***************************************************************************** * * * From the March 1990 edition of Harper's Magazine * * * * IS COMPUTER HACKING A CRIME? * * * * Typed by Warlock, March 13. * * * ***************************************************************************** The image of the computer hacker drifted into public awareness in the middle Seventies, when reports of Chinese-food-consuming geniuses working compulsively at keyboards began to issue from MIT. Over time, several of these impresarios entered commerce, and the public's impression of hackers changed: They were no longer nerds but young, millionaire entrepreneurs. The most recent news reports have given the term a more felonious connotation. Early this year, a graduate student named Robert Morris Jr. went on trial for releasing a computer program known as a worm into the vast Internet system, halting more than 6,000 computers. The subsequent public debate ranged from the matter of proper punishment for a mischievous kid to the issue of our rapidly changing notion of what constitutes free speech -- or property -- in an age of modems and data bases. In order to allow hackers to speak for themselves, Harper's Magazine recently organized an electronic discussion and asked some of the nation's best hackers to "log on," discuss the protean notions of contemporary speech, and explain what their powers and talents are. The following forum is based on a discussion held on the WELL, a computer bulletin board system based in Sausalito, California. The forum is the result of a gradual accretion of arguments as the participants -- located throughout the country -- opined and reacted over an eleven day period. Harper's Magazine senior editor Jack Hitt and assistant editor Paul Tough served as moderators. ADELAIDE is a pseudonym for a former hacker who has sold his soul to the corporate state as a computer programmer. BARLOW is John Perry Barlow, a retired cattle rancher, a former Republican county chairman, and a lyricist for the Grateful Dead, who currently is writing a book on computers and consciousness entitled Everything We Know Is Wrong. BLUEFIRE is Dr. Robert Jacobson, associate director of the Human Interface Technology Laboratory at the University of Washington and a former information-policy analyst with the California legislature. BRAND is Russell Brand, a senior computer scientist with Reasoning Systems, in Palo Alto, California. CLIFF is Clifford Stoll, the astronomer who caught a spy in a military computer network and recently published an account of his investigation entitled The Cuckoo's Egg. DAVE is Dave Hughes, a retired West Pointer who currently operates his own political bulletin board. DRAKE is Frank Drake, a computer-science student at a West Coast university and the editor of W.O.R.M., a cyberpunk magazine. EDDIE JOE HOMEBOY is a pseudonym for a professional software engineer who has worked at Lucasfilm, Pyramid Technology, Apple Computer, and Autodesk. EMMANUEL GOLDSTEIN is the editor of 2600, the "hacker's quarterly." HANK is Hank Roberts, who builds mobiles, flies hang gliders, and proofreads for the Whole Earth Catalog. JIMG is Jim Gasperini, the author, with TRANS Fiction Systems, of Hidden Agenda, a computer game that simulates political conflict in Central America. JRC is Jon Carroll, daily columnist for the San Francisco Chronical and writer-in-residence for the Pickle Family Circus, a national traveling circus troupe based in San Francisco. KK is Kevin Kelly, editor of the Whole Earth Review and a cofounder of the Hacker's Conference. LEE is Lee Felstein, who designed the Osborne-1 computer and cofounded the Homebrew Computer Club. MANDEL is Tom Mandel, a professional futurist and an organizer of the Hacker's Conference. RH is robert Horvitz, Washington correspondent for the Whole earth Review. RMS is Richard Stallman, founder of the Free Software Foundation. TENNEY is Glenn Tenney, an independant-systems architect and an organizer of the Hacker's Conference. ACID PHREAK and PHIBER OPTIK are both pseudonyms for hackers who decline to be identified. A Hacker's Lexicon Back Door: A point of entry into a computer system -- often installed there by the original programmer -- that provides secret access. Bomb: A destructive computer program, which, when activated, destroys the files in a computer system. Chipper: A hacker who specializes in changing the programming instructions of computer chips. Cracker: A hacker who breaks illegally into computer systems and creates mischief; often used pejoratively. The original meaning of cracker was narrower, describing those who decoded copyright-protection schemes on commercial software products or to modify them; sometimes known as a software pirate. Hacker: Originally, a compulsive computer programmer. The word has evolved in meaning over the years. Among computer users, hacker carries a positive connotation, meaning anyone who creatively explores the operations of computer systems. Recently, it has taken on a negative connotation, primarily through confusion with cracker. Phone phreak: One who explores the operations of the phone system, often with the intent of making free phone calls. Social engineering: A nontechnical means of gaining information simply by persuading people to hand it over. If a hacker wished to gain access to a computer system, for example, an act of social engineering might be able to contact a system operator and to convince him or her that the hacker is a legitimate user in need of a password; more colloquially, a con job. Virus: A program that, having been introduced into a system, replicates itself and attaches itself to other programs, often with a variety of mischievous effects. Worm: A destructive program that, when activated, fills a computer system with self-replicating information, clogging the system so that its operations are severely slowed, sometimes stopped. The Digital Frontier HARPER'S [Day 1, 9:00 A.M.]: When the computer was young, the word hacking was used to describe the work of brilliant students who explored and expanded the uses to which this new technology might be employed. There was even talk of a "hacker ethic." Somehow, in the succeeding years, the word has taken on dark connotations, suggestion the actions of a criminal. What is the hacker ethic, and does it survive? ADELAIDE [Day 1, 9:25 A.M.]: the hacker ethic survives, and it is a fraud. It survives in anyone excited by technology's power to turn many small, insignificant things into one vast, beautiful thing. It is a fraud because there is nothing magical about computers that causes a user to undergo religious conversion and devote himself to the public good. Early automobile inventors were hackers too. At first the elite drove in luxury. Later practically everyone had a car. Now we have traffic jams, drunk drivers, air pollution, and suburban sprawl. The old magic of an automobile occasionally