by Jason Snyder

Hack, snoop, and snitch vigilantes

news
Aug 25, 20063 mins

Comverse ex-CEO Jacob Alexander’s one-minute Skype call has put information technology once again into the crime-fighting limelight. On the lam and wanted for securities fraud, Alexander was tracked down yesterday in Sri Lanka despite opting to connect with a colleague via the arguably more secure peer-to-peer VoIP technology.

Dramatic, yes, but in an era when data mirroring and SWIFT messaging technology have the U.S. government privy to information beyond the scope of its controversial financial transaction investigations, questions regarding the use of information technology in pursuing criminals persist. Jurisdiction vs. technological ubiquity chief among them.

To wit, in today’s Police Blotter, News.com’s Declan McCullagh outlines the exploits of “Unknown User,” as he has been referred to in a recent court briefing. Unknown User’s implementation of Trojans has thus far led to the convictions of two men on counts of sexual exploitation of children. Whether Unknown User’s intention in planting Trojans was simply to uncover child pornography on individual’s hard drives is unknown.

What’s worth noting in McCullagh’s account is that the FBI, in a pre-emptive extension of diplomatic immunity, subsequently encouraged Unknown User to continue his vigilante hacking, guaranteeing freedom from prosecution based on his residing in Turkey (citizenship appears to have been implied). Contracting individuals beyond U.S. borders to circumvent federal privacy laws is a curious mode of outsourcing indeed. One that begs the question as to how many bank accounts and passwords, etc., Unknown User – and others like him – has been privy to in trolling, presumably, for leads.

Whether the ends in such cases justify the means is, of course, central to the debate over privacy rights in an increasingly plugged-in world. International law expects to become only more complicated as computing technology further conflates with everyday life. And with indiscriminate proliferation central to most malware campaigns, such as those undertaken by Unknown User, a collateral-damage-be-damned approach to outsourced law enforcement could lead to some seriously risky business.

Who, for example, wants to be the last corporation on the block not to reap the sideline advantages of “encouraging” – or setting up – an outsourced regulatory-compliance watchdog? Far-fetched, perhaps. But if the mantra is, Fish for something prosecutable to justify access to other, potentially more valuable data streams, who knows where all this “justifiable” hacking will lead?

When it comes to tracking down child molesters, stock scammers, and terrorist financiers, lines may be more readily drawn. But the precedents set by these cases will have far-reaching effects, particularly if this hack, snoop, and snitch vigilantism breeds.