Schneier on Security

Christian Gruber • April 6, 2005 10:26 AM

When I was a lad in the late 80s, I hacked the QNX lab using the old over-the-teacher’s-shoulder method. I spoke to the teacher who ran the network about it, and expressed an interest, and so he gave me (tacitly) free reign on the system. Personally, I thought this was a wonderfully enlightened approach. So some schmuck that cajoled me into teaching him how to do such things managed to erase the password file in an attempt to deny his friend access as a joke. Now that was my fault. I was a geeky teenager with self-esteem problems, so I was quite susceptible to this sort of wet hacking. So I nearly got arrested, after the whole thing blew apart, since the password file’s erasure caused a complete inability to access the network. (Yes, really old-school unix). Why am I mentioning this? Because the reaction was to threaten my arrest, suspend me from computer activities for the remainder of the year, and have me clean up the yard for the same period. The problem was fixed in hours, and I had actually gone a long way towards further securing the system as part of my meandering around the system. Fair? Sort-of.

Apart from griping about my childhood, there’s a larger point here. We have a judiciary (in most Euro or post-Euro democracies) that are entirely uneducated, and don’t know how to deal with such things. We don’t have standards about what constitutes crimes at what levels in the digital world. Worse, we have knee-jerk reactions of politicians designed to convince the public that they are acting responsively to new threats. The modern legal systems need a bit of a reset and recalibrations. What is serious and what isn’t? And who gets nailed?

For example, was I guilty? I hacked the system, but fessed, and was not “charged” when my crime was first discovered. My crime was teaching someone else how to do it. That I certainly do own, and I don’t think I should have “gotten away with it.” However, why would this other person not be subject to censure? Hi actions actually caused the damage. What about the teacher who let it happen. What about the QNX vendor who had unencrypted password files that I could edit from a teacher’s account? Yes… unencrypted password files. Yes… editable from a staff account. Yeesh.

So back to the article. The student clearly has a bunch of responsibility here. The intent to deceive and defraud was clear. But what about the insurance company, as mentioned above? What about the school that allowed an authentication method that anyone with a connection to the internet can break? And to what extent is the level of damage a factor in the charge and in the punishment? Are all such frauds and/or identity theft identical in severity? Should they all be punished similarly? Even murder has degrees and levels (premeditated, accidental, incidental, etc.) There are a lot of factors that lawmakers and executors and judges seem quite willing to downplay in their race to the press releases and media scrums. I suspect that no one will be safe, secure, or justly treated until we (and our representatives and governments) stop with the panic and start analyzing and thinking.

cg.