Why Hackers Win: Power and Disruption in the Network Society

Why Hackers Win

Why Hackers Win

Power and Disruption in the Network Society

Patrick Burkart and Tom McCourt

UNIVERSITY OF CALIFORNIA PRESS

University of California Press

Oakland, California

© 2019 by Patrick Burkart and Tom McCourt

Cataloging-in-Publication Data is on file with the Library of Congress.

Library of Congress Control Number: 2019950171

ISBN 978-0-520-30012-5 (cloth)

ISBN 978-0-520-30013-2 (paperback)

ISBN 978-0-520-97165-3 (e-edition)

Manufactured in the United States of America

28  27  26  25  24  23  22  21  20  19

10  9  8  7  6  5  4  3  2  1

For David and Jane

CONTENTS

List of Illustrations

Preface

Acknowledgments

1. On the Structures and Functions of Hacking

2. Hacking and Risk to Systems

3. The Political Economy of the Hack

4. Antihacking Law and Policy

5. Activism beyond Hacktivism

Notes

References

Index

ILLUSTRATIONS

TABLES

1. Security software and vendor revenue, worldwide

2. Tiers of commodification in cyber markets

3. Selected data spills

FIGURES

1. Data breaches and records exposure

PREFACE

Contemporary geopolitics are in flux as their norms shift and institutions realign. Information increasingly is employed as both hard and soft power in struggles that cross the social and technical boundaries of long-standing networks. These struggles are central to what we term the Network Society.¹ Why Hackers Win: Power and Disruption in the Network Society examines the pressures that have driven global law and policy into ambiguous territory. While many popular and scholarly accounts posit hacking as a means to wobble the trajectory of late capitalism, we argue the inverse is true. Hacking (offensively through exploits and defensively through cybersecurity) extends and deepens state and corporate proclivities to control social realities. We define hacking as unauthorized trespass, breach, or bypass of trusted systems for purposes of surveillance and potential theft, manipulation, or destruction of information.² These systems are based on communication networks in which service providers and users must be authenticated to access goods and services. Therefore, user trust in their security and reliability is essential.³ We focus on the hacking of trusted systems—and not other kinds of readily accessible systems—because the template for their protection has been refined in key areas of law, technology, and society.

We posit hacking as a generalized symbolic medium, like power and money, which can be collected and mobilized to influence communication systems. In the process hacking affords opportunities to bypass existing law and policy through force. Our purpose in Why Hackers Win is to examine hacking as a corporate and state strategy for managing risk. Ulrich Beck claims that being at risk is the way of being and ruling in the world of modernity; being at global risk is the human condition at the beginning of the twenty-first century (2006, 330). Given the immense complexity of the Network Society, state and corporate actors seek greater self-awareness and certainty. Hacking enables these actors to seek out their blind spots in online boundaries and activities. This knowledge is valuable for maintaining systems and exposing risks. Hacking (offensively through exploits or defensively through cybersecurity) reflects common social impulses to survey, to measure, to model, and to predict. While hacking often is viewed as essentially disruptive to social structures, we argue the inverse is true. States and corporations seek to maintain their standing and seek competitive advantage through hacking campaigns. The creation of markets for exploits and cybersecurity also affords new opportunities to develop and exchange commodities. Consequently, to preserve national-security prerogatives and develop global markets for hacking technologies, states have resisted legal regimes to contain hacking by institutions—even as they have enacted draconian laws against hacking by individuals.

We find that hacking and cybersecurity reinforce and accelerate each other in trusted systems. While ostensibly antagonistic, both increasingly share a common grounding in intellectual property. For hackers the value of hacking victims, or data subjects, is not so much in their personally identifiable information, which is gathered and commodified by trusted systems. Instead, hackers exploit the intellectual property that gathers and commodifies this information within these systems to squeeze revenues through phishing and fraud. A secondary value is that hacking provides data for valuing insurance products and refining cybersecurity products already in use. In turn, cybersecurity offers possibilities for developing intellectual property in the military and civilian sectors, particularly in software and services. Both private security firms and state military and police forces claim to have evolved cybersecurity and cyber warfare into a science, in which knowledge and expertise are increasingly institutionalized in higher education and corporate management. Both markets and militaries view offensive hacking techniques (intrusion software like malware and botnets) and defensive countermeasures as new opportunities to generate power and money and manage risk.

