Security

Hackers: From innocent curiosity to illegal activity

Researchers asked why talented youth skilled in "computerese" evolve into criminal hackers. Michael P. Kassner explains their unexpected results.

I'd like to introduce you to Ben, an intelligent, personable young man, who has shown a propensity for all things techy. At the age of eleven, Ben tested and passed both the Technician and General class ham radio license.

In middle school, Ben took to computers like Minnesota mosquitoes take to bare skin. By the time Ben graduated from high school he had accumulated a string of computer and networking certs including MCSE and CCNA, a 4.0 GPA, and was awarded numerous collegiate scholarships.

Because of a few stunts in high school, Ben had a somewhat tense relationship with the school district's CIO. Fortunately, Ben skirted the issue by helping the district's IT department plug the security gaps he discovered.

Ben is now in his second year at university. Up until recently, his biggest dilemma was deciding whether he wanted to major in Computer Science, Electrical Engineering, or perhaps both. The operative word being "was." As of today, it is unknown if Ben will even be in college next year.

Ben is in trouble -- deep trouble for illegal computer hacking.

If people had known

I wish the April 2013 ACM article, "Why Computer Talents Become Computer Hackers," written by Professors Zhengchuan Xu, Qing Hu, and Chenghong Zhang would have been published sooner -- a whole lot sooner. Maybe people concerned about Ben's welfare would have better understood the mess he was getting into, and helped him.

In their paper, the researchers divided the process of evolving into a criminal hacker into three stages: initiation, growth, and maturation. According to the paper, the middle stage is the only one getting any real attention:

Published studies focus primarily on the middle stage -- growth -- of the evolutionary path of computer hackers, in which hackers organize into loosely connected groups and virtual or real communities; acquire technical skills through mentoring and sharing; and establish social orders, group norms, and individual and social identities.

The professors expressed concern about the other stages:

However, little research has targeted the first and last stages -- initiation and maturation -- leaving many questions unanswered or with no clear answers, including: how, and why certain talented young people evolve into pathological computer hackers?

Since there was little research into initiation and maturation of hackers, the team decided to conduct their own study of six young and talented computer hackers, hoping to gain insight into why individuals with so many gifts prefer a criminal lifestyle over a promising career.

Ever evolving

Let's look at what happens in each of the stages (I condensed what the researchers described in their paper): Initiation
  • Early interest in computers: The research team found all but one of the subjects developed an early interest in computers.
  • Innocent motives: The subjects wanted to know more about computers, and enhance their online experiences. To do so required the subjects to alter existing software or overcome network restrictions.
Growth
  • Minds are not challenged: All six subjects were capable of being A-students, but were uninterested, preferring to spend their time learning hacking skills.
  • Porous security: The research team chose to mention what we all know, computers and networks are insecure. Meaning the subjects did not have much of a barrier to overcome.
  • Tolerated by schools: This appears to be a touchy subject; to get it right I'm going to quote the researchers:"Although it's clear not all school computer administrators are indifferent to hacking, evidence shows our student hackers were usually able to mend the relationship to avoid punishment after their hacking was exposed." In other words there were no repercussions.
Maturation
  • Associate with other hackers: If I have a problem, I go to the experts for an answer. No sense reinventing the wheel, ask someone who's already done it.
  • Shifting moral values: This concern is tough to quantify, and getting answers had to be difficult. Every one of the subjects felt they knew the difference between right and wrong, and have not stepped over the line. But, the subjects admitted they would consider it if their survival depended on it, or justice would be served.

Those are the evolutionary steps; the researchers then tried to figure out which ones had the most impact on convincing someone to take on malicious hacking. There were three.

The number one enabler is the lack of security and the abundance of software vulnerabilities. It is just too much of an enticement for young inquisitive minds. The other top enablers were tolerance of hacking by schools, and association with other more experienced hackers.

What can we do?

The researchers came to the conclusion there are two things we can do:

This framework calls for zero tolerance for hacking in schools and early intervention (such as through courses in computer ethics in middle and high schools, supervised competitions in defending computer security, and organizing computer security services for organizations) to strengthen the moral values of students against hacking and channel their interest in computers in a positive direction.
Zero tolerance and early intervention, I asked a few teachers and administrators what they thought about the team's conclusions. Unfortunately, I have not received any answers by deadline. So, I'd love to hear from you (particularly those who teach): do you agree with the paper's conclusions?

Final thoughts

What am I taking away from this article? Some serious guilt. Looking back, I recall numerous situations where I reacted just like most teachers -- far too reserved -- when students told me about their hacking exploits. I am also guilty of providing "information" when questioned at seminars or school talks.

I would like to extend my thanks to Professors Xu, Professor Hu, and Professor Zhang; along with the ACM for providing the data, and allowing me to borrow quotes from the article.

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");

document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

// -->

try {

var pageTracker = _gat._getTracker("UA-9822996-4");

pageTracker._trackPageview();

} catch(err) {}

// -->

About

Information is my field...Writing is my passion...Coupling the two is my mission.

152 comments
jolobel
jolobel

Catch the hacker and jail him. I think this is a simplistic point of view .We must teach a strong ethic and give the the boy or girl the tools to avoid tempation to fall in the illegality. I think this is a solution form many problems in our current society

jancardi
jancardi

... it's great that everyone has all of these ideas. But is anyone willing to help with the implementation?

michael
michael

The article misses the point as to who are the malicious hackers. There is very little wrong with students hacking, as long as it is not destructive, and it usually is not. The real problems is those hackers who are making lots of money putting malware on our computers to try to sell things or get us to pay for things which are available for free. And yes, many of them are on the payroll of companies like Sony, HP, etc, and have enough lawyers to make what they do have a cloak of legality. Example, why do I have to wait three minutes for an HP printer driver to scan 400 MB of my hard disk when I power up my machine to do who knows what. Shouldn't that be called hacking? Shouldn't somebody go to jail for that?

uotreoa
uotreoa

Such students need: (1) Information and legal challenges (2) Mentoring Such brilliance could be employed in Ethical Hacking.

