Are Hackers Criminals?

Sometimes the ‘why’ behind a blog indicates a problem that others are having too. My problem is that the words hacker and criminal are used so interchangeably that those who are “hacking for good” are often tarred with the same brush. But there are Criminal Hackers. Let me explain some terminology and hopefully, you’ll see where I am coming from too.

Criminals are criminals.

A criminal is someone who preys on their victims to make their own gains. Sometimes money, sometimes to create power over someone or something and sometimes just for the lulz. They are breaking systems, ways of working to find a loophole, a weakness that they can exploit for their own benefit.

Here’s an example: You discover that a well-known oil company has a vulnerability to a control system for a pipeline which means that you can turn that pipe off and on at your own amusement. One day you get turned away from a petrol station as they can’t serve you for some reason and you go home angry and you remember that vulnerability. Well, if I can’t have fuel then no one can and you turn the pipeline off. Sure enough, all the oil in your area stops, in fact, the backup of oil in the pipe causes it to split and there is an explosion which causes the company millions of dollars to repair… well they shouldn’t have turned you away should they?

Criminal or hacker? Well, your intent was to cause them harm by turning off the pipeline? That harm also caused the organisation more harm still as it accidentally exploded too.

Criminal then.

But a criminal is only a criminal when they break a law. Which law applies when it’s on the internet? Well, that’s a really good question and there is no easy answer which is why so many criminals “get away with it”.

A criminal may be based in the UK, and be using a server in the US to attack a victim in France. So which law applies? UK, US or French Law? Well, even more complications here as each country handles it differently, the UK defends the victim under UK law but goes after the criminal under whichever jurisdiction they are – but the attack came from France so France or USA? And so it gets complicated.

But I digress. What is a criminal and how do they differ from a hacker, for example?

Hackers are hackers.

Let me start by reframing your definition of a hacker. Here is a version of the definition I like to quote:

if you take something designed to do one thing and make it do something else … you’re a hacker.

If you’ve ever played Lego, you’re a hacker. If you’ve ever coded and then changed your code to make it do something else … you’re a hacker.

Be proud to be a hacker, it shows initiative, creative thought, a can do attitude, not scared to fail. Forget all that fail-fast rubbish, this is having a go, a curious mind unleashed. The intent is discovery, knowledge and education.

So Are Criminals Hackers?

Sometimes. There are Criminal Hackers. Yes.

They take code meant to do something and then exploit it in a way for their own personal gain.

Are Hackers Criminals?

I do not believe so.

Because, if they were using their hacking skills for bad intent, then they would be Criminals (Criminal Hackers). However, it is not always that clear-cut. Sometimes, Hackers can start off good, but, start using their knowledge and skills to access unauthorised systems in the pursuit of more information. See the difference? It was the “unauthorised access” bit that changed. That is where the criminal element comes in.

So which am I?

Well, when you take a long hard look at yourself in the mirror, were you manipulating code for your own personal gain at the detriment of someone else? Or, were you tinkering with something to see how it worked with permission from the owner.
Intent is the key differentiator.

So which are you? Criminal or Hacker?

Useful Reading:

Hackers manifesto: http://phrack.org/issues/7/3.html#article

Computer Misuse Act: https://www.legislation.gov.uk/ukpga/1990/18/contents

Hacking is not a crime: https://www.itpro.com/security/hacking/hacking-is-not-a-crime-criminal-activity-is

We Are Hackers…not Criminals: https://www.linkedin.com/pulse/we-hackersnot-criminals-mic-merritt/
Hacking is not a crime: https://www.hackingisnotacrime.org/