ie8 fix
madison

Hire hackers to catch other hackers?

By | September 29, 2011, 9:18pm PDT

Summary: Leading tech companies have long used ‘ethical hackers’ to help probe vulnerabilities in their systems and software. Should some of the not-so-ethical hackers be added to payrolls as well?

In recent times, “Anonymous” hackers have been wreaking havoc with corporate and government systems. So, should corporations hire these guys?

Leading tech companies have long used “ethical hackers” to help probe vulnerabilities in their systems and software. Should some of the not-so-ethical hackers be added to payrolls as well?

One journalist, Misha Glenny, says there is a solid case to be made for hiring hackers. Delivering his remarks at a recent TED event, Glenny pointed out that groups such as Anonymous tend to be idealistic, and “are providing a service by demonstrating how useless companies are at protecting our data.”  As he put it:

“Despite the fact that we are beginning to pour billions, hundreds of billions of dollars, into cybersecurity — for the most extraordinary technical solutions — no one wants to talk to these guys, the hackers, who are doing everything. Instead, we prefer these really dazzling technological solutions, which cost a huge amount of money…  Where we have a surplus of technology in the cybersecurity industry, we have a definite lack of — call me old-fashioned — human intelligence.”

There’s obvious moral hazard in rewarding people who try to tear down companies’ operations. But police and spy agencies often employ nefarious types to help with investigations, part of that “human intelligence” on the ground that helps catch even more bad guys. And remember how the brilliant but misguided con artist Frank Abagnale — pursued by the FBI for years because of his scams, highlighted in the movie Catch Me If You Can — eventually sided with the feds to become a valuable resource in catching other bad guys. Abagnale also provides security consulting to many large corporations as well, by the way.


The typical hacker is a person with a lot of talent and passion, Glenny says. Trying to catch and prosecute these individuals is the wrong way to spend our resources, he adds. “We need to engage and find ways of offering guidance to these young people, because they are a remarkable breed. And if we rely, as we do at the moment, solely on the criminal justice system and the threat of punitive sentences, we will be nurturing a monster we cannot tame.”

Is Glenny right?  Should more efforts be made to engage hackers, and bring them into the fold?  Should bad behavior be rewarded?

(Cross-posted at SmartPlanet Business Brains.)

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Joe McKendrick is an author, consultant and speaker specializing in trends and developments shaping the technology industry.

Disclosure

Joe McKendrick

Joe McKendrick is an independent consultant, editor and speaker.

Joe has performed project work (white papers, articles, blogs, research and presentations) for the following companies in the IT marketspace:

  • CBS Interactive/CNET/ZDNet (this blog)
  • ebizQ
  • Evans Data
  • Gartner
  • IBM
  • Informatica
  • IDC
  • Microsoft
  • Systinet/HP
  • Teradata
  • Unisphere Reseach, a division of Information Today, Inc.
  • WebLayers

Joe has also performed research work for the following sponsoring organizations in partnership with Unisphere Research, a division of Information Today, Inc.

  • IBM
  • Luminex
  • Noetix
  • Oracle Corp.
  • Teradata
  • Informatica
  • International Oracle Users Group
  • Oracle Applications Users Group
  • Professional Association for SQL Server
  • International DB2 Users Group
  • International Sybase Users Group
  • SHARE (IBM large systems users group)

Biography

Joe McKendrick

Joe McKendrick is an author and independent analyst who tracks the impact of information technology on management and markets. Joe is co-author, along with 16 leading industry leaders and thinkers, of the SOA Manifesto, which outlines the values and guiding principles of service orientation. He also speaks frequently on Enterprise 2.0 and SOA topics at industry events and Webcasts, and serves on the program committee for this year's SOA & Cloud Symposium in London. As an independent analyst, he has also authored numerous research reports in partnership with Unisphere Research, a division of Information Today, Inc. for user groups such as SHARE, Oracle Applications Users Group, and International DB2 Users Group. In a previous life, Joe served as director of the Administrative Management Society (AMS), an international professional association dedicated to advancing knowledge within the IT and business management fields. He is a graduate of Temple University.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
12
Comments

Join the conversation!

