, or hasn't reported all income, or for some other rea-son believes the filer has lied.

Now, as citizens of the United States, we are entitled to know all the laws and regulations of our country, right? Not so, according to the IRS. The decisionmaking formula (algorithm) used by the DFS to select which returns will be audited is kept secret from us (so we can never really know to what extent an action of ours breaks the IRS's re-turn-selection laws).

It seems logical and fitting for the IRS to not re-veal this secret, because doing so prevents a lot of fraud. But it also restricts our rights, and several years ago, two outraged citizens sued the IRS to re-veal their selection formula. The citizens won and the IRS was ordered to reveal the formula. The IRS was not ready to reveal
their secrets, and they ap-pealed their way up to the Supreme Court and still lost in favor of the Freedom of Information Act.

But since the IRS is a crying, whining, wily baby, they refused to obey the court orders, and ran to Congress for help. Congress, of course, immedi-ately enacted a statute which made the IRS's audit selection algorithm immune to the Freedom of In-formation Act.

Now, I ask you: Can you think of a better rea-son to hack than to get back at the IRS? I'm sure that someday some hacker will surreptitiously stroll into the IRS's computers and make off with their Discriminate Function System, and publicize it widely for all to see and file by. <This has already happened in Australia. A
computer professional working for the Australian Taxation Commission wrote up a guide to the confidential computer program which the commission used to determine the legitimacy of a taxpayer's income tax form. Taxpayers could use his guide to safely overstate the amount of deductions they claimed.> Even if that doesn't happen, and even if that's not a hacker's main goal (which I wouldn't expect it to be), there are plenty of motivations from which to choose.

Dissemination of information is always an hon-orable incentive to hack. According to Tom Forester and Perry Morrison in their book on computer eth-ics (listed in the bibliography), following the Cher-nobyl nuclear disaster, hackers in the Chaos Computer Club "released more information to the pub-lic about developments than did the West German government itself. All of this information was gained by illegal break-ins carried out in govern-ment computer installations." Certainly that was a noble and just act on their part, from our point of view.

Hackers also see themselves as preventers of disasters - computer disasters that is. There have been several recent examples of computer security companies from all over the world putting their se-curity products to the test. They did this by publicizing a phone number hackers could call to try to beat the system. Sure this is
done for advertising hype, but it is also a good idea, and it gives hackers a chance to do some computer cracking in a benign setting.

Hackers who maintain a high degree of virtue will use their illegal hacking to prevent disasters. Once they have discovered (and misused) a secu-rity loophole in a system, they will warn the system operator of that fact. Hackers are thus beneficial to the world in that they act to keep the world in-formed and secured. But we can only be assured of these traits if the hackers themselves conform to ethical behavior. Unfortunately, due to the exciting/risky/devilish nature of hacking, the people involved are often immature and play around in juvenile
activities such as vandalism and carding (mail ordering stuff on other people's credit cards). These are the sorts of activities that True Hackers should strive NOT to be associated with, as they degrade the word "hacker." Many hackers, even some very good hackers, have done their part to give hacking a bad name by having skewed motivations. There have been plenty of destructive hackers, and those who just did not know when to quit.

There are also hackers-for-hire. Private citizens are willing to pay hackers to change computerized information for them - grades, ratings, bills, access levels. Or there are the people who want informa-tion about themselves deleted from the record, be-cause they are in hiding. Private investigators can always use the skills of the hacker to find addresses and phone numbers, credit ratings, and other private concerns of clients and suspects which are con-tained on computers. Office workers have hired hackers to scope out the personal electronic mail and files of coworkers and competitors, to gain an edge when making a proposal or a bid.

There is not only industrial, but governmental espionage. All of the above has been done and is being done RIGHT NOW, by hackers who hack for money. Hackers tend to look down on other hackers who fall into this line of work. Maybe a once-in-a-while job is okay, but to do it extensively and exclusively is to sell out one's integrity.

I like to think that all people reading this book, and all hackers, will use their talents to good ends: to promote public awareness, prevent tragedy, and to learn new technologies and new innovations for one's own self-growth.