surfaces, but we possess no delusions that it automatically invades the consciousness of anyone who sits behind the wheel. Computers are power, and direct contact with power can bring out the best or worst in a person. It's tempting to think that everyone exposed to the technology will be grandly inspired, but, alas, it just ain't so. BRAND [Day 1, 9:54 A.M.] The hacker ethic involves several things. One is avoiding waste; insisting on using idle computer power -- often hacking into a system to do so, while taking the greatest precautions not to damage the system. A second goal of many hackers is the free exchange of technical information. These hackers feel that patent and copyright restrictions slow down technological advances. A third goal is the advancement of human knowledge for its own sake. Often this approach is unconventional. People we call crackers often explore systems and do mischief. The are called hackers by the press, which doesn't understand the issues. KK [Day 1, 11:19 A.M.]: The hacker ethic went unnoticed early on because the explorations of basement tinkerers were very local. Once we all became connected, the work of these investigations rippled through the world. today the hacking spirit is alive and kicking in video, satellite TV, and radio. In some fields they are called chippers, because the modify and peddle altered chips. Everything that was once said about "phone phreaks" can be said about them too. DAVE [Day 1, 11:29 A.M.]: Bah. Too academic. Hackers hack. Because the want to. Not for any higher purpose. Hacking is not dead and won't be as long as teenagers get their hands on the tools. There is a hacker born every minute. ADELAIDE [Day 1, 11:42 A.M.]: Don't forget ego. People break into computers because it's fun and it makes them feel powerful. BARLOW [Day 1, 11:54 A.M.]: Hackers hack. Yeah, right, but what's more to the point is that humans hack and always have. Far more than just opposable thumbs, upright posture, or excess cranial capacity, human beings are set apart from all other species by an itch, a hard-wired dissatisfaction. Computer hacking is just the latest in a series of quests that started with fire hacking. Hacking is also a collective enterprise. It brings to our joint endeavors the simultaneity that other collective organisms -- ant colonies, Canada geese -- take for granted. This is important, because combined with our itch to probe is a need to connect. Humans miss the almost telepathic connectedness that I've observed in other herding mammals. And we want it back. Ironically, the solitary sociopath and his 3:00 A.M. endeavors hold the most promise for delivering species reunion. EDDIE JOE HOMEBOY [Day 1, 4:44 P.M.]: Hacking really took hold with the advent of the personal computer, which freed programmers from having to use a big time-sharing system. A hacker could sit in the privacy of his home and hack to his heart's and head's content. LEE [Day 1, 5:17 P.M.]: "Angelheaded hipsters burning for the ancient heavenly connection to the starry dynamo in the machinery of night" (Allen Ginsberg, "Howl"). I still get an endorphin rush when I go on a design run -- my mind out over the edge, groping for possibilities that can be sensed when various parts are held in juxtaposition with a view toward creating a whole object: straining to get through the epsilon-wide crack between What Is and What Could Be. Somewhere there's the Dynamo of Night, the ultra-mechanism waiting to be dreamed, that we'll never get to in actuality, (think what is would weigh!) but that's present somehow in the vicinity of those mental wrestling matches. When I re-emerge into the light of another day with the design on paper -- and with the knowledge that if it ever gets built, things will never be the same again -- I know I've been where artists go. That's hacking to me: to transcend custom and to engage in creativity for its own sake, but also to create objective effects. I've been around long enough to see the greed creeps take up the unattended reins of power and shut down most of the creativity that put them where they are. But I've also seen things change, against the best efforts of a stupidly run industry. We cracked the egg out from under the Computer Priesthood, and now everyone can have omelets. RMS [Day 1, 5:19 P.M.]: The media and the courts are spreading a certain image of hackers. It's important for us not to be shaped by that image. But there are two ways that it can happen. One way is for hackers to become part of the security-maintenance establishment. The other, more subtle, way is for a hacker to become the security-breaking phreak the media portray. By shaping ourselves into the enemy of the establishment, we uphold the establishment. But there's nothing wrong with breaking security if you're accomplishing something useful. It's like picking a lock on a tool cabinet to get a screwdriver to fix your radio. As long as you put the screwdriver back, what harm does it do? ACID PHREAK [Day 1, 6:34 P.M.]: There is no one hacker ethic. Everyone has his own. To say that we all think the same way is preposterous. The hacker of old sought to find what the computer itself could do. There was nothing illegal about that. Today, hackers and phreaks are drawn to specific, often corporate, systems. It's no wonder everyone on the other side is getting mad. We're always one step ahead. We were back then, and we are now. CLIFF [Day 1, 8:38 P.M.]: RMS said, "There's nothing wrong with breaking security if you're accomplishing something useful." Huh? How about, There's nothing wrong with entering a neighbor's house if you're accomplishing something useful, just as long as you clean up after yourself. Does my personal privacy mean anything? Should my personal letters and data be open to anyone who knows how to crack passwords? If not my property, then how about a bank's? Should my credit history be available to anyone who can find a back door to the private computers of TRW, the firm that tracks people's credit histories? How about a list of AIDS patients from a hospital's data bank? Or next week's prime interest rate from a computer at the Treasury Department? BLUEFIRE [Day 1, 9:20 P.M.]: Computers are everywhere, and they link us together into a vast social "cybernetia." The grand skills of the hackers, formidable though they may have been, are incapable of subverting this automated social order. The networks in which we survive are more than copper wire and radio waves: They are the social organization. For every hacker in revolt, busting through a security code, ten thousand people are being wired up with automatic call-identification and credit-checking machines. Long live the Computer Revolution, which died aborning. JRC [Day 1, 10:28 P.M.]: We have two different definitions here. One speaks of a tinkerer's ecstasy, an ecstasy that is hard to maintain in the corporate world but is nevertheless at the heart of Why Hackers Hack. The