Technologically Enabled Crime: Shifting Paradigms for the Year 2000

This paper will consider the social and ethical factors involved in the transmission of computer viruses and other malicious software. In addition to the people, we will consider the part the systems and technology play in the spread of this sort of data. We will draw parallels with one of the more well known scientific paradigms, the medical one, and note the similarities with the problems we now face. We will describe the evolution of methods of virus distribution: virus exchange bulletin boards, virus exchange networks, distribution sites, robots/servers, and books. The paper will discuss viruses for sale and make some comparisons between distribution of computer viruses and the distribution methods of ``hacking tools''. Other issues examined in this paper include the characteristics of individuals involved in the distribution of these types of programs, and problems of legal redress, as well as possible solutions based on ethics and ethical theory.

We have available today a global system of communication technology. There also exist programs whose purpose is to disrupt the way this system functions. Moreover, the system is the perfect medium to host and transfer the very programs designed to destroy the functionality of the system itself. In this paper we will discuss the factors usually neglected in studies concerning computer virus infections.

There are various factors commonly considered when estimating the probability of virus infections. We have factors such as the ability of the virus to replicate, the amount of contact any given machine has with the general population of computers, and the presence of any computers currently infected. Elaborate studies have been done to calculate the possibilities of any given population becoming infected. In one such study by Dr. Alan Solomon [Solomon, 1990], one conclusion is that early detection is a very effective way to reduce the incidence of viruses in a population of computers. In fact, early detection is cited as one of the crucial factors in limiting infection. One such model [see Footnote 1] illustrates how finding a virus contributes to its detection and eradication.

There are cases however, where a virus being `found' means it will spread further and further; the same can be said of some hacking tools. These cases are where the malicious programs are `found' on computing systems, where they have been placed for exchange or distribution. These are programs which will not be detected in their `current state' by any virus detector or casual search methodologies. When they are found, by people looking for them (and in some cases by the casual observer who just happens to see them, download or ftp them, and use them), they spread from user to user and their use becomes widespread; in some cases, epidemic.

In this section, we will examine the sorts of programs which are sometimes used in criminal and/or unethical ways. People which make use of the current technology to distribute the tools and information will be discussed.

Having defined some types of programs that are used to cause disruption and criminal activity in our networks, aspects of cyberspace and technological development which can contribute to the problem and the general characteristics of some of the people involved, we will now look at the methods by which the people distribute the programs and information.

This shift can be observed by following the distribution of one hacking tool commonly know as the sunsniffer. Initially the sniffer was distributed only to a very few people. The source code and executable code for this sniffer were recently `"widebanded". Widebanding refers to indiscriminate intentional distribution of a program, through every available method. In some cases this is done to make tracing of the original distributor more difficult.

The sniffer, which compromised the security of large number of systems on the internet, worked by using a feature of the operating system called /dev/nit. This is the network interface tap, and it can read/write from/to different interfaces. The program was configured to place /dev/nit in promiscuous mode, because it could then read all traffic from any machine on the cable, even routed mail. Administrators who had not properly configured their own /dev/nit helped enable the compromise of their own systems. However, this "hole" was designed into the system, making this compromise possible. It is not feasible to disable a machine to prevent its compromise.

As people became more aware of the use of this program by a few individuals, the potential for apprehension of the individuals increased, so the tool was distributed a bit more widely. At the same time, other individuals began to find this "sniffer" on machines which had been compromised; they would then take a copy of it to use elsewhere. Copies of the sunsniffer were placed on publicly available FTP sites, where any user with access to anonymous FTP could obtain the program. The shift we are observing whereby hackers are distributing information such as this on a much wider scale than before is illustrated by the speed and manner of the distribution of this sniffer.

The connection between certain aspects of current computing technology and the crimes/activities being facilitated will be examined, with emphasis on the paradigm shifts which have been proven to improve the overall health of other forms of scientific research.

