Hacking Trump: Can we not label web vandalism as 'terrorism', please?

Sysadmin Blog American politics are something of a national sport in Canada. No matter who runs for either side, Canadians throw popcorn at the screen and try to pretend our choices are any better.

We debate the relative merits of the boob tube's highest stakes biennial reality TV soap opera. Things can get heated, sometimes, but we enjoy the sport of the thing.

And then there's Donald Trump.

I have never seen anyone so universally ridiculed, pilloried, and disavowed as part of the regular election cycle. Trump seems to unify Canadians in a nearly universal disgust that no public figure in generations seems to have managed. It is thusly not a surprise that Telecomix Canada, traditionally viewed as "the good guys" of Canadian hacktivism, went a little off the rails where he is concerned.

The powerful persona of Trump changes the rules for these sorts of events. Westerners in general – but North Americans in particular – have been steadily developing into a society where cliques are defined not on what (or whom) we like but instead by what (and whom) we hate.

Beyond the personal politics of the individual involved there is a powerful sense of belonging and community to be found in drinking a bucket of haterade and piling on the village idiot. Especially when the village idiot feeds the flames of their own ostracization every time they open their mouth.

None of the above is an attempt to take sides on the issue, but rather to serve as preamble for a bit of guesswork. Trump and his ill-defended website provide an easy thrill and a brief moment of notoriety amongst the sorts of people who care about social justice, civil rights, and so forth.

Analysis

Telecomix Canada's history proves that their interests lie pretty strongly in social justice movements, and they have been clear about their concerns regarding the steady degradation of civil and digital rights. It's highly unlikely that Telecomix Canada will be the next Sony hackers, or that they'd even care to make the attempt.

If you happen to be a major public figure or organization that makes their living kicking "the little guy" while they're down, you might want to put Telecomix Canada on your security team's radar – however, unless and until they actively target another site, it's probably safe to assign them a pretty low threat level.

Chances are pretty high that, damage done, they'll go back to their usual activities of giving voice to dissidents and civilians in places most people reading this article won't remember the name of. But Telecomix Canada is a useful lesson.

The World Wide Web – the piece of the internet we can see and search and interact with using our web browsers – has been around now for just over twenty years. Millions upon millions of websites exist that are the digital equivalent of a prairie shed.

When homesteaders moved out west and claimed prairie land, they built a small shed to live in. They then built a bigger one, and a bigger one, and eventually a fully modern house. The old buildings were rarely knocked down. They were used as storage until they deteriorated too far to be useful. Then they were just left there to slowly crumble.

Trump's website is an example of exactly this. It was compromised because his website simply wasn't taken care of. Yet one needn't be Trump for this sort of event to occur.

Thanks to the internet, the worst possible nature of human beings has been given free rein, and it seems that it's open season on everyone and anyone these days. I won't dwell on the hows and whys of that, when Monica Lewinski does such a stunning job of presenting the issues in her TED talk that anything I say is unnecessary.

That pizza house with the six-year-old Wordpress install could be next. Or a children's charity. Or a women's shelter. It's pretty much guaranteed that any website associated with any prominent figure or even remotely politically contentious activity is exactly this sort of website compromise waiting to happen.

Telecomix Canada was by all measures an incredibly benign tentacle of Anonymous. They didn't get up to legally or morally questionable activities, not even in the service of the greater good. They did what they did to help others and stayed in the background. Then they saw an opportunity and they jumped on it.

I'm sure there are any number of fire-and-brimstone evangelical churches out there with a collection of nerds who will get bored one day, decide to see if any of the local abortion clinics have any obvious flaws in their systems, and then deface the website without really thinking about it. Replace the church-going nerds with any other group's nerds, and the abortion clinic with any other likely target, and the exact same discussion can be had.

Curiosity is part of human nature. Curiosity about security flaws comes naturally to those interested in technology, and we've now raised two entire generations for whom the internet is as natural as breathing.

IT practices in general have reliably proven not to be up to the task of patching. Developers don't seem to be willing or able to keep old code up to date, and they frequently don't make switching between versions of software easy. Businesses don't want to pay for the cost of doing updates or the hassle of constant migrations. The whole thing has become a vicious cycle.