second is political, and it has to do with the free flow of information. Information should flow more freely (how freely is being debated), and the hacker can make it happen because the hacker knows how to undam the pipes. This makes the hacker ethic -- of necessity -- antiauthoritarian. EMMANUEL GOLDSTEIN [Day 2, 2:41 A.M.]: It's meaningless what we call ourselves: hackers, crackers, techno-rats. We're individuals who happen to play with high tech. There is no hacker community in the traditional sense of the term. There are no leaders and no agenda. We're just individuals out exploring. BRAND [Day 2, 9:02 A.M.]: There are two issues: invariance and privacy. Invariance is the art of leaving things as you found them. If someone used my house for the day and left everything as he found it so that there was no way to tell he had been there, I would see no problem. With a well-run computer system, we can assure invariance. Without this assurance we must fear that the person picking the lock to get the screwdriver will break the lock, the screwdriver, or both. Privacy is more complicated. I want my medical records, employment records, and letters to The New Republic private because I fear that someone will do something with the information that is against my interests. If I could trust people not to do bad things with information, I would not need to hide it. Rather than preventing the "theft" of this data, we should prohibit its collection in the first place. HOMEBOY [Day 2, 9:37 A.M.]: Are crackers really working for the free flow of information? Or are they unpaid tools of the establishment, identifying the holes in the institutional dike so that they can be plugged by the authorities, only to be tossed in jail or exiled? DRAKE [Day 2, 10:54 A.M.]: There is an unchallenged assumption that crackers have some political motivation. Earlier, crackers were portrayed as failed revolutionaries; now Homeboy suggests that crackers may be tools of the establishment. These ideas about crackers are based on earlier experiences with subcultures (beats, hippies, yippies). Actually, the contemporary cracker is often middle-class and doesn't really distance himself from the "establishment." While there are some anarcho-crackers, there are even more right-wing crackers. The hacker ethic crosses political boundaries. MANDEL [Day 2, 11:01 A.M.]: The data on crackers suggests that they are either juvenile delinquents or plain criminals. BARLOW [Day 2, 11:34 A.M.]: I would far rather have everyone know my most intimate secrets than to have noncontextual snippits of them "owned" by TRW and the FBI -- and withheld from me! Any cracker who is entertained by peeping into my electronic window is welcome to the view. Any institution that makes money selling rumors of my peccadilloes is stealing from me. Anybody who wants to inhibit that theft with electronic mischief has my complete support. Power to the techno-rats! EMMANUEL [Day 2, 7:09 P.M.]: Calling someone on the phone is the equivalent of knocking on that person's door, right? Wrong! When someone answers the phone, you are inside the home. You have already been let in. The same with an answering machine, or a personal computer, if it picks up the phone. It is wrong to violate a person's privacy, but electronic rummaging is not the same as breaking and entering. The key here is that most people are unaware of how easy it is for others to invade their electronic privacy and see credit reports, phone bills, FBI files, Social Security reports. The public is grossly underinformed, and that's what must be fixed if hackers are to be thwarted. If we had an educated public, though, perhaps the huge -- and now common -- date bases would never have been allowed to exist. Hackers have become scapegoats: We discover the gaping holes in the system and then get blamed for the flaws. HOMEBOY [Day 2, 7:41 P.M.]: Large, insular, undemocratic governments and institutions need scapegoats. It's the first step down the road to fascism. That's where hackers play into the hands of the establishment. DAVE [Day 2, 7:55 P.M.]: If the real criminals are those who leave gaping holes in their systems, the the real criminals in house burglaries are those who leave their windows unlatched. Right? Hardly. And Emmanuel's analogy to a phone being answered doesn't hold either. There is no security protection in making a phone call. A computer system has a password, implying a desire for security. Breaking into a poorly protected house is still burglary. CLIFF [Day 2, 9:06 P.M.]: Was there a hacker's ethic and does it survive? More appropriately, was there a vandal's ethic and does it survive? As long as there are communities, someone will violate the trust that binds them. Once, our computers were isolated, much as eighteenth-century villages were. Little was exchanged, and each developed independently. Now we've built far-flung electronic neighborhoods. These communities are built on trust: people believing that everyone profits by sharing resources. Sure enough, vandals crept in, breaking into systems, spreading viruses, pirating software, and destroying people's work. "It's okay," they say. "I can break into a system because I'm a hacker." Give me a break! BARLOW [Day 2, 10:41 P.M.]: I live in a small town. I don't have a key to my house. Am I asking for it? I think not. Among the juvenile delinquents in my town, there does exist a vandal's ethic. I know because I once was one. In a real community, part of a kid's rite of passage is discovering what walls can be breached. Driving 110 miles per hour on Main Street is a common symptom of rural adolescence, publicly denounced but privately understood. Many teenagers die in this quest -- two just the night before last -- but it is basic to our culture. Even rebellious kids understand that risk to one's safety is one thing, wanton vandalism or theft is another. As a result, almost no one locks anything here. In fact, a security system is an affront to a teenage psyche. While a kid might be dissuaded by conscience, he will regard a barricade as an insult and a challenge. So the CEOs who are moving here (the emperor of PepsiCo and the secretary of state among them) soon discover that over the winter people break into their protected mansions just to hang out. When systems are open, the community prospers, and teenage miscreants are satisfied to risk their own lives and little else. When the social contract is enforced by security, the native freedom of the adolescent soul will rise up to challenge it in direct proportion to its imposition. HANK [Day 2, 11:23 P.M.]: Barlow, the small town I grew up in was much like yours -- until two interstate highways crossed nearby. The open-door style changed in one, hard summer because our whole town became unlocked. I think Cliff's community is analogous to my little town -- confronted not by a new locked-up neighbor who poses a challenge to the local kids but by a