Underground - Suelette Dreyfus (best novels ever .TXT) 📗

who he would tell if he did do it. `No-one,’ he said, `because there is more risk if two people know than if one does.’

SKiMo is mostly a loner these days. He shares a limited amount of information about hacking exploits with two people, but the conversations are usually carefully worded or vague. He substitutes a different vendor’s names for the real one, or he discusses technical computer security issues in an in-depth but theoretical manner, so he doesn’t have to name any particular system.

He doesn’t talk about anything to do with hacking on the telephone. Mostly, when he manages to capture a particularly juicy prize, he keeps news of his latest conquest to himself.

It wasn’t always that way. `When I started hacking and phreaking, I had the need to learn very much and to establish contacts which I could ask for certain things—such as technical advice,’ SKiMo said. `Now I find it much easier to get that info myself than asking anyone for it. I look at the source code, then experiment and discover new bugs myself.’

Asked if the ever-increasing complexity of computer technology hasn’t forced hackers to work in groups of specialists instead of going solo, he said in some cases yes, but in most cases, no. `That is only true for people who don’t want to learn everything.’

SKiMo can’t see himself giving up hacking any time in the near future.

Who is on the other side these days?

In Australia, it is still the Australian Federal Police, although the agency has come a long way since the early days of the Computer Crimes Unit. When AFP officers burst in on Phoenix, Nom and Electron, they were like the Keystone Cops. The police were no match for the Australian hackers in the subsequent interviews. The hackers were so far out in front in technical knowledge it was laughable.

The AFP has been closing that gap with considerable alacrity. Under the guidance of officers like Ken Day, they now run a more technically skilled group of law enforcement officers. In 1995-96, the AFP had about 2800 employees, although some 800 of these worked in `community policing’—serving as the local police in places like the ACT and Norfolk Island. The AFP’s annual expenditure was about $270 million in that year.

As an institution, the AFP has recently gone through a major reorganisation, designed to make it less of a command-and-control military structure and more of an innovative, service oriented organisation.

Some of these changes are cosmetic. AFP officers are now no longer called `constable’ or `detective sergeant’—they are all just `federal agents’. The AFP now has a `vision’ which is `to fight crime and win’.3 Its organisational chart had been transformed from a traditional, hierarchical pyramid of square boxes into a collection of little circles linked to bigger circles—all in a circle shape. No phallo-centric structures here. You can tell the politically correct management consultants have been visiting the AFP.

The AFP has, however, also changed in more substantive ways. There are now `teams’ with different expertise, and AFP investigators can draw on them on an as-needed basis. In terms of increased efficiency, this fluidity is probably a good thing.

There are about five permanent officers in the Melbourne computer crimes area. Although the AFP doesn’t release detailed budget breakdowns, my back-of-the-envelope analysis suggested that the AFP spends less than $1 million per year on the Melbourne computer crimes area in total. Sydney also has a Computer Crimes Unit.

Catching hackers and phreakers is only one part of the unit’s job. Another important task is to provide technical computer expertise for other investigations.

Day still runs the show in Melbourne. He doesn’t think or act like a street cop. He is a psychological player, and therefore well suited to his opponents. According to a reliable source outside the underground, he is also a clean cop, a competent officer, and `a nice guy’.

However, being the head of the Computer Crimes Unit for so many years makes Day an easy target in the underground. In particular, hackers often make fun of how seriously he seems to take both himself and his job. When Day appeared on the former ABC show `Attitude’, sternly warning the audience off hacking, he told the viewers, `It’s not a game. It’s a criminal act’.

To hackers watching the show, this was a matter of opinion. Not long after the episode went to air, a few members of Neuro-cactus, an Australian group of hackers and phreakers which had its roots in Western Australia, decided to take the mickey out of Day. Two members, Pick and Minnow, clipped Day’s now famous soundbite. Before long, Day appeared to be saying, `It’s not a criminal act. It’s a game’—to the musical theme of `The Bill’. The Neuro-cactus crowd quickly spread their lampoon across the underground via an illicit VMB connected to its own toll-free 008 number.

Although Day does perhaps take himself somewhat seriously, it can’t be much fun for him to deal with this monkey business week in and week out. More than one hacker has told me with great excitement, `I know someone who is working on getting Day’s home number’. The word is that a few members of the underground already have the information and have used it. Some people think it would be hilarious to call up Day at home and prank him. Frankly, I feel a bit sorry for the guy. You can bet the folks in traffic operations don’t have to put up with this stuff.

But that doesn’t mean I think these pranksters should be locked up either.

If we, as a society, choose not to lock hackers up, then what should we do with them?

Perhaps a better question is, do we really need to do anything with them?

One answer is to simply ignore look-see hacking. Society could decide that it makes more sense to use valuable police resources to catch dangerous criminals—forgers, embezzlers, white-collar swindlers, corporate spies and malicious hackers—than to chase look-see hackers.

