How do I teach ethics in hacking?

I teach a course on hacking every other year. It's a very difficult class, and it only attracts kids who are really enthusiastic about delving deep into the bowels of gdb, stackframes, format string vulnerabilities, buffer overflow attacks, and the like. 1

At the beginning, I give a short lecture talking about ethics. The basic analogy that I draw is to a locksmith: a good locksmith can get into your car, and can get into your house. But an honest locksmith does not, because the lock that is in place communicates that he or she is not supposed to enter. Thus, a good lock is there to keep out honest people.2

From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

The question, then, is is this a sufficient message to impart? If not, what more need be said? Bear in mind that it is not actually a course in ethics per se. I really can't spare more than about 15-20 minutes to impart the most important ideas, so I really want to make that short time count.

¹ The course largely emphasizes security holes from the 90's and the 00's. This isn't to prevent them from being able to work in modern system, but because you can study the attacks we focus on in relatively pure forms using virtual machines from that time, so we don't have to spend time working around more advanced security features. And learning about those attacks in any depth is already plenty hard!

² The lock may not be effective against, say, a determined burglar. But it helps people who generally wish to stay honest avoid temptation and conquer moments of ethical weakness.

• The door analogy is very nice, but a bit flawed. It might be good to talk about the difference between security and privacy. I'd also make clear that some security is enforced via technology (those are the ones the course is about), but there are other ways to bring you security, such as laws. So even if a specific measure turns out not to be technically effective, it might still be illegal to disregard it. So apart from ethics, which are hard to teach, you could also focus on what is lawful. – Pascal Jun 25 '17 at 9:39
• Why not expand on justice and rigorous / formulaic approach to the subject? After all, it is not unique to hacking. Many programs that work with humans must incorporate the concept of justice, s.a. bandwidth distribution to the networking entities, elevators transporting people, traffic lights and so on. I also don't believe in ultimate statements like the one implying that breaking into other computers is always morally reprehensible. Trivial examples are good to motivate thinking, but, ultimately, students should make their own decisions. – wvxvw Jun 25 '17 at 11:24
• Realistically, the legal aspects are just as important as the ethical ones. Locks are also different - almost all all vunerable, whilst secure software may be fairly secure. – Sean Houlihane Jun 25 '17 at 12:30
• I'd suggest you teach how black hat hackers are punished, but Robert T Morris turned out pretty well off. – Ellen Spertus Jun 25 '17 at 13:55
• Please compare cracker and hacker. – styrofoam fly Jun 25 '17 at 16:01

I like your locksmith comparison, but I don't agree with the following assertion:

From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

What is wrong is to use your hacker skills in order to perform unethical actions. Hacking per se is not unethical, as it is not ethical or unethical to use a key to open a door. For the sake of comparison, a locksmith can ethically use her skills to open the door to your apartment... if you called her after you lost your keys. But if she opens the same door when you're away in order to steal your stuff, the same action becomes unethical, because the goal is now different.

Aside the goal, one has to think about the yield of a hacking attempt, i.e. what one would do when he actually found a weak point in a system. Let me illustrate this with an example.

When I was a student, I was talking with my friend about IT security and we started talking about SQL Injection. Long story short, I tried to connect to the University website using his name and " OR 1 = "1 as a password, and it worked. I got access to his account, his personal information, and, if I remember well, his e-mails. This is the actual hacking action, which, by itself, is not ethical or unethical.

From there, I had an ethical choice:

• I could behave unethically and use this weak point to my advantage. For instance, I could push further, trying to connect to the system as a teacher, in order, for instance, to change my grades, or even sell a service to other students to “improve” their grades for a small fee. I could also spy on other students, stealing their personal information.

• Or I could contact IT security staff, telling that they have a slight issue. This would be ethical.

• Or I could do nothing, which would be an ethically-neutral action.¹

Same hacking action leads to three different yields with very different ethical aspects associated with them.

if a security feature is designed to keep you out

What about a system which has no security features? Would you feel ethical doing whatever you want simply because security was not implemented?

Take an example of online games where each player competes against others. One system implemented a cheat protection system which could be easily circumvented given enough programming skills. Another system has no cheat protection whatsoever. How would cheating be unethical only in the first system, but not the second one?

Taking the same example of video games, imagine a different game where the competition notion doesn't exist—there is no online mode, and the score of an individual player is irrelevant for others. The system has a cheat protection system. Why would hacking this system be unethical?

Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

What about the locksmith who's opening the door of my apartment because I lost my keys?

¹ By the way, I did the ethical choice and contacted the staff. The staff never replied, not even to thank me, which taught me two things: ethical choices are rarely rewarded and if someone is acting ethically just to get a reward, he's not that ethical after all.

• Welcome to Computer Science Educators! This is a very clever distinction. I sure hope we'll be hearing more from you. – ItamarG3 Jun 25 '17 at 9:10
• Welcome to Computer Science Educators Arseni! I know @ItamarGreen already welcomed you, but I wanted to add that your answer is excellent, very well thought out, and was interesting to read. I hope that I'll see you around the site writing more excellent Q&A! – thesecretmaster Jun 25 '17 at 9:56
• This is an interesting one. Whilst I do agree with you that trying an SQLi isn't ethically wrong (and I think you did the right thing), it's probably not lawful and this could do with being mentioned in the context of a class on security. – Adam Williams Jun 25 '17 at 16:39
• Isn't disclosure to the controlling institution of a vulnerability required by ethics? – Bennett Brown Jul 2 '17 at 3:25

First please be very cognizant of the term "hacking" Some of what you are describing is "cracking" not "hacking" The techniques may be the same but the intent is different. I think you are having problems with this because you yourself aren't comfortable with making this distinction.

You cannot prevent someone who is rotten to the core from taking your class and abusing what they learned so don't beat yourself up trying to head that off. If they are rotten they will make you think they are an angel with a halo.

Instead why don't you assign them as the very first assignment, to write a short 1-2 page paper on "what does the difference between cracking and hacking mean to me" Then take the best 5 responses that have the most clearly thought out positive morals, and distribute them to the class. That would likely get the point across better then you saying "cracking is bad, don't do it" when they see their peers don't think it's acceptable. And you might even get a few pearls in, like someone writing about how an identity thief stole money from them and how violated they felt. Behind every successful crack there is a victim and if you can get them to empathize with the victim rather than the cracker, you have done the best you can do.

• When I wrote my answer, I thought of two points: a superficial one, which I covered, and a deeper but more important one, which I didn't. The second paragraph of this answer covers #2 perfectly, and in many fewer words than I would have. Kudos, Ted, +1. Some of the other answers here seem to think that these hypothetical students have simply never spent two seconds thinking about the implications of security violations, or that a few minutes of "don't be bad, it's not worth it" will change someone's mindset; those scenarios strain credulity and seem like the the height of naivete to me. – Piyush Parikh Jun 26 '17 at 2:26
• I never believed that I could cause people to act or not to act in any way. What I can do is try to draw the line of what good actions are; my students possess free will, and will ultimately do as they choose. I am not in control of others. However, our behavior is influenced by context. It is not the "height of naivete" to suggest that moral outcomes are influenced by contextual understandings, nor that a teacher can play some part in setting that context into place. I may not control my students, but I am not without influence. – Ben I. Jun 26 '17 at 3:51

I would go about detailing how much profit a white hacker can get, seeing as many security companies hire them as test attackers.

If any of the kids are tempted be unethical things, then explain that far greater profit can be achieved with greater ease if one chooses to use their learning for good. So that's that (for any student saying "But I can make a lot of money from hacking")

Now, appeal to their sentiment. Ask them how they'd feel if someone could simply type some stuff in some place, and then gain access to ALL their personal information. This includes but is most certainly not limited to:

• phone numbers
• photos, which includes any private photos they might have anywhere that is accessible from the internet.
• their parents' credit cards
• any gamers there: their steam account (that'll scare some of them)

After this shock, explain that each one of those has a security measure taken to protect that information. So if they want to hack that stuff, explain that there are people more or less like themselves on the other side. Hacking is never attacking a computer, it's attacking a person on the other side.

So this can be in addition to what you already plan to say to them. I think that most, if not all, would get the message of the ethics. They'll understand that those protective measures are there for a reason.

This seems insufficient to me, because of the following example at a minimum:

In small towns, people do not lock their doors, or at least they did in bygone days of yore, or so the story goes. If you steal from a house where the door is unlocked, is that suddenly somehow not unethical? What if there was no door on the house at all? If the stuff was just lying around out in the open at a campground?

What I'm getting at is, you said

if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it.

but I would posit that it is generally accepted to be unethical to intrude upon even systems with no security features.

In my own cybersecurity training, I have also been made to sign documents at the beginnings of classes saying that violations of ethical guidelines would be severely punished, by course failure, institutional sanctions and/or legal action. I don't remember the exact terms but they were along the lines of using any systems to hack any systems without explicit permission of the targeted systems' owners. Nor do I know how enforceable they really were, but they made good symbolic points, after the end of the ethics discussions and before the start of any practical security material.

• Isn't this a perfect example, though? The door itself is a security feature. Left unlocked it is poorly implemented, and yet it is still unethical to intrude upon the system. – Ben I. Jun 25 '17 at 8:27
• I wouldn't say it's a security feature, not even a poorly implemented one. Think of a camping site, with tents... privacy as part of a hopefully binding social contract is the limit to our actions, not the "poorly implemented security" of the tent flap. There is no security in a tent flap at all :) – jvb Jun 25 '17 at 8:32
• I am not 100% sure in what situations it is unethical to intrude, but it seems always unethical to take a copy of private information, or to destroy or damage anything. (I have avoided the work theft as this applies to physical goods, where when you take it, it is no longer where it was. This has two very different affects: they no longer have it. You have it. With information, then only one way apply, and they are very different concepts.) – ctrl-alt-delor Jun 25 '17 at 17:44
• @BenI. well, the unlocked door was merely the first step in the thought experiment chain leading to the idea of no security at all. I admit this answer is not my best work; I meant to come back and edit a second half in today, but Ted already basically made the second major point that I wanted to cover. See my comment under his answer for more. – Piyush Parikh Jun 26 '17 at 2:31

If students are learning penetration tools and techniques, they should first be required to learn, at a minimum:

• What is illegal and the civil, criminal, and professional penalties (I have students sign a statement that they have been told that any attempt to achieve unauthorized access to computing resources can result in felony conviction with penalties exceeding \$10,000 and 5 years in prison, even for a novice failure. The statement includes the fact that a "victim" can count as "damages" any costs to investigate the incident and improve their own readiness and defense-- at the crackers' expense. The statement acknowledges that attempts are highly likely to be caught and may result in lifelong exclusion from professional careers including plumbing, electrical, and teaching -- and certainly cyber work.)
• A handful of true stories about people who have been prosecuted, including at least one person from each category:

• A person intending to break the law (e.g. Kevin Mitnick)
• A person not intending to break the law (at times, Masters of Deception)
• A person whose action slid from innocent to less than innocent (e.g. Daniel Spitler and Andrew Auerheimer)
• A person who caused real damage without intending to do so (perhaps a person already described in the previous three cases)
• Ethics education should include teacher presentation, student discussion, and student writing.

I believe that it is typical for a first semester in cybersecurity at the post-secondary level to include 2+ weeks of law and ethics prior to covering tools or techniques. The consensus of professionals at the NICE cyber conference was that extensive ethics education should precede any instruction on penetration and that ethics education should be ongoing through the course, integrated into exercises and instruction.

Talking about ethics in hacking is very different than talking about ethics in any other field.

In hacking, when you talking about ethics, they will listen but when they learn how to keep anonymity, they become curious I know how to stay anon. No one can me or touch me. Then why should I still follow the ethics? Let's use our power.

the about e is not applicable for all students but many of them

I recall a thing happened in my college life,

One of my friend asked my another friend how to get Facebook password, at that time, there was a small vulnerability existed. He didn't teach him. He requested many times and promised that he want it to hack someone's account because of there was a small issue.

He taught the trick and later, the new person, hacked his account :P

So, just telling about ethics is not enough.

You should say, at what extend you are trying to protect your anonymity, you can be caught if you do something wrong. Even if you are in TOR network, they can still catch you.

Try to make some fear in the mind of students that doing such things in wrong purpose is a crime and once caught, they have to pay a huge amount fine plus may get jail.

Ethics + fear can make it.

But ethics alone, not in the case of hacking.

• Personally, I don't believe in fear as an adequate motivator... you will always meet persons who (a) think they are smarter, and (b) some that actually are. There are more components than those two. May I remind we as a society have both got laws and punishment, but nevertheless we still have need for good door locks! – jvb Jun 25 '17 at 8:24
• Anonymity has nothing to do with ethics. This is legal stuff: you get caught, you go to prison: ethics are irrelevant. However, when talking about ethics, you act ethically or unethically independently of the fact of being caught and sent to prison. If I'm 100% sure that hacking your PC won't get me to prison, I still won't do it, because this is against my ethics. – Arseni Mourzenko Jun 25 '17 at 9:13