sudden, permanent opening up of the community to many faceless outsiders who owe the town no allegiance. EMMANUEL [Day 3, 1:33 A.M.]: Sorry, I don't buy Dave's unlatched-window analogy. A hacker who wanders into a system with the ease that it's done today is, in my analogy, walking into a house without walls -- and with a cloaking device! Any good hacker can make himself invisible. If housebreaking were this easy, people would be enraged. But we're missing the point. I'm not referring to accessing a PC in someone's bedroom but about accessing credit reports, government files, motor vehicle records, and the megabytes of data piling up on each of us. Thousands of people legally see and use this ever-growing mountain of data, much of it erroneous. Whose rights are we violating when we peruse a file? Those of the person we look up? He doesn't even know that information exists, that it was compiled without his consent, and that it's not his property anymore! The invasion of privacy took place long before the hacker ever arrived. The only way to find out how such a system works is to break the rules. It's not what hackers do that will lead us into a state of constant surveillance; it's allowing the authorities to impose on us a state of mock crisis. MANDEL [Day 3, 9:27 A.M.]: Note that the word crime has no fixed reference in our discussion. Until recently, breaking into government computer systems wasn't a crime; now it is. In fact, there is some debate, to be resolved in the courts, whether what Robert Morris Jr. did was actually a crime [see "A Brief History of Hacking"]. Crime gets redefined all the time. Offend enough people or institutions and, lo and behold, someone will pass a law. That is partly what is going on right now: Hackers are pushing buttons, becoming more visible, and that inevitably means more laws and more crimes. ADELAIDE [Day 3, 9:42 A.M.]: Every practitioner of these arts knows that at minimum he is trespassing. The English "country traveler ethic" applies: The hiker is always ethical enough to close the pasture gates behind him so that no sheep escape during his pastoral stroll through someone else's property. The problem is that what some see as a gentle trespassing others see as theft of service, invasion of privacy, threat to national security -- take your pick. BARLOW [Day 3, 2:38 P.M.]: I regard the existence of proprietary data about me to be theft -- not just in the legal sense but in a faintly metaphysical one, rather like the belief among aborigines that a photograph steals the soul. The crackers who maintain access to that data are, at this level, liberators. Their incursions are the only way to keep the system honest. RMS [Day 3, 2:48 P.M.]: Recently, a tough anti-hacker measure was proposed in England. In The Economist I saw a wise response, arguing that it was silly to treat an action as worse when it involves a computer that when it does not. They noted, for example, that physical trespassing was considered a civil affair, not a criminal one, and said that computer trespassing should be treated likewise. Unfortunately, the U.S. government was not so wise. BARLOW [Day 3, 3:23 P.M.]: The idea that a crime is worse if a computer is involved relates to the gathering governmental perception that computer viruses and guns may be related. I know that sounds absurd, but they have more in common than one might think. For all its natural sociopathy, the virus is not without philosophical potency -- like a gun. Here in Wyoming guns are part of the furniture. Only recently have I observed an awareness of their political content. After a lot of frothing about prying cold, dead fingers from triggers, the sentiment was finally distilled to a bumper sticker I saw on a pickup the other day: "Fear the Government That Fears Your Gun." Now I've read too much Ghandi to buy that line without misgivings, but it would be hard to argue that Tiananmen Square could have been inflicted on a populace capable of shooting back. I don't wholeheartedly defend computer viruses, but one must consider their increasingly robust deterrent potential. Before it's over, the War on Drugs could easily turn into an Armageddon between those who love liberty and those who crave certainty, providing just the excuse the control freaks have been waiting for to rid America of all that constitutional mollycoddling called the Bill of Rights. Should that come to pass, I will want to use every available method to vex and confuse the eyes and ears of surveillance. The virus could become the necessary instrument of our freedom. At the risk of sounding like some digital posse comitatus, I say* Fear the Government That Fears Your Computer. TENNEY [Day 3, 4:41 P.M.]: Computer-related crimes are more feared because they are performed remotely -- a crime can be committed in New York by someone in Los Angeles -- and by people not normally viewed as being criminals -- by teenagers who don't look like delinquents. They're smart nerds, and they don't look like Chicago gangsters packing heat. BARLOW [Day 4, 12:12 A.M.]: People know so little of these things that they endow computers and the people who do understand them with powers neither possesses. If America has a religion, its ark is the computer and its covenant is the belief that Science Knows. We are mucking around in the temple, guys. It's a good way to catch hell. DAVE [Day 4, 9:18 A.M.]: Computers are the new American religion. The public is in awe of -- and fears -- the mysteries and the high priests who tend them. And the public reacts just as it always has when faced with fear of the unknown -- punishment, burning at the stake. Hackers are like the early Christians. When caught, they will be thrown to the lions before the Roman establishment: This year the mob will cheer madly as Robert Morris is devoured. KK [Day 6, 11:37 A.M.]: The crackers here suggest that they crack into systems with poor security BECAUSE the security is poor. Do more sophisticated security precautions diminish the need to crack the system or increase it? ACID [Day 6, 1:20 P.M.]: If there was a system that we knew was uncrackable, we wouldn't even try to crack it. On the other hand, if some organization boasted that its system was impenetrable and we knew that was media hype, I think it would be safe to say we'd have to "enlighten" them. EMMANUEL [Day 6, 2:49 P.M.]: Why do we insist on cracking systems? The more people ask those kinds of questions, the more I want to get in! Forbid access and the demand for access increases. For the most part, it's simply a mission of exploration. In the words of the new captain of the starship Enterprise, Jean-Luc Picard, "Let's see what's out there!" BARLOW [Day 6,4:34 P.M.]: Tell us, Acid, is there a system that you know to be uncrackable to the point where everyone's given up? ACID [Day 6, 8:29 P.M.]: CICIMS is pretty tough. PHIBER OPTIK [Day 7, 2:36 P.M.]: Really? CICIMS is a system used by Bell operating