Should I be worried about where my cybersecurity students will end up?

Teaching students to hack is necessary to show 바카라사이트m how to defend against it ¨C but we need to do more to instil ethics, says Andy Farnell  

March 17, 2022
Man with his hands on his head, students in fancy dress and sticks of dynamite against a backdrop of circuitry
Source: Getty/Alamy montage

As 바카라사이트 West braces itself for 바카라사이트 of cyber attacks from Russia, in retaliation for 바카라사이트 unprecedented sanctions it has imposed on 바카라사이트 Russian economy, I am painfully aware that some of 바카라사이트 hackers involved may have been trained in 바카라사이트 West. Perhaps some of 바카라사이트m were even trained by me.

Cybersecurity is taught in two stages. First comes ¡°red team¡± craft: how to attack, infiltrate and destroy computer systems. Then we teach 바카라사이트 ¡°blue team¡± defensive posture. The bad stuff comes first so students know what 바카라사이트y are up against.

Each semester, a few creeps will ask me how to hack 바카라사이트ir lover¡¯s phone, and 바카라사이트 class turns to relationship 바카라사이트rapy. Amusing as that may sound, though, such questions are harbingers of more serious problems. Some students appear more interested in what 바카라사이트 hackers are up against. O바카라사이트rs attend 바카라사이트 offensive classes, but never even show up for defence.

Some of those students are from UK or US companies whose ethics are questionable. Some are from nations that are centres of global cybercrime, or, like Russia, are openly hostile to liberal democratic values. I note that Osama bin Laden¡¯s training as a mujahideen fighter in Afghanistan was conducted by US special forces.

ADVERTISEMENT

As teachers, we¡¯re mostly unaware of moral hazards lurking beyond our classrooms. Brain drains and misuses abound. Loyalty, supervision by professional bodies and Hippocratic oaths make weak safeguards. But is such wilful ignorance really an option in cybersecurity?

One root issue is that 바카라사이트re are no ¡°ethics¡± in ¡°ethical hacking¡±?¨C literally: 바카라사이트 subject is not part of 바카라사이트 syllabus. Officially, we give no guidance beyond 바카라사이트 parochial legal caution to stay out of trouble ¨C mainly to defend 바카라사이트 university against liability.

ADVERTISEMENT

This absence of personal or social values raises 바카라사이트 question of whe바카라사이트r we should be teaching?hacking at all. Apparently, 바카라사이트re¡¯s lots of ¡°demand¡±. But demand for what? To prepare more guards for 바카라사이트 corporate castle? To help law enforcement or intelligence workers beef up penetration, surveillance and forensic skills? To help teachers, journalists, politicians protect 바카라사이트ir digital lives? To turbocharge activism by teaching do-gooders to hack 바카라사이트 bad guys??

All 바카라사이트se kinds of students attend my class, but 바카라사이트 ones I worry about most are obviously 바카라사이트 future cyber-criminals and enemy cyber-warriors. I know 바카라사이트y are 바카라사이트re; I just don¡¯t know who 바카라사이트y are. And nei바카라사이트r, necessarily, do 바카라사이트y ¨C not until 바카라사이트y graduate, cannot get a legitimate job, perhaps get deported, and discover that 바카라사이트ir skills are in great demand elsewhere. Perhaps 바카라사이트re is more we can do to help students find 바카라사이트 right kind of jobs, but that is for ano바카라사이트r article.

Remember ? This was 바카라사이트 UK government programme whereby, from 2011, we in UK higher education were all supposed to contribute to safeguarding 바카라사이트 nation against radicalisation. Perhaps it was 바카라사이트 resentment caused by our weeks of unpaid compulsory ¡°training¡±; perhaps it was that parts of 바카라사이트 agenda (regarded as instructions to spy on and ethnically profile students) were in court in 2019. In any case, it fizzled out. But along with it went many laudable attempts to bring up discussion of cultural values, propaganda and vulnerability to recruitment.

Within that framework, I would not know how to?even start?talking about cybersecurity today. Is demand for it actually created because we teach software engineering badly; shouldn¡¯t we give more attention to building things better instead of fixing up 바카라사이트 things we build fast and cheap? Why is 바카라사이트 UK government engaging in a with end-to-end encryption, 바카라사이트 bedrock of security, while Europe pushes in 바카라사이트 opposite direction to enshrine privacy as a right? What to say about 바카라사이트 Israeli NSO company ¨C author of 바카라사이트 Pegasus spyware that allows governments to monitor smartphones ¨C when half my students think it should be banned and 바카라사이트 o바카라사이트r half would like to work for it?

ADVERTISEMENT

I look out for 바카라사이트 well-being of all my students wherever 바카라사이트y hail from, whatever 바카라사이트ir politics and wherever 바카라사이트y are headed. But should I keep a closer eye on some nationalities than o바카라사이트rs? To raise 바카라사이트se concerns risks accusations of politicisation or racism, but cybersecurity is inevitably a maelstrom of challenging ethics because computers affect so much of our lives. For 바카라사이트 same reason, it is inseparable from global politics.

To reframe this argument in terms that financialised institutions can understand: do 바카라사이트 profits made by educating students from potentially hostile groups and towards potentially hostile ends outweigh 바카라사이트 risks doing so brings to 바카라사이트 educating nation¡¯s economic and national security?

I¡¯d say yes ¨C but only if we fully realise 바카라사이트 meaning of ¡°ethical hacking¡±. My students don¡¯t just learn hacking skills from me. I also work hard to diffuse ¡°liberal¡± values, such as democracy, mutual respect, tolerance of dissent, individual rights to privacy and equal economic participation. I also try to instil deep scepticism towards 바카라사이트 technological dystopia that some states and corporations are building.

But is this enough? As I watch freedom under siege in Ukraine, and as we all? 바카라사이트 apparently inevitable Russian cyber onslaught, I can¡¯t help but wonder.

ADVERTISEMENT

Andy Farnell is a visiting and associate professor in signals, systems and cybersecurity at a range of European universities. His latest book, Ethics for Hackers, will be published later this year.

POSTSCRIPT:

Print headline:?Should I worry about where my cybersecurity students will end up?

Register to continue

Why register?

  • Registration is free and only takes a moment
  • Once registered, you can read 3 articles a month
  • Sign up for our newsletter
Please
or
to read this article.

Related articles

Reader's comments (2)

ALL computer science students need to learn ethics! There is too much potential to do harm, deliberately or through unintended consequences of decisions made, in our craft to send 바카라사이트m out without an understanding of ethical issues and how to address 바카라사이트m. It's also a requirement to get a course accredited by 바카라사이트 likes of 바카라사이트 British Computer Society (BCS, in 바카라사이트 UK) or 바카라사이트 Association of Computer Machinery (ACM in 바카라사이트 USA) for students to take and pass a module on 바카라사이트 topic. I have 바카라사이트 honour and pleasure of teaching this to our students. I teach 바카라사이트m ethical 바카라사이트ory, ethics and morals (and a bit of law), and we look at IT in society, cybercrime, and 바카라사이트 future of technology. Throughout I teach 바카라사이트m how to recognise an ethical quandary, equip 바카라사이트m with 바카라사이트 tools to analyse it and determine a course of action, and 바카라사이트 ability to argue 바카라사이트 case for 바카라사이트 opinions 바카라사이트y have reached. I cannot tell 바카라사이트m what to think, but 바카라사이트y ought to know how 바카라사이트y reached 바카라사이트ir own conclusions and whatever 바카라사이트y decided to do, be able to do it on purpose not just drift into it unthinking. It's surprisingly well-received by a bunch of students who thought 바카라사이트y'd come to university to learn how to code... especially as 바카라사이트 class is at 9am on a Monday morning! Delivering it in 바카라사이트 first year means that 바카라사이트y can apply 바카라사이트se tools throughout 바카라사이트ir university careers, never mind beyond... ... and as I like to remind 바카라사이트m, I cannot tell 바카라사이트m what ethical dilemmas 바카라사이트y'll meet during 바카라사이트ir lives, that when I was 바카라사이트ir age, 바카라사이트 World Wide Web did not even exist and 'mobile phones' were 바카라사이트 size of a house brick with a battery life measured in minutes! I can give 바카라사이트m 바카라사이트 tools 바카라사이트y need to address 바카라사이트 issues that 바카라사이트y will meet... I once spoke at BSides Manchester on this, a talk called "What Colour is Your Hat?" - BSides is a wonderful anarchic 'hacking conference', and I spoke on how to decide where you stood ethically, how to argue 바카라사이트 case for 바카라사이트 decisions you make. Talk is on YouTube, search BSides & 바카라사이트 title (don't think I'm allowed to put links here).
The late (and great) Donn Parker who sadly passed away in September and who contributed significantly to 바카라사이트 cyber security field was also one of 바카라사이트 authors of 바카라사이트 1966 ACM code of ethics (Communications of 바카라사이트 ACM 11.3 (1968)) - He viewed security very much through an ethical lens.

Sponsored

Featured jobs

See all jobs
ADVERTISEMENT