Was Stuxnet a work of hackers?

My friend Jay Maynard has successfully incited me to blog by asking me the following question: “Would you call the perpetrators of the Stuxnet worm `hackers’, rather than crackers”? He’s actually raised an interesting question of definition, culture, and ethics, and I’m going to tackle it.

The factual background: The Stuxnet worm takes over a particular make of Siemens programmable industrial controller and does things to it the exact nature of which are undetermined, but which are highly unlikely to be good for whatever the controller is running. Once in place, it can be remote-programmed from a control machine. It appears to have targeted the industrial infrastructure of Iran. Code analysts believe the development and test time required to field Stuxnet would be 2.5 to 5 man years of full-time work by a well-funded group with access to test hardware. The worm continues to spread in Iran; the Iranians deny that it has damaged any government systems, but are offering big bucks to any security experts willing to help them clean it out.

Well-grounded speculation: It is widely believed that Stuxnet was aimed at the Iranian uranium-enrichment plant at Natanz and the nuclear power plant at Bushehr; experts have described it as clearly a “directed sabotage weapon” aimed not at normal criminal purposes such as spamming, phishing or intrusion blackmail but rather at causing physical infrastructure damage. The development effort was probably beyond the sustained funding capability of entities smaller than a large multinational or nation-state; the most obvious candidates are Israel and the United States.

For the purposes of this post, I am going to assume all these speculations are correct. I will further assume that actions which delay or halt the acquisition of nuclear weapons by Iran are a good thing, if only because they lessen the likelihood that the regime will actually be able to make good on its threats to execute a genocide on Israel.

Jay’s question is whether I think the programmers who wrote this code fall within the semantic field of the term “hacker”, and if not, what would I call them? Crackers? Jay clearly does not intend this merely as a question about my personal preferences, but as a question about how the hacker community defines itself in relation to large ethical issues: is it ever correct for us to use our abilities in such an attack, or should hackers adhere strictly to a rule of doing no harm?

I am by no means the hacker community’s only tribal elder. But I am one of them, and it is thus fair of Jay to ask the question and within my duty to attempt an answer.

Generally, I and others confer the label “hacker” only on people who build things that are useful or aesthetically interesting, and deny it to those who break things (or break into them). We dismiss people who merely exploit security vulnerabilities as “crackers”. A typical cracker trick relies, for example, on system administrators failing to change default passwords programmed into a router.

Hackers recognize the existence of a subculture of crackers distinct from our own; an important marker of the difference is that, in contrast to our open-source ethos, crackers keep their methods secret and use pseudonyms intended to hide their identities. We consider the members of that culture to be generally inferior to us in both technical skill and ethics – they couldn’t create something like (say) the Linux operating system, and would have little desire to try. The activities we primarily associate with crackers are vandalism and crime – spamming, phishing, data theft, and instrusion blackmail.

We know that many hackers could be extremely effective at cracking, but choose not to do it because they have better uses for their time. My own experience includes instructive examples. In the late 1980s I cracked into some systems on a Sun network where I was a guest – and promptly sent the system administrator mail as root explaining the hole and how to plug it. A few years later I broke some very trivial security on a real-estate database so that my mother (a licensed real-estate agent) could access it from a home PC rather that having to drive to the dedicated terminals at her firm’s offices. Most senior hackers could, I think, tell similar stories. But hackers don’t think of cracking as a primary skill, nor do we go looking for targets in the absence of a specific impediment to getting actual work done, and we have a strong ethos of not doing harm with the cracks we find.

These categories are further complicated by the fact that some sorts of cracking do both require real creative skill and contribute to the general good. The recent reconstruction of the HDCP master key, for example, must have required serious programming skill and mathematical analysis. By once again demonstrating the futility of DRM, it impedes the ongoing effort by the music and film industries to abolish fair-use rights and cripple general-purpose computers in order to prop up their failing business models. It supports the right of consumers to control and tinker with all the hardware they own.

Many hackers (I’d dare to say “almost all”, actually) consider the elements of the media industry pushing DRM to be gangsters, thieves, and enemies of liberty. We would be willing to consider whoever cracked the HDCP master key a peer in technical skill, and allow that he/she/they probably had motives reflecting the hacker ethos – after all, the crack was publicly released rather than privately exploited for criminal gain. The anonymity of the release is not quite good form by hacker standards, but excusable in light of the fact that the gangsters would certainly use the courts and law enforcement to attack the responsible person(s) if self-identified.

Tentatively, then, hackers might be willing to describe whoever broke HDCP as a hacker – the skill and the ethical commitments required seem to be present. The only hesitations we’d have would be about mindset and shared culture. Before conferring the honorific, we’d really prefer to know that the person laughs at hacker humor and shares the traditions we do. Not that this is a huge barrier, it’s not like there’s a lodge-pin or secret handshake, but it’s there. A good test for that cultural continuity is this: anybody who wouldn’t feel honored by being called a hacker almost certainly isn’t one.

In two important ways, the Stuxnet worm is like the HDCP crack, with bigger stakes on the table. Stuxnet is an extremely sophisticated and capable piece of software, not the sort of thing we think of crackers as being able to produce. And there are not many imaginable good outcomes larger than preventing a nuclear genocide. On the other hand, Stuxnet is unlike HDCP decryption code (which you could use to back up encrypted video) in that it has no constructive use. One does not commonly break into industrial plants in order to improve their process efficiency!

Stuxnet becomes a still more challenging case if we accept the speculation that it was created by a national military or intelligence establishment. I don’t doubt this, myself, and in particular I’d say the style of the operation has Israeli fingerprints all over it. Bold covert operations striking from unexpected angles have been a trademark of Israeli statecraft and warmaking since 1948. My bet would be that the most obvious speculative scenario is the correct one: Stuxnet was an Israeli project with U.S. approval and technical assistance.

The problem with this is that hackers do not in general handle the demands of operating in a military or spook shop very well. Even when there is no political clash, there’s a psychological beard-vs.-crewcut one; we tend to have strongly internalized personal ethics and not do subordination very well, and we don’t like secrecy. Thus, hackers in general don’t find it easy to imagine that they might have peers in the basement of the Pentagon or its Israeli equivalent.

What Jay is pointing out with this question is that we really don’t have good language or categories for edge cases like these. Furthermore, this absence is not a mere gap in language; it reflects troublesome issues of ethics and identity. Which is in turn why it’s not silly for me to be writing about it.

If we call the Stuxnet crew “hackers” we do two questionable things. First, we make an assumption about their cultural attachments that may not be true. Maybe they’ve never laughed at RFC1149! Second, we extend the honorific “hacker” to those who create software for destructive purposes. Yes, there’s the argument that preventing nuclear genocide is a constructive purpose, but there’s an obvious slippery slope here that I think many hackers would be reluctant to go near.

On the other hand, “cracker” doesn’t seem quite adequate either. Stuxnet is too clever for that. I think our community would also be reluctant to put people motivated by a desire to prevent their country from being A-bombed into radioactive slag in the same bin with people who break into websites to steal credit-card data.

I don’t think I can justify labeling the Stuxnet team as hackers based on the present state of my knowledge – but I can also imagine having a fifteen-minute conversation with one of them that would change my mind about that.

In professional security circles, where the term “hacker” is often sadly abused and misused, they often speak of “white hats”, “black hats”, and “gray hats”. This is a reference to old Western movies in which stereotypically villains wore black hats and good guys wore white ones. When Jay telephoned me about this question, the least bad approximation I thought I could come up with for the Stuxnet team was “white-hat crackers”.

That will do for now, I think. The important thing is not to quibble over labels but to understand the ethics and value issues behind the labels.

UPDATE: I should clarify that if I had been personally asked to work on Stuxnet on the premise that it was the least violent way to stop an Iranian A-bomb from happening, I would have accepted instantly and felt it was in conformance with hacker ethics to do so. However, I recognize that other hackers might consider creating destructive software to be unethical regardless of purpose, and therefore do not project my judgment on all hackers.

122 thoughts on “Was Stuxnet a work of hackers?

  1. Good analysis.

    Re: “but there’s an obvious slippery slope here”

    I wonder if the usual (brainless) suspects will show up to explain that “slippery slope” is a fallacy and no such thing can exist. Ever.

  2. Is Iran the primary user of these Siemens controllers? The real target could be elsewhere in the world, or the target could be Siemens itself. The assumption that Iran is the target is a pretty well reasoned assumption- especially given Israel’s defense needs in the midst of the craziness that is international politics- but it is currently still an assumption, and I can’t help wondering who profits if Stuxnet starts popping up elsewhere in the world.

  3. I know several white-hats, and while most would definitely give me a blank look after pointing them at RFC1149, there are a couple that would crack a grin.