We will now consider the aspect of this cyberspace environment known as dehumanization. Not all computing technologies are heavily influenced by the dehumanization and other psychological aspects of `cyberspace' which are seen in the environment surrounding the `malicious computer program', but it should not surprise us that people who have little contact with other human beings due to their intense immersion in the electronic communities we have designed have lost sight of their humanity. It follows that the impact of their actions is often seen, at least by them, as impacting machines, not other human beings.

We should also consider the aspects of cyberspace which facilitate inequality, and the possible results of these inequalities. This environment is no different than in any other aspect of society; it is normal for people to be unequal. For example, we do not all have access to the same quality of health care; not everyone has even a house in which to put a terminal. Cyberspace however, introduces a unique form of inequality in that the sort of information which is becoming available will provide what could be a very extreme advantage to those who `have' versus those who `have not' -- indeed, this advantage/disadvantage could impact the electronic community in such a way that the community could become unable to maintain itself entirely. Unequal access to information puts those who do not have the access at the distinct disadvantage of ever being able to fulfill their potential in the electronic society. While this is inherent in most societies, we are in a position now which could enable us to minimalize some aspects of social inequality by careful planning and policy making. Unlike other areas, this structure is not yet intact; there is still time to integrate equalizing factors. Most importantly, we need to consider what sorts of information belong in cyberspace; what sort of access policies should governments envision; is the idea of access for everyone feasible or even desirable.

At this time, cyberspace does tend to facilitate some inequality; this inequality is manifested in the number of `victims'. It can be argued that there is a great equalization, due to lack of real world visual biases or clues inherent in net communication and interaction; however, it is important to consider that along with the lack of the visual `bias' triggers comes a lack of contextual clues. Without these clues, often people do not realise their behaviour is unacceptable. If it is alright to do one little thing, another little thing is added to it. Eventually, you can end up with a very anti-social behavior, which was totally acceptable every step of the way by one's peer group. This is not to suggest that we should find a way to take real-time, real-space clues and integrate them into net societies. As users are given more and more power, the potential for trickery, lies, deceit and abuse increases right along with the potential for `good'. It may be wise to consider the nature of cyber-societies and the processes of social influence within them. [Sproull, 93]

The ":it" in the first case refers to advances in medicine relating to health care, and research; in particular fields such as genetic engineering. What occurred during this time was a remarkable advancement of technology which left scientists and researchers in somewhat of a quandary over exactly what, and how much, of this research and development should be put into common usage or pursued at all. We find a similar situation today, with computing technologies not only surpassing the abilities of administrators and users to understand them, but of the technologies themselves at times enabling their own destruction. It is perhaps wise to consider at some point what safeguards we should require. In the 60's, science turned to the field of ethics -- a field which was dying according to some -- and asked the question "Just what exactly should we do? What is -right- to do?". From this introspection, the field of bio-ethics emerged. [Bartels, Smith, 93] [Gustafson, 70]

When we look at medical science, and medical research today, we find questions being asked:

The Medical Science Paradigm today :

• We can do it
• Should we do it?
• How should we do it?

We can observe the shifts resulting from the interaction with ethical concerns. This shift has meant perhaps less scientific `advancement', but perhaps has placed medical science more in line with its true goals. The same could be said for integration of ethics with other scientific disciplines. As the technologies of computing today advance, they tend to focus on what the machines can do. In this assumption, we could be neglecting what we really need and want them to do.

The technologies described to this point which have enabled the sorts of crimes we are now seeing in our global computing environments were surely not created or designed to facilitate these sorts of behaviours. We must, however, take a serious look at contributory factors.

It could be the case that we have simply allowed technology to progress too quickly, with insufficient planning. This is not to suggest that we should stifle technology, but that we may need to begin now to pay particular attention to the ethical model that the technological model is generating. As an example, consider FSP and FTP applications. We have seen how FTP (File Transfer Protocol via connection state protocol) can in some cases allow files to be transferred anonymously. This is a good and necessary thing, and its potential for abuse or misuse could be minimized by correct configuration policies. FSP, or File Server Protocol (Transfers via Connection list) in which you have a connection only during pings, requests, etc. are an improvement in that you do not tie up resources during inactivity; however, use of FSP usually requires no special privileges to set up and no special ports; it doesn't require separate file systems, and anyone can set up this sort of `server'. We are seeing the same sorts of problems with these FSP servers as we are seeing with the DCC (Direct Client to Client transfer services) applications and Bots that are being used to transfer viruses and other programs on IRC (Internet Relay Chat).