cougar.b
cougar.b

I learned about the role that Anonymous Canada had in reopening the Amanda Todd case this week when a spokesperson for Anonymous was granted an extensive interview on our public radio network here in Canada. CBC currently enjoys editorial freedom, but the Harper government is trying to restrain it. over 120,000 Canadian citizens have signed a petition to prevent it, but Harper is Bush North, and we have no idea whether our voices will be heard. In the meantime, it's good having a national broadcasting network that still retains the ability to broadcast investigative journalism without political influence.

cougar.b
cougar.b

In both the books and the films, the Girl with the Dragon Tattoo operated on the far side of the law, but because of her personal ethical sense, she brought down corruption and wreaked vengeance against people who raped and abused her. The system failed her, and eventually, she took justice into her own hands in a way that many would find despicable. The authors of the study that led to this discussion apparently do not see the need for this kind of justice, which makes them enemies of true justice. In 2012 in Port Coquitlam, B.C., Amanda Todd, 15, took her own life after being abused and cyber-bullied in a variety of ways, including sexually. The authorities did not devote the resources to the case that would have led to convictions. Anonymous Canada stepped up to the plate and outed some of the abusers, and the case was reopened. This year, Rehtaeh Parsons, 17, of Halifax, Nova Scotia committed suicide because of the same types of problems, including rape. According to the news, Anonymous is again planning to do its own investigation to end the abuse and to make sure that justice is done. I think that the RCMP is taking note, and now cyber-bullying is regularly discussed on CBC radio nationwide. Maybe change is coming. I hope so. We need hackers of the Girl with the Dragon Tattoo and the Anonymous Canada variety because we have an abusive society that is more interested in preserving the status quo than defending justice. I say that hackers can be heroes. I personally don't understand the technology needed for any of this. I'm an amateur who is stumped by turning some of my code into jQuery plug-ins, and I devote all of my technical abilities to designing meditation and self-development software, such as a recent app called "Use Inner Silence to Be More Thoughtful Throughout your Daily Life," which is at http://grokwisdom.org/breathing.php. (This is just the tip of the iceberg--a prototype for a much bigger system.) Nonetheless, when I watched the film and read the books about the Girl with the Dragon Tattoo, and when I see what Anonymous Canada is doing to bring justice where otherwise there would be none, I cheer for the hackers. May God bless them. They're doing the work of righteousness. Frankly, our society doesn't provide any role models for young hackers that surpass Anonymous Canada. Wanna solve the problem? Create better role models that kids can truly admire. And get rid of the abuse so that the actions of Anonymous are not necessary, as they are today. The fact that we cheer in the movies for the Girl with the Dragon Tattoo is an indictment of what's wrong. Cougar

cougar.b
cougar.b

I wrote earlier in this thread about the schools I sent my children to in Canada, and I contrasted them with the psychopathic policies of most public schools in the US (and Canada to a much lesser extent). The North American system of education has never been proven superior through science. In fact, science favors other systems, and the two schools I mentioned are evidence of this statement. I wasn't aware that the entire school system of Finland also demonstrates the total inadequacy of the North American assumptions about education. Here's a very funny, yet very educational, TED talk by Sir Ken Robinson that provides the solution for all of the evil that North American school systems perpetrate against our youth. http://feedproxy.google.com/~r/TEDTalks_video/~5/Zi0l5yau0Kc/SirKenRobinson_2013S.mp4 As I said earlier, the solution is [b]Stop Abusing Kids.[/b] Discovery School and Windsor House School (both in BC) are simply the examples that I have the most experience with. Justifying the current education system and trying to shore it up with policy Band Aids is mostly just Stockholm syndrome. Cougar

Marc Jellinek
Marc Jellinek

A "study" with a sample size of SIX will be used to set policy recommendations? These guys are sniffing their own fumes. This study (peer reviewed? doubtful) was criminal to release and criminal to reprint.

mcarr
mcarr

is hiring, so Ben should be fine.

premiertechnologist
premiertechnologist

When I was a lad of 12 and having a subscription to Science magazine, I happened upon the binary counting system. I could not understand it, so, having discovered a rack of relays from AT&T in the town dump from the microwave tower, I built a 24 volt DC regulated power supply, designed the circuits, soldered them together and made a binary counter, replete with an indicator panel with 15 lights. I added a rotary telephone dial to be able to add the numbers in binary. I learned binary. So these talented lads should rise to the challenge and actually BUILD something to sate their curiosity -- but they just don't need to invade anyone else's space or property. Of course, teachers and parents should be supportive and peers? Well, if the peers don't keep up, that's their problem. Doesn't anyone think that the real problem is the attempt at socialization so every child will finally have the personality of a smarmy sleazy manager / director / CEO / salesman psychopath, cast in the same mode as the leaders of the world. Or worse, to be molded into the robotic slaves who work buried in IT departments adapting to insane dysfunction created by the smarmy sleazy managers / directors / CEOs / salesmen psychopaths, utterly helpless in he onslaught of unworkable high concepts from highly paid twits who have not one shred of understanding of science (particularly physics), logic, math, morals or ethics. Of course, what most can do, in typical boomer fashion is to discuss this, expressing opinions which will have no particular consequences for those who create the problems and doom the next generations to the same fate as their elders. The Universe is fair, the world is fair (in fact somewhat generous), but people? It's the people who are unfair and the problems keep multiplying and amplifying because of a total lack of character and utter compromise of the "shoot, what do we do now?" variety. The kids see the example of the adults and decide they can get away with it. The solution: Set the right example and mentor the kids to guide them on the right path. Good luck with that.