companies. The entire security system was changed after myself and a friend must have been noticed in it. For the entire United States, there is only one such system, located in Indiana. The new security scheme is flawless in itself, and there is no chance of "social engineering" i.e., bullshitting someone inside the system into telling you what the passwords are. The system works something like this: You log on with the proper account and password; then, depending on who you are, the system asks at random three of ten questions that are unique to each user. But the system can be compromised by entering forwarding instructions into the phone company's switch for that exchange, thereby intercepting every phone call that comes in to the system over a designated period of time and connecting the call to your computer. If you are familiar with the security layout, you can emulate its appearance and fool the caller into giving you the answers to his questions. Then you call the system yourself and use those answers to get in. There are other ways of doing it as well. BLUEFIRE [Day 7,11:53 P.M.]: I can't stand it! Who do you think pays for the security that the telephone companies must maintain to fend off illegal use? I bet it costs the ratepayers around $10 million for this little extravaganza. The cracker circus isn't harmless at all, unless you don't mind paying for other people's entertainment. Hackers who have contributed to the social welfare should be recognized. But cracking is something else -- namely, fun at someone else's expense -- and it ain't the folks who own the phone companies who pay; it's us, me and you. BARLOW [Day 8, 7:35 A.M.]: I am becoming increasingly irritated at this idea that you guys are exacting vengeance for the sin of openness. You seem to argue that if a system is dumb enough to be open, it is your moral duty to violate it. Does the fact that I've never locked my house -- even when I was away for months at a time -- mean that someone should come in and teach me a lesson? ACID [Day 8, 3:23 P.M.]: Barlow, you leave the door open to your house? Where do you live? BARLOW [Day 8, 10:11 P.M.]: Acid, my house is at 372 North Franklin Street in Pinedale, Wyoming. Heading north on Franklin, go about two blocks off the main drag before you run into a hay meadow on the left. I'm the last house before the field. The computer is always on. But do you really mean to imply what you did with that question? Are you merely a sneak looking for easy places to violate? You disappoint me, pal. For all your James Dean-on-Silicon, you're just a punk. EMMANUEL [Day 9, 12:55 A.M.]: No offense, Barlow, but your house analogy doesn't stand up, because your house is far less interesting than a Defense Department computer. For the most part, hackers don't mess with individuals. Maybe we feel sorry for them; maybe they're boring. Institutions are where the action is, because they are compiling this mountain of data -- without your consent. Hackers are not guardian angels, but if you think we're what's wrong with the system, I'd say that's precisely what those in charge want you to believe. By the way, you left out your zip code. It's 82941. BARLOW [Day 9, 8:34 A.M.]: Now that's more like it. There is an ethical distinction between people and institutions. The law makes little distinction. We pretend that institutions are somehow human because they are made of humans. A large bureaucracy resembles a human about as much as a reef resembles a coral polyp. To expect an institution to have a conscience is like expecting a horse to have one. As with every organism, institutions are chiefly concerned with their own physical integrity and survival. To say that they have some higher purpose beyond their survival is to anthropomorphize them. You are right, Emmanuel. The house analogy breaks down here. Individuals live in houses; institutions live in mainframes. Institutions are functionally remorseless and need to be checked. Since their blood is digital, we need to be in their bloodstreams like an infection of humanity. I'm willing to extend limitless trust to other human beings. In my experience they've never failed to deserve it. But I have as much faith in institutions as they have in me. None. OPTIK [Day 9, 10:19 A.M.]: In other words, Mr. Barlow, you say something, someone proves you wrong, and then you agree with him. I'm getting the feeling that you don't exactly chisel your views in stone. HANK [Day 9, 11:18 A.M.]: Has Mr. Optik heard the phrase "thesis, antithesis, synthesis"? BARLOW [Day 10, 10:48 A.M.]: Optik, I do change my mind a lot. Indeed, I often find it occupied by numerous contradictions. The last time I believed in absolutes, I was about your age. And there's not a damn thing wrong with believing in absolutes at your age either. Continue to do so, however, and you'll find yourself, at my age, carrying placards filled with nonsense and dressing in rags. ADELAIDE [Day 10, 6:27 P.M.]: The flaw in this discussion is the distorted image the media promote of the hacker as "whiz." The problem is that the one who gets caught obviously isn't. I haven't seen a story yet on a true genius hacker. Even Robert Morris was no whiz. The genius hackers are busy doing constructive things or are so good no one's caught them yet. It takes talent to break into something. Nobody calls subway graffiti artists geniuses for figuring out how to break into the yard. There's a difference between genius and ingenuity. BARLOW [Day 19, 9:48 P.M.]: Let me define my terms. Using hacker in a midspectrum sense (with crackers on one end and Leonardo da Vinci on the other), I think it does take a kind of genius to be a truly productive hacker. I'm learning PASCAL now, and I am constantly amazed that people can string those prolix recursions into something like PageMaker. It fills me with the kind of awe I reserve for splendors such as the cathedral at Chartres. With crackers like Acid and Optik, the issue is less intelligence than alienation. Trade their modems for skateboards and only a slight conceptual shift would occur. Yet I'm glad they're wedging open the cracks. Let a thousand worms flourish. OPTIK [Day 10, 10:11 P.M.]: You have some pair of balls comparing my talent with that of a skateboarder. Hmm... This was indeed boring, but nonetheless: [Editor's note: At this point in the discussion, Optik -- apparently having hacked into TRW's computer records -- posted a copy of Mr. Barlow's credit history. In the interest of Mr. Barlow's privacy -- at least what's left of it -- Harper's Magazine has not printed it.] I'm not showing off. Any fool knowing the proper syntax and the proper passwords can look up credit history. I just find your high-and-mighty attitude annoying and, yes, infantile. HOMEBOY [Day 10, 10:17 P.M.]: Key here is "any fool." ACID [Day 11, 1:37 P.M.]: For thirty-five dollars a year anyone can have access to TRW and see his or her own credit history. Optik