The law must still maintain the capacity to punish hard where someone has strayed into what society deems serious crime. However, almost any serious crime committed by a hacker could be committed by a non-hacker and prosecuted under other legislation. Fraud, wilful damage and dealing in stolen property are crimes regardless of the medium—and should be punished appropriately.

Does it make sense to view most look-see hackers—and by that I mean hackers who do not do malicious damage or commit fraud—as criminals? Probably not. They are primarily just a nuisance and should be treated as such. This would not be difficult to do. The law-makers could simply declare look-see hacking to be a minor legal infringement. In the worst-case scenario, a repeat offender might have to do a little community service. But such community service needs to be managed properly. In one Australian case, a corrections officer assigned a hacker to dig ditches with a convicted rapist and murderer.

Many hackers have never had a job—in part because of the high youth unemployment in some areas—and so their community service might be their first `position’. The right community service placement must involve hackers using their computer skills to give something back to society, preferably in some sort of autonomous, creative project. A hacker’s enthusiasm, curiosity and willingness to experiment can be directed toward a positive outcome if managed properly.

In cases where hacking or phreaking has been an addiction, the problem should be treated, not criminalised. Most importantly, these hackers should not have convictions recorded against them, particularly if they’re young. As Paul Galbally said to the court at Mendax’s sentencing, `All the accused are intelligent—but their intelligence outstretched their maturity’. Chances are, most will be able to overcome or outgrow their addiction.

In practice, most Australia’s judges have been reasonably fair in their sentencing, certainly compared to judges overseas. None of the Australian hackers detailed in this work received a prison sentence. Part of this is due to happenstance, but part is also due to the sound judgments of people like Judge Lewis and Judge Kimm. It must be very tempting, sitting on the bench every day, to shoot from the hip interpreting new laws.

As I sat in court listening to each judge, it quickly became clear that these judges had done their homework. With psychologist Tim Watson-Munro on the stand, Judge Lewis rapidly zeroed in on the subject of `free will’—as applied to addiction—regarding Prime Suspect. In Trax’s case, Judge Kimm asked pointed questions which he could only have formulated after serious study of the extensive legal brief. Their well-informed judgments suggested a deeper understanding both of hacking as a crime, and of the intent of the largely untested computer crime legislation.

However, a great deal of time and money has been wasted in the pursuit of look-see hackers, largely because this sort of hacking is treated as a major crime. Consider the following absurd situation created by Australia’s federal computer criminal legislation.

A spy breaks into a computer at the Liberal Party’s headquarters and reads the party’s top-secret election strategy, which he may want to pass on to the Labor Party. He doesn’t insert or delete any data in the process, or view any commercial information. The penalty under this legislation? A maximum of six months in prison.

That same spy decides he wants to get rich quick. Using the local telephone system, he hacks into a bank’s computer with the intention of defrauding the financial institution. He doesn’t view any commercial or personal information, or delete or insert any files. Yet the information he reviews—about the layout of a bank building, or how to set off its fire alarm or sprinkler system—proves vital in his plan to defraud the bank. His penalty: a maximum of two years prison.

Our spy now moves onto bigger and better things. He penetrates a Department of Defence computer with the intention of obtaining information about Australia’s military strategies and passing it on to the Malaysians. Again, he doesn’t delete or insert any data—he just reads every sensitive planning document he can find. Under the federal anti-hacking laws, the maximum penalty he would receive would also be two years prison.

Meanwhile, a look-see hacker breaks into a university computer without doing any damage. He doesn’t delete any files. He FTPs a public-domain file from another system and quietly tucks it away in a hidden, unused corner of the university machine. Maybe he writes a message to someone else on-line. If caught, the law, as interpreted by the AFP and the DPP, says he faces up to ten years in prison. The reason? He has inserted or deleted data.

Although the spy hacker might also face other charges—such as treason—this exercise illustrates some of the problems with the current computer crime legislation.

The letter of the law says that our look-see hacker might face a prison term five times greater than the bank fraud criminal or the military spy, and twenty times greater than the anti-Liberal Party subversive, if he inserts or deletes any data. The law, as interpreted by the AFP, says that the look-see hacking described above should have the same maximum ten-year prison penalty as judicial corruption. It’s a weird mental image—the corrupt judge and the look-see hacker sharing a prison cell.

Although the law-makers may not have fully understood the technological aspects of hacking when they introduced the computer crimes legislation, their intent seems clear. They were trying to differentiate between a malicious hacker and a look-see hacker, but they could have worded it better.

As it’s worded, the legislation puts malicious, destructive hacking on a par with look-see hacking by saying that anyone who destroys, erases, alters or inserts data via a carrier faces a prison term, regardless of the person’s intent. There is no gradation in the law between mere deletion of data and `aggravated deletion’—the maximum penalty is ten years for both. The AFP