    I guess I would say that there is some intersecting subclass of Crackers that are also Hackers, and I would further say that only White-Hats would qualify because of the ethical issues involved. A good example is perhaps Bruce Schneier. These tend to be the folks that the military, CIA, NSA, etc. are REALLY looking for, because they come with the in-built tools that allow them to find the cracks intuitively and the ethics necessary to make them trustworthy.

    Just my $0.02.

  4. >I can’t help wondering who profits if Stuxnet starts popping up elsewhere in the world.

    While this is an interesting question, the ethical question Jay wanted me to examine is most pointed if we assume Iran was the target.

    Besides, the distribution of known infected sites suggests that it was.

  5. Michael> …“slippery slope” is a fallacy…

    Of course it’s a fallacy, how else can they lead you to the ocean and make you drink.

  6. What caught my attention about the whole affair is that this is a clear case of hackers – or whatever – using their talents to directly affect real-world outcomes in an area where the Right Thing from a real-world ethical standpoint requires tools and techniques and mindsets of those who Do Wrong. I’m no friend of slippery-slope arguments, and in this case I think there’s a fair amount of sand on the slope; consider the opprobrium that DDoS attacks on the RIAA and SCO were met with.

    To me, the question is one of ethics, and where it lies in relation to thorny questions in the real world. I thought it was nontrivial enough to rate further discussion.

    I would also accept another hacker’s refusal to participate in such an attack as being within the norms of the community. There’s a lot of room for honorable disagreement.

  7. Good article. Minor quibble — I don’t think the Israelis would have required U.S. “technical assistance” in this endeavor.

  8. >I don’t think the Israelis would have required U.S. “technical assistance” in this endeavor.

    Required, perhaps not. But by at least some accounts the line of industrial controllers at issue was sold to Texas Instruments a few years back. This suggests that U.S. assistance would have been helpful in, for example, getting access to the sources for the microcode.

  9. Hrm. That’s an interesting thought, especially when you consider TI was and is a major defense contractor with a long history of helping the US’s military objectives. The corporate culture there would be especially conducive to such assistance. In particular, the kind of Brie-eating bicoastal liberal who would wring their hands at any such action by the Israelis is in extremely short supply at TI.

  10. >Could it not be the work of Iran’s own citizens?

    Just barely possible, but I think highly unlikely. If Iran grew enough people with the right skills the Iranian government wouldn’t be offering large inducements to foreigners to come fix the problem.

  11. Even if Natanz was the primary target, the Stuxnet authors may have been perfectly happy to have Siemens itself as a secondary target. A warning to others that technology sold to Iran is likely to be the target of a broad-based attack was likely thought an entirely desirable secondary outcome.

  12. To look at the end result another way, this is far less traumatic and damaging than a conventional military attack against either facility. Sure, it’s not going to permanently stop them from building a reactor or a bomb, but it might lead to enough of a disruption in the regime that the freedom movement manages to oust the mullahs and Achmadinejad.

  13. >To look at the end result another way, this is far less traumatic and damaging than a conventional military attack against either facility.

    That’s true, and it makes the ethical question more interesting. Is a hacker required to do no harm, or is acceptable to minimize harm when the alternative ways of thwarting the regime probably imply a lot of violence and death?

    My own answer is that I think minimizing harm is not only acceptable but ethically required of me. However, as Jay says, pacifist refusal is well within community norms.

  14. This issue brings to mind Orwell’s “Men sleep peacefully in their beds at night because rough men stand ready to do violence on their behalf.” In many cases, those violent men are trained in firearms, but the use of a fire arm is a morally neutral skill. It seems that hacking and cracking are munging the moral evaluation of the outcome of applying the skill.

    It would seem that we have vocabulary for the skill, but need to import or create vocabulary for the outcomes.

  15. One avenue of thought that hasn’t been explored here is that this just has to be bad because those evil Israelis are behind it. And no self-respecting hacker, of course, would want to help /them/.

  16. Anyone who’s interested in Stuxnet should read this:

    http://www.cs.columbia.edu/~smb/blog//2010-09/2010-09-27.html

    And then for more information, read these:

    http://www.wired.com/threatlevel/2010/09/stuxnet/
    http://www.informit.com/articles/article.aspx?p=1636983
    http://frank.geekheim.de/?p=1189

    I can state for a fact that there are Members of the Community of Hackers in the US white-hat community, but not as many as you might hope. Don’t expect me to answer any other questions about it.

    Hmmm … should it really be called the Community of Hackers, or would Commonwealth of Hackers be more appropriate, for those of you who’ve read Silverlock?

  17. >It would seem that we have vocabulary for the skill, but need to import or create vocabulary for the outcomes.

    That is, perhaps, what I was groping for when I said “white-hat cracker”.

    But I don’t entirely agree with your premise, because while hacking and cracking considered as sets of skills may be value neutral, the cultures that have accreted around them are not. It is a fact that hackers spend most of their time building useful and beautiful things and giving them away to the world. It is a fact that the cracker culture is equally invested in criminal tresspass, vandalism, espionage, and theft. These facts are not ethically neutral.

  18. >And no self-respecting hacker, of course, would want to help /them/.

    You’re being sarcastic at the expense of Israel-haters, I hope. In any case, Israel is plenty capable of growing its own hackers – probably as good as your average G8 country, if the truth be known.

  19. >These facts are not ethically neutral.

    Definitely not. But the logical end point of that way of thinking begins to look like “All hackers work for [socio-ethno-cultural-tribe], and all crackers work for [the other].”

    I think that what you are getting at is that certain skills are only fomented in a creative, responsible environments, while the desire to inflict harm / damage keep certain skillsets (or levels of experience) out of reach. That is true based on my experience in aggregate, but there is plenty of anecdotal evidence of counter examples. Anti-paladins could go to level 40 too.

    The next step to that is that those creative, responsible environments are more prevalent in moral, responsible cultures. But the fact is that moral, responsible cultures must at times engage in violence to protect themselves.

    White hat crackers is fine, in other words, but it is intentionally ignoring the coherence of the terms in the first place. I think that this term is blind to the moral issues involved in the act itself; that is, that a western power performing an act of self defense is not an act of cracking at all. It comes back to intentionality of the act itself, rather than the skill set.

  20. Very possibly not “hackers”, very likely not “crackers”, but surely there’s room for “none of the above” who are nonetheless able to put together some nice code? Some of the code on the Apollo lunar lander was pretty sweet – it had to be to tuck into such a little pocket- even if written by *very* crewcuttish kinds of guys.

    IOW, not everyone who can lay down a good hack are hackers by your definition.

    My opinion only, your mileage may vary.

  21. The world’s a big place. Turns out there are many excellent programmers who couldn’t care less is someone else considers them a hacker, who have no trouble with subordination as long as they’re treated reasonably well and given interesting problems to work on (and Stuxnet is nothing if not interesting), and share very little of your “hacker” culture.

  22. > You’re being sarcastic at the expense of Israel-haters, I hope. In any case, Israel is plenty capable of growing its own hackers – probably as good as your average G8 country, if the truth be known.

    Correct. Thought it was obvious.

    But my point was that there some who would decide the ethical question on that basis … helping the Israelis avoid nuclear annihilation is bad, doing same for some in-vogue favored group would be good. Not all hackers are clear-headed thinkers when it comes to questions outside the realm of vi vs emacs.

    Now, if the Iranians were to make a credible offer to wipe out our bi-coastal elites …

  23. > Michael> …“slippery slope” is a fallacy…

    > Of course it’s a fallacy, how else can they lead you to the ocean and make you drink.

    Slippery slope is a logical fallacy, but it is a useful empircal heuristic, like lot of logical fallacies.

    Yours.
    Tom

  24. >IOW, not everyone who can lay down a good hack are hackers by your definition.

    That is true. People who can lay down a good hack but don’t have the cultural markers of hackers (like laughing at RFC1149) are kind of a problem for us – we tend to think we ought to consider them hackers on merit but have difficulty feeling that way. Fortunately for our composure, we are very good at assimilating such people, so the problem tends not to persist :-)

  25. I have a passing familiarity with the Siemens PLCs in question, having worked at places that used them. (These are fairly common controllers; any place that does light manufacturing or small-run fabrication of any kind is likely to use them or something like them.)

    Based on the descriptions of the worm and, specifically, the attacks used, it sounds like the worm does not infect the controllers themselves per se, but infects the PCs used to send commands to them, which generally run Windows. Living on the PCs, the worms can then send commands to the PLCs in order to make them do, well, whatever.

    (The “cure” should be obvious enough to anyone with enough technical skill — I won’t mention it here lest Iranian officials are monitoring this forum, which I consider at least somewhat likely.)

