1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
|
<HTML>
<HEAD>
<TITLE>Computer Hacking and Ethics</TITLE>
</HEAD>
<BODY>
<H1>Computer Hacking and Ethics</H1>
<CITE>Brian Harvey<BR>University of California, Berkeley</CITE>
<P>[A slightly different version of this paper was written for the
``Panel on Hacking'' held by the Association for Computing Machinery in
April, 1985. Thanks to Batya Friedman, Donn Parker, and Carter Sanders for
their comments on early drafts.]
<BLOCKQUOTE>
<P>[Neal Patrick] said he and his friends, who named
themselves the ``414s'' after the Milwaukee area code, did not
intend to do any damage and did not realize they were doing
anything unethical or illegal. In fact, when asked [at a
Congressional subcommittee hearing] at what point he questioned
the ethics of his actions, he answered, ``Once the FBI knocked
on the door.''
<P>-- "`Common Sense' Urged on Computer Break-Ins,"
26 Sept 83; Copyright 1983 New York Times News Service
</BLOCKQUOTE>
<P>It's no secret that a mature sense of ethics is something a person
develops over time. Parents are supposed to exercise authority over their
children because the children are not expected to know how to make certain
decisions for themselves. We have a juvenile court system separate from the
adult criminal court system because we believe that a young person is not
<EM>capable</EM> of criminal intent in the same sense that an adult is
capable of it.
<P>Within this century, the obvious idea that the ethical sense
of an adolescent isn't the same as that of an adult has become the
focus of scientific research. Psychologists have entered a field
once left to philosophers: moral development. The best-known attempt
to formalize this development is probably the six-stage theory of
Harvard psychologist Lawrence Kohlberg. Here is his description of
Stage 3, the Interpersonal Concordance or ``Good Boy-Nice Girl'' Orientation:
<BLOCKQUOTE>
<P>Good behavior is that which pleases or helps
others and is approved by them. There is much conformity
to stereotypical images of what is majority or ``natural'' behavior.
Behavior is frequently judged by intention--the judgment ``he
means well'' becomes important for the first time. One earns
approval by being ``nice.'' [Kohlberg, p. 18]
</BLOCKQUOTE>
<P>Is Neal Patrick at this third stage of moral development? He seems
to judge his own actions in terms of intention. From the perspective
of the stage theory, we can see this as an improvement over ``Our mistake
was to get caught'' or ``What have those computer companies done for
me,'' responses that would be typical of the earlier stages.
<P>I don't mean to give too much weight to the specifics of the third stage.
It's not scientifically valid to assign Patrick to a developmental stage on
the basis of one quoted sentence. Also, not every researcher accepts
Kohlberg's stages. But the important point is that Patrick is
<EM>roughly</EM> at the stage of moral development appropriate to his age. He is
not some new kind of monster spawned by computer technology; he's a kid with
all the strengths and weaknesses we expect from kids in other situations.
<P>Compare a bunch of adolescents breaking into a computer system
with another bunch of kids hot-wiring a car for a joyride. The latter
would probably argue, with complete sincerity, that they were doing
no harm, because the owner of the car recovered his property afterward.
They didn't keep or sell it. It's a ``naughty'' prank to borrow someone's
property in that way, but not really serious.
<P>These hypothetical car thieves would be wrong, of course, in
making that argument. They might lack the sensitivity needed to give
weight to the victim's feelings of manipulation, of fear, of anger.
They may not understand how the experience of such a random attack
can leave a person feeling a profound loss of order and safety in
the world--the feeling that leads half our population to hail Bernhard
Goetz as a hero to be emulated. Some adolescents don't have the empathy
to see beyond the issue of loss of property. Some may show empathy
in certain situations but not in others.
<P>The point is that the computer raises no new issue, ethical or
pragmatic. The password hacker who says ``we aren't hurting anything
by looking around'' is exactly analogous to the joyrider saying ``we
aren't stealing the car permanently.''
<P>(The two cases need not seem analogous to an adolescent. There
may be many computer abusers who would never break into a car for
a joyride, but who don't understand that breaking into a computer
account raises the same ethical issues. But the analogy still holds
for us as adults.)
<P>The professional car thief and the teenaged joyrider are both social
problems, but they're <EM>different</EM> problems. To confuse the two--to
treat the teenager like a career criminal--would be a disastrously
self-fulfilling prophecy.
<P>In the context of computer systems, there is a similar dichotomy. There are
some career criminals who steal by electronic means. This small group poses
a large problem for society, but it's not a new one. Thieves are thieves.
Just as banks use special armored cars, they must also develop special
armored computer systems. But the rest of us don't use armored cars for
routine transportation, and we don't need armored computer systems for
routine communication either. (Of course there is a large middle ground
between heavy security and no security at all. My purpose here is not to
decide exactly what security measures are appropriate for any particular
computer system. Instead, I just want to make it clear that, while in this
paper I'm not trying to address the problem of professional criminals, I'm
not trying to deny that there is such a problem either.)
<P>There is also a middle ground between the young person who happens to break
unimportant rules in the innocent exercise of intellectual curiosity and the
hardened criminal. Consider the hypothetical case of a young man whose
girlfriend moves to Australia for a year, and so he builds himself a blue
box (a device used to place long distance telephone calls without paying for
them) and uses it to chat with her for an hour every other day. This is not
intellectual curiosity, nor is it a deliberate, long-term choice of a life
of crime. Instead, this hypothetical adolescent, probably normally honest,
has stepped over a line without really noticing it, because his mind is
focused on something else. It would be inappropriate, I think, to pat him
on the head and tell him how clever he is, and equally inappropriate to
throw him in prison. What we must do is call his attention to the
inconsistency between his activities and, most likely, his own moral
standards.
<H2>Two Models for Moral Direction</H2>
<P>What to do about it? Saying that the problems of computer ethics
are like other ethical problems doesn't solve them. Many approaches
are possible. We are starting to hear among computer experts the
same debates we've heard for centuries among criminologists: prevention,
deterrence, retribution, cure?
<P>Among all the possible approaches, it may be instructive to consider
two strongly opposed ones: first, control of the technology, and second,
moral training. As examples of these approaches, compare the registration
of automobiles with instruction in karate.
<P>Automobile registration is certainly a good idea in helping the
police control professional crime. As thieves have learned to steal
cars for their parts, rather than to sell whole, the technology of
registration has had to grow more sophisticated: we now see serial
numbers on each major component, not just on the door frame. But
registration doesn't help against joyriders.
<P>Other technological security measures can help. Steering column
locks have made joyriding harder, but not impossible. Many adolescents
are expert locksmiths, not because they're dishonest but because locks
and keys pose a technical challenge much like that of passwords in
a computer system. Also, increased security has made the consequences
of juvenile car theft more serious, because the easiest way to defeat
a steering column lock is to destroy it by brute force.
<P>The example of karate instruction shows a very different approach
to the problem of adolescent moral limitations. Instead of using
technology to limit the power of young people, this second approach
deliberately empowers them. Skill in karate is a deadly weapon; to
give that weapon to a young person is an affirmation of trust rather
than suspicion.
<P>Why do karate classes for kids work? Why don't they lead to
an epidemic of juvenile murders? This paper can't present a definitive
answer. But I want to suggest some possibilities and use them to draw
analogies for computer education.
<P>One probable reason is that every person responds to his or her
situation. If I know you're trusting me with something important,
I'll try to live up to your trust. If I sense that you consider me
untrustworthy, I may decide that I might as well live up to your low
expectations.
<P>Another vital reason, though, is that the technical instruction
in karate techniques is part of a larger initiation into a certain
culture and its rules. Karate schools don't begin by telling novices,
``Here's how to kill someone.'' They begin with simple, less dangerous
techniques; the criteria for advancement include <EM>control</EM> and
self-discipline as well as knowledge of particular moves. Instructors
emphasize that karate is an art that should not be abused. Students learn
to demonstrate punches and kicks without injury by stopping just short of
contact with the opponent's body.
<H2>Empowerment in Computer Education</H2>
<P>How can we <EM>teach</EM> young computer enthusiasts to be responsible
members of the electronic community, without defining them as criminals?
The analogy of karate instruction suggests that the answer is to combine
ethical training with real empowerment. To turn this broad slogan
into a practical program requires several changes in our approach
to educational computing and to computing in general.
<BLOCKQUOTE>
<P>Growth, like any ongoing function, requires adequate
objects in the environment to meet the needs and capacities
of the growing child, boy, youth, and young man, until he
can better choose and make his own environment. It is not
a ``psychological'' question of poor influences and bad attitudes,
but an objective question of real opportunities for worthwhile
experience.... Thwarted, or starved, in the important objects
proper to young capacities, the boys and young men naturally
find or invent deviant objects for themselves; this is the
beautiful shaping power of our human nature. Their choices
and inventions are rarely charming, usually stupid, and often
disastrous; we cannot expect average kids to deviate with
genius. [Goodman, pp. 12-13]
</BLOCKQUOTE>
<P>Paul Goodman was discussing traditional juvenile delinquents, not
password hackers. But the problem is fundamentally the same. How
can we provide a worthwhile culture for young computer enthusiasts
to grow into?
