8

It's not uncommon to see individuals who have caused damage / breached big systems and have subsequently been prosecuted that have received job proposals for infosec positions. This is usually tied to their undeniable aptitude, but it makes me wonder why companies do not see them as a threat as such prowess may be held against them, or others.

What are the circumstances and measures used to assist in gauging whether or not someone with a hacking offense in their record is going to be loyal to the company? Or should it plainly be avoided, both ethically and pragmatically speaking?

10
  • 8
    "... someone with a hacking offense in their record is going to be loyal to the company?" - what makes you sure that someone without such a hacking offense will be loyal?
    – Steffen Ullrich
    Jul 26, 2019 at 10:45
  • 6
    Should they be avoided? No. Should they be pursued? Also no. Their sentencing history is irrelevant. I personally know a lot of hackers who are extremely loyal and very knowledgeable. I also know quite a few hackers who are downright backstabbers. You couldn't predict which they'd be based on sentencing.
    – forest
    Jul 26, 2019 at 10:52
  • @SteffenUllrich I never brought up "being sure", though. I even use "gauge" rather than "assure" because I know such thing is impossible. Having a cyber criminal offense on your record scores against you in other fields, but in the infosec world it seems like something you'd include in your CV. How do you deal with that as an employer?
    – lucasgcb
    Jul 26, 2019 at 11:04
  • @forest If you could expand this into an answer which includes the signs of a trustworthy expert regardless of their sentencing history that'd be fantastic.
    – lucasgcb
    Jul 26, 2019 at 11:12
  • 7
    If I got caught in my teen years with some of the stuff I did out of curiosity, I would probably have had a criminal record, as I did some BlackHat stuff till I was 19. (That's when I started realizing the stuff I did was often not so harmless, and I was actually screwing people over doing what I did "for fun and learning"). Today, I think I'm a pretty loyal IT Professional, and I can guarantee you that I would NEVER shit where I eat. I even find it my duty to point out any weaknesses, or analyze breaches more thorougly, simply because I have the knowledge. This really differs between people.
    – Nomad
    Jul 26, 2019 at 11:38

3 Answers 3

10

I don't think there's any good answer to this question. But if I were doing the evaluation, I'd think about three things.

  1. Intent.

    What was the intent of the crime? Was this a crime of curiosity, to "see if it could be done" or "exploring the system", or was there a financial, revenge, or even ideological motivation? Beyond this, each motivation should be considered on how it might impact your company. DVD Jon (who assisted in cracking DVD protection), for instance, was motivated by ideology, but the ideology was the freedom to do what you wanted with DVDs. That's not a good fit for the MPAA developing a new content protection system, but it might be irrelevant, or even helpful to your company.

  2. Reform

    Some people with actual criminal intent have been reformed. Frank Abagnale Jr, portrayed in "Catch Me If You Can" had real criminal intent, and stole millions of dollars through fraud. He later worked for the FBI to catch people like him, and later still for Banks to help protect against check fraud. Over time that he's demonstrated that he's actually reformed.

    Determining with any degree of accuracy if someone is truly reformed, especially shortly after the crime was committed is likely impossible, and certainly beyond the scope of a stack exchange answer. Whether you want take this risk on a real criminal is likely more a matter of a gut-check rather than based on rational data and analysis.

  3. Harm

    What harm was done? Harm done has some indication of what the person might be capable of, and how they view their own actions. Keep in mind that in the past, harm in hacking cases has sometimes been blown out of proportion. In the early 90s Craig Neidorf, publisher of Phrack magazine was charged with publishing details of the e911 system, which Bell South said was worth $80,000. Only later was it found the same publication was available for $13, and the charges were dropped.

.

2
  • Frank Abagnale is a bad example here. It's not like they just handed him a blank check and trusted him not to forge it. He wasn't placed in the same situations where he committed fraud. He produced techniques that can be judged on their own without requiring much trust in the author. OP's situation is like hiring Frank Anagnale to be your treasurer. Maybe you can say the FBI trusted him not to commit more crimes when they released him early, but he was also being watched much more closely so had less opportunity to do so without getting caught.
    – SquiddleXO
    Jul 28, 2019 at 21:43
  • @SquiddleXO OP wasn't specific about the situation involved, so I don't see how your analogy applies. Abagnale was still given access to how other criminals operated, which in itself is useful information if he wanted to further his criminal career. He was also hired by banks as a consultant, likely with access to some of their internal procedures. My point is more that there's been cases where criminal intent was widely established, but the criminal was still reformed, and trusted to work on the other side of the fence, trying to catch people who did the same thing. Jul 29, 2019 at 16:21
2

This is not actually a matter of security, but of psychological evaluation and human-associated risk assessment.

A sentence does not necessarily make a person evil or destructive. If one hacked a gov site out of curiosity and you hire him in your company and put him in charge of data security, automatically granting him access to your data, his has no curiosity about your data anymore, therefore he can do harm due to that. This is a simple example, but there are dozens similar.

On the so-called legal side, there's a big debate also. Current laws are less and less based on morality and end up re-defining morality as the ones in power will it. Therefore, a sentence-based on a current law does not necessarily mean that the sentenced person did something bad, even if at the point of its sentence it was considered illegal.

May companies prefer to hire previously sentenced security experts because a sentence by a high authority means usually skill proven beyond any doubt. The companies filter them out, find a person fitting their requirements and hire that person.

Having a person in charge of security automatically implies a high level of trust in that person. Here, the evaluations come in. If the evaluations are done by competent people, everything ends up fine and I personally know quite a few situations where it happened so.

Evaluation such a person may be an extremely complex thing to do, but it also may be pretty simple, depending on the situation. Let's take some other examples: why should I not hire a person that hacked a football's team site for fun ? Or a person that obtained restricted data out of pure curiosity ? I would certainly hire them. But then, I would not hire a person hacking sites for profit. This will inevitably result in that person being susceptible to bribe and to selling my data to the highest bidder.

1
  • 3
    True that breaking the law doesn’t necessarily make someone evil, destructive, or immoral but it does mean they’re not afraid to break the law. So it begs the question, if they don’t have respect for the law, how can you expect them to follow the rules of your organization? Surely there are always going to be some files you wouldn’t want them snooping around in. Jul 26, 2019 at 13:17
2

In the example linked, many of people used sophisticated methods to attack or exploit a system or vulnerability. They didn't use a already made tool to exploit something (like downloaded a malware factory to lock people's computers), and they didn't use random luck. Their attacks were on purpose and exploited a system at the lowest level.

With that said, these folks probably turned out to be model prisoners and probably did a lot to earn back trust. To date, I never heard any of these folks turn against their companies.

But there was a case recently of a some kid who hacked apple to get files They were not amused or offered him a job. He got arrested. His rationale is about these historical teen hackers who got jobs after a career of mischiefs.

1
  • 2
    Also, back in the day there was a dearth of qualified people who came through traditional career paths, which is why hackers were recruited. Today the profession is much more mature and you can find plenty of law abiding employees, so taking the risk is much less necessary.
    – SquiddleXO
    Jul 28, 2019 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .