Computer Hacking and EthicsComputer Hacking and EthicsBrian HarveyUniversity of California, Berkeley[A slightly different version of this paper was written for the``Panel on Hacking'' held by the Association for Computing Machinery inApril, 1985. Thanks to Batya Friedman, Donn Parker, and Carter Sanders fortheir comments on early drafts.][Neal Patrick] said he and his friends, who namedthemselves the ``414s'' after the Milwaukee area code, did notintend to do any damage and did not realize they were doinganything unethical or illegal. In fact, when asked [at aCongressional subcommittee hearing] at what point he questionedthe ethics of his actions, he answered, ``Once the FBI knockedon the door.''-- "`Common Sense' Urged on Computer Break-Ins,"26 Sept 83; Copyright 1983 New York Times News ServiceIt's no secret that a mature sense of ethics is something a persondevelops over time. Parents are supposed to exercise authority over theirchildren because the children are not expected to know how to make certaindecisions for themselves. We have a juvenile court system separate from theadult criminal court system because we believe that a young person is notcapable of criminal intent in the same sense that an adult iscapable of it.Within this century, the obvious idea that the ethical senseof an adolescent isn't the same as that of an adult has become thefocus of scientific research. Psychologists have entered a fieldonce left to philosophers: moral development. The best-known attemptto formalize this development is probably the six-stage theory ofHarvard psychologist Lawrence Kohlberg. Here is his description ofStage 3, the Interpersonal Concordance or ``Good Boy-Nice Girl'' Orientation:Good behavior is that which pleases or helpsothers and is approved by them. There is much conformityto stereotypical images of what is majority or ``natural'' behavior.Behavior is frequently judged by intention--the judgment ``hemeans well'' becomes important for the first time. One earnsapproval by being ``nice.'' [Kohlberg, p. 18]Is Neal Patrick at this third stage of moral development? He seemsto judge his own actions in terms of intention. From the perspectiveof the stage theory, we can see this as an improvement over ``Our mistakewas to get caught'' or ``What have those computer companies done forme,'' responses that would be typical of the earlier stages.I don't mean to give too much weight to the specifics of the third stage.It's not scientifically valid to assign Patrick to a developmental stage onthe basis of one quoted sentence. Also, not every researcher acceptsKohlberg's stages. But the important point is that Patrick isroughly at the stage of moral development appropriate to his age. He isnot some new kind of monster spawned by computer technology; he's a kid withall the strengths and weaknesses we expect from kids in other situations.Compare a bunch of adolescents breaking into a computer systemwith another bunch of kids hot-wiring a car for a joyride. The latterwould probably argue, with complete sincerity, that they were doingno harm, because the owner of the car recovered his property afterward.They didn't keep or sell it. It's a ``naughty'' prank to borrow someone'sproperty in that way, but not really serious.These hypothetical car thieves would be wrong, of course, inmaking that argument. They might lack the sensitivity needed to giveweight to the victim's feelings of manipulation, of fear, of anger.They may not understand how the experience of such a random attackcan leave a person feeling a profound loss of order and safety inthe world--the feeling that leads half our population to hail BernhardGoetz as a hero to be emulated. Some adolescents don't have the empathyto see beyond the issue of loss of property. Some may show empathyin certain situations but not in others.The point is that the computer raises no new issue, ethical orpragmatic. The password hacker who says ``we aren't hurting anythingby looking around'' is exactly analogous to the joyrider saying ``wearen't stealing the car permanently.''(The two cases need not seem analogous to an adolescent. Theremay be many computer abusers who would never break into a car fora joyride, but who don't understand that breaking into a computeraccount raises the same ethical issues. But the analogy still holdsfor us as adults.)The professional car thief and the teenaged joyrider are both socialproblems, but they're different problems. To confuse the two--totreat the teenager like a career criminal--would be a disastrouslyself-fulfilling prophecy.In the context of computer systems, there is a similar dichotomy. There aresome career criminals who steal by electronic means. This small group posesa large problem for society, but it's not a new one. Thieves are thieves.Just as banks use special armored cars, they must also develop specialarmored computer systems. But the rest of us don't use armored cars forroutine transportation, and we don't need armored computer systems forroutine communication either. (Of course there is a large middle groundbetween heavy security and no security at all. My purpose here is not todecide exactly what security measures are appropriate for any particularcomputer system. Instead, I just want to make it clear that, while in thispaper I'm not trying to address the problem of professional criminals, I'mnot trying to deny that there is such a problem either.)There is also a middle ground between