  26. The “cure” should be obvious enough to anyone with enough technical skill

    Are you sure? The reports I saw said that Iran is trying to get outside technical expertise to clean things up because their own homegrown experts can’t fix it. I can’t believe they’re all that st00pid.

  27. I’m gonna show my ignorance of the talent pool here and ask the obvious question: how difficult would it be for the US military to grow an offensive cyberwar capacity, as demonstrated here, from talented recruits?

    I’m not sure which is the more difficult problem: finding and developing talent in a known-friendly pool as determined by the ASVAB, or recruiting ideologically reliable/friendly talent from a civilian sector known for its antipathy to the military and authoritarian systems.

  28. Um, reasonably sure. After re-reading one article, I believe I misspoke: the worm does infect the PLCs, but its attack vector is definitely the controlling PC. Come to think of it, the ease of cleaning it up would depend a lot on how adequate their, um….maintenance policies are.

  29. > how difficult would it be for the US military to grow an offensive cyberwar capacity, as demonstrated here, from talented recruits?

    IMHO, easy. Or at least there would be no shortage of candidates to interview. You don’t necessarily need hackers; you need competent, motivated, trustworthy individuals.

    > I’m not sure which is the more difficult problem: finding and developing talent in a known-friendly pool as determined by the ASVAB, or recruiting ideologically reliable/friendly talent from a civilian sector known for its antipathy to the military and authoritarian systems.

    I’m neither a textbook example of what Eric would label as a hacker and I probably wouldn’t be at the top of their recruitment list. (But I’ve worked on lots of stuff similar to the Siemens PLCs and related.)

    For many of us, antipathy to authoritarian systems does not translate to antipathy toward the military. The military is authoritarian by necessity and by its nature. For it to be otherwise would be for it to cease to exist. I reserve my antipathy toward civilian governments that should be the opposite of authoritarian but usually aren’t. And the corporatists that are frequently their partners-in-crime.

    Work with the military on some very interesting stuff that will be hurled at a regime that totally deserves whatever we can deliver? Sign me up.

  30. This is a very old ethical issue, going right back to Archimedes building seige engines for the Syracuse panjandrums, and in modern times, culminating in the Manhattan project.

    The Athena worshiper gives the Mars worshiper some new tech to solve a short term crisis but worries about increasing the power of the crew cut irrational maniacs who point the guns and pull the trigger.

    It’s one of those Thorny Problems, that results in what I call Chaotic Morality. An ethical conundrum which can’t be solved in advance, only on a case by case basis, since microscopic details of a particular situation can swing the whole decision one way or another.

  31. It seems to me the problem is the skill set is conflated with the culture or personality of the person employing it. If we take the very basics of your definitions we get that the skill set of hacking is using computer skills for construction, where the skill set of cracking is using computer skills for destructive ends. By disassociating the skill with the culture, we can then apply descriptors and other words to define the culture in which the skills are employed, similar to the end result that you have reached. So you and others in your position might be defined as “hobby hackers”, where as the employees of Red Hat or even Microsoft would be “professional hackers”. The virus writers and spammers might be described as “rouge crackers” or “criminal crackers” and security researchers and testers might be described as “professional crackers”. That means for the folks behind the crack in question, we might call them “government crackers” or “military crackers”, and for say the folks at NASA making lunar landing modules, we would call them “government hackers”.

    Our language is descriptive enough that we needn’t tie skill sets and culture together with a single word.

  32. What Jay is pointing out with this question is that we really don’t have good language or categories for edge cases like these.

    Maybe you are trying to shove them into the wrong taxonomic niche? We could call them “proto-hackers” or “hacker-analogues” (hackalogues?).

  33. Someone who ‘cracks” is also contributing to the evolution of security and progress. If it is not a victim-less action, it probably carries some civil and/or criminal liability. The moral judgment is irrelevant to me as a scientist.

  34. Btw read the article “Cybergeddon: the coming Sino-Anglo showdown” written by a hacker who got into the national security field after 9/11. I think his email is in the article, otherwise I can put you in touch…

  35. >For many of us, antipathy to authoritarian systems does not translate to antipathy toward the military. The military is authoritarian by necessity and by its nature.

    As both a student of military history and science and a hacker cred certification authority :-), let me say that the culture clash is not a simple one. I agree with you that the military is authoritarian by necessity. Speaking as an anarchist, I even recognize that military culture is so well adapted to a few kinds of dirty but necessary jobs that it would probably survive the death of government as we know it (and end up on retainer to insurance companies, but that’s a whole different discussion which we will not have in this thread).

    My point is that it is not entailed in hacker ethics that one has to hate the military for being what its functional constraints require it to be. It makes more sense to hate organizations that don’t have to be authoritarian but are anyway. As long as there’s no draft, the ethical status of the military is a consequence of who it’s aimed at and what it actually does, not what it is.

    That said…there’s still a serious culture clash. If I were offered a job with the military bringing the smackdown to a regime that totally deserves whatever we can deliver, I’d be tempted myself. But only as a civilian contractor who could resign if ethical alarm bells went off. Putting me in uniform and under orders would not end well for either me or the military. I think that could be predicted of most hackers.

  36. I wrote: “If I were offered a job with the military bringing the smackdown to a regime that totally deserves whatever we can deliver, I’d be tempted myself. ”

    Well, or if they offered me a gig as an unarmed-combat instructor. That could be tempting too. :-)

  37. Since you’re tackling tough ethical issues in this post, I would remind you that many hacks and cracks today are highly sophisticated and often times it is difficult to foresee, with certitude, the eventual outcome. Even the act of exposing an software vulnerability for the purpose of plugging a hole can sometimes have unintended consequences. It’s not always easy to know what is benign and what is destructive. If a hacker inadvertently causes harm, can he still claim the ethical high ground? If all that matters is your intention, then is the club really that exclusive?

  38. Hi esr,

    this is a great post… I ever read RFC1149 before, now i do and i felt from the chair laughing (“[...] loss of a carrier can be tolerated. With time, the carriers are self-regenerating. [...]” X-D)…
    (I’d like to be but) I’m not a hacker so take this one with a grain of salt: experts said Stuxnet should be updated remotely and what if the contractor point out with “i pay you, bunch of hackers or whatever you are, tons of money to make a software that lurks in Siemen’s forest; it has to be remote programmable and when you’ll do it, you’ll tell my men how to do that… then you could take your vacation to hell!”.
    This scenario is a bit foggy (and a bit extreme), because those hackers, or crackers, or whatever don’t know what’s the software’s purpose (supposing that “remote programmable” gives a lot of freedom on it), so their ethic-half couldn’t know if it’s right or wrong… this could lead a “hacker” to take the job, perhaps on the other side a more paranoid (in the good way) hacker don’t.
    In other words i think that only knowing the clarity level that those _authors_ have about the job could tell us if they can be called hackers, crackers, mercenaries or something else.
    I really enjoy reading your explanation on “hacker vs. cracker” (enlightening every time ;-)), and of course the RFC1149 :-D…

    Cheers,
    Alessandro

  39. @ Jay Maynard
    > the kind of Brie-eating bicoastal liberal

    Forgive the OT digression … But what on earth do you (and Eric) have against soft cheese?

  40. >If a hacker inadvertently causes harm, can he still claim the ethical high ground?

    Nobody ever has that certainty. Every act is an ethical experiment, with correctness measured not by intention but by outcomes.

    The rule of doing no harm, whether it’s expressed in religious form such as the doctrine of ahimsa or more secular ones like the Hippocratic Oath, isn’t a demand that none of your actions ever cause harm – that would be an impossible standard. It’s a requirement that (a) you not intend harm, and (b) you do what any reasonable person would to avoid unintentional harm.

    >Even the act of exposing an software vulnerability for the purpose of plugging a hole can sometimes have unintended consequences.

    True. So, your decision about exposing the hole has to pass the reasonable-person test about infliction of unintended harm. That means using the practices that have been shown to minimize harm in the past. When the entity responsible for the software has a history of being responsive to security defect reports, private disclosure followed by a timeout and public disclosure seems to be the best policy. When the entity is unresponsive, immediate disclosure and public shaming seems to work better.

  41. It’s an interesting category. I’m inclined to suspect that the developers of projects like Tor and Freenet are, if not within its boundaries, at least hanging out near the edges. Or maybe Stuxnet is hanging out near the edges of Tor.

    I note Tor was originally developed by the military, which strikes me as strange, considering the values that it reflects, supports, and to some degree implements.

  42. I’ve go nothing against Brie. In fact, the store here used to have a pre-made baked Brie en croûte (toss it in the oven, bake, serve) that I loved, and I wish they’d bring it back.

    My ire is reserved for the kind of elitist liberal infesting the east and west coasts of the US that , stereotypically, eats Brie on tiny crackers at parties while sipping their oh-so-genteel martinis and discussing how best to run the country without reference to little details like the Constitution.