Mahegan
Mahegan

The science master came up to me and said "..., we have taught you all that is required for the higher school certificate. Here are the keys to the prep (chemistry preparation room). Earn this school a few science competition prizes" - Perhaps that is what is required for the "Ben's" of this world. "Ben Franklin", or "Ben to prison"? Who knows what might happen if "Ben" had been given the task of setting up a CCNA laboratory for the benefit of the other tecchies in the school? Sometimes the creativity of the students exceeds that of their (standardised NCLB) teachers - and perhaps something is required there, as well.

sgtgary
sgtgary

Kids are naturally curious and we shouldn't be punishing them for learning. The problem resolves around the fact that there is nobody mentoring or teaching them and they're ready for the challenges of finding out how software works. In today's day and age, we should be teaching kids about software, security, and computer ethics, all the way through their school years. Until then, there are organizations that help challenge these gifted kids and keep them on track towards cybersecurity -- places like Hack the Future, CyberFoundations, and many others. At no time to I suggest we tolerate illegal hacking, but we should focus on guiding our future cybersecurity professionals.

crcraft
crcraft

If you believe you evolved from monkeys why wouldn't you do anything that "feels" good? Their behavior is perfectly normal and expected when you consider the world view taught in our "wonderful" public school system and put forth by this administration. It really is this simple.

femaletechie
femaletechie

This is not going to help the young hackers in the audience "behave". But it might help the rest of the audience understand. In reality, Schools can do anything they want to. They choose to play to the lowest, dumbest, and most obvious denominator ... but they DON'T HAVE TO. I speak from experience. I grew in an era before computers, before playground shootings, and before anyone had any notion that any student would not just knuckle under and attend class, chew gum, spit chew, comb their hair and pass notes, 5 days a week, every week, for exactly 12 required years. And then, in my freshman year of high school, I got sick. Life-threateningly sick. I wasn't able to study or even read for very long for months. And before I was well enough to give it any thought, they decided, on their own, that I was "so far behind" that I needed a private tutor, and they just gave me one. Turns out, they can do that - and while I knew I could catch up in a week, I definitely wasn't going to argue with them. Almost dying was the best thing that ever happened to me. He let me write my own curriculum (within some very loose guidelines), and he did not pace it. Seeing the light at the end of the tunnel and with absolutely nothing better to do, I finished high school (and a bunch of early college) in a year and when they realized that the only things they had left to offer me were gym and shop classes (rural area, there were LOTS of shop classes), after a few run-ins where I'd show up on the first day of class and finish the week with all the homework completed and ask "and what now?" ... they let me just move on to taking courses at the local community college. I got to apply the credits both ways - I got a real high-school diploma (while, thank god, rarely setting foot in one) AND I got to keep them as college credits. That led to a transfer to a 4-year university where I was recruited by Microsoft in the late 80's. Women were not well received in computer science classes in the 1980's. I became expert at picking guy's passwords by simply watching them type them in and sending embarrassing messages on their behalf (is that "hacking?"). I figured out how to hack the mainframe job queue and make the most insufferable of them, receive their time-critical, grade-critical output ... on punch cards. (is that "hacking"?) And once, irritated with an overbearing far-too-full-of-himself professor, I simply renamed all of the (unprotected) assignment files and brought the entire department to a grinding halt for a week (if that's "hacking" ya'll should just be embarrassed). And I fixed a defect in the bug-riddled Modula-2 compiler that was preventing ANYONE from actually writing a program that worked. If that's "hacking" - fine. I'll live with that. I worked for Microsoft for 14 years. The Net/net in this is that these smart kids need to be EMBRACED, ENCOURAGED, AND GIVEN BETTER WAYS TO LEARN ... not stuck in the stifling mess that we call high school that was designed to create factory workers and has not been retooled since.

msinkm
msinkm

This zero tolerance foolishness is not the solution. As he said, get the kid onside and working on pen testing. Not in the penitentiary! This is where he would be recruited by much worse people. Mentoring is the solution. I have zero tolerance for those with zero tolerance.

elidreamer
elidreamer

Although not all people go where the most money is, if we don't pay instructors anywhere near what they could make in the private sector, it's no wonder the brightest kids are ahead of the staff. ... thus not challenged. I've also seen where the staff are paranoid of anything that makes them look like they don't have everything under control and are the top of their game. A good student see's security problems and points it out to to the staff and get's reprimanded for snooping around in the network, and then get accused of being bad and trying to mess up the system or steal or whatever. The idea of holding 'survival' and 'justice' as the moral high ground is fine, but there seem to be few that understand the difference between want and need. If they don't understand what is really needed to survive, then it can quickly become a slippery place to stand. And justice? Justice for who? "Zero tolerance" is often code for people not wanting to get involved in others lives. It's just the opposite of what's needed in working with students. If you want to have a positive impact on their lives, you are involved. If you don't care, why should they.

eoschlotz
eoschlotz

Zero tolerance is the typical bureaucratic response to anything. I have never seen it have any real benefit. It will cause those bright, curious, motivated kids to become better and more mature hackers in order to satisfy their curiosity without getting caught.

mowder
mowder

"Computer ethics" is far too limited - the entire ethical framework of these children needs an adjustment. I play a MMORPG with tens of thousands of middle schoolers and young adults. Easily half of the players are adults, but the kids always assume *everyone* is in their age cohort, so they talk quite freely. From what I've seen, kids (all of whom have great computer skills) have learned from a social/political environment the lesson that if an action is profitable, go for it - whether you have to lie, cheat or steal.The bigger the amount at stake, the better. The Too-Big-To-Fail banks did it, and they got huge taxpayer bailouts. The last President lied so that we would fight a war for his psychological satisfaction, and the fiscal benefit of his backers. He's still treated as a revered man. They see this everywhere, from the tax system to business profits. So easily 50% of them cheat the game and other players, whether by using illegal bots, scamming, "luring" players to rob them, or any of the dozens of ways you can cheat people online. They laugh about it. They congratulate each other! And this is only for game gold pieces. Just look at the torrents of copyrighted material on any given day. In their opinion, only suckers don't cheat and steal. Imagine what they will feel comfortable doing when they get to deal with real money. You can't stop hacking by making middle-schoolers take a class in computer ethics any more than you can stop illicit marijuana use with DARE classes. These kids make fun of the anti-drug message that DARE delivers, even while getting "A"s. They will make fun of the computer ethics classes as well. You want to stop computer hacking? Stop corporate and political practices that put wealth first, and ethics last.