Much like the dual-use nature of exploits themselves and consistent with other domains in the Network Society, the boundaries between private and public are blurred and indeterminate. In the neoliberal era the economic system has assumed more and more responsibility for allocating risk through the market function of pricing, and the state has turned more areas of social welfare over to markets in an elaborated process of risk management and deregulation.⁴ Similarly, states increasingly outsource both hacking and cybersecurity as a means of managing risk. Internet service providers perform state surveillance by proxy, and states (including the United States) frequently employ independent spyware and hacking firms to supplement their operations. Innovations such as insurance against corporate hacking and identity theft also reflect the commodification of hacking risks. When these responsibilities are outsourced to the market, risks are distributed in patterns that can reinforce social inequalities. The economy provides markets for risk management, but with the economic exploitation of the risks it sets free, industrial society produces the hazards and the political potential of the risk society (Beck 1992b, 23).

Through all these means hacking represents an interface between technical code (the structure of trusted systems), legal code (the laws that govern their access and use), and social code (their impact on society, particularly in terms of privacy and sanctioned activity). As a growing portion of the global economy is based in digital trusted systems, we find a proportional growth in the vulnerabilities inherent to these systems: the buggy software, the unprotected account access, and the availability of personally identifying information to others on the internet. Although hacking ostensibly undermines their own security, corporations and states paradoxically use hacking for gain. Hacking can suit a broad spectrum of purposes, including gathering intelligence, managing crises, and accumulating competitive advantages over rivals. Some exfiltration hacks have successfully stolen data such as business plans, while some failed episodes have landed spies in jail (Landau 2013). The hack-back, an attempt by victims of cyberattacks to get into the hacker’s computer, can try to ascertain the fallout from the initial breach, as well as knowledge about any new schemes and risks of future breaches. While examining abuses of power through computer vulnerabilities and exploits, we have not found master conspiracies of surveillance and espionage, or even a systematic imposition of will, in coordinated hacking campaigns. Instead, we see a proliferation of agents contributing to offenses and defenses played in long games and embedded in global networks. In our view hacking has become a mundane, business as usual application of force for many enterprises.

The development of hacking and cybersecurity together also foregrounds paradoxes for social systems. Hacking is now integrated into state and corporate activities, especially where business or security interests are invested in maintaining trusted systems. Organizations may hack for advantages over rivals by exploiting vulnerabilities in trusted systems. At the same time organizations may hack their own trusted systems or invite others to hack them (sometimes called penetration testing or pen testing) for purposes of cybersecurity. Red Team v. Blue Team exercises take pen testing to active warfare levels—one team trying to break in while the other defends. (In cybersecurity gospel Red team ALWAYS wins eventually. Blue just holds on as long as they can.) Red teaming is embraced and institutionalized by the U.S. Department of Defense, where in the cyber world, offense and defense stemmed from the same tools and techniques (Kaplan 2016, 260). In all these scenarios hacking activity provides recursive knowledge about trusted systems and the communication systems in which they are embedded. In turn, these reflexive processes can exercise coercive force in these systems. Whether or not they encounter defenses, an exploit delivered through the right attack vector can contribute to cybernetic feedback loops within systems. These loops appear to be generated with increasing frequency, as hacking campaigns (or cyberattacks) proliferate together with mass data breaches.