  43. IMHO, easy. Or at least there would be no shortage of candidates to interview. You don’t necessarily need hackers; you need competent, motivated, trustworthy individuals.

    Judging by the quality of the military’s IT security staff, I’d say it would be harder than you might think. The Air Force already <a href="http://en.wikipedia.org/wiki/Air_Force_Cyber_Command_(Provisional)"tried this with AFCYBER and failed at least once.

    You’re right that they wouldn’t need hackers, but a recent news story I read on Slashdot (which I am not going to link because that’ll increase my link-to-post ratio too much, but googling it shouldn’t be hard) said they won’t be using techie civilians, either. They’ll train combat soldiers on tech rather than teach military tactics to a bunch of geeks. That really shouldn’t surprise anyone familiar with the military, however.

  44. This is an area that is going to be crucial in the future, unless we never succeed in creating the nanobots-in-the-bloodstream world of Science Fiction. This is one of the reasons that I have so many misgivings about some of the Utopian visions that some have for nanobots curing all disease, prolonging life, etc, etc.

    Both L. Neil Smith and John Ringo have used the altered implant/nanobot as a plot device for brainwashing a saboteur – if you could brainwash your enemy’s army, you wouldn’t have to field your own.

    Most hackers ignore the security aspect of programming. This is understandable, and unfortunate. How will we keep future dictators from using computers and viruses against the masses?

    Would you let a surgeon implant a chip in you if it was manufactured by Sony? Given their history of stealth spyware on CD’s, I would hesitate unless they were the only supplier and it was life or death.

    How about the DOD?

    Just who could you trust with the power to literally change your mind?

  45. esr, you are using the wrong ethical paradigm. Among those with the relevant technical proficiencies, hackers are Chaotic Good, crackers are Chaotic Evil; the (putative) stuxnet creators are Lawful (or Neutral) Good, while the mullohcrats’ minions are Lawful Evil…

    Slightly more seriously, no one here seems to be considering the possibility that the Israelis might actually be cooperating with the Germans. Their spies are reputed to be low key but quite proficient; Germany, the land of bratwürst and Siemens, is also keen on curbing Iran’s nuclear enthusiasm, and has far more access than the US due to being Iran’s largest Western commercial partner.

    Lastly: esr, do you have any direct corroboration about Iran’s search for outside talent to sort out this (putative) mess? I ask this only because the various instances of this claim I’ve seen seem to have originated in Debka, and I haven’t been able to trace this claim to anywhere else that offers supporting evidence. Would love it to be true, of course.

  46. How about the ethics of cyber warfare, where hackers could presumably be conscripted as frontline warriors? Do you become a conscientious objector or go all in and fight to the death?

  47. I think that the comparison to the Manhattan Project is apt. It points out a difference between Stuxnet and what I gather is an important part of the whole Hacker Culture Thing (you can all gang up on me if you think that I’m wrong) in that people are motivated to do hacker projects because they think that they will be interesting and FUN TO DO.

    That’s got to be lacking here. Everything is a secret. Stuxnet programmers were probably kept in the dark about the rest of the team (as much as possible). No credit for their work can ever be given. I think that most hackers would suffocate on that job, and the recruiters for the project probably chose their programmers accordingly.

  48. >Forgive the OT digression … But what on earth do you (and Eric) have against soft cheese?

    Jay put it pretty well. I will note that I in fact can’t stand fermented cheeses – they make me ill.

  49. >I ask this only because the various instances of this claim I’ve seen seem to have originated in Debka, and I haven’t been able to trace this claim to anywhere else that offers supporting evidence.

    You’re ahead of me – I heard it relayed through Jay Maynard, who generally shows good judgment about stuff like this, and didn’t know all such reports were sourced from Debkafile. For that matter, Jay may not know that if he heard it from secondary sources. Debkafile is…flaky.

  50. >Do you become a conscientious objector or go all in and fight to the death?

    Well, I actually think this is a silly scenario. There are some kinds of talent you don’t try to conscript, because they don’t work worth shit if they’re not self-motivated and measuring their quality of results is very difficult at the best of times, let alone under conditions of wartime uncertainty. Hackers are like that.

  51. I phrased my question regarding cyber warfare poorly.

    Assuming a hypothetical existential war (e.g. nations vs. nations, earth vs. hostile galactic aliens, etc.) and its all hands on deck at the Alamo, do you have any qualms about joining the battle with deadly intent? It is likely that a lone cyber warrior can be far more disruptive and deadly than conventional military units, even given the advanced nature of weaponry.

  52. >Most hackers ignore the security aspect of programming.

    Huh? Maybe you need to hang out with a better grade of hacker. I’m not saying all the hackers I know are security experts, and I’m not one myself. But I don’t know a single one that takes such issues lightly.

  53. I heard it relayed through Jay Maynard, who generally shows good judgment about stuff like this, and didn’t know all such reports were sourced from Debkafile. For that matter, Jay may not know that if he heard it from secondary sources. Debkafile is…flaky.

    I got it from Slashdot, and clicked through to read it at Debkafile. I wasn’t aware that that site’s not regarded as anything approaching authoritative.

    That said, I think the ethical question is interesting enough that it warrants discussion, independently of the actual facts at hand. I happen to think ti’d be nifty to have a hacker army taking down the mullahs in a way nobody else could. For that matter, is the story that implausible?

  54. >Assuming a hypothetical existential war (e.g. nations vs. nations, earth vs. hostile galactic aliens, etc.) and its all hands on deck at the Alamo, do you have any qualms about joining the battle with deadly intent?

    In that case, no. You muddied the waters by bringing in conscription.

    The premise that the war is existential does change the calculations somewhat. In the Iran case, Israelis have good reason to believe they would face an existential threat from an Iranian A-bomb. A pacifist American hacker could justify not participating in a cyberattack on Iran and be within hacker-community norms, but I also don’t think hackers would be very patient with anyone who condemned an Israeli hacker for making the opposite decision.

  55. >I wasn’t aware that that site’s not regarded as anything approaching authoritative.

    Debkafile has a checkered history. Sometimes they scoop everyone else; sometimes they publish wild stories that turn out to be false. The last I remember in the second category was breathless stuff about an imminent coup in Syria that never happened.

  56. I also don’t think hackers would be very patient with anyone who condemned an Israeli hacker for making the opposite decision.

    And in this case, the notoriously short fuse of a good chunk of the hacker community might well get microscopic. The resulting flamewar might well be of epic proportions.

  57. May I suggest a third likely suspect: Germany.
    Perhaps the German government felt compelled to allow Seimens to the controllers to Iran, despite the obvious drawbacks. This may have been necessary to secure an oil deal, or the jobs/foreign currency may have been considered essential; perhaps the Germans didn’t want to participate in an American-led boycott, for reasons of politics internal or external. Maybe Seimens is just too powerful for the German Government to block their trades. Who knows? But if the Iranian nuclear program ever developed nuclear weapons — even if there were never used — Germany would take a hard hit to their reputation, which they have been slowly but steadily repairing since April, 1945. Germany too just such a hit in 1972, when the Israeli Olympic team members were murdered on German soil — less than 30 years after the end of World War II, Jews were again murdered in Germany. (I remember much speculation among my Jewish friends, then and later, that the PLO killers “had a deal” with Germany, or at least expected that they could operate there with impunity. This was reinforced when Germany let the surviving terrorists go in a hostage exchange.) Imagine what the world community would say if Tel Aviv was vaporized in a nuclear attack. Don’t forget that unreconstructed Nazis built rockets and other high-tech weapons for Egypt during Nasser’s rule, before the 1967 War. The German government was sharply criticized for allowing the scientists, engineers and ex-soliders working for Nasser to travel back and forth from Germany to Egypt freely, and for further allowing them to draw upon the resources of the resurgent German industry.
    So the German Government has a motive to cripple the Iranian nuclear facilities. “We take your money and shake your hands over the table, but we take back what we sold you under the table.” Germany has all the resources of a technically-advanced nation and has done a few things in software. (Evidence: SAP). With direct access to the Seimens technology, INCLUDING THE CODERS WHO WROTE IT, the job would be a lot less than 2.5 man-years of effort. (The entire reverse-engineering stage could be skipped. The coders would also know which bugs they never fixed.) Everybody wins: Seimens gets their money, the German economy gets a boost, the oil keeps flowing, German diplomacy isn’t hindered and the nuclear facilities never go operational. Well, of course the Iranians lose. It’s everybody else who wins.
    This doesn’t have to be something the management at Seimens necessarily knew about it advance. It is even possible that the government spooks responsible for the sabotage didn’t inform Seimens upper management. The whole thing could be put together with just the guys in the trenches. The suits could be kept in their usual suit-based state of ignorance.
    To my knowledge, no one has yet pointed out another potential achievement of the Stuxnet worm: the people who go to Iran to fix the problem will presumably have wide-ranging access to the Iranian nuclear facilities as they ARE, not as the published designs portray them. If Iran is indeed building a weapons program, they will be extensive mods to their facilities, especially in control software. (Uranium enriched to the weapons-grade level is very different from uranium enriched for power plants. The processes for making it are not identical.) The Stuxnet disaster potentially gives the world an opportunity for an inside look at the plants Iran actually built, as opposed to the plants they announced they would build.)
    Frankly, if I were the head of German Intelligence, I would cripple every bit of nuclear technology my country sold.