AidanRoberts
AidanRoberts

Not that every intelligent person dreams of being a criminal, but smart people don't like boxes, and if they're not free to be, they look for challenges elsewhere, where they can be free to exercise their judgment and play around figuring things out. It's also the thrill - gets boring fast when you're smart.

brian
brian

I agree with you completely. I am not a crook. :) What I described is basically a form of White Hat Hacking. I never made any secret of what I was doing. I would talk at nauseating length about what I had discovered. To anybody who would listen. But I gamed the system. The teacher and school got more recognition and equipment. All the students involved had the opportunity to benefit. This whole thing represents the ever-present "slippery slope". How did my skewing the results affect funding for other schools? What about the tax-payers who funded my endless recalculations of the value of PI? This leads to a situation that I call Culpable Ignorance. If the child is given tacit permission to do something that will benefit the adults, is everybody absolved of the moral or (in this day and age) legal ramifications? There are two points: 1) Permission or not, the Zero-Tolerance policy WOULD criminalize this. It would be argued that I was the mastermind of a criminal conspiracy among teachers and students. We used electronic computer access credentials that did not belong to us. We intentionally inflated a metric that we knew would affect funding and equipment allocations. 2) Zero Tolerance policies are a crutch that allow uninformed administrators to simply criminalize anything that they do not understand and to shirk responsibility for the jobs they should be doing. System crashed? Must have been Brian. Payroll was late? Ummm. We were hacked. Must have been Brian. It is true that Bad Things happened occasionally. Sometimes the system slowed to a crawl. Sometimes it crashed. The administrators NEVER gave me any feedback about what I did. I was left to figure out what went wrong on my own. If someone had known enough, and taken the time to actually talk to me (or teach me) some of this could have been avoided. I have a moral dilemma and the school district has a headache. There is no doubt that the district would have run more smoothly and been less expensive if I had not been involved. The solution is simple. Lock me and my kind away. Come to think of it, students are the biggest problem in any educational system. Best to tightly constrain them, if we cannot eliminate them altogether.

dasdave
dasdave

Fill a leaky balloon with gas and what happens? It escapes. Molecules diffuse, according to the various "laws" of physics. This is objective fact. While much more complex, humans also act within the physical universe, subject to physics, but also in an informational universe, of sensation, motivation, cognition and emotion which neuroscience and psychology have barely begun to understand. Just like helium atoms in a balloon or animals released in a game reserve, curious humans explore and eventually discover all sorts of possibility for expansion beyond the normative bounds of their containers. The "initiation" stage is the heart of all learning, a particular application of some hard-wired survival motivations in all living things. The "growth" stage describes evolution of individuals in a particular direction, again an essential part of survival, but the filtered, in this case, to those with interests in the exploitation of computational power, and further, leveraging penetration and circumvention skills. Even association and competition with others (first part of "maturation" stage) is a necessary, value-neutral part of every human's life. Stunting any of these stages limits human potential. I look at the problems with so-called "hackers" as similar to Wall Street fraud: a broad class of anti-social self dealing, putting personal gain above the collective good, or adherence to laws or moral code. Such behavior, age-old throughout human history and the animal kingdom, still thrives today despite the “corrective” influence of values and laws. Indeed, one may view the arms race between hackers and security experts as parallel to the conflict between corporate profiteers and those who seek to architect business and markets to benefit collective humanity rather than a narrow slice of oligarchs. Any behavior involving risk, be it crossing the street, parachuting, investing, or crime – can be represented by the game theory equation of (Benefits – Costs). Punishments, however steep, are only a small part of the “game,” since the high costs of being caught are nearly eliminated by the often very low probability of being caught. Consider: of the many thousands of individuals involved in the colossal Wall Street real estate fraud, how many are in jail right now? The physics of behavior are intrinsically related to environment and incentive. If there is reward for a particular behavior, be it hacking or insider trading, it attracts players. Spammers “hack” consumers by stealing their identities. Crackers break corporate security systems. Corporations circumvent financial safety controls like Glass–Steagall; congress guts the Stop Trading on Congressional Knowledge act. Legal or not, all these players are betting that the benefits outweigh the costs, and they nearly always win. So, yes, “hacking” is a problem -- witness this week’s “massive” $45million ATM theft – but compare that to the scale of corporate thefts: Enron’s alleged $9 *Billion* theft from electricity customers in California. Madoff’s $50b Ponzi scheme. AIG’s Credit Default Swap implosion requiring over $180b in taxpayer bailouts. Billions in fines – on profits large enough that these fines are considered the “cost of doing business.” Over 14 *trillion* doled out to banks and mega-corps to forestall total collapse. And that’s just in the financial domain. Computer hacking is just one small but growing slice of the endemic hacking of social, legal and financial systems that threatens to further destabilize and possibly collapse economies across the globe. The U.S. once became *the* place to invest, arguably due in large part to both growth AND stability based on the rule of law and its enforcement. Zero Tolerance for computer hacking? That’s no cure at all. When society rewards self-dealing at all levels, “Bend the rules, but don’t get caught,” we reward and accelerate self-dealing at the expense of societal values, civility, and stability. Corporations do it, Congress does it, most people who are successful self-deal to one extent or another (and then often complain about their share paying taxes!). What *is* the cure? No single law, bill or program, will solve it. But opening our eyes, deepening our understanding of how humans respond to societal environments, all the while identifying and applying corrective actions both to individual human or corporate perpetrators of anti-social behavior, will help. Over time, evolving our systems -- legal, financial, social, computational -- to reward evolutionarily progressive acts and create disincentives for harmful, antisocial and regressive acts is necessary for civilization to survive. Alternatively, civilization can de-evolve towards an animalistic pecking-order survival of the fittest, rising brutality and suffering, until homo sapiens or its replacement is more capable of altruism and broad collective support. You and I are part way there, and each day we decide which road to take in every one of the many small decisions we make.

