Stop Him Before He Hacks Again

05/03/2002 Written by Alex Salkever

Stop Him Before He Hacks Again
Adrian Lamo has made quite a name for him­self by break­ing into cor­po­rate net­works. He has done no harm — but that’s not the issue.
By Alex Salkever, Busi­ness Week
Mar 5 2002 11:19AM PT

Read­ers of The New York Times’s “op-​ed” page reg­u­larly find columns writ­ten by a host of world lead­ers and celebri­ties, from Pales­tin­ian leader Yas­sir Arafat and for­mer U.S. Pres­i­dent Jimmy Carter to hip-​hop star and talk-​show host Queen Lat­i­fah. The con­tact infor­ma­tion for these lumi­nar­ies is a closely guarded Times secret, as is the con­tents of the op-​ed section’s Rolodex.

Not any­more. The Times op-​ed sec­tion and its list of con­trib­u­tors were recently pen­e­trated by one of the most con­tro­ver­sial hack­ers to emerge since Kevin Mit­nick, who spent almost five years in prison for repeat­edly invad­ing com­puter sys­tems at a slather of high-​tech out­fits. Meet Adrian Lamo, a soft-​spoken 21-​year-​old snoop from San Fran­cisco who hacks with noth­ing more than a lap­top, a Web browser, and a Net con­nec­tion at the local cof­fee shop.

Friendly Warn­ing
Lamo recently broke into the Times com­puter net­work, where he co-​opted contact-​information files as well as sen­si­tive details of the news-​gathering and edit­ing process at the Times. His tear through the Gray Lady’s closet even gave him the abil­ity to change the Web site at one of the world’s most pow­er­ful media orga­ni­za­tions with a few key strokes — an option he didn’t exer­cise. Lamo then con­tacted computer-​security pub­li­ca­tion Secu­rity Focus Online and asked it to con­tact the Times on his behalf to out­line the breach.

This isn’t Lamo’s first con­quest. In Sep­tem­ber, 2001, he hacked into the con­tent servers at Yahoo! — and actu­ally did alter a news story to demon­strate that he was capa­ble of breach­ing secu­rity. A month later, he hacked customer-​information data­bases at soft­ware pow­er­house Microsoft. In Decem­ber, 2001, he gained access to secret network-​topography dia­grams at voice-​and-​data car­rier World­Com, going so far as to e-​mail com­pany offi­cials a sup­pos­edly secret file show­ing key loca­tions of net­work equip­ment.

So why hasn’t Lamo been pros­e­cuted for com­puter crimes? In each of these cases, he warned the com­pa­nies about their flaws after-​the-​fact and offered to help fix them for free. Lamo fur­ther claims that he has accepted no money or com­pen­sa­tion from any of his tar­gets, some­thing that often hap­pens in the computer-​security world, where a con­sul­tant report­ing a breach often gets awarded a con­tract. Rather than con­demn­ing him, Lamo’s “vic­tims” have mostly praised him for help­ing to secure their net­works.

Intruder or Hero?
So far, the Times has nei­ther con­demned nor lauded Lamo. “We are cur­rently deter­min­ing what the appro­pri­ate next steps will be,” was how Times spokesper­son Chris­tine Mohan responded to an e-​mail from Busi­ness­Week Online. To date, no one has pressed charges.

Lamo says his main moti­va­tion for hack­ing is mere curios­ity. Does that make his escapades O.K.? Good ques­tion. Herein, two schools of thought — each vehe­mently expressed in numer­ous Inter­net dis­cus­sions of the affair that are still rag­ing today. Let’s exam­ine the first, the atti­tude that says Lamo actu­ally pro­vided the Times with a ser­vice.

Fair enough. He did help by alert­ing the paper to the flaws in its net­works. And it’s quite pos­si­ble that he saved it from a seri­ous dose of egg on its august face — not to men­tion a pile of legal fees — if any pri­vate infor­ma­tion had been hacked. Lamo did all this by walk­ing through the equiv­a­lent of an unlocked door fronting a very pub­lic thor­ough­fare, the Inter­net. What’s more, he hasn’t prof­ited from his exploits. Nor has he dam­aged the sys­tems or done any real harm.

