Ask HN: What if we legalize cybercrime?
bqp.io
bqp.io
People will be forced to be nicer to one another. People will learn self defense and become stronger and more capable. There will be more gun safety because everyone will be trained in gun use properly. Fewer spouses will cheat.
It will be a great world for everybody.
Obviously this is a thought experiment and probably shouldn't actually be done, but I think the murder comparison is slightly unfair to the idea.
Essentially, the state would have abandoned its job of providing protection and average people would be left to their own devices.
But more importantly, who ever had power in other capacities would be tempted to use murder to solve their problems, including getting people to pay bills on time and stuff. The legality of murder is kind of what separates a mafia-state from a regular state. Murder isn't constant in a mafia state but the strong are willing to prey on the weak ruthlessly there.
Similarly, if hacking is legal, every legitimate software vendor will be happy to put backdoors in their product - and use those backdoors against those too weak to fight back.
Which is to say, the thing the "legalize hacking and people will be more careful about criminals" and similar arguments misses is that the laws have the important effect of making it more likely that only "criminals", people outside normal society, will do crime. When those with power and money also do crime, the average person suffers pretty badly (and the law doesn't guarantee the end of corruption, just makes it a bit less likely).
That isn't necessarily true. It is, for instance, not illegal to make shitty quality products that break down, or provide low quality services. But companies that do that develop a reputation for doing so, and are penalized for it in the market place.
That is to say, if you were to legalize cybercrime, yes, some companies would try to capitalize on that. But others would then move to fill that hole in the market place by being honest. And once their credibility and therefore future profits are predicated on that honesty, they will be highly incentivized to protect it.
This is vaguely analogous to the argument that security by obscurity is bad. If our computer networks and systems are secure due to the threat of violence of the state and not due to their inherent security, are they really secure?
Now, I think the nuance here is that sometimes this sort of argument is correct and sometimes it is not. When two forms of safety compete, they crowd each other out.
- When the state prevents murder, people don't have to. - When the state prevents cybercrime, vendors don't have to. - When your security procedures are secret, they're harder to exploit (until they become known).
Sometimes the tradeoffs involved are good, and sometimes they are bad. In the cases of the two cited instances on the ends, which is which is pretty clear. But #2 pretty clearly falls somewhere in the middle. Why that is true can be seen by analyzing the likely components of that value equation:
- How good is the state at preventing thing X? - What would the cost of that burden be on the private sector?
In the case of murder, the state is pretty good at preventing it - not nearly as much in the case of cybercrime. The cost of everyone protecting themselves from murder at all times would be astronomical, as there is no scalable way to do that. The cost of software security on the other hand, is not nearly as high.
So, while it likely still ends up to be a bad idea on balance, I think there is an interesting case to be made in that direction, at least as a thought experiment.
That really depends on both the jurisdiction and the product. The USA is the exception not the norm here, and even in that regard still has strict laws on big ticket items like appliances and automobiles.
The top commenter analogized, jestfully, legalizing homicide with legalizing cybercrime [1]. A second comment said this comparison was unfair [2]. My comment [3] responds to that second comment.
In essence, if a state's claim to a monopoly on violence is legitimate, then its claim to protecting property rights is (almost) as valid. Thus, advocating a dissolution of the latter, e.g. legalizing cybercrime, can be compared, as a legal argumentum ad absurdum, with permitting murder.
[1] https://news.ycombinator.com/item?id=13266097
They aren't relinquishing their theoretical right to control it. They are simply choosing not to for practical reasons.
Or maybe I should just read this as a punchy response, rather than a decent analogy. In which case I should probably just downvote the comment as sensationalist ;)
Basically this is what happens at the international level, since there is no global authority - countries can kill as much as they want. And they established themselves through killings.
If you do that at the local level, you will end up with the same - lots of warlords establishing themselves through killings, assisted by forming alliances, etc..
One of his earlier works, with their contemporary-culture-driven stereotypes; nonetheless interesting.
P.S. A lot of murder in today's world is currently de facto "legal", whatever some doctrine written down somewhere may say. Having an honest perspective towards, recounting of, and analysis of this might improve our approach to building and maintaining societies.
P.P.S. I'm not advocating for murder, but for a more honest conversation about power dynamics -- and communication of this to younger people learning to navigate the world.
Murder is the permanent end to a human being's life.
The difference makes your argument a non sequitur.
But one reason that's not mentioned is that it's horribly asymmetric:
> Let me paint a utopian world for you, where all kinds of cybercrime – hacking, ransomware, DDoS, etc. – are entirely legal.
It's much more expensive to defend against a DDoS attack than it is to launch one. Granted, if we did live in a world where cybercrime was legal, and things like IoT cameras were much harder to subvert into a free botnet, it might become more expensive, but in the end a lot more effort would be put into prevention than would be put into cause.
