6

I've posted a question about the usefulness of hacking back to corporations, asking the question to be taken apart from legal and ethical concerns. The legal and ethical concerns are an interesting question, however I am not sure whether it would be an acceptable question on this forum.

  • Would a question on the legality and ethics of hacking back be on-topic?
  • Would it be too broad a question?
3

I don't think it would be too broad at all, however:

Legality is always an issue on SE, they even closed the proposal - giving answering questions about legality can be construed as legal advice, which has legal standing of itself. Not to mention that it would depend greatly on location (complicated further since you are talking about more than one location - you might be in one country, your adversary in another - who has jurisdiction?)
hus, unless it's very generic and high-level, a question about legality would be problematic, and thus closed (if it's just about legality).

As for ethics, this can be very subjective, which doesn't really lead to good answers. There is a subset of ethics that can be answered cleanly, though, it would still be tricky to focus that. (E.g. CISSP's Code of Ethics, or any other defined code.)

I think there is some wiggle-room on the above, but it is not much.
For example, you could ask what laws or regulations would apply, depending on specific location. Or you could ask about the expected consequences.

2
  • This is why I didn't ask about the legal and ethical aspects in my original question. As there's no real answers it would be more about debate, and this wouldn't be the forum for that I expect. – GdD Nov 29 '12 at 11:46
  • 2
    Pretty much the case, I think. I think there is room to touch on law here, but more like "when do we need a lawyer" or "what should I ask my lawyer". Otherwise the answer would always be "CYL" (consult your lawyer). As for ethical, you could vaguely touch on whether or not this is considered white- or black-hat, but it would be very close to subjective. – AviD♦ Nov 29 '12 at 12:11
3

In my opinion:

  1. You should separate legality from ethics. Asking about both in the same question would be too broad. Ask two questions, if you want to know both.

  2. Asking about the ethics of hacking back is probably OK. Please make sure to do some research of your own first ("do your homework") and show what you came up with so far.

  3. Asking about the legality of hacking back is probably not going to lead to a useful answer. The short version is "if you have authorization, it's probably legal; if you don't have authorization, it probably is illegal" and for anything at all non-trivial, "talk to a lawyer".

  4. The legality of hacking in general is fairly well-covered already by At what point does "hacking" become illegal? (US) so a question about legality would only be on-topic if it was clear what's different about this. Also, questions about legality tend to be jurisdiction-specific, so you'd probably need to specify what country you are concerned with.

  5. If you do ask about legality, do your homework first. (Read, e.g., the blog posts on the Volokh Conspiracy about the legality of hacking back first before posting.)

  6. Finally, I don't think the community on this site tends to have a great deal of legal expertise, so that kind of question might not get the kind of answers you are looking for, or might be closed because it just isn't a good fit for our community's interests and expertise. Once it gets into anything at all non-trivial -- which "hacking back" probably is -- then I suspect the best we're likely to to be able to do is tell you to talk to your lawyer.

3

Questions about legality should not be asked or answered (they are intrinsically local, and as AviD points out, they may have legal standing). Questions about ethics IMHO should not be asked or answered. They are even more local, they lead to discussions, and cannot close in on answers.

I believe Sec:SE works best (all SE work best) when the answers can be reviewed and assessed against reasonably objective criteria. If I answer that ethically you should hack back only after the company has reported financial returns to the stock exchange is that a good answer or a bad answer?

Ultimately, ethics leads to discussions; the internet has many fora where discussions are better served than Sec:SE.

8
  • Why are questions about ethics intrinsically local? – D.W. Dec 3 '12 at 9:02
  • "If I answer that ethically you should hack back only after the company has reported financial returns to the stock exchange is that a good answer or a bad answer?" - It's a bad answer if that is the extent of the answer, because it does not provide the justification for this position or the reasoning behind it. On the other hand, if you add reasoned arguments to explain/justify this position, it might become a good answer. That said, I take your general point: questions about ethics can easily be too subjective, and would need to be framed very carefully to avoid that pitfall. – D.W. Dec 3 '12 at 9:05
  • 1
    Ethics are intrinsically local because they don't apply beyond the individual (or in rare cases the professional community). If I believe that it is ethical to hack back, and you do not, who is wrong? To what standard do we appeal? (One could discuss the quasi-ethical standards of organizations like ISC2, but since they don't consistently interpret their own <a href="erratasec.blogspot.com/2011/07/…" title="ethics">ethics</a>I think the discussion is either pointless, or else supports my point that ethics are local. – Mark C. Wallace Dec 3 '12 at 11:56
  • Can anyone tell me why the link reference in the above doesn't work as documented? – Mark C. Wallace Dec 3 '12 at 11:58
  • Thanks, I think I understand. I'm not persuaded that ethics are local; but I think maybe what you are saying is that ethics questions are likely to be subjective. On that topic, I would recommend reading Good Subjective, Bad Subjective, which discusses how some subjective questions can still fit this kind of site OK in some cases, if they are asked very carefully. – D.W. Dec 3 '12 at 19:00
  • On formatting, it might be because only a restricted subset of Markdown is allowed in comments. I suspect inline HTML is not allowed in comments (only questions and answers). See editing help for comments (particular the section on Comment formatting). – D.W. Dec 3 '12 at 19:02
  • I freely admit that my bias is towards more objective and less subjective. (which is why I get only one vote, and I try to avoid overplaying my bias). I've read "good subjective, bad subjective" multiple times, and I get something new out of it every time; I think it is an excellent frame for the discussion. Ultimately though, I feel that Sec:SE benefits from less subjective and more objective. – Mark C. Wallace Dec 3 '12 at 19:05
  • Re formatting, you can add links via [link text](http://example.com/). – Polynomial Dec 10 '12 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .