Hackers are people who explore the details of computer systems to identify their problems and weaknesses with the goal of changing or increasing their capabilities. Because the most well-known instances of hacking involve malicious intent, the term hacker has become synonymous with people who break into computer systems to commit mischief or to steal sensitive information. The term hacking refers to the process of using backdoor programs, bypassing normal authentication like passwords; malware, or software intended to damage or disable a computer; or flaws in computer code to gain access to a system.
While some cybercriminals are hackers, not all hackers are involved in cybercrime. White hat hackers work for organizations or corporations to assess computer security systems and fortify them against mischief. Although gray hat hackers do not work with the intent of harming those whom they hack, they may use tools and skills that are associated with malicious hackers. Both white hat and gray hat hackers may search for hidden information, as in a criminal investigation; work on behalf of governments; or partner with law enforcement. Black hat hackers hack systems in order to gain advantage from others’ misfortune, breaking into computer systems or networks for their personal benefit.
Origins of Hacking
Computer hacking can be traced back to the 1950s when a group of model-train enthusiasts at the Massachusetts Institute of Technology (MIT) became interested in the large mainframe computers installed at the university. Calling themselves hackers, a title they coined after tinkering with their electronic trains and switches to improve their performance, they began to experiment with and modify computer programs to customize them for specific applications or investigate how they were put together. At that time, hacker was generally a positive term that described a resourceful person who displayed impressive computer programming skills. Hacking was limited to a small group of enthusiasts because computers were not available to the general public.
It was not until the proliferation of personal computers in the 1980s that hacking became widespread. As individuals purchased computers and communicated over telephone lines with other computers, the potential for motivated, curious, and resourceful people to play with the technology increased rapidly. Electronic bulletin boards allowed hackers to share tips on how to gain access to protected networks. Hacking was further popularized in 1983 with the release of the film War Games, which follows the exploits of a young hacker who accesses the US government’s military supercomputer.
In one of the first major cases of computer hacking, a group of six teenagers from Milwaukee met as members of a local scouting troop and found that they shared a common interest in hacking. After gaining access to dozens of highly secure and classified computer systems, including Los Alamos National Laboratory and Security Pacific Bank, the group, known as the 414s in reference to their local area code, was identified and caught by the FBI in 1983. The case garnered national interest and widespread media coverage.
By the mid-1980s, hacking had expanded to include a criminal enterprise. Hackers began to access computer systems and classified information for personal gain, stealing credit card numbers and pirating software and games. By 2000, groups of hackers had formed collectives and started coordinating cyberattacks on other hackers as well as corporate and government websites through denial-of-service (DoS) attacks. In a DoS attack, hackers overload a web server by bombarding it with external communication requests.
Anti-Hacking Legislation
In 1986, Congress passed the Computer Fraud and Abuse Act (CFAA), making hacking a felony. The law gave federal authorities power to prosecute and punish hacking. Law enforcement also became more aggressive in investigating and prosecuting criminal hackers, making a number of high-profile arrests and prosecutions. The CFAA was meant primarily to define criminal activity, but private industry saw risks to the integrity of its information as well, and corporations began to realize how expensive data theft and malware attacks could become. In 1994, Congress amended the CFAA to also address civil actions, making it possible for corporations to sue workers whose hacking revealed company secrets.
On November 2, 1988, Cornell University student Robert T. Morris released the first computer worm. The worm reportedly disabled about 6,000 computers, or approximately ten percent of the computers connected to the Internet, which at the time was used only by universities, governments, and the military. This prompted the Defense Advanced Research Projects Agency (DARPA), an agency of the US Department of Defense, to create a computer emergency response team to prevent future hackers from doing the kind of extensive damage the Morris Worm had done.
As hacking collectives continued to form and grow in the 1990s, they began to clash online and battle one another for dominance. This led to downed networks, jammed phone lines, and one of the largest hacker suppressions in history, Operation Sun Devil, orchestrated by the US Secret Service and the Arizona Organized Crime and Racketeering Bureau. Operation Sun Devil brought down hackers in twelve cities across eight states, raising public awareness of the consequences of illegal hacking.
