The U.S. Crackdown on Hackers Is Our New War on Drugs • Hacker News Board

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#41

Post by jerf » Thu, Jan 23, 2014, 9:24 PM UTC

tptacek wrote: post #17

rayiner wrote: post #14

Earlier quoted context omitted.

The article goes off the rails with this sentence: "As a country and a criminal justice system, we’ve been down this road of excessive punishment before: with drugs." There's no particularly strong connection between computer crimes and drug crimes. As you point out, the comparison is hyperbole, and ignores the deep racial, cultural, and class conflicts at the heart of the drug war. None of those things are really ap…

I've been idly working on an essay for... I don't know, 5 years now? about how computers and the Internet catalyze harm, by shielding people who cause harm from the impact of their action, and by making harmful actions practically indistinguishable from benign ones --- "click this button and 'like' someone on Facebook, click this other button and help DDoS someone whose politics you disagree with". I have some sympat…

"I don't have the right words yet for it, as you can see; I'll probably still be mulling it 5 years from now."

I call it the Turing Chaos; intrinsic to computer science is that a single bit flip can completely and utterly change how a system works... and this is not a trivial observation, it is actually a deep and profound observation about the difference between the "cyber"world and the physical world that has pervasive and radical consequences at every level from the entirely ivory-tower theoretic out to how Grandma uses her computer (as you mention). Usually I've thought of this in the context of programming in general and trying to contain bugs against the overwhelming forces of chaos pressing in on us as we try to build systems of millions, billions, or trillions of bits; as programmers, we are exposed to some fairly raw mathematical chaos, in the "chaos theory" sense of the term, and in particular, the difficulty of fully predicting what a chaotic system will do in response to some stimulus. A great deal of software engineering is a desperate attempt to wall it away from ourselves and confine our intrinsically wild and wooly systems to just the behaviors that fit in our heads... but alas, we fight against a crafty foe that can find even one bit's worth of weakness and bring millions of dollars worth of systems down around our heads.

And that's before we consider human attackers.

One bit flipped can be the difference between an attacker walking off with the entire contents of your billing database, or getting a simple rejected request. One click can start a cascade of trillions of instructions terminating in your amazing computer becoming a spam delivery device that belongs to a guy 15,000 miles away. Every computer program stands balanced precisely on a small, small knife edge, with an n-dimensional abyss waiting on all sides to consume it, and hostile, intelligent forces anxious to give it a small, carefully calculated tip into their bit of it.

That probably doesn't work for the essay you're looking to write; my metaphor comes more from the software engineering side. But I think it's the same thing; the computer world is the math world, and it is a harsh, subtle, uncompromising place compared to the physical world, no matter how complicated the latter can be.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#42

Post by pbhjpbhj » Thu, Jan 23, 2014, 9:27 PM UTC

klez wrote: post #34

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.

I don't know but I suspect it's probably in the clean up.

For example I've cleaned up websites with malware infections that ultimately failed to operate (they had errors in their implementation).

The infections thus caused zero direct damage. There was nothing on the front end that changed and no hidden phishing pages were operated, etc.. However the infections nonetheless had to be cleaned up, the source of the infections found, modifications to the sites made (where possible) including increased protections and reporting mechanisms.

It's like losing your keys - locks might need changing, those locks might have multiple keys, etc., the locks might be secure facilities than need to be checked for incursions (eg inventories made) and such ...

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#43

Post by elemeno » Thu, Jan 23, 2014, 9:29 PM UTC

klez wrote: post #34

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.

Because fixing the problem isn't just a matter of changing the headline back to what it was supposed to read.

Someone entering your system, which is supposed to be secure, and changing the headline on your front page mean that you'll (if you're sensible) then go and contract an external firm to perform a security audit and find out how the intruders got into your system, what needs to be done to fix it, and why your system had that particular vulnerability to begin with. All of which costs money.

Alternatively, you'll use your own staff to do the same - which isn't free either, since they're now not doing their normal jobs for the duration. If I'm paying you $120,000 to be my sysadmin and then need to pull you off your normal duties to investigate someone entering my systems for a month then that investigation has cost me $10,000. That I was going to be paying you that money anyway isn't really relevant - that was the cost of your time that was used on that investigation.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#44

Post by snake_plissken » Thu, Jan 23, 2014, 9:30 PM UTC

When we start locking up tens of thousands of people because someone Trojaned their computer and used it to run a LOIC node, maybe this could resonate. What makes the War on Drugs unique is that so many people are and have been locked up on felony charges for buying/possessing some type of substance that they willingly want to put in their own bodies.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#45

Post by _delirium » Thu, Jan 23, 2014, 9:31 PM UTC

tptacek wrote: post #37

klez wrote: post #34

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.