brian
brian

Zero tolerance is exactly the wrong policy. The administrators are already paranoid enough, barely understand what their own policies mean, and are years behind the state of the art. When I was in high school the district had a central mainframe that provided time-sharing services to the individual high school computer students via dial-up links. The computer administrator hated me. I always knew more technical details about the mainframe than he did. He loved computers. He wanted to be the expert. But he was the Administrator. His job was to keep the system up. Get the payroll out. Attend meetings. Prepare budgets. On the other hand, I went to the Burroughs field office on my holidays. I bought the latest manuals with my own money. I read the operating system patch notices at bedtime. I discovered that the schools that used the time-sharing system the most got new and better equipment. More phone lines. More teletypes. The new CRT terminals. Hmmmm. I wrote programs that used LOTS of CPU time. I came in early and stayed late. I was always logged in. My teacher and school were recognized for the top computer science class in the district. There were limits to how much one user could use the system. This was time-sharing. We had multiple terminals. We needed more users. I wrote a program. Very simple. Allocate a huge disk file and see what garbage it contains. It turned out that if you ran this program on the right day you could pull a list of ALL usernames and passwords, left over from the administrative update the night before. I posted selected parts of the list in the computer room. Now, anytime a student was done with their terminal, they could log in as a random person and start running one of my CPU wasters. The teacher loved it. Higher ratings. More equipment. More awards. The mainframe got more upgrades. The data center grew. The computer science budgets grew. Other students saw what I was doing. I came in early and stayed late. They saw that you could use the terminals when they weren't so crowded. The interested ones started coming in at odd times, too. I showed them what I was doing. We discussed programming languages and techniques. We worked together, mentored each other. We formed teams and went to programming competitions at various colleges. I taught classes, had keys to the computer room and the school building. I was a Junior in high school. ----- Consider Chemistry Class: Your best students come into a lab every day. There is lots of shiny glassware, chemicals and equipment. They are told that they will sit still in their seat and read from picture-books written in the last millennium. They will never, ever, touch any of the shiny equipment. They will watch as the teacher occasionally heats some chemicals on a hot-plate (no open flames allowed). They will be frequently tested on what the instructor has illegibly written on a whiteboard. Consider Shop Class: Your best students come into the shop every day. There is lots of big machinery, tools and supplies. They are told that they will watch as the instructor builds a project. They will never, ever, touch any of the tools. They will be graded on the number of days that they showed up to class. ----- Computer Science should be treated like a science: Observation, Hypothesis, Experiment, Conclusion. Classes should foster the inquisitive. Student's interests should be nurtured and directed. Equipment and tools should be provided to stimulate as many interests as possible. If a student wants to try an experiment, the instructor's purpose should be to ensure that things are done safely. Things occasionally blow up (chemistry), fly across the room at high speed (shop) or crash (mainframes). The instructor should be bright enough and knowledgeable enough to ensure that these events are educational and not Darwinian. Science is all about communication. If you do an experiment, write it up. If something blows up, try to figure out why. Present reports to the class. They don't have to be elaborate: I figured out that semi-colons are really important. I figured out that 17% of the teacher's account passwords are "password". This helps the students AND the teachers. The biggest problem in high school education today is that the teachers are clueless about their subject and out of touch with their students. ----- The anecdote above demonstrates some of the things that I got out of computer class in the 1970's. Programming languages and operating systems, Psychology, Perseverance, Problem-solving, Business, Leadership, Teamwork. Now, in 2013, no one would see past the charges for criminal hacking and demands for jail time. In what way is this progress?

vucliriel
vucliriel

As a preamble, we should not forget one very important fact, that this study applies specifically to China, NOT the United States. In other words, the study was produced by academics who are living in a society that encourages compliance with accepted norms, not one that challenges it. The fact this has been ignored by the author of this post is to me, very worrisome and telling about the state of our society. So let me challenge a few assertions by commenting the article of the original authors: "How and why do they evolve from innocent behavior (such as curious exploration of school computer systems) to criminal acts (such as stealing intellectual property)?" It seems obvious to me that the so-called "problem" is not one of "criminal acts" but of language. The very fundamental notion of "intellectual property" is not even challenged, whereas it is a fact that it is seriously questioned by the majority of the population of the world. How can such a basic fact have been ignored by serious academics? Are they even aware of the global social phenomenon that is file sharing? Furthermore, the authors state: "Most academic research on computer hackers understandably takes a criminal view, using criminological theories as the lens of analysis. Citing the research literature, Yar in 2005 attributed two primary causes to the "youth problem" in hacking, as hackers tend to be young males and school dropouts in their mid-20s. The first is adolescence as a period of inevitable psychological turmoil, helping account for youthful participation in various forms of "delinquent" and "antisocial" behavior. The second is the apparent "ethical deficit" among adolescents disposing them toward law- and rule-breaking behavior. " "Ethical deficit"? Did I actually read that correctly? What about the ethical deficit of a society that criminalizes those who challenge a system that crushes 99% of its population while rewarding the 1% that steal from them? Following this, the authors state: "However, a few of our subjects acknowledged they might cross such a line under certain circumstances (such as for survival and for justice, not a very high bar in today's material world)" "(such as for survival and for justice, not a very high bar in today's material world)"! If that last remark doesn't clearly cast doubt on the credibility of these supposedly learned authors by clearly showing their bias, what will it take? If anything, these people should be questioning themselves rather than starting their argument with a foregone conclusion! Frankly, that is enough for me to see the very grave bias of this so-called "study". Then again, knowing where these "academics" come from comes as no surprise and is probably why it seemed to have rung a bell with Michael Kassner... Because in reality, what difference does it make for people, being in repressive state-controlled China or in repressive elite-controlled America? The fact such a biased "study" has gained such traction as to be posted here on techrepublic seriously worries me because it proves there is really no difference in our two respective repressive regimes. On the other hand, it is a sign of hope that change is brewing, even in state-controlled societies such as China, and will eventually happen from within and on a global scale, whether the old dinosaurs who try to contain this normal societal evolution like it or not.