Our approach to technology foregrounds the role of human agents and institutions in communication. We argue that technologies are socially constructed rather than deterministic and autonomous. Notwithstanding the impact of technological change on the economy and society, even our most powerful technologies do not operate independently of human controls such as market exchange, law, policy, and cultural norms. Why Hackers Win takes a sociological perspective on hacking, viewing it as one of many activities that constitute communication in social systems. If we view the cybernetic arena as a social system, hacking serves to differentiate the components of this system, which then adapts accordingly. The system as a whole is reconfigured, with consequences for political, economic, and legal systems, among others. Hacking and its codependent, cybersecurity, therefore contribute to encoding communication in social systems rather than undermining them. This idea is informed by Jürgen Habermas’s (1984, 1987) theory of communicative action and his dualistic system and lifeworld analysis of modern societies. Accordingly, hacking is related to digital piracy as a means of cultural reproduction (Burkart 2011, 2014). In the absence of a tightly regulated market for cybersecurity and component exploits, hacking has greater freedom to steer interactions between states, markets, and laws. If the legal system were to suppress the proliferation of commercial hacking tools and spyware, the risks perpetuated by cyber insecurity might improve. But the legal system is not designed to do this; in fact, it contributes to systemic risk by enabling legal or gray markets for vulnerabilities. We argue that the conjoining of intellectual property and cyber defense in copyright law and policy adds additional levels of risk for society as a whole. This is in part because hacking and data breaches are not just episodic bugs; rather, they are routine and institutionalized features of the system. The growth of cybersecurity software and related industries also impact these institutions and routines, contributing social effects in the process.

Although social-technical systems for media, business and finance, and defense are increasingly globalized, the nation-state still provides the basis for law and policy governing hacking. But the coherence and continuity of law and policy within nation-states can fall on a continuum from anarchic to totalitarian. Hacking therefore illustrates governance in areas of limited statehood (Risse 2013). The relative dependence or independence of hacking on law and policy can turn on a variety of factors. Why Hackers Win addresses cases where new laws on hacking have conflicted with both received policy traditions and emergent policy regimes and where hacking still occupies legal gray areas. Judicial review is not fully incorporated into many decision-making processes; broad categories of hacking remain the privilege of the state and therefore are exempted from the rule of law. Even hacking by private firms may be absolved by the state (such as when telecommunications carriers received retroactive immunity from illegal wiretapping violations).⁵ Secrecy and self-regulation are the rule for states and firms, with little concern for values and norms for personal privacy.

Numerous national and international legal systems have categorized piracy and hacking as cybercrimes, which has intertwined their history and led us to consider them as distinct but related aspects of communicative social action. As with piracy, the conflicts surrounding trusted systems center on issues of ownership and control, based on the right to share private property or exclude others from access. It remains as unlikely today as it did in 2006, when we wrote Digital Music Wars, that a universal standard for digital-rights management will be adopted by even a single industry. But the reprising of digital-rights–management models for managing cybersecurity risks and the securitization of intellectual property in military cybersecurity policy suggest that guidelines for intellectual-property theft will dominate discourse over how to define and prioritize cyber threats. We also anticipate that enterprises dependent on trusted systems will employ technology practices, legal activities, and political lobbying to strengthen pecuniary rights at the expense of the public good. However unjust they may be, consumption norms already have gelled for trusted systems—along with their bases in surveillance and intellectual property (Burkart 2010, 2014). In the aggregate of digital dirty tricks and the attack vectors that enable them, we find an unfolding, alternative history of technological development and its impact on society. We conclude our study with a reflection on the overt and covert applications of hacking and cybersecurity by states and corporations and the importance of research and activist groups in drawing attention to these activities. Without their efforts the question of who is responsible for guarding the public interest in the Network Society seems to answer itself: no one. The development of hacking and its double star, cybersecurity, offers another example of how ostensibly resistant technologies and practices may be contained, controlled, and repurposed to suit the instrumental purposes of state and corporate power.

ACKNOWLEDGMENTS

Thanks go to the Department of Communication and College of Liberal Arts at Texas A&M University and the Department of Communication and Media Studies at Fordham University for institutional support. The Global Fusion consortium and NORDICOM also contributed in numerous ways. Allan Alford, Steve Bales, Göran Bolin, Sandra Braman, Stuart Brotman, James Caverlee, Barbara Cherry, Christian Christensen, Miyase Christensen, Jonathan Coopersmith, Gregory Donovan, Rob Drew, Cecilia Ferm-Almqvist, Johanna Jääsaari, Elaine R. Kahan, Emmett Krueger, Lucas V. Logan, Vincent Mosco, Jeffrey J. Radice, Brian Rose, Mary Savigar, Harmeet Sawhney, Dan Schiller, Lyn Uhl, Katja Valaskivi, and Peter Yu helped with motivation, conceptualization, research, editing, and publishing. Tom McCourt owes Jane Juliano a particular debt of gratitude for gently placing his hand back on the tiller.