Extended Vis­its
The sec­ond school of thought says Lamo should have the book thrown at him. Never mind his high-​minded inten­tions or curios­ity. Accord­ing to this view’s adher­ents, break­ing into a company’s or an individual’s com­puter is akin to break­ing into somebody’s house. It’s ille­gal, period — even if the only result is that the home­owner now knows how easy it was to com­mit the crime.

In some of these cases, Lamo was actu­ally pok­ing around in these net­works for extended peri­ods. At World­Com, his sojourn lasted sev­eral months, yet the tele­com had no knowl­edge of his snoop­ing. Clearly, Lamo could have warned these com­pa­nies. Then there’s the poten­tial for inad­ver­tent dam­age to the net­works, a real pos­si­bil­ity when some­one who’s largely unfa­mil­iar with the intri­ca­cies of the sys­tem is snoop­ing around.

Besides, why didn’t Lamo ask the com­pa­nies if he could break into their net­works? They prob­a­bly wouldn’t have said, “Go ahead! Have fun.” The proper way to enter a house is by knock­ing on the front door, no?

White Hat Hacker
Finally, in each case, Lamo widely pub­li­cized what he did — not just to the com­pa­nies involved, but to the pub­lic at large. Granted, he did give the com­pa­nies a chance to fix their net­work prob­lems before he went pub­lic with the infor­ma­tion. But why go pub­lic at all unless the goal of the exer­cise is to broad­cast one’s exploits?

Lamo is hardly the first to test net­works for fun and sport. Many of these so-​called white-​hat hack­ers turn their skills to the trade of infor­ma­tion secu­rity, where they look for vul­ner­a­bil­i­ties to gain pres­tige for them­selves and their employ­ers. The dif­fer­ence: These guys look for vul­ner­a­bil­i­ties in soft­ware prod­ucts that, for the most part, they have legally licensed. As a gen­eral rule, they don’t poke around in net­works with­out being invited.

When I con­tacted Lamo on his cell phone (some­where on pub­lic tran­sit in San Fran­cisco or Oak­land, he told me), he seemed like a pleas­ant enough guy. He wasn’t boast­ful. He con­ceded that he was oper­at­ing in a gray area and that he could run afoul of the law. He also admit­ted that dam­ag­ing a net­work inad­ver­tently was a sig­nif­i­cant risk dur­ing his under­tak­ings.

Let­ter vs. Spirit
All in all, it seemed that Lamo was quite clear-​eyed about what he had done and its impli­ca­tions, although he did say he hoped it wouldn’t develop into a legal bat­tle. “It would be inac­cu­rate to say that I don’t care,” says Lamo, “and that I feel that I’m beyond the law.”

Did Lamo vio­late the law? Per­haps, if you look at its let­ter. On the Inter­net, when a perime­ter is breached, it’s tres­pass­ing. But in the spirit of the law, com­pa­nies aren’t throw­ing the book at him — and for good rea­son. He’s telling them things about their net­works that are very valu­able and cost them noth­ing to learn. And, again, his exploits have caused no harm. The “vic­tims” of these vic­tim­less crimes have allowed him to con­tinue going about his busi­ness.

Part of me admires Lamo. Part of me wor­ries about him. Allow­ing this type of unin­vited hack­ing to go on unchecked is unac­cept­able. Before you know it, Lamo’s imi­ta­tors will pro­lif­er­ate. Soon, hun­dreds if not thou­sands of peo­ple could be rat­tling the win­dows of com­pa­nies’ com­puter sys­tems, check­ing the doors, and wan­der­ing through the house. That’s hardly the best way to run a dig­i­tal soci­ety.

Appro­pri­ate Reme­dies
Think of hun­dreds of garage mechan­ics hotwiring your car and tak­ing it for a test-​drive to see if it has any kinks. Even if they don’t steal any­thing, it’s a major inva­sion of pri­vacy.

This issue has other ways of being resolved with­out pros­e­cut­ing Lamo. Per­haps a court should require him to per­form community-​service secu­rity work for non­prof­its or gov­ern­ment agen­cies. Or maybe he should serve as a com­puter teacher to under­priv­i­leged kids. But if he com­mits fur­ther trans­gres­sions (on top of the many already detailed), he should be issued a stern warn­ing by law enforce­ment.

Lamo is clearly not a mali­cious guy. But there’s no short­age of good work a white-​hat hacker could carry out with­out secretly break­ing into sys­tems.



Copy­right 2001, by The McGraw-​Hill Com­pa­nies Inc. All rights reserved