did it for free. What's wrong with that? And why does TRW keep files on what color and religion we are? If you didn't know that they kept such files, who would have found out if it wasn't for a hacker? Barlow should be grateful that Optik has offered his services to update him on his personal credit file. Of course, I'd hate to see my credit history up in lights. But if you hadn't made our skins crawl, your info would not have been posted. Everyone gets back at someone when he's pissed; so do we. Only we do it differently. Are we punks? Yeah, I guess we are. A punk is what someone who has been made to eat his words calls the guy who fed them to him. **************************************************************************** A Brief History of Hacking September 1970 - John Draper takes as his alias the name of Captain Crunch after he discovers that the toy whistle found in the cereal of the same name perfectly simulates the tone necessary to make free phone calls. March 1975 - The Homebrew Computer Club, an early group of computer hackers, holds its first meeting in Menlo Park, California. July 1976 - Homebrew members Steve Wozniak, twenty-six, and Steve Jobs, twenty-one, working out of a garage, begin selling the first personal computer, known as the Apple. June 1980 - In one week, errors in the computer system operating the U.S. air-defense network cause two separate false reports of soviet missile launches, each prompting an increased state of nuclear readiness. December 1982 - Sales of Apple personal computers top one billion dollars per year. November 1984 - Steven Levy's book Hackers is published, popularizing the concept of the "hacker ethic": that "access to computers, and anything that might teach you something about the way the world works, should be unlimited and total." The book inspires the first Hacker's Conference, held that month. January 1986 - The "Pakistani Brain" virus, created by a software distributor in Lahore, Pakistan, infects IBM computers around the world, erasing data files. June 1986 - The U.S. Office of Technology Assessment warns that massive, cross-indexed government computer records have become a "de facto national data base containing personal information on most Americans." March 1987 - William Fates, a Harvard dropout who founded Microsoft Corporation, becomes a billionaire. November 1988 - More that 6,000 computers linked by the nationwide Internet computer network are infected by a computer program known as a worm and are crippled for two days. The worm is traced to Robert Morris Jr., a twenty-four- year-old Cornell University graduate student. December 1988 - A federal grand jury charges Kevin Mitnick, twenty-five, with stealing computer programs over telephone lines. Mitnick is held without bail and forbidden access to any telephones without supervision. March 1989 - Three West German hackers are arrested for entering thirty sensitive military computers using home computers and modems. The arrests follow a three-year investigation by Clifford Stoll, an astronomer at the Lawrence Berkeley Laboratory who began tracing the hackers after finding a seventy-five-cent billing error in the lab's computer system. January 1990 - Robert Morris Jr. Goes on trial in Syracuse, New York, for designing and releasing the Internet worm. Convicted, he faces up to five years in prison and a $250,000 fine. ***************************************************************************** * * * Part 2: Hacking The Constitution * * * ***************************************************************************** HARPER'S [Day 4, 9:00 A.M.]: Suppose that a mole inside the government confirmed the existence of files on each of you, stored in the White House computer system, PROFS. Would you have the right to hack into that system to retrieve and expose the existence of such files? Could you do it? TENNEY [Day 4, 1:42 P.M.]: The proverbial question of whether the end justifies the means. This doesn't have much to do with hacking. If the file were a sheet of paper in a locked cabinet, the same question would apply. In that case you could accomplish everything without technological hacking. Consider the Pentagon Papers. EMMANUEL [Day 4, 3:55 P.M.]: Let's address the hypothetical. First, I need to find out more about PROFS. Is it accessible from off site, and if so, how? Should I update my 202-456 scan [a list of phone numbers in the White House's exchange that connect incoming calls to a computer]? I have a listing for every computer in that exchange, but the scan was done back in 1984. Is PROFS a new system? Perhaps it's in a different exchange? Does anybody know how many people have access to it? I'm also on fairly god terms with a White House operator who owes me a favor. But I don't know what to ask for. Obviously, I've already made up my mind about the right to examine this material. I don't want to debate the ethics of it at this point. If you're with me, let's do something about this. Otherwise, stay out of the way. There's hacking to be done. ACID [Day 4, 5:24 P.M.]: Yes, I would try to break into the PROFS system. But first I'd have someone in the public eye, with no ties to hacking, request the info through the Freedom of Information Act. Then I'd hack in to verify the information I received. DRAKE [Day 4, 9:13 P.M.]: Are there a lot of people involved in this antihacker project? If so, the chances of social engineering data out of people would be far higher than if it were a small, close-knit group. But yes, the simple truth is, if the White House has a dial-up line, it can be hacked. EMMANUEL [Day 4, 11:27 P.M.]: The implication that a trust has been betrayed on the part of the government is certainly enough to make me want to look a little further. And I know I'm doing the right thing on behalf of others who don't have my abilities. Most people I meet see me as an ally who can help them stay ahead of an unfair system. That's what I intend to do here. I have a small core of dedicated hackers who could help. One's specialty is the UNIX system, another's is networks, and another's is phone systems. TENNEY [Day 5, 12:24 P.M.]: PROFS is an IBM message program that runs on an operating system known as VM. VM systems usually have a fair number of holes, wither to gain access or to gain full privileges. The CIA was working on, and may have completed, a supposedly secure VM system. No ethics here, just facts. But a prime question is to determine what system via what phone number. Of course, the old inside job is easier. Just find someone who owes a favor or convince an insider that it is a moral obligation to do this. BARLOW [Day 5, 2:46 P.M.]: This scenario needs to be addressed in four parts: ethical, political, practical I (from the standpoint of the hack itself), and practical II (disseminating the information without undue risk). Ethical: Since World War II, we've been governed by a paramilitary bureaucracy that believes