Do They Ride the Same Cycle? Criminal hacking, terrorists, and other security threats

I have written this post/article/paper because I see a pattern of human behavior, the understanding of which may have some potential to improve the security of data and data subjects in the virtual world, as well as the security of persons and property in the real world. Because my thoughts about this pattern came together while I was in my favorite coffee shop, I coined the term “CAFE cycle” to describe a cycle of behavior that goes like this:

Cause-Action-Frustration-Exposure/Extremism

I will describe the cycle in generic terms then present two examples. Generically, a person becomes motivated by a Cause and takes Action to achieve the goal of that cause. Frustrated by failure to achieve the goal through legal means, the person takes illegal action, exposing him or her to three potentially problematic experiences: illicit thrills, illegal gains, and group membership. Continued failure to achieve the goal leads the person to pursue extreme forms of these experiences until they become an end in their own right, an Extremism that supplants the original Cause for Action, essentially rendering it irrelevant.

For a basic example consider an adolescent male who wants to learn, through direct experience, the workings of large computer networks. He exhausts the limited avenues of legal access to a large network and so he makes repeated attempts to gain unauthorized access, breaking the law as he does so.

The hacker is now a criminal hacker and part of a criminal hacking sub-culture which has a certain appeal, partly due to irresponsible and ill-informed media coverage of criminal hacking. He did not try to break into the network for the thrill of it, or for financial gain, or to join a sub-culture. His cause was education. His goal was knowledge. But through the CAFE cycle all that can change. He may pursue illegal acts for kicks, for gain, or for the feeling of belonging that comes from participation in a group committed to this lifestyle.

Consider another adolescent male. He perceives an injustice in the world and he wants to change it. He exhausts the limited avenues of legal redress such as peaceful demonstrations and goes one step further, throwing a stone at a police barricade, breaking the law as he does so. He is now a part of a sub-culture of violent protest which has a certain appeal, partly due to irresponsible and ill-informed media coverage of such protests. He did not throw the stone for the thrill of it, or for financial gain, or to join a sub-culture. His cause was justice. His goal was redress. But through the CAFE cycle all that can change. He may pursue illegal acts for kicks, for gain, or for the feeling of belonging that comes from participation in a group committed to this lifestyle. And the lifestyle can become extreme, going as far as violence against innocent persons for its own sake.

The CAFE cycle indicates that, for a certain percentage of people, the repetition of illegal acts committed to achieve a desired goal leads to one or more forms of motivational displacement, the three most worrying of which are: kicks, gain, and membership. Over time these can become sociopathic thrill-seeking, greed, and fanatical attachment. An example: terrorists who kill innocent civilians, extortion gangs that feed off innocent civilians in regions of political instability, and suicide bombers who kill themselves for the cause.

Note that I am not equating criminal hackers with terrorists or suicide bombers, but I think the underlying pattern is the same. Some criminal hackers get hooked on the thrill, others get hooked on the growing profits to be made from their skills. Some form groups by which the thrills and/or the profits can be enhanced through collaboration, and to which there is satisfaction in belonging. Likewise, some people who adopt virtuous causes go through the CAFE cycle so many times they become addicted to the life of the freedom-fighter-terrorist, a life driven by thrills, or greed, or bonding or some combination thereof.

The CAFE cycle has the power to produce, from the totality of supporters of a legitimate cause, some subset of persons who engage in illegal activity for reasons other than furtherance of the cause. This power can be seen when a cause gets close to achieving its goal, and also when the goal has been achieved and the cause is moot. Some criminal hackers just can't stop hacking. Some terrorists can't handle the outbreak of peace and continue to commit acts of greed, violence, extortion, and so on.

Clearly there are many variables involved in the CAFE cycle and these can vary greatly from one community to another or between communities. Analysis of this phenomenon is further complicated when there is lack of consensus within a community as to what constitutes a reasonable goal. The phenomenon takes on its most difficult form when the “community” is the world community. Global consensus is hard to reach. For advocates of some causes who are perpetually frustrated the CAFE cycle generates multiple subsets of persons acting primarily for the perpetuation of an illegal lifestyle.

In my next post I will outline implications of the CAFE cycle for security. (And I will probably post something about the use of hacking versus criminal hacking, terms that are fraught with potential to upset some people.)