How do we decide if a cyber action is good or bad? If hackers attack a major site like Visa or MasterCard as part of an extortion attempt, most people would consider that to be an evil act — maybe even the people who do it think it is evil, but they want the money more than they want to feel good about themselves. On the other hand, if Anonymous brings down a child porn site using the same illegal methods, do you think that is also an evil act? It is certainly an illegal one. Both actions are illegal. Both cause damage to someone, but we do not consider harming child pornographers as evil in the same sense as stealing confidential information from innocent users or bringing down a legitimate website.
Why it that? To start, illegal and just plain wrong are two different concepts. In a good society we try to make bad things illegal, but there is always a dynamic tension between outlawing things and personal freedom. We see that in the ongoing fights over legalization of marijuana and access to abortions. Some people think both marijuana and abortions are bad, but at this time one is legal and one is not.
If the Internet is the Wild West, then hackivists are the vigilantes. Vigilantes generally get a bad press. Numerous old-time western movies feature an honest hero who must butt heads with a misguided vigilante group to find the true bad guys before the stupid, prejudiced, and ignorant vigilantes string up the wrong person. But true vigilantism goes beyond such simple stereotypes. If a rapist is caught by a rancher while that man is in the act of sexually assaulting the rancher’s daughter, and the rancher in his rage beats the offender to death, is he acting as a vigilante?. Yes, technically, this seems to be the case, but in Texas, and maybe elsewhere, that type of taking the law into your own hands is permissible in addition to being justified (by my standards).
So how do we decide if a cyber-vigilante act is good or bad? That is not an easy question to answer honestly and completely. We can give lip service to the rule of law and bringing the bad guys to court where they will get a fair trial, but try searching the Internet for “vigilantes: good or bad” to see some of the questions that can arise when you look at this issue carefully.
Twice this last week I received phone calls from a man with an Eastern accent who announced he was from Microsoft and my computer was sending out too many error messages and certainly had been badly infected. Therefore I should go to my computer and let his technician have remote control of it so they could assess the damage and advise me of how to fix the problem. The closest I came to being a vigilante was to attempt to keep them on the phone for as long as it was amusing. While they are talking to me, they are not making money by fleecing innocent PC users elsewhere. If I were on a jury deliberating the fate of a group that performed an Anonymous-like attack on these parasites, I would have no problem dismissing charges. Maybe that is one reason I never get selected for jury duty. (Having special agents in my family and designing special video equipment for surveillance might also have something to do with it!)
So bringing down Visa is bad, but bringing down child porn sites is good. Those are easy calls. The more likely scenario is messy. If you witness what you think is an evil act (legal or not), you can respond by (1) walking away,(2) notifying authorities, or (3) doing something about it without authorization. Each choice has issues. The first is probably the most common and implicitly makes you part of the evil act. There is a special place in Hell for those who damage others by refusing to get involved. The second choice might make you feel better, but will the police or other authorities be able to do anything? Budgets being what they are, someone might make a report and that is that. I have had things stolen and the authorities frankly told me they only took reports on minor thefts (minor to you, fella!) for insurance purposes. In other words, the thieves got a pass. Still, following the path of reporting to the authorities is the best, over all, for society.
The third choice can put you in physical danger, open you to making a serious mistake, and might make you liable for citation yourself. In rare cases, it can make you a hero. The bona fide heroes on United Flight 93 did not wait for authorization to take out the terrorists. We are all better off for their actions.
Authorities do have a history of going after vigilantes more actively than after the original perpetrators. A cynic might suggest that vigilantes represent competition in a way, while the original perpetrator adds to the authorities’ justification for being. I am not a cynic, but that is something to think about before taking the law into your own hands when the legal competition has guns. Authorities have a vested interest in making sure their way is the only way.
Was the USA justified in planting a virus to take out Iran’s centrifuges? Would Iran be justified in planting a virus to cripple some portion of our commerce in retaliation?
These are not easy questions. Dismissing vigilantes as scofflaws is easy, but the example of United Flight 93 shows the real situation is more complex. In the end, whoever wins ultimately determines what was good — or at least what was legal.
Do you think cyber vigilantism is ever justified?