freedom is too precious to be entrusted to the people. These are the same folks who had to destroy the village in order to save it. Thus the government has become a set of Chinese boxes. Americans who believe in democracy have little choice but to shred the barricades of secrecy at every opportunity. It isn't merely permissible to hack PROFS. It is a moral obligation. Political: In the struggle between control and liberty, one has to avoid action that will drive either side to extreme behaviour. The basis of terrorism, remember, is excess. If we hack PROFS, we must do it in a way that doesn't become a pretext for hysterical responses that might eventually include zero tolerance of personal computers. The answer is to set up a system for entry and exit that never lets on we've been there. Practical I: Hacking the system should be a trivial undertaking. Practical II: Having retrieved the smoking gun, it must be made public in such a way that the actual method of acquisition does not become public. Consider Watergate: The prime leaker was somebody whose identity and information-gathering technique is still unknown. So having obtained the files, we turn them over to the Washington Post without revealing our own identities or how we came by the files. EMMANUEL [Day 5, 9:51 P.M.]: PROFS is used for sending messages back and forth. It's designed not to forget things. And it's used by people who are not computer literate. The document we are looking for is likely an electronic message. If we can find out who the recipient or sender is, we can take it from there. Since these people frequently use the system to communicate, there may be a way for them to dial into the White House from home. Finding that number won't be difficult: frequent calls to a number local to the White House and common to a few different people. Once I get the dial-up, I'll have to look at whatever greeting I get to determine what kind of system it is. Then we need to locate someone expert in the system to see if there are any built-in back doors. If there aren't, I will social engineer my way into a working account and then attempt to break out of the program and explore the entire system. BRAND [Day 6, 10:06 A.M.]: I have two questions: do you believe in due process as found in our Constitution? And do you believe that this "conspiracy" is so serious that extraordinary measures need to be taken? If you believe in due process, then you shouldn't hack into the system to defend our liberties. If you don't believe in due process, you are an anarchist and potentially a terrorist. The government is justified in taking extreme action to protect itself and the rest of us from you. If you believe in the Constitution but also that this threat is so extreme that patriots have a duty to intercede, then you should seek one of the honest national officials who can legally demand a copy of the document. If you believe that there is no sufficiently honest politician and you steal and publish the documents, you are talking about a revolution. ACID [Day 6, 1:30 P..]: This is getting too political. Who says that hacking has to have a political side? Generalizing does nothing but give hackers a false image. I couldn't care less about politics, and I hack. LEE [Day 6, 9:01 P.M.]: Sorry, Acid, but if you hack, what you do is inherently political. Here goes: Political power is exercised by control of information channels. Therefore, any action that changes the capability of someone in power to control these channels is politically relevant. Historically, the one in power has been not the strongest person but the one who has convinced the goon squad to do his bidding. The goons give their power to him, usually in exchange for free food, sex, and great uniforms. The turning point of most successful revolutions is when the troops ignore the orders coming from above and switch their allegiance. Information channels. Politics. These days, the cracker represents a potential for making serious political change if he coordinates with larger social and economic forces. With out this coordination, the cracker is but a techno-bandit, sharpening his weapon and chuckling about how someday... Revolutions often make good use of bandits, and some of them move into high positions when they're successful. but most of them are done away with. One cracker getting in won't do much good. Working in coordination with others is another matter -- called politics. JIMG [Day 7, 12:28 A.M.]: A thought: Because it has become so difficult to keep secrets (thanks, in part, to crackers), and so expensive and counterproductive (the trade-off in lost opportunities is too great), secrets are becoming less worth protecting. Today, when secrets come out that would have brought down governments in the past, "spin-control experts" shower the media with so many lies that the truth is obscured despite being in plain sight. It's the information equivalent of the Pentagon planto surround each real missile with hundreds of fake ones, rendering radar useless. If hackers managed to crack the White House system, a hue and cry would be raised -- not about what the hackers found in the files but about what a threat hackers are to this great democracy of ours. HARPER'S [Day 7, 9:00 A.M.]: Suppose you hacked the files from the White House and a backlash erupted. Congressmen call for restrictions, arguing that the computer is "property" susceptible to regulation and not an instrument of "information" protected by the First Amendment. Can we craft a manifesto setting forth your views on how the computer fits into the traditions of the American Constitution? DAVE [Day 7, 5:30 P.M.]: If Congress ever passed laws that tried to define what we do as "technology" (regulatable) and not "speech," I would become a rebellious criminal immediately -- and as loud as Thomas Paine ever was. Although computers are part "property" and part "premises" (which suggest a need for privacy), they are supremely instruments of speech. I don't want any congressional King Georges treading on my cursor. We must continue to have absolute freedom of electronic speech! BARLOW [Day 7, 10:07 P.M.]: Even in a court guided by my favorite oxymoron, Justice Rehnquist, this is an open-and-shut case. The computer is a printing press. Period. The only hot-lead presses left in this country are either in museums or being operated by poets in Vermont. The computer cannot fall under the kind of regulation to which radio and TV have become subject, since computer output is not broadcast. If these regulations amount to anything more than a fart in the congressional maelstrom, then we might as well scrap the whole Bill of Rights. What I am doing with my fingers is "speech" in the clearest sense of the word. We don't need no stinking manifestos. JIMG [Day 8, 12:02 P.M.]: This type of congressional action is so clearly unconstitutional that "law hackers" -- everyone from William Kunstler to Robert Bork -- would be all over it. The whole idea runs so completely counter to our laws that it's hard to get worked up about it. ADELAIDE [Day 8, 9:51 A.M.]: Not so fast. There used to be a right in the Constitution called "freedom from unreasonable search and seizure," but, thanks to recent Supreme Court decisions, your urine can be demanded by a lot of people. I have no faith in the present Supreme Court to uphold any of my rights of free speech. The complacent reaction here -- that whatever Congress does will eventually be found unconstitutional -- is the same kind of complacency that led to the current near-reversals of Roe v. Wade. JRC [Day 8, 10:05 A.M.]: I'd forgo the manifestos and official explanations altogether: Fight brushfire wars against specific government incursions and wait for the technology to metastasize. In a hundred years, people won't have to be told about computers because they will have an instinctive understanding of them. KK [Day 8, 2:14 P.M.]: Hackers are not sloganeers. They are doers, take-things-in-handers. They are the opposite of philosophers: They don't wait for language to catch up to them. Their arguments are their actions. You want a manifesto? The Internet worm was a manifesto. It had more meaning and symbolism than any revolutionary document you could write. To those in power running the world's nervous system, it said: Wake up! To the underground of hackers, crackers, chippers, techno-punks, it said: You have power; be careful. To the mass of citizens who find computers taking over their telephone, their TV, their toaster, and their house, it said: Welcome to Wonderland. BARLOW [Day 8, 10:51 P.M.]: Apart from the legal futility of fixing the dam after it's been breached, I've never been comfortable with manifestos. They are based on the ideologue's delusion about the simplicity, the figure-out-ability, of the infinitely complex thing that is Life Among the Humans. Manifestos take reductionism for a long ride off a short pier. Sometimes the ride takes a very long time. Marx and Engels didn't actually crash until last year. Manifestos fail because they are fixed and consciousness isn't. I'm with JRC: Deal with incursions when we need to, on our terms, like the guerrillas we are. To say that we can outmaneuver those who are against us is like saying that honeybees move quicker than Congress. The future is to the quick, not the respectable. RH [Day 8, 11:43 P.M.]: Who thinks computers can't be regulated? The Electronic Communications Privacy Act of 1986 made it a crime to own "any electronic, mechanical, or other device [whose design] renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communication." Because of the way Congress defined "electronic communication," one could argue that even a modem is a surreptitious interception device (SID), banned by the ECPA and subject to confiscation. It's not that Congress intended to ban modems; it was just sloppy drafting. The courts will ultimately decide what devices are legal. Since it may not be possible to draw a clear bright line between legal and illegal interception devices, the grey area -- devices with both legitimate uses and illegitimate uses -- may be subject to regulation. BARLOW [Day 9, 8:52 A.M.]: I admit with some chagrin that I'm not familiar with the ECPA. It seems I've fallen on the wrong side of an old tautology: Just because all saloon keepers are Democrats, it doesn't follow that all Democrats are saloon keepers. By the same token, the fact that all printing presses are computers hardly limits computers to that function. And one of the other things computers are good at it surreptitous monitoring. Maybe there's more reason for concern than I thought. Has any of this stuff been tested in the courts yet? RH [Day 9, 10:06 P.M.]: My comments about surreptitous interception devices are not based on any court cases, since there have not been any in this area since the ECPA was enacted. It is a stretch of the imagination to think that a judge would ever find a stock, off-the-shelf personal computer to be a "surreptitous interception device." But a modem is getting a little closer to the point where a creative prosecutor could make trouble for a cracker, with fallout affecting many others. An important unknown is how the courts will apply the word surreptitious. There's very little law, but taking it to mean "by stealth; hidden from view; having its true purpose physically disguised," I can spin some worrisome examples. I lobbied against the bill, pointing out the defects. Congressional staffers admitted privately that there was a problem, but they were in a rush to get the bill to the floor before Congress adjourned. They said they could patch it later, but it is a pothole waiting for a truck axle to rumble through. JIMG [Day 10, 8:55 A.M.]: That's sobering information, RH. Yet I still think that this law, if interpreted the way you suggest, would be found unconstitutional, even by courts dominated by Reagan appointees. Also, the economic cost of prohibiting modems, or even restricting their use, would so outweigh conceivable benefits that the law would never go through. Finally, restricting modems would have no effect on the phreaks but would simply manage to slow everybody else down. If modems are outlawed, only outlaws will have modems. RH [Day 10, 1:52 P.M.]: We're already past the time when one would wrap hacking in the First Amendment. There's a traditional distinction between words -- expressions of opinions, beliefs, and information -- and deeds. You can shout "Revolution!" from the rooftops all you want, and the post office will obligingly deliver your recipes for nitroglycerin. But acting on that information exposes you to criminal prosecution. The philosophical problem posed by hacking is that computer programs transcend this distinction: They are pure language that dictates action when read by the device being addressed. In that sense, a program is very different from a novel, a play, or even a recipe: Actions result automatically from the machine reading the words. A computer has no independent moral judgement, no sense of responsibility. Not yet, anyway. As we program and automate more of our lives, we undoubtedly will deal with more laws: limiting what the public can know, restricting devices that can execute certain instructions, and criminalizing the possession of "harmful" programs with "no redeeming social value." Blurring the distinction between language and action, as computer programming does, could eventually undermine the First Amendment or at least force society to limit its application. That's a very high price to pay, even for all the good things that computers make possible. HOMEBOY [Day 10, 11:03 P.M.]: HACKING IS ART. CRACKING IS REVOLUTION. All else is noise. Cracks in the firmament are by nature threatening. Taking a crowbar to them is revolution. ******************************************************************************