Analysis of Hacktivism on Social Change - Term Paper Example

Hactivism Name Institution Hactivism 1. Introduction to Hactivism As businesses put their operations online, the attractiveness of the Internet as a means of conducting a protest has also increased. It has now become common for protestors to take down websites or deny the businesses legitimate access to the sites for political reasons using denial-of-service attacks (Fitri 2011). These protestors (hactivists) are essentially hackers who use similar tools and techniques to disrupt online services so as to bring attention to their political cause (Li, 2013). It has therefore become important that businesses take necessary measures to protect themselves from these attacks. Hactivism is use of electronic media to influence social change (Li, 2013). It also refers to the destruction and malicious behaviour towards organisational information systems and the Internet for political reasons. This phenomenon gained popularity after a political group called Anonymous engaged in a number of cyber-attacks against companies, which suspended their services to WikiLeaks (Fitri 2011; Yip & Webber 2011). Hactivist attacks may comprise of distributed denial of service attacks (DDoS), Internet worms and website defacements. Hactivists may use DDoS to bring down a company website or to interrupt Internet activity by sending many requests to a server to cause temporary shutdown of the server. DDoS attacks on corporate includes web sit-ins or email bombing. Alternatively, companies may have their websites defaced or altered by hactivists as a way of propagating a political message. Lastly, hactivists may use Internet worms, which are programs that spread within a network to spread a message or disrupt an activity (Hampson 2012) 2. Why Is Hactivism a Recent Issue? Hactivist attacks have increased over the years. Instances of Internet disruption include the take down of EBay in 2001, hacking of the New York Times website in 2002 and hacking of WikiLeaks in 2006 and 2010. This hacking has significant technical and financial implications on the affected companies. In 2010, WikiLeaks’ website crashed and remained inaccessible for more than 24 hours. According to Hampson (2012), the website crashed after posting more than 250,000 classified documents obtained from the United States (US) government. The Hactivist, named The Jester, had hacked into WikiLeaks to prevent the public from accessing the documents claiming that the publications endangered the lives of the US military and foreign relations. WikiLeaks had to switch its website-hosting provider and sourced bandwidth from Amazon. Amazon recanted its service from WikiLeaks after a Senator questioned the company involvement with the whistleblower website. WikiLeaks moved to another website hosting service provider but later moved due to the frequency of DoS attacks. The website gained stability after it developed mirror websites (pp.511-2). The hactivist attacks on WikiLeaks also had financial repercussions. PayPal cancelled an account held by WikiLeaks for receiving donations (Kelly 2013). The website could no longer receive online donations from international supporters. MasterCard and Visa also suspended WikiLeaks payments while PostFinance, a Swiss bank, closed the account of the website’s founder, Julian Assange. The Bank of America also refused to process WikiLeaks payment citing concerns about WikiLeaks’ engagement in activities that contradicted the bank’s internal policies (Hampson 2012, p.513). These actions instigated further hactivism as groups of people, referred as Anonymous, hacked into the websites of companies which opposed WikiLeaks. This mission was declared Operation Payback and was aimed at raising the awareness of WikiLeaks and its opponents who were perceived to fight for censorship (Hampson 2012; Yip & Webber 2011). In WikiLeaks’ case, the website’s DoS attacks by hackers and suspension by financial institutions led to hactivism by the Anonymous group (Kelly, 2013; Mansfield-Devine, 2011). Unlike hacking which is motivated by fraudulent goals, hactivism is motivated by political concerns. It is more communicative and less destructive than hacking because it is regarded as a form of protest. 3. Why is Hactivism Important to the Organisation? Understanding the meaning of hactivism and its propagation is important for our organisation. It would help managers understand why hactivists would deface our company website to convey a certain political message. The defacement would not adversely alter our website but would have negative effects on the company’s brand image (Mansfield-Devine 2011). Customers would interpret the hacker's message to be the company’s sympathy towards a political movement. The company’s reputation in the industry would also be affected because a defaced website raises the technical profile of the hactivist but lowers the technological reputation of the company. Also important is the knowledge of how DDoS attacks and information theft by hactivists affect the company’s reputation. Customers and the public would not have access to the company’s website or would be redirected to the hactivist’s target website. In information theft, the hactivist may gain access to the company’s network infrastructure and steal the data for personal use. The stolen data would expose the organisation to privacy lawsuits and public distrust (Mansfield-Devine 2011). It is important to know about hactivism so that the organisation can implement measures to prevent the disruption of its network services and components. This knowledge would motivate the company to protect each of its information system components from an attack such as switches, routers and personal computers. Understanding the motives and impact of hactivism could help organisations adopt safeguards for the frustration and inconvenience that arises from political protests (Hampson 2012). 4. What Safeguards Protect the Organisation from Activism? Small and medium enterprises such as our organisation are exposed to security threats and data breaches just like larger multinational corporations (Kluitenberg 2014). It is therefore important that the organisation analyses its technological infrastructure and reduces security risks that would give the hactivists access to our corporate network and website. Firstly, managers should scan the vulnerability of architectural assets. The organisation could ensure server usage aligns with internal policies and secure remote access measures are implemented for virtual or shared hosting solutions (Kluitenberg 2014). Secondly, the firm could secure its application layer assets to protect web and email servers from unauthorised access and website defacement. Mechanisms for password management, spam handling, filtering emails and application testing should be revised regularly. Thirdly, precautions for mobile assets (such as Bring-Your-Own-Device) can be improved to through logging data, monitoring network access and segmenting networks for mobile access. Lastly, file storage and exchange mechanisms can be protected from data leakage, unauthorised access and malware infection (Pinguelo, Lee & Muller 2012) using firewalls and intrusion detection systems (Udo-Akang 2014). Where a breach has occurred, the organisation could adopt the remote wipe functionality which prevents further escalation of hactivist attacks (Kluitenberg 2014). 5. Conclusion Corporations should be aware of hactivism and implement preventive measures against these hackers. This is particularly important because companies have to protect their brand image and reputation for competitive advantage. The preventive measures should aim to protect internal data and information infrastructure from unauthorised access by a hactivist. 6. References Fitri, N 2011, Democracy discourses through the Internet communication: Understanding the hactivism for the global changing’, Online Journal of Communication and Media Technologies, vol.1, no.2, pp.1-20. Hampson, N C 2012, ‘Hactivism: A new breed of protests in a networked world’, Boston College International & Comparative Law Review, vol.35, pp.511-542. Kelly, BB 2012, ‘Investing in a centralised cyber security infrastructure: Why hactivism can and should influence cyber security reform’, Boston University Law Review, vol.92, pp.1663-1711. Kluitenberg, HF 2014, ‘Security risk management in IT small and medium enterprises’, Paper presented at the 20th Twente Student Conference on IT, Enschede, The Netherlands. Li, X 2013, ‘Hactivism and the first amendment: Drawing the line between cyber protests and crime’, Harvard Journal of Law and Technology, vol.27, no.1, pp.301-329. Mansfield-Devine, S 2011, ‘Hactivism: Assessing the damage’, Network Security, vol.2011, no.8, pp. 5-13. Pinguelo, F, Lee, W & Muller, B 2012, ‘Virtual crimes, real damages part II: What businesses can do today to protect themselves from cybercrime, and what public-private partnerships are attempting to achieve for the nation of tomorrow’, Virginia Journal of Law & Technology, vol.17, no.1, pp.76-88. Sembrat, E 2011, ‘Hactivism: How to respond and build around hacker communities’, Disaster Recovery and Contingency Planning, vol. 2011, pp.1-6. Udo-Akang, D 2014, ‘Cyber perspectives: Internet exploitation and business survivability’, International Journal of Business, Humanities and Technology, vol.4, no.2, pp.15-27. Yip, M & Webber, C 2011, ‘Hactivism: A theoretical and empirical exploration of China’s cyber warriors’, Presentation at the 2011 WebSci, Koblenz, Germany. 7. Annotated Bibliography Fitri, N 2011, Democracy discourses through the Internet communication: Understanding the hactivism for the global changing’, Online Journal of Communication and Media Technologies, vol.1, no.2, pp.1-20. Fitri describes the concept of Internet communication within the context of political participation. The article posits that hactivism is an emerging social movement which uses media communication to promote global political participation. Tracing hactivism activities to the 1990s, the author observes that hactivist activities encourage global participation and democracy discourse because they propagate social-humanity messages. In addition, the author observes that hactivism merges technology and communication to promote freedom of speech and distribute the principles of democracy across the world. Although the article adopts an optimistic view of hactivism, it does not explain how businesses can protect their information systems and data from the hackers. Nevertheless, it provided valuable historical information on hactivism for the briefing paper. Hampson, N C 2012, ‘Hactivism: A new breed of protests in a networked world’, Boston College International & Comparative Law Review, vol.35, pp.511-542. In this article, Hampson traces hactivism to the 1990s and describes the WikiLeaks case in great detail. This description formed the basis for the example given in the briefing paper. The article was published in a peer-reviewed Boston college journal and described in detail the difference between hactivism and hacking, forms of hactivism, federal and international statutes on cybercrime, and how hactivism can be used as a form of legal protest. The author proposes the regulation of hactivism to prevent unauthorized intrusion of networks and computers, or reputational damage to online business platforms. The article is useful because it explains how hactivists use different forms of cyber attacks to hijack corporate networks with a political motive. Kelly, BB 2012, ‘Investing in a centralised cyber security infrastructure: Why hactivism can and should influence cyber security reform’, Boston University Law Review, vol.92, pp.1663-1711. The article, published in peer reviewed and reputable Boston University Law journal, explains the notion of cybercrime and hactivism. It peruses cyber security law and describes how federal statutes and international coalitions address hactivism. Based on this information, Kelly proposes a cyber security infrastructure to regulate hactivism and hacking in four areas: amendment of criminal statutes, notification of data breach, personnel recruitment and liability protections. The article is very insightful because it presents current information on hactivism and cyber security laws. It also proposes a security infrastructure for reducing incidences of hacking and hactivism in the United States and international community. Kluitenberg, HF 2014, ‘Security risk management in IT small and medium enterprises’, Paper presented at the 20th Twente Student Conference on IT, Enschede, The