To boost computer security, let's try tough love - As a society, we use criminallaws to control unwanted behavior.
People who break into computers can be jailed. But inadequate security makes many agency computers vulnerable. Studies document a continuing problem with computer security. We need to do better, and the traditional criminal law approaches are not helping. The current computer crime laws are directed only at those on the outside of the computer systems that we are trying to protect. The law may create a deterrent to dangerous or unwanted conduct.
People who break into computers can be jailed. But inadequate security makes many
agency computers vulnerable. Studies document a continuing problem with computer security.
We need to do better, and the traditional criminal law approaches are not helping.
The current computer crime laws are directed only at those on the outside of the
computer systems that we are trying to protect. The law may create a deterrent to
dangerous or unwanted conduct.
At least, it may accomplish the purpose as well as other criminal statutes do--not very
well.
But is current law the most effective way to improve computer security? Probably not.
Computers have become an integral part of our everyday lives. We rely on them for
essential agency functions. Telling hackers not to break in is OK as far as it goes.
But we need to get the attention of computer users themselves. They are the people
responsible for security of their computers. They can be more easily encouraged to do the
right thing than some 14-year-old whiz kid.
But neither computer and network users nor their managers have enough incentive to make
security improvements. If they did, then security wouldn't be so lax. Perhaps we can use
the criminal laws to affect the behavior of users, as well as hackers.
I have two modest proposals to improve computer security by defining some new crimes.
First, let's make it a crime to post a password on a monitor frame or anywhere else in
public view. Write your password on the wall, and you could be prosecuted.
In my travels through government and private offices, I have routinely found passwords
posted where anyone could see them. My favorite was the password that my bank kept taped
to the screen of a computer that sat in full public view just off the lobby.
I recently spoke with a doctor who told me that he shares a computer with his
secretary, and they have a common password. Because the password changes routinely, the
secretary kept it taped on the wall. That allows the doctor to access the computer without
any bother. Of course, it also allowed anyone who wanders through the clinic to do the
same thing.
I suggested that perhaps the password could at least be taped inside a desk drawer so
that it wasn't on public display. The doctor, never having thought about computer security
before, agreed.
That illustrates part of the problem. Ordinary users don't think about security. A
criminal statute might offer an effective incentive to get people to protect passwords. In
fact, a criminal statute on passwords might produce the greatest overall improvement in
computer security at the lowest cost.
The basic idea is appealing, and passage of the law would generate enormous publicity.
People might actually consider computer security just long enough to stay out of court.
My second proposal is similar. If you are a computer or network user, and someone
breaks into the computer for which you are responsible, then you go to jail.
Too harsh? A user can defend himself by showing that he took all known and reasonable
steps to plug security holes. If a hacker used an access method not easily foreseen, then
the user gets off.
If the hacker, however, was able to break in using, for example, the factory installed
password, then the user is at fault.
Remember the Robert Morris worm incident from 1988? Morris sent a message that
multiplied and ultimately crashed computer systems all around the Internet. He used known
security holes to obtain the desired access and pass his message to other computers.
Any user who had up-to-date security could have immunized his system from the Morris
attack. Had even a single computer user also been convicted for negligent security, it
would have sent a blaring signal to others that sloppy security practices will not be
tolerated.
Would a criminal penalty really provide an incentive to users to protect passwords and
otherwise improve computer security?
You never know, but whatever we are doing now to enforce computer security isn't
enough.
Sending violators to jail may be a bit much, but a nice stiff fine would serve the
purpose just as well.
Robert Gellman, former chief counsel to the House Government Operations Subcommittee on
Information, Justice, Transportation and Agriculture, is a Washington privacy and
information policy consultant. His e-mail address is rgellman@cais.com.