  58. >I happen to think ti’d be nifty to have a hacker army taking down the mullahs in a way nobody else could.

    Been there. Done that. Have the death threat.

  59. “…Many hackers (I’d dare to say “almost all”, actually) consider the elements of the media industry pushing DRM to be gangsters, thieves, and enemies of liberty….”

    …and they would largely be wrong, as most half-assed ‘adolescent’ whingers tend to be.

  60. I got it from Slashdot, and clicked through to read it at Debkafile. I wasn’t aware that that site’s not regarded as anything approaching authoritative.

    I’ve never heard of it before. The site’s creators claim that 80% of what they publish turns out to be true. Doesn’t seem unreasonable to me, given what they cover.

  61. So, we have established that there are circumstances in which it would be ethically acceptable to use hacker mojo to deploy software with potentially deadly consequences (aka an existential threat via major warfare). This sounds like the moral and ethical dilemmas faced by scientists working on the Manhattan Project in WWII. For example, what if the Stuxnet worm inadvertently infected and compromised life support controls at a hospital outside the war zone?

  62. Back on topic : I think your confusion stems from the insistance that the term ‘hacker’ should convey some paladin-like quality.

    Personally, I think the semantic war has been lost, and it’s rather qaint/pathetic to cling to the term ‘hacker’ – get over it : hacker = criminal…at least for now.

    Nevertheless, given that the hypothetical people involved may well have been acting from a desire to thwart evil, and needed to devise a cunning plan to do so…their ingenuity and morality would place them firmly in the realm of ‘noble hackers’.

  63. @John Woodward:

    Germany sounds sounds far-fetched. And your evidence that Germany has technical excellence is a poor example. SAP is crap. Anyone who tells you otherwise is either making money doing SAP admin, integration, etc., or else is a corporate drone.

    I’d point out KDE as better evidence that Germany has good software engineers, but, um, well, the last version of KDE that actually impressed me was 3.0 or 3.2 or something.

    Additionally, the idea of Siemens being a German company is more than a bit outdated. Siemens is a huge multinational conglomerate whose world headquarters happen to be in Munich. The group supporting Iran is in Tehran (according to their website).

  64. >Personally, I think the semantic war has been lost

    The Oxford English Dictionary disagrees with you.

    By some strange coincidence, the OED considers me an authoritative source. :-)

  65. Morgan Greywolf says:
    >>> Based on the descriptions of the worm and, specifically, the attacks used, it sounds like the worm does not infect the controllers themselves per se, but infects the PCs used to send commands to them, which generally run Windows. Living on the PCs, the worms can then send commands to the PLCs in order to make them do, well, whatever.

    (The “cure” should be obvious enough to anyone with enough technical skill — I won’t mention it here lest Iranian officials are monitoring this forum, which I consider at least somewhat likely.)

    Let me take a stab:

    Is the solution…. running Linux boxes instead of Windows?

  66. >>…and they would largely be wrong, as most half-assed ‘adolescent’ whingers tend to be.

    As adolescent(That was not too long ago), I have a very sophisticated knowledge of IP theory. I knew the arguments of the IP opponents like the back of my hand, and hear them for any potential evidence for their side. Of course, I read up lots on theory and evidence of anti-IP folks, which coincidently were often published freely and much more available. I often read the arguments of IP moderates but found them lacking of deepness in understanding that anti-IP folks do.

    Of course, the Austrian school, in particular distinguish copyright and patents as evil, with the exception of copyright contracts(which I agree with on principle) that was advanced decades ago. Now the traditions has apparently reject copyright and patents wholesale. The LvMI site put their content empire under Creative Common Attribution.

    In fact, 99% adolescents have no opinion on IP whatsoever. They would all grow up and learn that pirating is an expensive use of their time, so they pay for it.

    As for me? I don’t recommend “pirating” people’s stuff. That support the enemies of liberty, not pro-liberty businessmen. If at all possible, buy stuff and support these anti-IP businessmen. The more money anti-IP people make, the quicker the death of disgusting behaviors that surround IP.

  67. I don’t think our involvement is necessary. Possible….yes, but not required or even desirable from an Israeli point of view.

    Israel is perfectly capable of using industrial espionage to get needed info from TI or Siemens. It wouldn’t be the first time.

    Murky area. I’m not a hacker but I would avoid it. I have less than no sympathy for the mullahs….but, avoid the spooks. Clear cut ideas of what is going on are almost certainly wrong. Lavon Affair etc….

    Why would an anarchist hacker ever work for the military? Private defensive security pays better and usually avoids many of the ethical dilemmas.

    The military mindset would indeed endure…but only the special kind. That kind is far more compatible with hacker ideas than you might think, and also despised by the obsolete line up and shoot each other “crew cut” crowd.

  68. >The Oxford English Dictionary disagrees with you.

    And I got shouted down by an ignorant bus driver in high school for saying that there are hackers like ESR and that some great programmer really do call themselves hackers. Even the dictionary didn’t help me.

    She have a “computer husband” and worked with programmer before.

    Unfortunately, the old woman who think she knows everything beat down a youngster with a real cultural identity which she think not exists.

    Afterward, I decided it is futile.

  69. @Kiba

    >Afterward, I decided it is futile.

    The only opinions that count belong to your colleagues. Ignore the rest. When it really counts ignore them as well….

  70. @Morgan Greywolf: Of course SAP is crap. But it’s mostly crap because the customers WANT crap. The big companies and government agencies that implement SAP LOVE the idea of top-down authoritarian software that paralyzes the users. That said, KDE was a better example I didn’t think of because all my Linux computers have used Gnome. :-)
    As for Siemens being multinational, yes. But try telling folks in, say, Japan, that GE is “a huge multinational conglomerate whose world headquarters happen to be in Schenectady, New York” where, but the way, The US Gov’t gave their HQ building it’s own ZIP code. Siemens is regarded as German for the same reason GE and IBM are considerd American.
    My original thought was that the German Government chose not to block the sale of the PLCs to IRan. As a matter of fact, I can’t find any evidence that the PLCs attacked by Stuxnet are under any export restriction enforced by the German Government. There are restrictions on something called a SINUMERIK (all caps in original), but I can’t find anything that says a SINUMERIK is involved in the attack. On the Siemens tech support page that explains how to remove Stuxnet. the SINUMERIK is mentioned as a vulnerable product, but it’s listing is at the bottom of the index, under “other mentions.” I don’t think the SINUMERIK is involved in this.
    BTW. the Siemens tech support department has a very detailed page on removing the Stuxnet. It looks like a long job, but not particularly tricky:
    http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=43876783&caller=view
    Speaking as one who has dug out trojans and worms from rootkitted Windows networks (before I got the Word and burned my MCSE — literally; it felt great), this is a lot of time-consuming drudgery, but nothing special.
    Symantic has the best technical explanation I’ve read yet.:
    http://www.isssource.com/stuxnet-attack-an-industry-perspective/

    I still say German is a credible suspect: they have the means, motive and the best opportunity. And I would happily buy a round of Maker’s Mark for all those who contributed.

  71. >Why would an anarchist hacker ever work for the military? Private defensive security pays better and usually avoids many of the ethical dilemmas.

    Agreed, but in the world we have no private security company is going to get paid to take down the Iranian A-bomb project unless as a government contractor, which brings the ethical problems right back.

    When the state-run military is the only possible defense against a threat, I’ll cooperate with it. The goal of liberty is not served if I stand by while my neighbors are killed or enslaved by something worse than the U.S. government.

    >but only the special kind. That kind is far more compatible with hacker ideas than you might think, and also despised by the obsolete line up and shoot each other “crew cut” crowd.

    Presuming you mean “special forces”, I know. I’ve been told by a former U.S. Special Forces officer that they actually collect people like me who are physically tough and psychologically willing to fight but too bright for the regular line military. Not actually a possible life path for me because of the cerebral palsy, however.

  72. @esr

    >Agreed, but in the world we have no private security company is going to get paid to take down the Iranian A-bomb project unless as a government contractor, which brings the ethical problems right back.

