In today’s digitalised world, it would seem that any concept we are accustomed to observing in the physical space can be almost directly taken and duplicated in cyberspace as well. When it comes to security, whether that of citizens, businesses or states, the matter is no different. In particular, crime, which we characterise with concepts such as criminals, laws, law-enforcement and property, exists in the cyberspace as well. Nevertheless, with the digital space being less regulated than the physical one, it is sometimes difficult to ascertain what constitutes crime, who the perpetrator is and most importantly: how does one ensure their cybersecurity. It is no wonder then that it is popular among cybersecurity and technology experts to explain the cyberspace as a digital Wild West, with its very own moral digital norms of behaviour. If this is the case, then it is worth identifying the good guys, the bad guys and their reasons for acting for or against cybersecurity.
A hacker – what’s in a name?
The term “hacker” is fairly contested and usually has a negative connotation due to most people associating it with criminal or malicious purposes. A more suitable definition of a hacker, however, would be that of someone who has the ability and skills to penetrate computer security, regardless of their intentions for doing so. If a hacker has the means to breach digital security, then it is his or her intentions for doing so and ultimately, the outcome of such breach that define the colour of their moral “hat.”
The most notorious of hackers are the so-called “Black hats.”
Just like in Western movies, they are the “bad guys” or in more legal terms: they are the ones perpetrating the cybercrime through their skills to break into computer networks and bypass security measures. Their goal is usually to steal, modify or corrupt confidential and personal data or to disrupt web-based services. Their intent, on the other hand, is malicious and motivated by either personal gain or simply the desire to disrupt. Whether it is stealing one’s bank log-in credentials and using their funds, illegally obtaining private data and using it for criminal purposes, or bringing down websites with DDOS attacks, Black hats’ actions act against one’s digital safety and property. Thus, such actions constitute cybercrime.
Nevertheless, there are hackers who use their skills for better purposes.
One might be tempted to follow on the Western hats analogy and assume “White hats” are like the sheriffs of cyberspace and that they apprehend the black hats and put them in digital jail. In reality, however, law enforcement and punitive measures against malicious hackers remain within the jurisdiction of traditional police forces. Ethical hackers on the other hand, or White hats, have the benign intent of improving the security measures of a computer system or website by exposing security vulnerabilities that are unknown to the owner. They use the same hacking skills to find a security breach, in the same fashion a malicious hacker would. The difference, however, is that once they find a vulnerability, they inform the user and advise on how the system’s security can be improved. What is more, ethical hackers operate legally, with the knowledge of the user and provide their hacking skills in a more professional manner.
Cyber bounty hunters
Hiring ethical hackers has become increasingly popular and profitable, as companies hire White hat hackers to increase and reinforce their cybersecurity. Ethical hackers are usually trained to run these tests and hold a certification of their abilities and competencies. Many of them are hired and paid by big IT companies to perform so-called “penetration tests” (or “pentests”) to assess the state of cybersecurity and to enhance it. Some companies, particularly in the financial sector, are even required by regulating or industry bodies to perform systematic pentests to prove the robustness of their cybersecurity.
While some White hats are employed on a contract, others prefer the free-lance approach, and usually have other jobs in IT in parallel. Some companies further encourage this practice, by taking on the “bug bounty” approach. In this case, instead of hiring the White hat in a more permanent manner, they pay him or her for each software vulnerability they find. In 2015, for example, Google paid up to $20, 000 to White hat hackers for each bug they could find. What is more, there now exist web-based services, such as HackerOne, BugCrowd, Cobalt and BountyFactory in Europe which connect White hats and the clients that seek their services, with the connecting service collecting a percentage of the profit on each bug found. In essence, such companies are the “brokers” between the ethical hackers and the companies in need of pen-testers.
White hats’ freelance services are not solely sought by businesses and corporations, however: they can also be hired by governments, financial institutions, critical infrastructure services, the healthcare sector, or even the military. In 2016, for example, the US Department of Defense launched its “Hack the Pentagon” program. True to its name, the program allowed over 50 participating hackers to legally try hacking the Pentagon, for which it paid them more than $70,000 in bounties. What the Pentagon got in return, however, was no less impressive: the hackers managed to find 134 cybersecurity vulnerabilities in the course of three weeks.
The best defence - (preventive) offence?
The White hat community can consist of security researchers, academics and computer science students. For big companies, which are consistently threatened by cyber vulnerabilities, often an entire team from the White Hat community is needed. The idea behind such team is that outside ethical hackers can pool their various expertise and uncover many vulnerabilities, which otherwise can be missed by a single security expert. The reasoning is that no matter how good the security expert(s) of a certain establishment is in setting up defences against Black hat hackers, the best added defence measure is to simulate an offence by another hacker who thinks and operates in a way different to the defence team. That is not to say that the White hats are replacing traditional defence-based cybersecurity experts. The job of an ethical hacker is not to build a cybersecurity defence, but rather, to test its resilience and diagnose where it can be improved.
Another added advantage of this approach is that it allows for a wider range of people to get involved in the cybersecurity sector, where skilled experts are desperately needed. An organisation can thus choose to hire a White hat certified hacker, but can also choose to hire someone just as skilled, but who has not managed to get the professional (an often expensive) certification. The approach has an added advantage of attracting young hackers to join the White hat team, instead of seeking financial profits through cybercrime. Facebook, for example, awarded more than $4.3 million to ethical hackers in 2015 alone. What is more, in 2016, the company gave a bounty award of $10, 000 to a 10-year old boy from Finland who had managed to find a vulnerability in Instagram’s code.[i] In a similar fashion, in 2014, Google awarded then 17-year old George Hotz $150, 000 for discovering a vulnerability in Google Chrome. What followed was an offer for Hotz to join the then starting Project Zero: Google’s very own paid bug-bounty hunting team, which in the past three years of its existence has gained a notable White hat reputation. Such cases highlight an innovative approach of filling the cybersecurity skills gap by giving children and youth not only an incentive to improve their IT and coding skills, but also a clear career cybersecurity path they can aim for.
The digital road ahead
In an ideal world, laws and norms governing our physical space, would be as easily applicable in the digital one. With technology fast developing, however, cybercrime and its cost are proliferating while both cybersecurity experts and ordinary citizens alike are struggling to keep up with the quickly evolving threats. This leads to a sense of impunity when it comes to cybercrime. In turn, this reinforces a belief that hackers can operate anonymously in the digital space and get away with illegal actions. The ultimate goal in cybersecurity then is clearly to enforce norms of legality in a more efficient way: a complex and arduous process which will not happen overnight. In the meantime, however: one strategy against cybercrime would be to offer convincing incentives for hackers to put on their White hat instead of a Black one and work towards filling the cybersecurity gap, not widening it.
[i] In 2012, Instagram was bought by Facebook for over $1 billion