the young person who happens to breakunimportant rules in the innocent exercise of intellectual curiosity and thehardened criminal. Consider the hypothetical case of a young man whosegirlfriend moves to Australia for a year, and so he builds himself a bluebox (a device used to place long distance telephone calls without paying forthem) and uses it to chat with her for an hour every other day. This is notintellectual curiosity, nor is it a deliberate, long-term choice of a lifeof crime. Instead, this hypothetical adolescent, probably normally honest,has stepped over a line without really noticing it, because his mind isfocused on something else. It would be inappropriate, I think, to pat himon the head and tell him how clever he is, and equally inappropriate tothrow him in prison. What we must do is call his attention to theinconsistency between his activities and, most likely, his own moralstandards.Two Models for Moral DirectionWhat to do about it? Saying that the problems of computer ethicsare like other ethical problems doesn't solve them. Many approachesare possible. We are starting to hear among computer experts thesame debates we've heard for centuries among criminologists: prevention,deterrence, retribution, cure?Among all the possible approaches, it may be instructive to considertwo strongly opposed ones: first, control of the technology, and second,moral training. As examples of these approaches, compare the registrationof automobiles with instruction in karate.Automobile registration is certainly a good idea in helping thepolice control professional crime. As thieves have learned to stealcars for their parts, rather than to sell whole, the technology ofregistration has had to grow more sophisticated: we now see serialnumbers on each major component, not just on the door frame. Butregistration doesn't help against joyriders.Other technological security measures can help. Steering columnlocks have made joyriding harder, but not impossible. Many adolescentsare expert locksmiths, not because they're dishonest but because locksand keys pose a technical challenge much like that of passwords ina computer system. Also, increased security has made the consequencesof juvenile car theft more serious, because the easiest way to defeata steering column lock is to destroy it by brute force.The example of karate instruction shows a very different approachto the problem of adolescent moral limitations. Instead of usingtechnology to limit the power of young people, this second approachdeliberately empowers them. Skill in karate is a deadly weapon; togive that weapon to a young person is an affirmation of trust ratherthan suspicion.Why do karate classes for kids work? Why don't they lead toan epidemic of juvenile murders? This paper can't present a definitiveanswer. But I want to suggest some possibilities and use them to drawanalogies for computer education.One probable reason is that every person responds to his or hersituation. If I know you're trusting me with something important,I'll try to live up to your trust. If I sense that you consider meuntrustworthy, I may decide that I might as well live up to your lowexpectations.Another vital reason, though, is that the technical instructionin karate techniques is part of a larger initiation into a certainculture and its rules. Karate schools don't begin by telling novices,``Here's how to kill someone.'' They begin with simple, less dangeroustechniques; the criteria for advancement include control andself-discipline as well as knowledge of particular moves. Instructorsemphasize that karate is an art that should not be abused. Students learnto demonstrate punches and kicks without injury by stopping just short ofcontact with the opponent's body.Empowerment in Computer EducationHow can we teach young computer enthusiasts to be responsiblemembers of the electronic community, without defining them as criminals?The analogy of karate instruction suggests that the answer is to combineethical training with real empowerment. To turn this broad sloganinto a practical program requires several changes in our approachto educational computing and to computing in general.Growth, like any ongoing function, requires adequateobjects in the environment to meet the needs and capacitiesof the growing child, boy, youth, and young man, until hecan better choose and make his own environment. It is nota ``psychological'' question of poor influences and bad attitudes,but an objective question of real opportunities for worthwhileexperience.... Thwarted, or starved, in the important objectsproper to young capacities, the boys and young men naturallyfind or invent deviant objects for themselves; this is thebeautiful shaping power of our human nature. Their choicesand inventions are rarely charming, usually stupid, and oftendisastrous; we cannot expect average kids to deviate withgenius. [Goodman, pp. 12-13]Paul Goodman was discussing traditional juvenile delinquents, notpassword hackers. But the problem is fundamentally the same. Howcan we provide a worthwhile culture for young computer enthusiaststo grow into?1. Serious adult models. In karate instruction, disciplineis not only for novices. The adult instructors follow the same disciplinethemselves. The ethical principles taught to beginners are takenseriously in the adult community. As a result, young students don'tsee the discipline of karate as an arbitrary imposition on them; theysee it as