The anonymity of both of these applications plays a role in the ethical models of behaviour that have developed around their uses. While FTP sites are used to transfer the sorts of programs and information with which we are concerned, there appears to be a much higher incidence of FSP sites being used on a regular basis to transfer this information and data. The controversy surrounding anonymity and pseudo-anonymity is one which will probably continue for a long time as we learn the effects of such freedoms. However, what we can see now is that these sorts of anonymous applications do provide almost a "Use Me for Your Own Purposes" sign.

Both legal and ethical solutions to some of the problems discussed in this paper are worth considering. However, both have limitations, and need to be used in a cooperative, or multidisciplinary approach. We will look now at some of the methods we can use to address the problems.

We see a very good suggestion as to how we may begin to positively influence students and young people. We can observe how this has been seen to work in the past by looking at the issue of drinking and driving. At one point in time, drinking and driving was a personal issue. As we as a society began to see some of the consequences of this interaction, we began to pass laws which restricted the such behaviour. There was some resistance to this type of law initially, which people saw as an infringement on their right to drink alcohol and drive their vehicles. However, as the law became more widely accepted, people began to refuse to drink and drive on the principle that it is `wrong' to do. Policymakers and lawmakers are very aware of this form of societal control. However, they are often not very aware of the societal structure of `cyberspace', and for this reason there is the danger that laws they make will not create the desired ethical model, but will instead create a backlash or revolutionary movement against the society. By continuing to take time to develop realistic policies and effective laws, it is possible we can avoid such a backlash.

When a new technology emerges , a paradigm associated with that technology appears or is borrowed from an associated technology. As the technology develops towards maturity, the paradigm shapes its development. At certain points, it becomes apparent that the paradigm is no longer appropriate, and a paradigm shift occurs. Typically this is first seen as an outlandish if not heretical move by some maverick individual. But if the shift is appropriate, it becomes adopted by the scientific community, and then serves to shape or even control the further development of the technology. Without such paradigm shifts, the technology may become stagnated, or even dangerously out of touch with its aims and the society around it. Computer science is no exception.

I have argued above that we are now at the point where a significant paradigm shift is necessary in this area. The speed with which global electronic communication is developing has brought with it an enormous benefit to all those fortunate enough to be able to exploit it. It has also brought opportunities to those who are willing to abuse it. The way in which it has introduced relative and absolute anonymity to its users itself may encourage acts which would otherwise have appeared to be too risky to the perpetrator. That is, its very nature may encourage various kinds of antisocial activities, ranging from innocent pranks through serious malicious damage to data and individuals to downright criminal fraud. The speed and power of the technology itself enables these activities to take place, and encourages them. Since its principle users are relatively young, and may be impressionable or unprincipled, an ethos has developed in which it is `cool' to be an outlaw. Moreover, the inherent power embodied in being able to control the `system' is itself potentially irresistibly attractive.

It is natural, given the way that societies tend to develop, that antisocial or otherwise undesirable activities lead to legislation against them, designed to contain or eradicate them. This is the point we have reached with such excesses on the Internet. This is the current paradigm of control, and the one that is influencing the development of the technology. However, legislation is notorious for not solving the problems it is designed to deal with. A paradigm shift is now necessary, both in the way the technology develops further and in the way that malicious activities associated with it are combatted. The problem of internet abuse cannot be solved by trying to legislate it out of existence. It is necessary to promote an ethical approach to computing. This itself requires there to be an ethical model of developing computer science. The paradigm for this technology can no longer be determined purely along scientific lines. Introducing ethics into the way the technology is used will help to instill appropriate ethics in the users of the technology, and thus to reduce the numbers of abusers. If this program is successful, it will soon sound outdated and even `lame' to say "it's ok to do it if it isn't illegal", just as it has become `uncool' to drink and drive; not merely illegal, but unethical, and not the sort of thing that enchances the image and status of a potential role model.

