A group of highly dangerous individuals has just met in Las Vegas. Among other crimes, they broke into electronic voting machines and altered the code inside them so that they played pop music, they cracked automatic teller machines (ATMs) so that they would deliver all the money inside them, they disabled a supposedly high-technology device that would prevent a gun being fired by an unauthorized person and they penetrated high-security corporate systems.
All of these “criminals” were gathered under the gaze of police and security officials. Yet not a single arrest was made. This was because the event was the annual DefCon hacking conference, which with its California counterpart, the Hackers’ Conference, brings together computer geeks from all over the world. Whether they are young nerds who have taken time out from an online life lived almost exclusively in their proverbial bedrooms or highly-paid professionals from the computer security industry, this was a collection of individuals with the coding skills and knowledge to wreck most of the protection ordinary computer users fondly imagine guards them from outside intrusion.
Their abilities are truly frightening. They can make fools of those who have developed supposedly un-hackable expensive physical devices and software systems marketed as the last word in high-technology safety. The alarming truth is that the last word actually rests with these hackers.
The first reaction is naturally that such very public assemblies of technological talent should be banned. But the truth of course is that if they were, they would merely take place online in concealed corners of the web, just as the Dark Web already houses an apparently vibrant criminal marketplace in ingenious and devastating hacks, stolen passwords and identities.
By encouraging the hackers to come out into the open and show off their skills, the cybersecurity industry actually benefits. It is not simply that these highly-accomplished hackers can show the industry glaring vulnerabilities in supposedly secure systems; it is also true that the conference rooms are patrolled by recruiters from the cybersecurity firms anxious to recruit the brightest and best from the hackers.
It needs to be understood that hackers share the mentality of mountaineers. They crack code because it is there. For them the morality of breaking into someone else’s system is of little importance. The intellectual challenge is everything. The problem is that once they have pulled off a hack, not unnaturally, they need to boast about it to their peers. And therein, of course, lies the great danger, since not all their fellow hackers are merely interested in the hack itself - they want to exploit it for criminal purposes.
What these legitimate hacking events prove beyond all reasonable doubt is that there is no such thing as a completely secure computer system, just as there is probably no such thing as a secure house or office, even if every sensible security measure is taken, every window shut tight, every door locked. Burglars have duplicate keys and know how to bypass alarms.
Therefore, the message from the likes of the DefCon and Hackers’ conferences is that nothing should ever be taken for granted when using computers and if they contain vulnerable data, that data should be encrypted, which will at least slow down but probably will not stop the hacking geniuses.