    IMHO we don’t need one. The Soviet Union is gone. I would argue mostly from economic and technological pressures. We may have helped some around the margins. OTOH We might have helped prop them up by providing an external enemy. The “our Soviet is better than your Soviet” strategy is starting to haunt us a bit…don’t you think? I don’t see that lasting much longer either.

    Back on point, say that Iran had the A bomb. I don’t think for a moment they would be stupid enough to use it against Israel. Israel could turn them into a glass skating rink and would do so instantly. I think Iran wants a deterrent. Wanting is not getting. Iran is a long way from any ability to create, let alone deliver a weapon. I think they want the NPT honored. I think they want to start up their medical isotope reactor. I think they want a civilian nuclear power program and were willing to work with us to that end regarding fuel processing exchange through a third party nation. I’m not defending the Iranian state, just pointing out this is not a black and white issue.

    I view this as more about Israel trying to maintain absolute regional dominance. Can’t blame them, but in this equation of mice and men we are Lenny. The Turks have a saying about us. You have to watch us; You never know when we are going to stab ourselves in the back.

    I just like to keep in mind that reactionaries on either side of a conflict can do great damage to humanity, even their own “side”. I don’t give preference to a state founded on religion….any, including the enforced absence of one.

    IMHO DPRK, Iran et al will not exist in the present sense in 20 years, even if we do nothing but play containment. At this rate I’m not sure we will exist in the present sense in 20 years. Due mostly to the same trends.

    I understand the urge to go monster slaying…have a touch of that myself. It’s just that our perception of who the monster is may be cloudy at best. Worse yet it may be “hacked”. Once you have firsthand knowledge, it may be too late.

    As to the mullahs gaining control of me or anybody nearby….I’m more worried about the squirrels chewing holes in my house.

  73. @ Jay (and Eric)
    > My ire is reserved for the kind of elitist liberal infesting the east and west coasts of the US that , stereotypically, eats Brie on tiny crackers at parties while sipping their oh-so-genteel martinis and discussing how best to run the country without reference to little details like the Constitution.

    Oh, I see. You were being cute. Is this a little like when Eric refers to “art fags”?

    I’m not sure that “brie-nibbling” or even “brie-eating” is a terribly useful shorthand for the kind of dismissive stereotyping you seem to want to do.

    But then I suppose I would say that – I both nibble my brie and hold views about social and economic policy which you no doubt disagree with.

  74. Eric, I like your examination of the hacker ethic versus military service, but I think it may be too US (and 21st century) culturally biased. Israelis have no choice about military service, so if you’re a hacker and an Israeli then you find some way of combining your obligations with your obsessions. Just look at the mass of security software and solutions coming from Israel to see the outcome of this mixture.

    Looking through a different lens, the military has (or at least had) cool problems to work on, and cool problems are hacker catnip. For sure there are ethical and cultural tensions, but the outcome is a strong hacker subculture within the more straight laced .gov/.mil community.

  75. Do you think that a nedanet style group could grow up in the event of a nuclear strike by Iran to try and prevent further ones via writing and deploying viruses.

    > The Oxford English Dictionary disagrees with you.

    Although the OED includes both definitions, the schematic war has been lost among the general public. I can’t use “hacker” according to esr’s definition in everyday speech, it is too confusing and sentences usually remain semanticly valid and sensical (e.g. “I am a hacker”). I don’t think its feasible for english to contain both meanings.

    The only people who I know physically that know the esr’s definition are ones I’ve told.

  76. TMR – you are, unfortunately, wrong about Iran. Iran’s ruling class knows that a strike on Israel will be the end of them. They don’t care. Their official policy is to destroy Israel, even if it means the end of Iran. As Ahmadinejad has said (paraphrased) “They can destroy Iran, but they will only kill a part of islam, while we will kill all of the jews.”

    You are making the mistake that so many people make: that Iran is operating in a way that is rational by Western standards of rationality. They are not. They are (at present) culturally incapable of it.

    My other worry is that DPRK will go out in a blaze of glory with the passing of “Dear Leader” because his only son is an idiot that won’t be able to continue the regime after he’s gone. Better to let it burn than fizzle, right?

    We have reached the point where certifiably insane people now have their hands on the most destructive technologies ever created. If we can stop Iran from triggering a nuclear war with computer viruses, I’m all for it.

  77. Looking through a different lens, the military has (or at least had) cool problems to work on, and cool problems are hacker catnip.

    There may be a useful parallel to be drawn here with the hackerish views on the world of IBM mainframes up until about the turn of the millennium. (After that, they became cool as Linux platforms.) There were and are plenty of cool problems to work on there, but the environment, both technical and sociopolitical, that goes along with it tended to run hackers off. There were nevertheless hackers in the mainframe world of that era, but they were comparatively rare.

  78. @Darrencardinal:

    As John Woodward pointed out, the fix is publicly available, but it is what I thought: not hard at all. Any competent admin should be able to fix it. Yes, they lose all the programs stored on their PLC, but if they’re running things right, they can restore those from a backup copy.

  79. There may be a useful parallel to be drawn here with the hackerish views on the world of IBM mainframes up until about the turn of the millennium. There were and are plenty of cool problems to work on there, but the environment, both technical and sociopolitical, that goes along with it tended to run hackers off.

    @Jay Maynard:
    The closest thing to a mainframe I’ve actually sat down and worked on is an AS/400. That being said, the only place I can see hackers might be interested in working for the government is in SIGINT within the NSA. Cryptanalysis is one of those interesting problems.

  80. @Morgan – However, we’re talking about Iran here. If they are anything like Saudi Arabia (and I’ve no reason to believe otherwise) they really don’t know squat about the tech they have, and they need someone else to fix it for them.

    If nobody is willing to help them, they are screwed.

  81. @Morgan

    > The closest thing to a mainframe I’ve actually sat down and worked on is an AS/400. That being said, the only place I can see hackers might be interested in working for the government is in SIGINT within the NSA. Cryptanalysis is one of those interesting problems.

    There are a lot of other interesting problems to work on for hackers in the government.
    I’m just not allowed to tell you what they are…

  82. @ Brian

    How many Iranians do you know? Easy to dismiss a nuanced argument with cocksure statements in a limited forum. I can back up my position, though this is not the place.

    You seem frightened….

  83. I’m not sure you can discount the possibility that military ‘white-hat crackers’ would laugh at hacker humor. Recall that Shub-Internet was implemented by someone in the Pentagon…

  84. @ Brian

    The Saudis are Arabs. The Iranians are Persians. There are huge cultural differences.

    The Persians tend to be arrogant, but study and work are not anaethema to them.

    The Saudis hire people to do these things for them. At premium rates.

  85. “The problem with this is that hackers do not in general handle the demands of operating in a military or spook shop very well. Even when there is no political clash, there’s a psychological beard-vs.-crewcut one; we tend to have strongly internalized personal ethics and not do subordination very well, and we don’t like secrecy. Thus, hackers in general don’t find it easy to imagine that they might have peers in the basement of the Pentagon or its Israeli equivalent.”

    I imagine it would be less of an issue in places where there’s a universal military draft …

  86. also – it is easy to imagine ways in which Siemens itself would be involved, such as providing documentation.

  87. … hackers do not in general handle the demands of operating in a military or spook shop very well …

    Non-conformists don’t usually mix well with military organizations – unless there’s a war on.

    Look at World War II. Churchill once remarked of the staff at Bletchley Park “I told you to leave no stone unturned – but I didn’t expect to be taken quite so literally.” Eccentrics like Orde Wingate and Vladimir Peniakoff flourished. The U.S. had the OSS and the Manhattan Project. Yes, tbere was a lot of friction, but in the end everyone worked together and worked very hard and maintained security.

    Israel is at war. When you know that there are people trying to kill you, it makes a lot of these other issues insignificant.

  88. @Craig Trader:

    There are a lot of other interesting problems to work on for hackers in the government.
    I’m just not allowed to tell you what they are…

    And now you know why there aren’t many hackers working in the government. ;) Having worked for a major defense contractor, I can say that are also interesting problems along those lines I do not possess any clearances (nor have I ever), so all I have are broad-brush details, but I know enough to get the gist.

    The culture in that business is um, interesting; though I did not possess any clearances, I did, on occasion, work on equipment that was either used for classified purposes, or in one case, the equipment itself was classified. This was mostly due to the fact that no one else competent enough was available.

    They did check my citizenship status before allowing me to work (I’m a natural-born U.S. citizen.) and made me swear that I was patriotic (Question: “Are you patriotic?” Answer: “I fly the Flag on the 4th of July and light off fireworks, does that count?” Response: *frown*. Re-answer: “Yes, of course I am.”) and, as I worked, they proceeded to watch me like a hawk.