CHAPTER ONE

On the Structures and Functions of Hacking

Individuals and groups may hack, or disrupt online systems as a means of causing mischief or creative destruction, while hacks by states and corporations may involve coordinated campaigns to gain political and economic advantage over rivals. Hacking, like espionage or an everyday ruse, is based on ingenuity and deception. It employs techniques to evade detection, redirect attention, and blur identities. We define hacking as changes made, without permission, to the confidentiality, integrity, and accessibility of computerized data or networks.¹ Jurisprudence typically regards hacking as unauthorized trespass, via the internet and networked devices, into trusted systems for purposes of surveillance and potential manipulation.² Hacks exploit attack vectors, which are technical vulnerabilities providing points of entry by attackers into trusted systems. We discuss many of the most common attack vectors, including known vulnerabilities, phishing, malware attacks, and brute-force password hacking.

As much as a hack functions as a cultural and technological magic trick that illuminates its social milieu, it also represents an agonistic exercise of political, economic, and social power. A hack can be legally interpreted as malicious intent toward a targeted individual or institution, even if it is found to have been a wrong turn down the paths of a trusted system. A hack also may serve a symbolic function as speech, either as a discrete speech act or as part of a coordinated campaign. It may create a ripple effect that first influences interconnected sociotechnical systems such as e-commerce and online banking and then ripples outward to political systems. Regardless of actor or intent, the apparent pervasiveness of cyberattacks today by intrusion software and distributed denial-of-service (DDoS) botnets (botnet is a portmanteau of robot and network) suggests that surveillance, disruption, and loss of privacy are now basic costs of living with trusted systems both online and offline.³ Trusted systems are essential for online commerce, banking, media entertainment, and a host of other activities. With promises of ever-greater convenience, firms drive consumers to these systems, and the data that consumers wittingly and unwittingly contribute about themselves provides firms with increasingly granular user profiles and the ability to track and predict user behavior.

The closed nature of these networks is crucial to their legitimacy and engendering the trust of participants. Yet as more and more members of the public have their personal data collected, analyzed, and compiled into databases by third parties, these data subjects (in European Union parlance) increasingly are exposed to identity theft, financial disruptions, doxxing, and cyberbullying. Cloud computing already has introduced a new scale to the communicative effects of hacking (Mosco 2015). As a growing number of trusted systems connect smart devices like refrigerators, webcams, and digital video recorders to online services, the empirical bases for trust in these systems continues to erode even as these systems become ubiquitous. According to Gartner Research, the global number of Internet of Things devices has surged nearly 70 percent, to 6.4 billion, between 2014 and 2016. By 2020 the number will reach 20.8 billion (Lohr 2016, B3). Given that every thousand lines of software code has, on average, fifteen to twenty defects (Perlroth 2016c, F5), the Internet of Things promises a vast playground for hackers. For example, unsecured gadgets can be remotely commandeered to join in a network of robotically controlled botnets, which in turn can be converted into a targetable swarm cyber weapon (Limer 2016).

Hacks can employ many attack vectors to breach trusted systems, including printers, routers, USB drives, email attachments, infected web pages, and fake browser plugins. Once a system is breached and a payload (or recombinatory software code) is dropped, intrusion software can perform countless functions. It can take over a system for surveillance, destroying its data or holding it for ransom (i.e., ransomware, which increasingly bedevils individuals and institutions through online extortion). Intrusion software can also exfiltrate (exfil) or remove sensitive information from the network. Mass exfiltrations of account databases have leaked private data and personally identifiable information of millions of credit card users, subjecting them to possible identity theft. Email exfiltrations can lead to doxxing, in which private information on individuals is released on the internet with malicious intent.⁴ Intrusion software can also replicate in a botnet system, allowing a remote server to commandeer enslaved devices: Cybercriminals use special Trojan viruses to breach the security of several users’ computers, take control of each computer and organize all of the infected machines into a network of ‘bots’ that the criminal can remotely manage (Kaspersky Lab 2018).⁵

Zero-day vulnerabilities—unknown or unaddressed holes in program or network security, so named because they are newly discovered, or zero days old—allow anyone with knowledge of these systems and a fluency in the appropriate coding language to penetrate