Straightforward. * Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number. Plus: * If the site is disabled or degraded, you can often easily calculate outage costs based on the average volume of revenue the site generates during the outage period. Plus:…

That makes some sense, but is a little out of keeping with what people expect in part because losses in many "physical" kinds of crimes aren't usually reported in an all-inclusive manner, but just report the direct damage. For example, if someone vandalizes (or steals) $20k of goods in a Wal-Mart warehouse, both Wal-Mart and the media will typically report that as $20k damage (or theft), rather than adding to the $20k the cost of the security response, lost business or increased overtime caused by supply-chain disruption, etc. Theft statutes that include thresholds for different classes of theft also usually refer only to the value of the stolen goods, not other losses caused by their theft (such as loss of business, cost of security response, or supply-chain disruption). You could justify including them, but it doesn't seem to be that common.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#46

Post by tptacek » Thu, Jan 23, 2014, 9:35 PM UTC

_delirium wrote: post #45

tptacek wrote: post #37

Earlier quoted context omitted.

Straightforward. * Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number. Plus: * If the site is disabled or degraded, you can often easily calculate outage costs based on the average volume of revenue the site generates during the outage period. Plus:…

That makes some sense, but is a little out of keeping with what people expect in part because losses in many "physical" kinds of crimes aren't usually reported in an all-inclusive manner, but just report the direct damage. For example, if someone vandalizes (or steals) $20k of goods in a Wal-Mart warehouse, both Wal-Mart and the media will typically report that as $20k damage (or theft), rather than adding to the $20…

We might be talking about two different issues. If you steal $20k worth of PS4s from Best Buy and totally fuck up their January promo event, the $20k theft amount might be all that factors into your criminal sentence, but Best Buy can probably come after you civilly for the rest of it.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#47

Post by tptacek » Thu, Jan 23, 2014, 9:36 PM UTC

elemeno wrote: post #43

klez wrote: post #34

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.

Because fixing the problem isn't just a matter of changing the headline back to what it was supposed to read. Someone entering your system, which is supposed to be secure, and changing the headline on your front page mean that you'll (if you're sensible) then go and contract an external firm to perform a security audit and find out how the intruders got into your system, what needs to be done to fix it, and why your…

You probably can't simply use your own staff to do it; your contractual and insurance obligations will probably mandate that a reputable third party conduct the audit. That's not always the case, but in big cases it usually is.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#48

Post by adamfeldman » Thu, Jan 23, 2014, 9:50 PM UTC

dobbsbob wrote: post #11

Hacker crackdown been going on since the late 80s http://en.m.wikipedia.org/wiki/The_Hacker_Crackdown I remember when I came home from school to find cops going through my room demanding to know where I kept my copy of the cellular hackers bible because I had told somebody on fidonet I had it and it was deemed forbidden knowledge

That's the first ebook I ever read. It's free online! http://www.mit.edu/hacker/hacker.html

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#49

Post by alan_cx » Thu, Jan 23, 2014, 9:52 PM UTC

tptacek wrote: post #17

rayiner wrote: post #14

Earlier quoted context omitted.

The article goes off the rails with this sentence: "As a country and a criminal justice system, we’ve been down this road of excessive punishment before: with drugs." There's no particularly strong connection between computer crimes and drug crimes. As you point out, the comparison is hyperbole, and ignores the deep racial, cultural, and class conflicts at the heart of the drug war. None of those things are really ap…

I've been idly working on an essay for... I don't know, 5 years now? about how computers and the Internet catalyze harm, by shielding people who cause harm from the impact of their action, and by making harmful actions practically indistinguishable from benign ones --- "click this button and 'like' someone on Facebook, click this other button and help DDoS someone whose politics you disagree with". I have some sympat…

I don't see that as an internet thing, its about long distance control, or remote control. Its the same thing when people say its easy for politicians to send troops to war, or when a soldier controls a drone. They don't directly witness the outcome. The internet is just a more efficient, wider spread, easier to access example of it. Maybe also, its the same sort of thing as common folk committing minor insurance fraud. They don't see a victim.

Often wondered.... If a website were set up which had just one button one the page, and message saying the following: "After 10 million unique hits, a nuclear missile will be launched at a random capital city" Then lots of genuinely convincing stuff about it being about it being real, such that it was know to be for real. Also probably restrict it to adults, some how. (No, I don't quite know how, but this is a thought experiment after all.) How long would it take to hit the 10M? Would anyone really click?

Anyway, its clear to me that the more remote something is, the more people disassociate from it. The internet is just another example.

Re: The U.S. Crackdown on Hackers Is Our New War on Drugs

#50

Post by sliverstorm » Thu, Jan 23, 2014, 10:05 PM UTC

asmallfish wrote: post #6

The government gives harsher sentences to hackers than many rapists. This is because it is actually afraid of hackers. Hackers hold power that petty criminals do not. The sentences for hackers are completely ridiculous because they are created by fear.

Examples?