    While a bit — unnerving — I had no problem functioning in that environment, regardless of whether you might call me hacker or not. But I can definitely understand why many hackers might be reluctant to work in such conditions.

  89. @TMR – Why do people always fall back on appeal to authority? I don’t need to know any Iranians to know that the mullahs are in control, and are not supported by the people. But since the mullahs control the military, the people don’t have much in the way of getting control.

    Needless to say, when your government doesn’t care if you die as a side-effect of their overall agenda, you don’t really matter at all.

    The government of Iran is hell-bent on regional hegemony. They understand that taking out Israel buys them that. And even if Israel were to glass Iran, their leaders would be long gone and ready to take charge of the middle east.

    You don’t need to be at the CIA to analyze events.

    @BobW – I hadn’t given the cultural angle much thought. You could be right on that count. In fact, if you are right, then it’s not unthinkable that this is an inside job, at least in part.

  90. A couple of points

    In my experience there are quite a number of Israeli hackers who are closely related to the military and there are a number in the US. They certainly get a lot of hacker humor – devotion to the number 42, quotes from Monty Python etc. etc. – but they are also patriots and people who accept hierarchies (though possibly in a somewhat Vorkosigan sense of acceptign them because they tend to be near the top). Stuxnet – from all the analyses I’ve read – is a very elegant attack. The people who created it (and who are probably sniggering at this thread and all the other discussions of their creation) produced the sort of code quality that many of us strive for and generally fail to achieve. Unlike, for example, ZeuS – http://www.theregister.co.uk/2010/09/27/zeus_botnet_hijacking/ – their malware does not seem to be vulnerable to counterattack or takeover. It also appears to have been running, undetected, for at least a year. Although it was first detected and reported in June/July this year forensics etc. indicate that it has been around since at least early 2009. I think quite a lot of hackers would be proud of that sort of stealthiness.

    The ethical issue IMO is that it opens up a huge can of worms and, now that it has been discovered, every script kiddie and cyber mafioso is aware of a huge underbelly of highly vulnerable systems that they can potentially infect and control relatively easily. Many of us who know about industrial control systems and network security have been pointing this out as best we can to the powers that be for years and inertia/complacency (plus the gienormous scale of the problem) has resulted in our warnings being totally ignored. Fixing and hardening SCADA networks is going to be a fucking nightmare – and actuallly turn out not to be possible.

    Repairing the current infestation is a non-trivial exercise even if Iran has sufficient competent technicians. It will require actually running the correct AV software on every compujter, USB drive etc etc in the affected etstablishment(s) and quite likely reloading/reinstalling – from CD or equivalent – all software and required patches, upgrades etc. This could take months of frantic effort and quite likely it will turn out that at least the first couple of times some stuff will get missed and the whole network will get reinfected again. Keeping it clean will then require the enforcement of a strict policy to ensure that no laptops, USB sticks, smartphones etc etc are ever brought into the establishment and allowed to connect to the network or its computers.

  91. “They can destroy Iran, but they will only kill a part of islam, while we will kill all of the jews.”

    That sounds so incredibly stupid that I find it hard to believe that even someone like Ahmadenijad might have said something like that. First, they aren’t just Muslim, but Shi’a, and they are the only Shi’a theocratic state. Without them Shi’a is done for, the Sunni take over Iraq, and game over for Shi’a. No religious fanatic would risk a move that would wipe out their church and hand over their religion to “heretics” unless there is indeed such a level of irrationality there that’s absolutely outside anything I can imagine, as in, a 100% contradiction between goals and means. Second, AFAIK not even half of the Jews of the world live in Israel.

  92. @Shenpen –

    Look, I didn’t say he was sane, I said he said what he intended to do, given the means.

    We all know that the leadership in Iran is certifiably insane. They’ve also got all the weapons. Oh, and they fix the elections. And they arrest, jail, beat, rape, and murder anyone who rocks the boat too hard. Hell, they just threw a blogger in prison for 20 years FOR HAVING OPINIONS NOT APPROVED BY THE RULERS.

    I forget where I read it, but some polling group did a poll over in the middle east, and some people over there believe that the majority of the population in the US is Jewish. SHHH! Don’t tell Rick Sanchez!

    We’re dealing with weapons-grade stupid here. And when you mix that with weapons-grade uraniun, nothing good can come of it.

  93. @FrancisT

    Fixing and hardening SCADA networks is going to be a fucking nightmare – and actuallly turn out not to be possible.

    [Citation needed]

    Seriously. There is no reason that the PLCs and can’t simply be reset and the controlling PCs be cleaned of the Windows part of the worm. In fact, this is pretty much what Siemens is recommending. Furthermore, security hardening a SCADA network is certainly possibly through appropriate installation of firewalls and VPNs, though the better solution would be for Siemens to add appropriate access controls and validation on their brain damaged protocols.

    Sadly, industrial control is one of those areas where people believe that so long as the network is disconnected from the Internet, no one can pwn it. There are good reasons why the FTP protocol is turned off on my firewalled-off-from-the-Net NAS box, despite the fact that it is behind a firewall.

  94. How one uses the word hacker is, of course, open to debate. The defining characteristic of a hacker, as I see it, is someone who uses ingenuity to solve difficult problems. These problems are those which have eluded those with more resources and less skill.

    If the stuxnet guys were indeed part of a government agency, which has access to intelligence and other resources, then there activities are not necessarily those of a quintessential hacker. It may be that it was the amount of resources (man years, espionage etc) were key rather than overwhelming skill.

  95. >esr – would care to know your opinion on Flea’s theory that the target was actually Siemens:

    I don’t buy it. It would have been easier to write a virus that roached all Siemens SCADA systems than one as precisely targeted as Stuxnet is – and if the perpetrators were after Siemens, that’s what they’d do.

  96. Remember that Ahmadenijad is the Shia version of a Christian Millenialist. Well connected with reality is not in his job description. That said, his reasoning is irrelevant to the discussion since it’s little more than a convenient smokescreen for the rather more sane Ayatollahs. Of course they’re working from a different playbook and one that’s too often prone to significant overreach and that’s exactly what they’re in the process of doing.

    The real issues going on here are a combination of the traditional Persian/Arab struggle for dominance over Asia Minor and the struggles of an Islamic Theocracy which has lost its primary supporters via a combination of attrition and alienation.

    @Shenpen: That’s incorrect in some parts. Iraq’s Shia majority is supported primarily by the US, not Iran (although Iran does support it while simultaneously opposing American support for it) and there’s almost no chance of the Sunni minority regaining control at this point as that would require an invasion and overthrow of the current government and the forces to do that simply don’t exist in the Arab world (Syria is Shia-controlled, the Turks really don’t care enough, nobody else has the forces). Sunni control of Iraq was primarily an artifact of the Ottoman Empire and its fall as well as the British fondness for the Hashemites, the Sunni simply are not in a position sufficient to be able to restore their dominance in Iraq.

  97. “…Although the OED includes both definitions, the schematic war has been lost among the general public…”

    That was really my point. I take a ‘functional’ view of language, and as such, consider the communicative value of words…in general, the semantics of “hacker” have been firmly cemented into peoples’ minds – a criminal…maybe younger, usually male & single…

    The OED documents our vocab, it doesn’t prescribe it. It will ultimately reflect the actual usage and understandings of words…so it isn’t surprising to read it has both defs.

    Much like you, I don’t use the term much outside ‘our circle’, it’s too confusing and irritating to have to give the hacker/cracker speech every goddamn time ;)

    Plus, around here, throwing the word “cracker” around will earn you a busted jaw.

  98. Re: “white-hat crackers”
    I am sorry ESR but I wonder if there is _anything_ in the world that would make you say “black-hat hackers” :D

  99. For obvious reasons, this is an anon comment, so take it with a grain of salt.

    Eric: I have been out of the military for a while, but let me assure you that the people who wrote the Stuxnet worm, if your assumptions re: Israeli involvement are true, would laugh at RFC1149. That was where I first read the RFC in question :)

  100. esr said: Second, we extend the honorific “hacker” to those who create software for destructive purposes.

    Imagine someone makes software that controls some custom hardware he made, to destroy a scrap automobile in an amusing and decorative fashion – perhaps making the sounds of the saws and drills and torches controlled by the computer make a video game theme song.

    I submit that none would dare suggest that person was “not a hacker” because the end was “destructive”.

    Because that’s so freakin’ cool.

    Plainly the term is lacking some precision; I think we probably share the feeling that “there’s destruction and then there’s destruction”… but how can it be put cleanly?

    (Or is it that the notional car-destroying-machine hacker was really “creating” the machine, despite its entire point being “destruction”?

    That’s always the problem with the “creative”/”destructive” dichotomy – put perhaps best, if unwholesomely, by Juan Baptiste Emanuel Zorg.)