Just In

RE: Hire hackers to catch other hackers?
webmasters Updated - 30th Sep
I think hackers are modern pirates which killed mostly 16. centuary. Internet is a new sea for pirates. We can estimate hacker will not alive too long.
0 Votes
+ -
"In recent times, ???Anonymous??? hackers have been wreaking havoc with corporate and government systems. So, should corporations hire these guys?"

I'd recommend against it - it could easily backfire and cost you. In fact, now that this person has inside information, there's the potential for even more damage.

"The typical hacker is a person with a lot of talent and passion, Glenny says."

There's a lot of people out there who aren't so morally questionable that are also talented. I don't think it's reasonable to say that only morally questionable people have talent.

"We need to engage and find ways of offering guidance to these young people, because they are a remarkable breed."

Perhaps, but it should be done in a way where there's not a risk they'll continue to harm others.

"Is Glenny right?"

He's off his rocker.

"Should more efforts be made to engage hackers, and bring them into the fold?"

Engage them, perhaps. Bring them into the fold - not until we can reasonably trust them.

"Should bad behavior be rewarded?"

Most certainly not. That will only encourage more bad behavior.
0 Votes
+ -
@CobraA1
Your name even sounds like that of a hacker.
0 Votes
+ -
NO bad behavior should be punished. Anomnuts may not have use the information they hacked but they sure allowed the criminals the information on a silver platter. All that said If any company isn't using the most up to date security resources they also must be punished and depending on the severity, jail time for those who push security to the side to save money and put there customers at risk.
0 Votes
+ -
It's not hackers like anonymous that are the real threat. They're hacking to send a message.

The hackers who should be punished are the ones who hack things that bring danger to human life, or the ones who steal money, actual money not theoretical money or something like that. Outside of that I see no reason that a hacker be punished...we need to stop criminalizing hacking, and start criminalizing cracking. Things like spamming, cracking into financial institutions, scamming and such are unethical uses of such skill and should be punished. The skill itself should not be.
0 Votes
+ -
Reward skills, punish bad behaviour. And you can do both at once!
0 Votes
+ -
RE: Hire hackers to catch other hackers?
douglas_john_ledet@... 30th Sep
Perhaps we could hire politicians to catch the crimical acts of other politicians.

Wait....

They do that already and yet, no one goes to jail....
0 Votes
+ -
Suppose the hackers you bring in are the ones you want to keep out? Hmm...
0 Votes
+ -
@gitwut I guess the old fashioned job interview would need to be employed first. This completely removes any possible threat to you so long as you admit that you need to figure out how to see just how much a liar that is too destructive really is not that good at keeping up the front. Then again, this also depends upon what your personal definition of "keeper" vs. "useful but not without risk". The ugly hackers don't really like working at regular jobs where they have to hide themselves away from home.
0 Votes
+ -
Yeah, it's OK to hire hackers, unless they are political fanatics. Anonymous is a political group, hacking it's just the way they express their points.

There are other hackers who just hack because they can and for the rush.
0 Votes
+ -
@luiselizondo You just made two statements that belittled hackers, and decidedly so.
0 Votes
+ -
When one is dirty, he/she is dirty to the core nowaday and can always get away with it. I am no hacker, but it's stereo type to assume a hacker is bad. How do one thinks when the first AV company started? People like hackers can easily think out of the box, but how many normal joe can do that? probably not many, I suppose. Maybe one should worry about the script kiddies, because many of them probably don't even understand the level of impact the tools where were/are using, (i.e. the DDOS Canadian kid while back). One should not belittles hackers b/c it just only say that person is jealous or even worst -- incompent.
0 Votes
+ -
RE: Hire hackers to catch other hackers?
webmasters Updated - 30th Sep
I think hackers are modern pirates which killed mostly 16. centuary. Internet is a new sea for pirates. We can estimate hacker will not alive too long.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix