DarkMarket_ Cyberthieves, Cybercops and You - Misha Glenny [120]
To combat these growing threats, governments and industry are now pouring hundreds of billions of dollars into cyber security, whether in law enforcement, the protection of intellectual copyright or the military domain. Almost all of these funds are invested in technology, the idea being that this will be sufficient to protect the Internet from all the bad code, malware and viruses that are prowling around cyberspace looking for unprotected computer networks to attack.
By contrast, there is virtually no investment in trying to ascertain who is hacking and why. Nobody differentiates between the hackers from WikiLeaks, from the American or Chinese military, from criminal syndicates and from the simply curious.
But hackers are a rare and very special breed. Their psychological and social profiles differ, on the whole, from those of traditional criminals, above all the ones who are key to unlocking the criminal business opportunities on the Web, but are not very interested in money – in other words, the geeks. Understanding their abilities and their motivation in engaging in specific activities, whether criminal or otherwise, would enormously benefit a security industry that is over-dependent on technical solutions. On those rare occasions when law enforcement or the private sector tracks down hackers, leading to their prosecution and conviction, little is done to engage with the wrongdoers. Instead, the criminal-justice systems of Europe and the United States seek to impose heavy jail sentences on them and thereafter to restrict their access to computers.
Given their peculiar psycho-sociological profile, this is a big error. First, one should take their age into consideration: most hackers engage at a very early age in activity that one might best describe as legally ambiguous. Like Detlef Hartmann, they can be seduced into illegal work on the Web before their moral compass has properly evolved and before they fully understand the implications of what they are doing.
In real life they are often psychologically vulnerable, which means that locking them away among real criminals can be very counterproductive, as was the case with Max Vision. While he has an unpredictable ego, all officials agree that Vision has a planet-sized brain with an unparalleled understanding of computer security. In a world where there is a dearth of computer security specialists and where the threats are proliferating, it seems unwise to incarcerate a phenomenal asset. This is not to argue that hackers who have engaged in criminal activity should escape punishment, but that the need for rehabilitation is not only a moral imperative for the state, but potentially of considerable practical value.
Raoul Chiesa, a former hacker, runs a small academic centre called the Hacker Profiling Unit based in Turin and funded by the United Nations. His research is grounded in his intimate knowledge of the hacking community and on hackers’ answers to the extensive questionnaires that he sends out to them. The early results from his work offer important clues as to the make-up of the hacker.
Most striking is the gender imbalance that pervades not just the illicit domains of cyber, but also the organisation and operation of the Internet as a whole. It is a subject only alluded to in the pages of this book, but deserves detailed study. While men still dominate politics and the economy the world over, this domination is extreme when it comes to new technology. There are, of course, many very dynamic women engaged in new technology and new media, but statistically they comprise a tiny percentage: according to Chiesa, just 5 per cent. Hackers are almost invariably men.
A second finding in Chiesa’s study is that the average hacker is either smart or very smart. Furthermore he has noted that there is a high incidence, close to 100 per cent, among hackers of advanced ability in science – physics, maths and chemisty. This is combined with a relatively low level