We cannot eliminate the social aspects of malicious computer program development and distribution through solely legal means, or through solely technical means. We can look to technology for detection in some cases, and to law for prosecution or relief in some cases. In all cases, resources to enable us to emphasise and integrate ethical computing behaviours in all areas -- not just in areas relating to viruses and hacking -- may provide a stablizing influence. Our computing environments are very vulnerable regarding distribution of information -- after all, it is what they were designed to do. I suggest that we need to focus somewhat more on what we were designed to do: to behave as rational self-policing beings and to impart this ethical model to people learning the technology. Without the proper interaction of laws, education and ethical development, there is a very real risk that this technology will soon become unusable and ultimately self-destructive.

1. Bartels, Smith, 93 New Frontiers in Genetic Testing and Screening: The Human Genome Project, Bartels, Dianne M. and Truesdell-Smith, Elizabeth, Center for Biomedical Ethics, University of Minnesota, August 1993
2. Cook, 93, "Network Traffic Liability: 1993", Cook, William J., op-ed for AAAS Invitational Conference on Technical, Ethical and Legal Aspects of Computer and Network Use and Abuse. report forthcoming.
3. Forrester, Morrison 94, Computer Ethics: Cautionary Tales and Ethical Dilemmas in Computing, MIT Press, 1994
4. Gordon, 94 "The Generic Virus Writer", Gordon, Sara (in progress, Virus Bulletin Conference)
5. Gustafson, 1970 "Basic Issues in the Biomedical Fields", Soundings 53, Summer 1970 151ff
6. Ladd, 93, "Critical Reflections on Ethical Issues Relating to Computer and Network Use and Abuse", Ladd, John, Dept. of Philosophy, Brown University. AAAS Invitational Conference on Technical, Ethical and Legal Aspects of Computer and Network Use and Abuse. report forthcoming.
7. Neumann, 93 "Limitations of Computer-Communications Technology", AAAS Invitational Conference on Legal, Ethical and Technological Aspects of Computer and Network Use and Abuse. report forthcoming.
8. President's Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioural Research, "Splicing Life". U.S. Government Printing Office
9. Solomon, 90 Epidemiology and Computer Viruses, Solomon, Alan, 1990, S&S International
10. Sproull, 93 "Social Influence in Electronic Groups", Sproull, Lee, December 1993 from "Atheism, Sex, and Databases", Sproull, Lee and Faraj, Samer, in progress -- Presented at AAAS Invitational Conference on Technical, Ethical and Legal Aspects of Computer and Network Use and Abuse. report forthcoming.
11. Swanson, Chamelin and Territo, 92, "Criminal Investigation", Swanson, Charles, Chamelin, Neil and Territo, Leonard, ed. Butcher, Phillip A. and Rosenberg, Elaine. pp. 53

1. Solomon model: In the Solomon model, the rate of new infections is proportional to the number of infected PCs, to the number of uninfected PCs and to the probability of infection. The rate of infections being eradicated is proportional to the number of infected PCs, and to the probability of detection.
2. A list of viruses distributed with commercial software, compiled from VIRUS-L, RISKS-FORUM and other public sources, identifies virus infections transmitted through either commercial or government entities in which the distributor would generally have been considered to be a "reputable source". Incidents which were unwilling to fully disclose, or incidents in which the source of the infection was unsure were omitted. This list was obtained from Wallace Hale of the PCVRF. It is noted that any addition information may be requested from, or forwarded to cmcdonal@wsmr-emh34.army.mil.
3. "The resolution was formulated by the chairman of IFIPs Technical Committee TC-11 `Computer Security', Professor William J. Caelli, of Queensland University, Brisbane/Australia, and the chairman-elect of IFIPs TC-9 `Computer and Society', Prof. Klaus Brunnstein of Hamburg University. IFIP General assembly asked the president, Ashley Goldsworthy, to inform all member societies and to ask the governments to take proper actions." (Used with permission)

I am grateful to Tim Martin, Jon David, and Harold Highland for their comments on an earlier draft. They are not responsible for any errors or ommissions.