==Phrack Inc.== Volume Two, Issue 22, File 7 of 12 [][][][][][][][][][][][][][][][][][][][][][][][][][][][] [] [] [] Computer Hackers Follow A Guttman-Like Progression [] [] [] [] by Richard C. Hollinger [] [] University Of Florida [] [] [] [] April, 1988 [] [] [] [][][][][][][][][][][][][][][][][][][][][][][][][][][][] Little is known about computer "hackers," those who invade the privacy of somone else's computer. This pretest gives us reason to believe that their illegal activities follow a Guttman-like involvement in deviance. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Computer crime has gained increasing attention, from news media to the legislature. The nation's first computer crime statute passed unanimously in the Florida Legislature during 1978 in response to a widely publicized incident at the Flagler Dog Track near Miami where employees used a computer to print bogus winning trifecta tickets (Miami Herald, 1977a and 1977b; Underwood, 1979). Forty-seven states and the federal government have enacted some criminal statue prohibiting unauthorized computer access, both malicious and non-malicious (BloomBecker, 1986; Scott, 1984; U.S. Public Law 98-4733, 1984; U.S. Public Law 99-474, 1986). Although some computer deviance might already have been illegal under fraud or other statutes, such rapid criminalization of this form of deviant behavior is itself an interesting social phenomenon. Parker documented thousands of computer-related incidents (1976; 1979; 1980a; 1980b; and 1983), arguing that most documented cases of computer abuse were discovered by accident. He believed that these incidents represent the tip of the iceberg. Others counter that many of these so-called computer crimes are apocryphal or not uniquely perpetrated by computer (Taber, 1980; Time, 1986). Parker's work (1976; 1983) suggests that computer offenders are typically males in the mid-twenties and thirties, acting illegally in their jobs, but others may be high school and college students (New York Times, 1984b; see related points in Hafner, 1983; Shea, 1984; New York Times, 1984a). Levy (1984) and Landreth (1985) both note that some computer aficionados have developed a "hacker ethic" allowing harmless computer exploration, including free access to files belonging to other users, bypassing passwords and security systems, outwitting bureaucrats preventing access, and opposing private software and copy protection schemes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This research on computer hackers is based on a small number of semi-structured two-hour interviews covering many topics, including ties to other users, computer ethics, knowledge of computer crime statutes, and self-reports of using computers in an illegal fashion. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Such acts include these ten: 1. Acquiring another user's password. 2. Unauthorized use of someone else's computer account. 3. Unauthorized "browsing" among other user's computer files. 4. Unauthorized "copying" of another user's computer files. 5. Unauthorized file modification. 6. Deliberate sabotage of another user's programs. 7. Deliberately "crashing" a computer system. 8. Deliberate damage or theft of computer hardware. 9. Making an unauthorized or "pirated" copy of proprietary computer software for another user. 10. Receiving an unauthorized or "pirated" copy of proprietary computer software from another user. In 1985, a group of five students took unauthorized control of the account management system on one of the University of Florida's Digital VAX computers. They were able to allocate new accounts to each other and their friends. In addition, they browsed through other users' accounts, files and programs, and most importantly, they modified or damaged a couple of files and programs on the system. All first-time offenders, three of the five performed "community service" in consenting to being interviewed for this paper. Eight additional interviews were conducted with students selected randomly from an computer science "assembler" (advanced machine language) class. These students are required to have a working knowledge of both mainframe systems and micro computers, in addition to literacy in at least two other computer languages. The State Attorney's decision not to prosecute these non-malicious offenders under Florida's Computer Crime Act (Chapter 815) may reflect a more general trend. From research on the use (actually