<P><STRONG>1. Serious adult models.</STRONG> In karate instruction, discipline
is not only for novices. The adult instructors follow the same discipline
themselves. The ethical principles taught to beginners are taken
seriously in the adult community. As a result, young students don't
see the discipline of karate as an arbitrary imposition on them; they
see it as part of what it means to be a full member of the community.
<P>In the computer culture, adults rarely take seriously the idea of belonging
to a community. The social ideal is the self-serving entrepreneur. Our
heros are the ones who become millionaires by doing a slick marketing job on
yet another spreadsheet program. (When my high school programming students
discovered that I actually knew how to program a computer, many of them
decided I was crazy. Why should anyone want to teach when he could make
more money programming?) In this context, why should any young person
listen to our moral lecturing?
<P>Fundamentally what is needed is personal action by each individual
computer professional. But we can act as a society to
encourage this individual commitment. We can urge our colleagues
to devote part of their time to <EM>pro bono publico</EM> activities, like
other professionals. We can give special public recognition to computer
professionals who choose a life of disinterested public service over
the quest for personal gain. Some corporations allow their employees
paid sabbatical leave for public service work; we should encourage
this policy.
<P><STRONG>2. Access to real power.</STRONG> Another important part of the karate
analogy is that there are not two kinds of karate, one for adults
and one for kids. What beginners learn may be elementary, but it's
a start down the same road traveled by experts. The community into
which young karate students are welcomed is the real, adult community.
That's not how things work with computers. How many adult computer
scientists put up with CP/M, BASIC, and floppy disks? The technology
available to most young people is not a simpler version of what experts
use; it's a completely separate, more arcane, fundamentally less powerful
medium. That medium--the programming languages, the file storage,
the editing tools, and so on--is simply inadequate to challenging
intellectual work.
<P>The community of computer professionals has come to take for
granted easy access to electronic communication with colleagues anywhere
in the world. Those of us lucky enough to be on the Arpanet have
instantaneous communication supported by taxpayers. Even the less
fortunate who communicate over dialup networks like uucp, though,
have the cost of their mail supported by computing facilities other
than their own; the general agreement among even competing private
businesses to forward one another's mail is a remarkable example of
disinterested cooperation. Some of this mail traffic is serious business.
But some of it is also ``junk mail'' like sf-lovers (for science fiction
enthusiasts) and human-nets. Is it surprising that young computer
enthusiasts want a slice of the pie too?
<P>Adolescents are excluded not only from access to equipment but
also from access to ideas. The password hackers' preoccupation with
magic words and magic numbers is harmful to <EM>themselves</EM> as well as
to the rest of us; it's an intellectual dead end that gives them no
real insight into computer science. They learn a bag of isolated
tricks rather than powerful ideas that extend to solving other kinds
of problems. Instead of just telling them what's forbidden, we would
do better to show them the path to our own understanding of algorithms,
formal theory of computation, and so on. We all know you can't program
well in BASIC; why do we allow manufacturers to inflict it on children?
<P>To take positive steps toward this goal requires action on two fronts,
access to technology and access to ideas. The latter requires training high
school teachers who are themselves qualified computer programmers. In the
long run, this means paying teachers salaries competitive with industry
standards. That's a matter for government action. Another approach may be
to promote active cooperation between university computer science
departments and high schools. Perhaps college faculty and graduate students
could contribute some of their time to the local high schools. (This is not
a new idea; outside experts are donating time to secondary schools to help
teach other areas of science. Such partnership brings its own problems,
because both the goals and the techniques of college teaching are different
from those of high school teaching. Still, this collaboration has sometimes
been fruitful.)
<P>The problem of access to equipment is economically more difficult,
but it's getting easier. The availability of 32-bit microprocessors
means that serious computational power should be affordable in the
near future. Equipment manufacturers should
take the high school market seriously, as an investment in future
technical workers. Another approach is for interested educators to
establish regional computing centers for adolescents, not part of
a particular school, where kids can come on their own time. Economies
of scale may allow such centers to provide state-of-the-art equipment
that a single high school couldn't justify economically.
<P><STRONG>3. Apprenticeship: challenging problems and access to expertise.</STRONG>
The karate student is given not only access to a body of knowledge,
but also the personal attention of a master in the field. The instructor
is responsible for the moral development of his students as well as
their technical skill. He steers them in the direction of challenges
appropriate to each one's progress, and his own expertise is available
to help the learner.
