![]() | ||
|
February 09, 2000 Those of you that have been reading this space for the last few weeks know that I'm more than willing to look beyond the shallow analysis that is often provided when it comes to the Internet and e-business. As I watched the coverage of the attacks against Yahoo, EBay, CNN, E*Trade and the rest this week, I was struck by the tone of the reporting that appeared to often treat these events with a "hackers will be hackers" and "aren't they naughty" tone. Too often the reporter seemed to view the attacks as the ends themselves, rather than the means for more serious consequences. I believe these attacks are just that, the means for developing a wholly different kind of end game than we've considered so far. I did some nosing around and had some very off-the-record conversations, and it's time to consider that the attacks against these sites are because the sites are unwilling to pay some group "protection" money. In much the same way that a shopkeeper in a city might pay some money each week to make sure his plate-glass windows aren't smashed in the night, a similar scheme may be happening in the Web community, with organized groups making the same demand, but with a cyber spin. After all, creating a site outage through a denial-of-service attack is not something that takes millions of dollars in resources, and the ownership of thousands of computers. Hackers that have contacted me said that this is an attack that literally thousands in the hacker community could perpetrate. The ability to spoof and alias through "innocent" machines and use them as the attack points is well-documented at any number of hacker Web sites. We're stuck in thinking about hacking from a historical perspective, where hackers were usually disgruntled loners who were driven by the chaos caused by the hack itself, rather than by actually pocketing money for using the hack as a way to create fear. In my mind that's wrong-headed analysis. Extortion is the third oldest profession, and in this case it's actually a fairly perfect crime. No one gets physically hurt, the "victim" is exceedingly rich, the problem created by the extortionist is very, very big, and getting caught may not be an issue at all. While much of the focus in the next few weeks will be catching the hackers, and let's assume that they are caught, what happens if the hacker resides in a country with nonexistent laws and no extradition treaty? This attack could be perpetrated from anywhere in the world. And while some states do sponsor physical terrorists and criminal organizations, what's to say that they might not sponsor a cyber equivalent? That may explain a political motive, but what about the most basic motive of all, greed? It's not out of the question that government officials could be in for a piece of the action in return for providing a safe haven. If they'll take drug money, what makes us think that they wouldn't take a little extortion where no one even really gets hurt. This is a whole new class of crime, with a new modus operandi, that we have little if any experience in dealing with. From where I sit, not only does the Web create incredible opportunities for legitimate new business ventures, it also creates some new opportunities for illegitimate ones. This could well be the first very visible and public one. At this point you'd be wise to ask, "Do you know this for a fact, Aaron?" And I'd have to answer no, I don't. Small snippets of conversation here, a phone message there, and some discussions with a few folks as to the possibility that this might happen lead me to think that if it's so possible, why isn't it happening? Do we know that it's not? But Jerry Yang has not called me up to ask for advice about this. Ted Turner has not e-mailed me asking what I think. There's just too much opportunity here for me to think that one of the six or seven potential groups that could support such a "racket" aren't doing it. There's too much to gain. And don't tell me about corporations being unwilling to pay money in this manner. Look at the previously cozy relationship between the Yakuza and senior management in Japanese business. Disguising it would be incredibly easy. It's just a payment to a third-party "development house" that exists in a legally convenient country. Isn't there an AICPA bulletin on accounting standards for payoffs? So color me cynical and cast me as someone that thinks too much of extra-legal possibilities. The reality is I'm not buying the nuisance hacker on this one. Perhaps we should get Oliver Stone to look into it. |
|