non-use) of computer crime statutes nationally, both BloomBecker (1986) and Pfuhl (1987) report that given the lack of a previous criminal record and the generally "prankish" nature of the vast majority of these "crimes," very few offenders are being prosecuted with these new laws. The three known offenders differed little from four of the eight computer science students in their level of self-reported computer deviance. The interviews suggest that computer deviance follows a Guttman-like progression of involvement. Four of the eight computer science respondents (including all three females) reported no significant deviant activity using the computer. They indicated no unauthorized browsing or file modification and only isolated trading of "pirated" proprietary software. When asked, none of these respondents considered themselves "hackers." However, two of the eight computer science students admitted to being very active in unauthorized use. Respondents who admitted to violations seem to fit into three categories. PIRATES reported mainly copyright infringements, such as giving or receiving illegally copied versions of popular software programs. In fact, pirating software was the most common form of computer deviance discovered, with slightly over half of the respondents indicating some level of involvement. In addition to software piracy, BROWSERS gained occasional unauthorized access to another user's university computer account and browsed the private files of others. However, they did not damage or copy these files. CRACKERS were most serious abusers. These five individuals admitted many separate instances of the other two types of computer deviance, but went beyond that. They reported copying, modifying, and sabotaging other user's computer files and programs. These respondents also reported "crashing" entire computer systems or trying to do so. Whether for normative or technical reaspons, at least in this small sample, involvement in computer crime seems to follow a Guttman-like progression. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - REFERENCES BloomBecker, Jay. 1986. Computer Crime Law Reporter: 1986 Update. Los Angeles: National Center for Computer Crime Data. Florida, State of. 1978. Florida Computer Crimes Act Chapter 815.01-815.08. Hafner, Katherine. 1983. "UCLA student penetrates DOD Network," InfoWorld 5(47): 28. Landreth, Bill. 1985. Out of the Inner Circle: A Hacker's Guide to Computer Security. Bellevue, Washington: Microsoft Press. Levy, Steven. 1984. Hackers: Heroes of the Computer Revolution. New York: Doubleday. Miami Herald. 1977a-. "Dog players bilked via computer," (September 20):1,16. --1977b "Why Flagler Dog Track was easy pickings," (September 21): 1,17. Newsweek. 1983a. "Beware: Hackers at play," (September 5): 42-46,48. --1983b. "Preventing 'WarGames'," (September 5): 48. New York Times. 1984a. "Low Tech" (January 5): 26. --1984b. "Two who raided computers pleading guilty," (March 17): 6. Parker, Donn B. 1976. Crime By Computer. New York: Charles Scribner's Sons. --1979. Computer Crime: Criminal Justice Resource Manual. Washington, D.C.: U.S. Government Printing Office. --1980a. "Computer abuse research update," Computer/Law Journal 2: 329-52. --1980b. "Computer-related white collar crime," In Gilbert Geis and Ezra Stotland (eds.), White Collar Crime: Theory and Research. Beverly Hills, CA.: Sage, pp. 199-220. --1983. Fighting Computer Crime. New York: Charles Scribner's Sons. Pful, Erdwin H. 1987. "Computer abuse: problems of instrumental control. Deviant Behavior 8: 113-130. Scott, Michael D. 1984. Computer Law. New York: John Wiley and Sons. Shea, Tom. 1984. "The FBI goes after hackers," Infoworld 6 (13): 38,39,41,43,44. Taber, John K. 1980. "A survey of computer crime studies," Computer/Law Journal 2: 275-327. Time. 1983a. "Playing games," (August 22): 14. --1983b. "The 414 gang strikes again," (August 29): 75. --1986. "Surveying the data diddlers," (February 17): 95. Underwood, John. 1979. "Win, place... and sting," Sports Illustrated 51 (July 23): 54-81+. U.S. Public Law 98-473. 1984. Counterfeit Access Device and Computer Fraud and Abuse Act of 1984. Amendment to Chapter 47 of Title 18 of the United States Code, (October 12). U.S. Public Law 99-474. 1986. Computer Fraud and Abuse Act of 1986. Amendment to Chapter 47 of Title 18 of the United States Code, (October 16). _______________________________________________________________________________