Netherlands. Kluitenberg describes how small and medium enterprises (SME) can manage cyber-security risks such as hacking. The purpose of his study is to evaluate information technology (IT) risk management policies in Dutch SMEs and propose control measures based on International Standards Organisation (ISO) guidelines. The findings reveal that most SMEs have weak IT policies on the use of architectural, mobile and application layer assets as well as data storage. The findings reveal that SMEs need to define assets used in their operational processes, develop formal constraints on asset usage and common policies used in SMEs such as daily backups. The peer-reviewed conference publication is relevant because was published recently and gives practical solutions for managing the threat of hactivism. Li, X 2013, ‘Hactivism and the first amendment: Drawing the line between cyber protests and crime’, Harvard Journal of Law and Technology, vol.27, no.1, pp.301-329. In the article, the author describes the meaning and forms of hactivism, and how it compares with the traditional forms of protest. Li also examines hactivism within the context of criminal liability law and first amendment protection. The author observes that first amendment protection for hactivism is hindered by doctrine, speech dichotomy and censorship of cyber attacks. This recent article, published in reputable, peer-reviewed Harvard journal, is insightful because it describes hactivism within the context of the law. Although it does not explain how businesses can protect themselves from hactivists, it does explain the legal spaces which encourage or discourage protests by hactivists. Mansfield-Devine, S 2011, ‘Hactivism: Assessing the damage’, Network Security, vol.2011, no.8, pp. 5-13. The article looks at the development of hactivist groups such as LulzSec and Anonymous. Its purpose is to analyse the groups’ actions and determine if they affect information security for organisations. Mansfield-Devine states that hactivists groups do not deploy original technological exploits but crave publicity through stealing and sharing of organisational data. The author posits that whilst these groups reveal security infrastructure breaches and affect public trust in corporate brand image, their methods of accessing data have not changed the information security landscape. Nevertheless, the author observes that other hactivism groups may arise in the future to outwit the older groups and may use more sophisticated methods to breach information security. Although the article is not peer-reviewed, it is written by an expert in network security who has performed extensive research on the behaviour and trends of hactivist groups. Pinguelo, F, Lee, W & Muller, B 2012, ‘Virtual crimes, real damages part II: What businesses can do today to protect themselves from cybercrime, and what public-private partnerships are attempting to achieve for the nation of tomorrow’, Virginia Journal of Law & Technology, vol.17, no.1, pp.76-88. The article was published in a peer-reviewed journal. It is relevant because the authors focus on security concerns facing businesses and how public-private partnerships can combat cybercrime. The article does not delve into the motives of hactivism and its impact on businesses but provides preventive measures to improve cyber security. These measures include employee training, robust passwords, data encryption, network segmentation, regular vulnerability scans, access controls, logging data, monitoring network for anomalies and monitoring remote access services. The authors use qualitative data to propose the establishment of private-public partnerships for cyber-security. Their explanation on the formation of cyber-partnerships with organizations such as the National Cyber-Forensics and Training Alliance (NCFTA) provides valuable insight into how organisations can secure their technology infrastructure against hactivism. Sembrat, E 2011, ‘Hactivism: How to respond and build around hacker communities’, Disaster Recovery and Contingency Planning, vol. 2011, pp.1-6. Sembrat traces hactivism from the 1990s to the recent WikiLeaks backlash from the Anonymous group and the splinter group, LulzSec. This provides great background information on the motives for hactivism and the author’s analysis of the hactivist attack against Sony Corporation’s Playstation 3 (PS3). Throughout the case, the author describes Udo-Akang, D 2014, ‘Cyber perspectives: Internet exploitation and business survivability’, International Journal of Business, Humanities and Technology, vol.4, no.2, pp.15-27. In the article, Udo-Akang looks at the exploitation of the Internet and how businesses can survive cyber-security risks. The article, published recently in an international peer-reviewed journal, focuses on the challenges businesses face from cyber threats and strategies for empowering the businesses to survive these threats. Although the article does not discuss hactivism in detail, it acknowledges that hactivists use sophisticated techniques to target critical organisational infrastructure to pass on a political or social message. It proposes that business should adopt preventive measures (such as intrusion detections systems) to protect themselves from hostile attacks. The article is relevant to the topic because it provides practical strategies for preventing cyber attacks and controlling the impact on the business. Yip, M & Webber, C 2011, ‘Hactivism: A theoretical and empirical exploration of China’s cyber warriors’, Presentation at the 2011 WebSci, Koblenz, Germany. The authors describe cyber security issues in China with the focus being hactivism. Their article, published in an esteemed conference paper, describes the theoretical framework for hactivism. Unlike other hactivism studies which focus on the actions performed by the hackers, this article tries to explain these behaviours from a theoretical perspective. It posits that hactivist behaviour is motivated by relative deprivation (and humiliation), nationalism and patriotism. The article is relevant because it describes the motives for hactivists and explains why membership into China’s hactivists sites has increased in recent years. The theoretical background is insightful because it improves the reader’s understanding of hactivist behaviour. Read More