part of what it means to be a full member of the community.In the computer culture, adults rarely take seriously the idea of belongingto a community. The social ideal is the self-serving entrepreneur. Ourheros are the ones who become millionaires by doing a slick marketing job onyet another spreadsheet program. (When my high school programming studentsdiscovered that I actually knew how to program a computer, many of themdecided I was crazy. Why should anyone want to teach when he could makemore money programming?) In this context, why should any young personlisten to our moral lecturing?Fundamentally what is needed is personal action by each individualcomputer professional. But we can act as a society toencourage this individual commitment. We can urge our colleaguesto devote part of their time to pro bono publico activities, likeother professionals. We can give special public recognition to computerprofessionals who choose a life of disinterested public service overthe quest for personal gain. Some corporations allow their employeespaid sabbatical leave for public service work; we should encouragethis policy.2. Access to real power. Another important part of the karateanalogy is that there are not two kinds of karate, one for adultsand one for kids. What beginners learn may be elementary, but it'sa start down the same road traveled by experts. The community intowhich young karate students are welcomed is the real, adult community.That's not how things work with computers. How many adult computerscientists put up with CP/M, BASIC, and floppy disks? The technologyavailable to most young people is not a simpler version of what expertsuse; it's a completely separate, more arcane, fundamentally less powerfulmedium. That medium--the programming languages, the file storage,the editing tools, and so on--is simply inadequate to challengingintellectual work.The community of computer professionals has come to take forgranted easy access to electronic communication with colleagues anywherein the world. Those of us lucky enough to be on the Arpanet haveinstantaneous communication supported by taxpayers. Even the lessfortunate who communicate over dialup networks like uucp, though,have the cost of their mail supported by computing facilities otherthan their own; the general agreement among even competing privatebusinesses to forward one another's mail is a remarkable example ofdisinterested cooperation. Some of this mail traffic is serious business.But some of it is also ``junk mail'' like sf-lovers (for science fictionenthusiasts) and human-nets. Is it surprising that young computerenthusiasts want a slice of the pie too?Adolescents are excluded not only from access to equipment butalso from access to ideas. The password hackers' preoccupation withmagic words and magic numbers is harmful to themselves as well asto the rest of us; it's an intellectual dead end that gives them noreal insight into computer science. They learn a bag of isolatedtricks rather than powerful ideas that extend to solving other kindsof problems. Instead of just telling them what's forbidden, we woulddo better to show them the path to our own understanding of algorithms,formal theory of computation, and so on. We all know you can't programwell in BASIC; why do we allow manufacturers to inflict it on children?To take positive steps toward this goal requires action on two fronts,access to technology and access to ideas. The latter requires training highschool teachers who are themselves qualified computer programmers. In thelong run, this means paying teachers salaries competitive with industrystandards. That's a matter for government action. Another approach may beto promote active cooperation between university computer sciencedepartments and high schools. Perhaps college faculty and graduate studentscould contribute some of their time to the local high schools. (This is nota new idea; outside experts are donating time to secondary schools to helpteach other areas of science. Such partnership brings its own problems,because both the goals and the techniques of college teaching are differentfrom those of high school teaching. Still, this collaboration has sometimesbeen fruitful.)The problem of access to equipment is economically more difficult,but it's getting easier. The availability of 32-bit microprocessorsmeans that serious computational power should be affordable in thenear future. Equipment manufacturers shouldtake the high school market seriously, as an investment in futuretechnical workers. Another approach is for interested educators toestablish regional computing centers for adolescents, not part ofa particular school, where kids can come on their own time. Economiesof scale may allow such centers to provide state-of-the-art equipmentthat a single high school couldn't justify economically.3. Apprenticeship: challenging problems and access to expertise.The karate student is given not only access to a body of knowledge,but also the personal attention of a master in the field. The instructoris responsible for the moral development of his students as well astheir technical skill. He steers them in the direction of challengesappropriate to each one's progress, and his own expertise is availableto help the learner.For many years, the MIT Artificial Intelligence Laboratory ran a computersystem with no passwords and no file protection at all. (It was pressurefrom their Defense Department funding