If 10,000 IPs are syn flooding, all out of one ISP, their peers can stop routing that ISP's traffic until that ISP starts mitigating.
I imagine the biggest impracticality is that ISPs are monopolistic, so if you stop routing someone like Comcast, all of a sudden half of America is offline.
Perhaps we COULD let the internet be the Wild West, if we had a fair selection of providers, or if they effectively self-regulated.
The Tier 1-3's mostly don't care since they're paid primarily to provide the line plus have regulators in their pockets. There's certainly work in these to reduce DDOS a bit for competitiveness but they avoid a simple solution like mine out of greed. ;)
Who would pay? My name is Serhei, and I'm in Ukraine, and I just unleashed a 100k-strong botnet of smartbulbs and babycams. It's spread somewhat evenly across American households, and mostly among their ISPs. I still pay nothing.
I reckon the biggest problem would be that you could DoS an entire ISP simply by doing a SYN flood attack from inside it.
At first glance it seems like "Oh if only cybercrime were illegal then companies would have to step up their security practices." But this just isn't true. The companies responsible for the security holes in IoT devices are not the ones who suffer because of the DDoS attacks launched with them.
Similarly, the free market response to the current reality of cyber crime is not for makers of vulnerable devices and software to simply make better products, but it is additional services and companies rising up to fill needs. Some of these are effective and others are not, and they all cost a lot of money for the victims of the attacks, and not for the people making vulnerable products.
For me this blog post was really lazy and needed a lot more thought put into it.
Only because there is little incentive to change our infrastructure to mitigate such attacks. If we change to content-based addressing that utilizes pervasive multi-level caching, then every DDoS becomes instantly futile.
I like that this article looks at the distributed, societal-level effects that derive from law. But I find the "should consider moving in that direction" part to be perplexing. One straw-man take against that: what about defense in depth? Can we strongly incentivize secure software and software-based appliances and still have legal deterrents against cybercrime perpetrators?
People still don't care. And it is still asymmetric in that the people with loose security aren't being hurt by their own loosiness. And it is still impossible to ensure your system is completely secure. And it is still asymmetric in that attackers only need one flaw to win, defense must fix every flaw.
It's not like the "Nobody will do this" stuff makes much sense at the moment given there are hacking stories in the press all the time.
The author points to these items:
- The value they expect to gain for themselves by attempting the attack.
- The probability of getting caught.
- The punishment they expect to receive if they do get caught.
Legalizing cybercrime would have some positive effects, for sure, but also many negatives, as discussed.
What if we tried to minimize "value they expect to gain for themselves by attempting the attack"?
Here's a twist, I'd like to consider minimizing that by breaking it down further. There are two important components here:
1. the value
2. the who (the boundary of what's included as part of "themselves")
I look at myself as an example here. I personally have very little interest in harming others. Even if I were in a hypothetical situation where I knew I could do something with low chance of being caught and/or low punishment, I still wouldn't take advantage of that situation. In fact, I would really enjoy being nice/white hat in such a situation. But it's not because the value is low, it's because I consider "myself" as the overall humanity and not just myself the person who's typing this comment. My goal is to maximize the benefit for everyone by creating net positive value. I know that if I could to DDoS or steal money from someone, even if it's risk-free or legal, I still wouldn't do it just because it doesn't benefit all of humanity (even if it benefits myself)... the value as I see it is overall negative (I gain less than someone else loses).
So I wonder if it's possible for more people to look at things that way, where they try to maximize value for everyone rather than themselves. Can we increase people's empathy? But most importantly, if everyone behaved this way, would that actually be better for us, or would absence of selfish behavior and competition be harmful?
Psychopaths exist. What do we do about them?
Yeah, it's a real problem that needs to be addressed when discussing empathy.
It's the wild west; government has abandoned it's responsibility to protect its citizens and institutions, and for some reason very few people object; they accept it as the norm.
While they have their issues, properly administered they are a win for security researchers, consumers and companies.
A great recent example is Shopify: https://news.ycombinator.com/item?id=13200455
This is bad logic, increasing punishments does not necessarily mean more innocent people get caught.
It's not necessarily that more innocent people get prosecuted, but that when they do the stakes will be higher.
Intelligence or military cybercrime is definitely legal to the ones doing it. Some places or countries are too small to enforce or don't care about it. Some people are probably helped by funders who have bribed their way into legality.
Yeah, I'm not digging this dystopian future. On the plus side, it would bring typewriters back into common use.
Never, ever, use biometrics as a valid login option for identity-sensitive data/applications. They're way too easy to find out for an attacker.
brb picking up an old google phone on craigslist