Earlier this year I worked through a short course on general philosophy, I read "The Art of Motorcycle Maintenance" a couple of months ago, I re-read "Man's Search for Meaning" a few weeks ago, and I just finished a short course on the history of moral thought and ethics. You can begin to see where my head-space has been for the past year.
I received an odd e-mail message last week that was rather serendipitous. The sender asked for my opinion about the proposition: "
Ethical hackers, which cause no harm or damage to anyone else's property, should never be arrested, or prohibited to use a machine, especially when their knowledge of security is so desperately needed in today's society." Here the word hacker is used to mean someone that breaks into computer systems. I ignored the message for several days before dashing off a half-baked reply. I've since giving the proposition more thought.
Owing to my background, my age, and where my head has been lately I identified some problems with the proposition as it is written. At first glance the proposition seems simple enough, however on closer examination it is open to many avenues of enquiry. It raises concepts such as: property, ownership, rights, responsibilities, civics, justice, risk, knowledge, skill, experience, professionalism, ethics, and wisdom - I'm sure there are others. I don't think I'm able to take on any of the deep weighty philosophical issues, but I will try to address some of the easier issues closer to the surface.
The statement "
Ethical hackers, which cause no harm or damage to anyone else's property, ..." seems no different than "
it is ethical to throw rocks at houses as long as you don't break any windows." I don't think that's what was intended. The real problem has to do with a failure to distinguish between behavior and the means by which the behavior is carried out. For example, many people have no qualms about downloading copyrighted music or video, which they have not paid for, but they would never go into a store and steel a CD or DVD. Yet, the behavior is the same, it's still theft, only the means by which the theft is carried out is different.
I live in a city with streets, sidewalks, traffic lights, stores, houses and apartments. There are a couple of restaurants up the street and a grocery store within walking distance. As I walk about the city there isn't anything to physically prevent me from randomly walking up to a house and trying the doors and windows to see if I can find one open. If I found a window open there is nothing physically preventing me from crawling inside. If I go home and use my computer to break into someone else's computer system, how is that behavior different? To me there is no difference in the behavior only the means by which the behavior is carried out is different.
There is something that stops me from such behavior - it's my ability to empathize with others, my understanding of "the social contract", my understanding of privacy, property, ownership, my understanding of civic duty, my sense of fairness and justice, and my own sense of ethics.
It is a common practice for a company to contract with a team of professional penetration testers to test the company's security systems. The important distinction is - permission! The company hired the penetration testers, under contract, to test the their security; they have the company's permission to hack into their systems. For example: a company hires a security firm to patrol their plant and check all the doors. The company instructed the security firm that there is one particular door that they should check but never open the door or go inside that room. Inside that room is the worlds most dangerous bacteria, if unleashed it could wipe out the entire human population. Along comes a self-appointed so called ethical hacker, who hasn't been hired by the company and hasn't been briefed about that one door, they pick the lock, go inside and without intending to, unleash the deadly bacteria. Substitute a network for the door and a computer for the lock. Was that ethical or was it reckless hubris? The professional security firm knew what they were doing and understood the risks - the self-appointed so called ethical hacker did not. The only difference between a hacker and a penetration tester is permission.
The claim "
Ethical hackers, which cause no harm or damage to anyone else's property,.." is inaccurate. The self-appointed so called ethical hacker, who breaks into systems without permission, is not in a position to know the potential harm (risks) their activities can cause nor are they in a position to know when their activities do cause harm. The absence of real or perceived harm doesn't make hacking ethical; the absence of permission, and the potential to cause harm, make it unethical!
Our beliefs and actions (behavior) have consequences. Consequences can be good or bad, and consequences can be intentional or unintentional. Regardless, we are solely responsible for our actions and their consequences (good or bad.) Being responsible for our actions means that we are accountable for our actions.
In a perfect world everyone would know what is right and good and would behave accordingly unfortunately our real world isn't so perfect. Our society creates laws to address the more extreme problems. Law is not the measure of ethical conduct; law is the measure of last resort. Law is for when ethics fail! I generally lean towards "let the sentence fit the crime." I am opposed to mandatory sentencing guidelines. I believe our courts need to have the liberty to consider other factors when determining a sentence. For example: the persons age and maturity. Did they understand what they were doing? How often did the badness occur? How wide spread was the badness? Was there real harm? How serious was the harm? What is their environment like? How much supervision do they have? How likely is the behavior to reoccur? Then let the sentence fit the crime.
We make ethical decisions every day, usually with little or no thought, but ethics isn't always so easy. An apparently simple proposition such as "
Ethical hackers, which cause no harm or damage to anyone else's property, should never be arrested, or prohibited to use a machine, especially when their knowledge of security is so desperately needed in today's society." can unwind into a tangle of philosophical and ethical dilemmas.
My head hurts.
Photo credit: Conscience and law, Wiki Commons, Marcel Douwe Dekker (2007), public domain.
http://commons.wikimedia.org/wiki/Image:Conscience_and_law.jpg