agency, not internal needs, thatforced them to implement a password scheme.) Even now, the laboratory has aliberal ``tourist'' policy: anyone can have an account, provided thatsomeone at the laboratory is willing to be his or her mentor. Thephilosophy behind this policy is that most ``malicious'' computer abuse isthe result of ignorance, misunderstanding, and thoughtlessness, rather thantruly malign intent. With a particular person responsible for each newuser, tourists learn to share the values of the community. They are taughtthat the vulnerability of MIT's system is a price researchers pay willinglyfor the open exchange of information that that vulnerability allows.Treated as legitimate members of the community, even young tourists quicklylearn to act responsibly toward the group.Not every computer facility can be expected to share the visionof MIT-AI. Certainly the computers that control the missiles andthe banking transactions should not be so open to visitors. But atypical large company has several computers, not all equally sensitive.Many could allow access to young people in their communities in theevenings, especially if some of their professional staff members areinterested in serving as volunteer mentors. It's the mentor/apprenticerelationship that makes all the difference. Just giving a kid anaccount on your machine may be asking for trouble, but making a friendof the kid is a good investment.In particular, universities often treat their undergraduate student userslike irresponsible children. Undergraduates are generally second-classcitizens, with limited access to the school's computing resources, includinghuman resources (faculty). Universities should allow undergraduates tofunction as true members of serious research teams, as graduate studentsdo. This policy would provide both access to faculty mentors andchallenging, useful tasks.For secondary schools, the issue is partly one of curriculum. Too manyteenagers are taught (not only in the schools but also in the magazines)that true computer expertise means knowing what number to POKEinto what address in order to change the color of the screen on some brandof microcomputer. Such learning is not intellectually challenging. It doesnot lead to a feeling of fruitful apprenticeship.4. A safe arena for moral experimentation. Thebeginning karate student might be afraid to try his or her skill with afellow student, lest he or she injure or be injured. But it's safe to fighta match with a black belt instructor. ``I won't hurt you,'' says theinstructor, ``and I won't let you hurt me.'' To allow for safe sparringbetween students, classes begin with half-speed motions and no body contactallowed. Later they may progress to rules that allow light body contact butno contact to the opponent's head. These rules allow students to feel safeas they experiment and develop their skills.Young people have a similar need for safety in moral experimentation.One of the reasons for the appeal of role-playing games like Dungeonsand Dragons is that a player can say ``I'm going to be a thief,'' or``I'm going to be evil,'' trying on these roles without actually harminganyone. Similarly, a good school should be a place where studentsfeel safe, a kind of ``ethics laboratory.''Neal Patrick's first exposure to an ethical dilemma should nothave involved the FBI. He should have confronted the issue of informationprivacy while using a computer system in his school. He could havelearned how his antisocial acts hurt and angered the legitimate usersof the system, without risking really serious trouble for himselfor for anyone else. For one thing, it's hard for a young person tounderstand the chain of reasoning from the abstract corporate ownerof a computer system to the actual human beings whose lives are affectedwhen that system breaks down. It's easier to understand the issueswhen the users are one's friends and classmates, and the social effectsof malicious password hacking are immediately apparent.(None of this is meant to excuse Patrick or the other 414s. Neither ignorance of the law nor misunderstanding the ethical issuesis accepted in our culture as an excuse for lawbreaking. But I am notwriting for a court of law meeting to settle Patrick's guilt or innocence.The question for us is how, as a society, we can act to make the nextgeneration of teenagers less likely to paint themselves into thisparticular corner.)As a practical matter, what's needed to build an ethics laboratoryfor computing students has already been recommended in another context:adequate computing power to support a user community, as opposed toa bunch of isolated, independent microcomputer users. Whether thismeans timesharing or a network of personal computers with a sharedfile server is a technical question beyond the scope of this paper.But sharing is essential. The ethical issues of a living communitydon't arise in the context of isolated individuals using microcomputersseparately with no communication among them. (If we do not fill this need,we leave a void that in practice is filled by ``pirate'' bulletin boardsthat build a sort of outlaw community around illegal computing activities.)Appendix A: What is a Hacker?Appendix B: A Case StudyReferencesGoodman, Paul. Growing Up Absurd. New York: Random House, 1960.Kohlberg, Lawrence. Essays on Moral Development, volume 1: ThePhilosophy of Moral Development. New York: Harper & Row, 1981.www.cs.berkeley.edu/~bh |
|