    That said, I’d totally call the stuxnet programmers “hackers”. But I have nothing personally invested in the term at all.

  101. >Imagine someone makes software that controls some custom hardware he made, to destroy a scrap automobile in an amusing and decorative fashion – perhaps making the sounds of the saws and drills and torches controlled by the computer make a video game theme song. I submit that none would dare suggest that person was “not a hacker” because the end was “destructive”.

    You’re quite right. But all this does is open a larger debate over the meaning of “destructive”. That debate is orthogonal to how the term “hacker” is used. That is, for each reading of “destructive” you’ll find a slightly different set of hackers, but no real disagreement on what the meta-problem is.

    So, for example, I argue that the scenario you describe is not destruction at all. You specified a scrap car, making it clear that the value of the thing destroyed is intended to be less than the value of the aesthetic experience received by the audience for the stunt. This is an argument about the meaning of the term “destruction”, not about the meaning of “hacker”.

  102. Funny thing – I was reading Jon Erickson’s Hacking: The Art of Exploitation, today.

    What do you think of that book — because i have a feeling his definition of the term Hacker is not based on the ethical aspect at all and instead focusses purely on the technical and creative knowledge aspect regardless of whether the end result is constructive or destructive, legal or not. I feel that he places the term above all ethical or legal considerations.

  103. >What do you think of that book

    Never seen it. Don’t care to – I figure anybody claiming to be a security expert who would would abuse “hacker” that way is either too ignorant to be worth my time or actively dishonest.

  104. Thanks for the reply. i was confused because this writer obviously has hacker credentials but he has a far more morally ambiguous stance towards the effects of hacking itself. He says, for example, that hacking can be used both for morally right and wrong purposes, but he is reluctant to exclude people who use hacking for criminal or destructive purposes away from his definition. But on the whole, he appears to be of the opinion that hacking rises above all its ends and is all about the “means” – which is creative problem solving skills and using programming in ways previously unconceived by most people.

    That’s why I felt compelled to ask you the question. Because i myself am a merest hobbyist and I don’t pretend to know a whole deal about the whole culture surrounding hackers. His stance appears to be that hacking is a very neutral term and rises over and above legal and (I guess) moral issues. Also the title of his book “The Art of Exploitation” made me feel more uncomfortable about the stance. The word Exploitation itself appears to point that hacking has more to do with finding ways to crack into systems using malicious code rather than writing good code to protect the system. The book itself is extremely technical and focusses on a lot of known exploits of code like buffer overflows etc, and even has a section on cryptology and common cracking methods as well. Clearly he is somebody who knows the stuff well.

    That’s why I thought your authority in this area might clear up these doubts for me!

  105. >But on the whole, he appears to be of the opinion that hacking rises above all its ends and is all about the “means” – which is creative problem solving skills and using programming in ways previously unconceived by most people.

    This is what you get if you consider only skill and ignore culture and the ethos of service – that is, you ask only who has technical chops and not who laughs at RFC1149 and who gifts the world with productions like the Web or Linux.

    I would be more sympathetic to this way of thinking if I hadn’t often seen it used as an excuse by people who actually want to wave the term “hacker” around as a sensationalist ploy. This is what I meant by dishonesty. People like Erickson want to have it both ways – pretending to instrumental neutrality about the term while actually using it to evoke a bogeyman in order to sell books. Simple ignorance is excusable; this is not.

  106. > This is what you get if you consider only skill and ignore culture and the ethos of service – that is, you ask only who has technical chops and not who laughs at RFC1149 and who gifts the world with productions like the Web or Linux.

    Agree entirely with you here. i think this was what i was searching for and found missing. Also when the focus is different (e.g. security) as in this case, you tend to view the whole thing from a different angle which subverts the original meaning of the word. If this was intentional, it was wrong of the author to use the word “hacker”.

    >This is what you get if you consider only skill and ignore culture and the ethos of service – that is, you ask only who has technical chops and not who laughs at RFC1149 and who gifts the world with productions like the Web or Linux.

    Part of the issue with many tpeople is that they define “hacking” first and the predominant popular perception is that it is the act of breaking into computer systems by devious means with malicious intent. And then it’s much easier to say that a hacker is somebody who is hacks. Without the missing picture provided by your cultural and social aspects the term will tend to be abused…

  107. esr: Indeed, as I said, my comment was about what “destructive” means.

    But since “is it destructive?” was proposed as part of the criteria for hackerdom vs. crackerdom, it must be relevant to the discussion.

    (And, hell, if “destructive” for hacker/cracker discussion purposes is – as seems implied by your analysis of my example – to be determined by comparing the value of what’s destroyed to the value received from the destruction, it seems pretty clear that to everyone but the Iranian government [and a few anti-Semites or hyper-statists/sovereignty worshippers] that the destruction of Iranian nuclear weapons ambitions is profoundly non-destructive, in that constrained use of the term.

    Just as the Allied invasion of France was not the same as the German invasion of France, destroying a nuclear plant to stop an Iranian A-bomb ain’t the same as destroying one because they wouldn’t pay you not to (or just for kicks, to prove you could).

    Various hackers might want to “put a wall around Torah”, so to speak, and avoid the slippery slope of calling the Stuxnet programmers hackers [assuming the cultural clash issue isn't there], because they destroyed something.

    I’m comfortable with thinking that slope’s not so slippery and not so slanted. But then I can’t pretend to speak for any hackers at all, let alone as a tribal elder.)

  108. >I’m comfortable with thinking that slope’s not so slippery and not so slanted. But then I can’t pretend to speak for any hackers at all, let alone as a tribal elder.)

    Personally, I agree with both your conclusion and your reasoning. But part of what’s required to be a tribal elder in the first place is the understanding that you cannot always apply a strictly personal standard of judgment; you have to judge according to community norms, recognizing that your tribe includes a range of positions on, for example, what constitutes “destruction”.

    This is why I say that I would not judge writing Stuxnet to have been a violation of hacker ethics, but I recognize that a contrary position is within the range of community norms. By doing this I am both stating a normative position for those who respect my authority, but also signaling that I have not fallen into the error of regarding my own evaluations as necessarily rather than contingently correct.

  109. > Part of the issue with many tpeople is that they define “hacking” first and the predominant popular perception is that it is the act of breaking into computer systems by devious means with malicious intent. And then it’s much easier to say that a hacker is somebody who is hacks. Without the missing picture provided by your cultural and social aspects the term will tend to be abused…

    Well, part of the problem is the two root meanings of the work hack – “hack to pieces” vs. “person hired to do routine work”.

    The word hacker as originally created to describe creative IT work is clearly derived from the second meaning, like the phrase hack writer, but, as often happens reversing the meaning so that hack becomes a compliment (like “the bomb” becomes something good). However most people use hack in the first sense, to “hack to pieces”. Thus, hacker, for most people sounds more like a kind of murderer. This will drive people to use hacker in the pejorative and criminal sense rather than it’s original meaning.

    Yours,
    Tom

  110. Jay sez:
    > My ire is reserved for the kind of elitist liberal infesting the east and west coasts of the US that , stereotypically, eats Brie on tiny crackers at parties while sipping their oh-so-genteel martinis and discussing how best to run the country without reference to little details like the Constitution.

    In my experience, Jay, the people not referencing the Constitution (in what they *do*, as opposed to what they *say*) are Conservatives.

    I’d be happy to debate it with you further, but Eric probably would prefer that I not do it *here*. :-)

    In other news, do you have any plans for the :Legacy premiere?

  111. > To my knowledge, no one has yet pointed out another potential achievement of the Stuxnet worm: the people who go to Iran to fix the problem will presumably have wide-ranging access to the Iranian nuclear facilities as they ARE, not as the published designs portray them.

    That’s a helluva good point: the whole thing could be a false flag to get as-built data out of the facilities…

  112. ESR- what you said. I don’t believe that Siemans was a target because the stux also used Yamaha contollers as a vector.
    Actually, Siemans is probably scratching their collective heads and saying how come we didn’t think of this software to sell to other large multinational corporations who buy Siemans controllers. Everyone comments how Stuxi can be remotely contolled by another computer. This is the perfect software program for a 1st world multinational corporation to check whether a 2nd world country is copying patented formulations (ahem, China & India).All the multinational corporate attorney has to do is give the signal and the factory is shut down. No worrying about the grey courts and companies where a General sits on the factory’s board – you know what country I’m talking about.
    Stuxi is giving the Iranians a headache not only because it fried some centrifuges, but the Iranian populace who don’t give a damn about the ruling party of Iran don’t want the Revolutionary Guard to hijack their controllers and extort money. If I had a controller and I was Iranian, I would be punching any Basij member who strolled into my factory.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>