molly_dog
molly_dog

of the lack of family or balanced home life in this day and age when it's needed more than at any other time in the history of mankind. Go ahead and scoff but, to me--someone who learned quickly growing up in the 60s & 70s that there ARE consequences at home; there ARE consequences at school & then again at home--discipline has long since been replaced with psychoanalysis and the desire to be a child's friend instead of their parent. There are no consequences at home. A litigious society has obliterated consequences outside of the home because every child is so special, so angelic and would NEVER do anything wrong. Never mind that some parents talk to their child as I would not talk even to my worst enemy. Just last night in a big-box store I heard a woman scream F-bombs, GDs and S**ts at her 8 year-old because he distracted her and I, with 2 items, got ahead of her in the checkout. She then called me a "M-Fin' racist" because I said something to her about it. Kids require boundaries and they're not getting them. They need parents and too many are getting "buddies" and every imaginable material gadget in place of what they so desperately need. Schools have been relegated to bare minimum babysitting duties and the police are supposed to discipline the child in order to free up the "parent" to be shocked when the kid does something reprehensible like the two kids who set a stray Jack Russell Terrier on fire last year. The grandmother who is raising one of the boys for the absentee "mother" squalled on TV, "My baby would NEVER do something like that!" Guess what? An eyewitness saw your "baby" pouring the gas on the poor animal and laughing while he did it. What do we do? We're oh, so shocked so, along with the media, we mournfully opine about where it "went wrong" for the child. What could we have possibly done differently? "Kids today have to deal with so much." "Peer pressure." "Bullying." Yes, those are real problems but they're the exact same problems every generation of children faces. Each generation has to contend with technology that did not exist in their parents' time. I endured untold bullying because I was fat. Not "morbidly obese." FAT. And I was the new fat kid whose dad managed a fast food place. It was brutal. Notes everywhere you can imagine, phone calls in the middle of the night, snickers and snorts when I walked past or to the restroom or to the front of the class. Physical abuse. Mental abuse. But my parents and family kept me grounded. THAT's what is missing in the majority of these kids' lives. It's painfully simple: Accept the responsibility for making the child or don't bump uglies until you're ready to accept the responsibility. Until that happens, gifted kids will become criminal hackers; teens will do their best to destroy the community center provided to them by the village in which they live; fifteen year-olds will bludgeon to death their own babies in fits of rage and society will continue to write and read pointless articles. Studies about "why does this happen?" and "what can we do differently?" will continue to skirt that simple truth and give us a play-by-play of what has already happened, how it happened and point fingers at everyone except at those who are the root cause of the problem.

premiertechnologist
premiertechnologist

My teacher friend conducts IT classes in Middle School in the State of Washington (he is of very high moral character and is an unpaid minister of a church here). He tells the parents that their children are amoral. It's true. Do they know right from wrong? It's rather irrelevant. For the most part, they do what they can get away with. Moreover, the school counselor is a boozer who drinks with the administrator at a bar nearby (we know since a teacher is a bar maid to supplement her meager teacher's salary -- a salary which has been reduced significantly because of Governor Gregoire's cutbacks (if you remember, she was reelected when she had a surplus and after the election there was an $8 Billion shortfall -- all in a period of 3 weeks)). The school counselor has finally been reprimanded for yelling at teachers and parents for no particularly good reason. The liaison for career development with the high school was an ex pro football player who had a book ghosted for him on his "success" while he did an incompetent job and didn't even know those with whom he was to interact nor did he show up for meetings. While the teachers should have their contracts for next year some time this week, they will have to wait until mid June because the State Legislature can't decide on how to fund schools. As it is, because of sequestering, up to 50% of the teachers in one building may not be there next year. Certainly, there is going to be a massive shuffle. Did I mention that the teacher's pensions have been cut as much as 60%? The younger teachers will probably be gone, the older ones retired (on less money than they should have had). The question is, amidst this chaos, teachers will likely be expected to carry out policies concerning guns in school, adding extra burdens. We haven't even begun to address the problem of bullies. So kids are bullied in middle school and we wonder why they lose it and shoot their schoolmates and teachers in high school? So now we come to the problem of student hackers. OK, here's a little story. A woman comes to the County IT for user support. Her boyfriend works at the library. They met at the University and started a romance. She pushes to get her boyfriend into the County. He shows himself to be a somewhat talented hacker who learns RBase and goes forth without being in a position to do so, builds database systems for courts, judges and the sheriff's department. He becomes the county hero. In due time, she becomes the manager (after her manager is finally booted) and because he can't work directly for her, he is moved over to development where he finally becomes the manager. They end up being married and between the two of them control 85% of the people in IT and manage millions of dollars a year in budget -- all in violation of County Law against conflict of interest (they sign each other's requisitions after all). Moreover, the ethics class which was required of all employees was, in the words of the course catalog from HR, "discontinued until further notice" (the catalog was accessible over the Internet). The County Chaplain had a good laugh over that one. They had a woman working for the Sheriff's department lie so they could use the money designated for the Sheriff for internal IT work. (Two years ago, they were the only two managers, but the IT Director hired 12 more managers last year). Yes, and now the IT department has a Federal Grant of $7 million to rewrite the Legal database system in a new language (which hasn't been decided yet) with no new features (and US citizens are paying for this). The guy manager wants to continue his position as manager with the perks but is now working full time as a developer. Stepping back, as an IT manager in a misfortune 50 company, I watched the most unethical and immoral (if not illegal) practices in the company (which wasted nearly $100 million on a failed IT project). You should have been in the meeting with the outside project manager to hear the yelling, shouting and screaming -- mostly from the Project Manager (paid $250 per hour for no particularly good reason) that the company didn't appreciate what he was doing (which was pretty much nothing). Now maybe it's just me, but I find the idea in the video documentary "The Corporation" that corporations are psychopaths. Dr. Robert Hare has tried to do damage control on the statement he made to that effect, but it wasn't very effective and most of us who "got it" still think that with a lack of empathy, morals and any kind of conscience, and especially games playing, corporations are psychopaths. Moreover, if we are to accept the premise from "Moral Mazes" from Robert Jackall that mangers and corporate officers believe that what is right and moral is what the guy above you wants from you, we can conclude that minimally, corporate executives and managers are, at minimum, sociopaths. It's looking more and more that way every week that goes by. Of course, government and academia aren't exempt either, if you have watched the documentary DVD narrated by Matt Damon, "Inside Job". It looks like corporations, government and academia were pretty much responsible for the 2008 worldwide financial meltdown. But what do I know, I'm just a retired guy watching all this from afar. I think lawyers in the 1920s started most of our problems when they got corporations to be recognized as "legal persons". In the past quarter century, government seems to have implemented the worst of the corporate model badly. So here we are. We are looking at a small piece of this huge global puzzle and wondering how to prevent good students from becoming technological terrorists. Unless we transform the underlying dysfunctional chaotic landscape, I'd say, good luck with that. And if you want suggestions on how to do that, I have my first suggestion: Fire the two IT managers. It's a start.

Alienwilly
Alienwilly

We need more security in almost every aspect of our techy little lives. Why don't we make it a contest, the winners get their names submitted to Companies that need the security enhancements and offer these kids a job. It's called free enterprise. They could even be consultants for more than one company.

cmllx
cmllx

I have no special skills with computers and computing... As an artist/designer/creative, I am more adept in the relevant programs to design and communicate... My thought on this subject is purely layman and observational of patterns in the nature of people... In any skill or expertise that persons might excel in - whatever stages of and to the zenith in a persons abilities - comes the point of - does one serve good or ill... In part it is a question of ethics and integrity of self, a question of egoism/narcism - alternately - self-awareness, and a question of foresightedness... Ethics is a way a person approaches their life... this then defines their own level of integrity. Egoism is how much is done for personal aggrandizement... the extreme of this 'reflects' the level of narcism as displayed in a 'above-it-all-of-things and persons manner', and the joining in with those of like minds... Self-awareness could mitigate or support egoism, by way of having an unflinching review of one's 'true' self, motives, agendas, and character... but choosing to self reflect and make constructive changes, requires great insight and an evolved nature to make headway... (It can be a mean process.) In having foresight of your 'works', it is the act of ticking off a mental list, potential 'worst-case-scenarios' to result from the creations of intellect... delay producing the 'work' or alter it to fix the flaw, or build in safeguards... So many aspects and categories of life and lifestyle are up for scrutiny - albeit these things often scrutinized after the horses have fled the gates... Maybe a bit of 'ethical idealism' would go a long way in our early development to balance and shape the pursuit and achievement of our great ideas....

kwarnick
kwarnick

I have seen where the teachers do all they can to keep the students engaged. and the students still find time to hack. The issue (from an x school IT manager) is the punishment from the school. you cannot suspend or kick the student out because of the loss of revenue to the school. When administrators look at the students as dollars instead of students you give the power to the student and take it away from the teacher. My job was to track the students all day and see how they were getting trough our restrictions and stop it. So it became a game for them. We had a morning students and a different group of students in the afternoon. If the morning class figured a way around the restrictions, they would pass the info on and the afternoon students would be out side the restrictions when they sat down. they never got into the school network, but they would be hacking on the net all day. So the real issues is the Finance.

dakra137
dakra137

Explain to the kids the unreasonable risk of going to prison for doing things that don't seem evil. "Andrew 'weev' Auernheimer sentenced to 41 months for exploiting AT&T iPad security flaw" http://www.bloomberg.com/news/2013-03-18/at-t-hacker-auernheimer-is-sentenced-to-months-in-prison.html As I understand it, he did not exploit a security flaw. He did not circumvent any security mechanism. He downloaded unsecured data publicly available to anyone on the internet. He did transfer the data to others who reposted it more visibly on the internet. He was convicted and sentenced to prison for almost 3.5 years. I don't think that is fair. I know of someone who, when he was in high school, downloaded some unsecured data that should not have been exposed from the school network. He did not show or transfer it to others, except to school officials to demonstrate the exposure. He was punished. That wasn't fair. A security consultant on a contract assignment at a bank found a flaw in their ATM system. To demonstrate, he encoded a card that would let him take cash from any of their ATM's, then demonstrated it to bank executives. They were upset with him. That wasn't fair. In some states, you can go to prison for using somebody else's unsecured WiFi without their explicit permission. The owner doesn't even have to complain. I don't think that's fair. People want the world to be fair. It isn't. This is part of learning that there are things that you may think are not wrong, but can still result in a lot of pain.

Mike.Miller
Mike.Miller

As a older student in a computer security class 2 years ago I had a discussion with another student who stipulated that as long as a hacker who infiltrated a system, inflicted no damage (monetary of otherwise), it was perfectly OK to do so. After explaining to him that his scenario would be like me walking into his living room uninvited, looking around, and reasoning that I am doing nothing wrong. He did see a problem with my example, but could not see the correlation to his. The sad part is that no one else in the class got it either. Our society in general seems to be lacking when it comes to ethical wisdom, and it is probably going to get worse.

CrimeDog
CrimeDog

First out the gate: zero-tolerance is a synonym for 'lazy'. It means that those in control do not have to weigh each case on its own merit, or even understand the infraction, for that matter. Zero-tolerance, in fact, diminishes the concept of consequences by making the punishment the same regardless of the severity of the infraction. Having said THAT, I am a firm believer in the process of imposing consequences for one's actions. You should be held accountable for your actions - either good or bad. Further, you should know about those consequences, which makes a good case for teaching ethics in HS and following the business practice of security accountability training, to include signed statements from each student that confirm the training. If you know what is considered to be unacceptable behavior and you know the consequences, then you are responsible for your actions. Of course, the consequences have to be administered universally. As for "I was just testing security..." - doing the wrong thing for the right reasons is still the wrong thing.

cecilled
cecilled

Zero tolerance policies have to be the absolute most inept solution to any problem. Every time I have seen a zero tolerance policy implemented in a education facility it takes away the ability of those who are supposed to be skilled at making logical educated decisions to make those logical educated decisions. In many cases it is our brightest minds that catch the wrath of these zero tolerance policies. We should attempt to get to the real cause of the problem. This type of zero tolerance could never be implemented in our justice system assume that capital murder convictions were dealt with in a manner similar to the zero tolerance policies in schools, once you were deemed guilty you would immediately be carried outside and the capital murder punishment would be implemented no questions no chance of appeal. This society seems to grant our criminals more rights than those that are among the brightest minds in our society. This year alone I am aware of two our brightest youths will have a blemish on their record that can never be erased because by the time the system can handle the appeal their graduation will have occurred and they will never be able to repeat those years and events. One has received national coverage where the eagle scout, student slated to graduate with honors will not graduate with his class due to an incident where his skeet shooting gun was left in his truck, was discovered when the student attempted to call his mom to come pick up the gun and remove it from the school premises. Another where a honors student expelled from school due to hunting knife found in vehicle was not even brandish on anyone. This child has had to delay college entry by a full semester while he attempts to clear his high school graduation. Yet in that same school there are known perpetrators, thieves, and hoods graduating, walking with their class that barely have the academic minimal needed to graduate. No wonder our academic have fallen below that of many other nations we are catering to the needs of those barely able to meet the academic minimal for graduation and have zero tolerance policies that seem to capture and punish some of best and brightest students. I firmly believe that a zero tolerance is never a good solution for an educated society use our minds and come up with some better means to administer a problem that is likely in place due to the inadequacies of the system, leaders, educators, and parents to nourish and develop these minds on a path that will nurture these youth to become active proud contributors to the growth of our society.