Amendments to the CFAA have been proposed in Congress. An amendment known as Aaron’s Law was named for Aaron Swartz, an Internet programmer and activist who breached the MIT network to download millions of academic papers from the JSTOR subscription service. Swartz, who considered his goal of releasing academic research to the public for free to be an act of good, was indicted on federal charges under the CFAA and faced a prison sentence of up to thirty-five years. In 2013, Swartz committed suicide while awaiting trial. The amendment, introduced shortly after his death, would keep prosecutors from using the CFAA to prosecute people for minor infractions related to contract agreements. Aaron’s Law was reintroduced in 2015 but never came to the floor for a vote. Critics of the amendment suggest that strong punishments should remain in place to deter hackers and other cybercriminals, while supporters claim CFAA is too broad, with penalties for hacking too severe for the crimes committed.
Malicious Hacking Incidents
As cybercrime became commonplace in the 2000s, black hat hackers developed more sophisticated technology to allow them to gather information on a massive scale. Botnets, for example, refers to computers in many locations that are infected with identical malware. All of the infected computers can then be accessed by one hacker, known as a bot herder. Another form of technology, ransomware, allows hackers to lock users out of their own computers or other devices and demand payment in exchange for restoring access.
In 2012, a group of black hat hackers who referred to themselves as the Cutting Sword of Justice used a virus sent via e-mail to break into the computer system at Saudi Aramco, one of the world’s wealthiest companies. The corporation, which is held by the Saudi Arabian government, supplies 10 percent of the world’s oil. The virus partially erased or destroyed thirty-five thousand computers, and it took five months for Saudi Aramco to fully restore its computer system. While US officials suspected that the Iranian government had been involved in the attack, the hackers were never identified.
Other high-profile incidents made headlines later in the same decade. In November 2013, one of the most widespread and visible hacker actions occurred when an attack on the Target retail chain resulted in the theft of forty million credit card numbers. In 2014, North Korean hackers infiltrated computers at the US-based Sony Pictures, deleting and destroying data on more than 3,000 personal computers and 837 servers. Hackers also stole confidential files, including social security numbers, personal and corporate e-mails, movie scripts, and salary information. In a message posted online, the alleged hackers implied that their motive involved the recently released Sony film, The Interview, in which filmmaker Seth Rogan parodied life in North Korea and its leader, Kim Jong Un. The alleged hackers referred to the film as a “movie of terrorism.”
Hacking again entered the national conversation in 2016 when hackers affiliated with the Russian government were suspected of interfering in the 2016 US presidential election in favor of Republican Party nominee Donald Trump. According to a report released by the US Office of the Director of National Intelligence in January 2017, the intelligence community believed with “high confidence” that Russian intelligence officials had hacked into the Democratic National Committee server and illegally obtained access to the emails of John Podesta, the campaign chairman for Democratic Party nominee Hillary Clinton. These emails were then leaked to WikiLeaks, an independent website and organization, which published them online. President Trump at first promoted the possibility that a rogue hacker could have leaked the emails but later acknowledged that the Russians may have been involved. The FBI continues to investigate links between the Russian hacking scheme and the Trump campaign.
Hacktivism in the Twenty-First Century
The term hacktivism refers to actions performed by white hat or gray hat hackers who use their skills on behalf of causes they consider to be beneficial to the public good. One of the highest profile hacktivist collectives is Anonymous, which has orchestrated attacks on the FBI, the Vatican, the nation of Israel, and PayPal to move forward political and social objectives. Causes promoted by Anonymous activists have included animal rights, repression in Tunisia, Israel’s actions against Palestine, and the refusal of some web payment services to process contributions to WikiLeaks. Hacktivists use methods including denial-of-service and doxing, which involves publishing personal information about a target, often including passwords and credit card numbers.
While hacktivist organizations such as Anonymous have gained public support, opponents of hacktivism claim that the activists’ actions are illegal under the CFAA. Identifying the perpetrators and determining the actual damage done has been difficult for law enforcement, however. In addition, many hacktivist attacks involve hackers in more than one country, making their arrests a question of international relations.