<P>For many years, the MIT Artificial Intelligence Laboratory ran a computer
system with no passwords and no file protection at all. (It was pressure
from their Defense Department funding agency, not internal needs, that
forced them to implement a password scheme.) Even now, the laboratory has a
liberal ``tourist'' policy: anyone can have an account, provided that
someone at the laboratory is willing to be his or her mentor. The
philosophy behind this policy is that most ``malicious'' computer abuse is
the result of ignorance, misunderstanding, and thoughtlessness, rather than
truly malign intent. With a particular person responsible for each new
user, tourists learn to share the values of the community. They are taught
that the vulnerability of MIT's system is a price researchers pay willingly
for the open exchange of information that that vulnerability allows.
Treated as legitimate members of the community, even young tourists quickly
learn to act responsibly toward the group.
<P>Not every computer facility can be expected to share the vision
of MIT-AI. Certainly the computers that control the missiles and
the banking transactions should not be so open to visitors. But a
typical large company has several computers, not all equally sensitive.
Many could allow access to young people in their communities in the
evenings, especially if some of their professional staff members are
interested in serving as volunteer mentors. It's the mentor/apprentice
relationship that makes all the difference. Just giving a kid an
account on your machine may be asking for trouble, but making a friend
of the kid is a good investment.
<P>In particular, universities often treat their undergraduate student users
like irresponsible children. Undergraduates are generally second-class
citizens, with limited access to the school's computing resources, including
human resources (faculty). Universities should allow undergraduates to
function as true members of serious research teams, as graduate students
do. This policy would provide both access to faculty mentors and
challenging, useful tasks.
<P>For secondary schools, the issue is partly one of curriculum. Too many
teenagers are taught (not only in the schools but also in the magazines)
that true computer expertise means knowing what number to <CODE>POKE</CODE>
into what address in order to change the color of the screen on some brand
of microcomputer. Such learning is not intellectually challenging. It does
not lead to a feeling of fruitful apprenticeship.
<P><STRONG>4. A safe arena for moral experimentation.</STRONG> The
beginning karate student might be afraid to try his or her skill with a
fellow student, lest he or she injure or be injured. But it's safe to fight
a match with a black belt instructor. ``I won't hurt you,'' says the
instructor, ``and I won't let you hurt me.'' To allow for safe sparring
between students, classes begin with half-speed motions and no body contact
allowed. Later they may progress to rules that allow light body contact but
no contact to the opponent's head. These rules allow students to feel safe
as they experiment and develop their skills.
<P>Young people have a similar need for safety in moral experimentation.
One of the reasons for the appeal of role-playing games like Dungeons
and Dragons is that a player can say ``I'm going to be a thief,'' or
``I'm going to be evil,'' trying on these roles without actually harming
anyone. Similarly, a good school should be a place where students
feel safe, a kind of ``ethics laboratory.''
<P>Neal Patrick's first exposure to an ethical dilemma should not
have involved the FBI. He should have confronted the issue of information
privacy while using a computer system in his school. He could have
learned how his antisocial acts hurt and angered the legitimate users
of the system, without risking really serious trouble for himself
or for anyone else. For one thing, it's hard for a young person to
understand the chain of reasoning from the abstract corporate owner
of a computer system to the actual human beings whose lives are affected
when that system breaks down. It's easier to understand the issues
when the users are one's friends and classmates, and the social effects
of malicious password hacking are immediately apparent.
<P>(None of this is meant to excuse Patrick or the other 414s.
Neither ignorance of the law nor misunderstanding the ethical issues
is accepted in our culture as an excuse for lawbreaking. But I am not
writing for a court of law meeting to settle Patrick's guilt or innocence.
The question for us is how, as a society, we can act to make the next
generation of teenagers less likely to paint themselves into this
particular corner.)
<P>As a practical matter, what's needed to build an ethics laboratory
for computing students has already been recommended in another context:
adequate computing power to support a user community, as opposed to
a bunch of isolated, independent microcomputer users. Whether this
means timesharing or a network of personal computers with a shared
file server is a technical question beyond the scope of this paper.
But sharing is essential. The ethical issues of a living community
don't arise in the context of isolated individuals using microcomputers
separately with no communication among them. (If we do not fill this need,
we leave a void that in practice is filled by ``pirate'' bulletin boards
that build a sort of outlaw community around illegal computing activities.)
<H2>Appendix A: <A HREF="hacker.html">What is a Hacker?</A></H2>
<H2>Appendix B: <A HREF="lsrhs.html">A Case Study</A></H2>
<H2>References</H2>
<P>Goodman, Paul. <CITE>Growing Up Absurd</CITE>. New York: Random House, 1960.
<P>Kohlberg, Lawrence. <CITE>Essays on Moral Development, volume 1: The
Philosophy of Moral Development<CITE>. New York: Harper & Row, 1981.
<P><ADDRESS>
<A HREF="index.html"><CODE>www.cs.berkeley.edu/~bh</CODE></A>
</ADDRESS>
</BODY>
</HTML>
|