Michael Kassner
Michael Kassner

I suspect you missed what the researchers and I were trying to say. The young hackers are converting into the ones you refer to in your comment.

again5
again5

...then tell me there is no political partisanship at CBC.

vucliriel
vucliriel

Fighting cyber bullying is vital, but beware what you wish for and how easy it is for tyrants to use it as a pretext to deprive ALL citizens of their freedom of expression with the exact opposite result that what you wish for. This was exactly the pretext used last year by the Conservative government of Canada to try to pass the warrantless online spying bill C-30, euphemistically called the "Protecting Children from Internet Predators Act". Just remember what happened as a consequence of 9/11 in America: 30 people killed 3000 and put 300 million and more on their knees (aren't you grateful for the Patirot Act and its deprivation of civil liberties), and caused incalculable pain and loss of human life in the rest of the world afterwards (the senseless Iraq war being the most obvious). Please have some wisdom before tempting authorities to intervene. Don't contribute to this over-the-top, allergic-like, knee-jerk reaction against those who don't fit the norms. Hackers and other revolutionaries are not only to be tolerated for their occasional so-called misdeeds, they are in reality essential to maintain a healthy society and protect us against those who use such crises as a pretext to build up their power at the expense of the freedom and rights of the people.

Michael Kassner
Michael Kassner

I am sorry you feel that way. I offered the findings of three researchers, I did not demand you use it for anything. I had hoped you would look objectively at what they had to say. Many members disagreed with the professor's proposals, which is fine. All I was trying to do is get a discussion going about a subject that needs a solution.

Michael Kassner
Michael Kassner

Seems like this goes deeper than just computer misuse.

Michael Kassner
Michael Kassner

But, I sure see a major roadblock getting anything done, considering who you have to go through to get the ball rolling.

Michael Kassner
Michael Kassner

I have friends that fit this definition. Me, I'm never bored, so what does that say.

Michael Kassner
Michael Kassner

You bring up a multitude of good points, and things to think about and more importantly discuss. I was hoping for this kind of comment activity, lots of great information. Thank you.

Michael Kassner
Michael Kassner

You seemed to have permission and the backing. I did not read where you altered grades or benefitted personally at the expense of others. As for teachers, I haven't researched that aspect of it. Yet, I suspect there's more to it than what you are saying.

Michael Kassner
Michael Kassner

I guess you can take it the way you did, but I suggest that you also look with a different set of glasses as well. The fact two of the three researchers were from China provided some insight as to what is going on. The fact (you agreed) that there are some major similarities has to mean something. Besides, how can a fair and open discussion take place if all viewpoints are not brought to bear?

bobcglewis
bobcglewis

You are quite right. Trouble is, that today that most people can't spell 'ethics' much less understand its implications. One only has to consider the un-ethical decisions of so-called 'ethics committees' in the political field, to realise the word has become another, largely meaningless, cliche - like 'zero tolerance.'

Michael Kassner
Michael Kassner

The hard part is keeping up with what's right and what's not.

Michael Kassner
Michael Kassner

I have witnessed that same disconnect. It will be interesting to see how it resolves, whether our older version will remain, or it morphs into a newer one that takes into account different situations.

Michael Kassner
Michael Kassner

That has to be difficult. It seems you are right in the mix. I would appreciate learning what you think needs to be done to fix the problem.

cougar.b
cougar.b

The two young girls in question were both victims of sexual molestation, in addition to cyber-bullying, so if we had a just society, hackers wouldn't need to rise to their defence, with or without the Canadian Patriot Act. There is no question that the Conservatives use any pretext to reduce our civil rights, and in addition, that they are more concerned with consolidating their power than the rule of law. If the American powers that be were concerned with the rule of law, the Patriot Act would have never been tolerated, and if the Conservative government was concerned with the rule of law, Bill C-30 would not be tolerated. Nonetheless, the police need to be encouraged to protect the innocent from abuse, both sexual and cyber-bullying related, and for that reason, I continue to admire Anonymous Canada for seeking to do what the police do not choose to do. We need a civil liberties movement against the officially sanctioned bullies, and hackers are among the patriots who have the gumption and will to fight them. Thank you for your comments. Americans who read this need to know that all is not well in the polite North, and that evil has a foothold in our political system, as it does in their land. In a world of global empire, the fight for freedom must also be global in scope. The oppressors are connected behind closed doors.

vucliriel
vucliriel

from http://www.michaelgeist.ca/content/view/6681/125/ : "The Canadian Association of Chiefs of Police renewed its call for Internet surveillance legislation [and said:] "Criminal bullying is extremely concerning to all Canadians, especially the parents of young children, and Bill C-30 also provides new legislation to help police intervene and investigate cyber bullying in their early stages to prevent needless tragedy. The Bill makes it an offence to use telecommunications, including social media and the Internet, to injure, alarm, and harass others." It is striking that the government never mentioned cyber-bullying when it introduced Bill C-30 - not in the press release, the backgrounder, or the myths document. That is because the bill has little to do with cyber-bullying. The attempt to raise it as a justification for Internet surveillance demonstrates yet again how proponents of the bill have failed to muster compelling evidence to support the bill and instead rely on headline-grabbing claims that have minimal connection to the actual proposed legislation."

again5
again5

...and you are a foot soldier for that evil. Begone with your hate mongering. Techrepublic; why are you allowing political nonsense like this? It's becoming more prevalent. If you are going to turn into a leftist hate mongering site be prepared to see your subscriber base plummet.

Editor's Picks