Could the US Government use LulzSec to justify a crackdown?

 

Lulzsec has featured prominently in security discussions after their hacks of PBS, Sony, Nintendo and a raft of gaming companies in the past month.

There were even more discussions when they took aim at the CIA and went on to proclaim victory.

Patrick wrote an interesting piece which went viral titled: Why we secretly love LulzSec.

His argument was simple:

So why do we like LulzSec?
"I told you so."
That's why.

The article clearly struck a chord with many who added cries of "hell yeah!" all over the twittersphere.

There's a part of me that wants to agree, and scream "we've been telling 'em since 2000... Maybe now they will listen".

Among those who've been "telling 'em since 2000" is industry stalwart Marcus Ranum.

Ranum says a lot of things. Some things I disagree with on principle, and other times he is just being contrarian.

But at BlackHat 2000 he gave a keynote titled "Script Kiddiez Suck" that has turned out to be remarkably prophetic.

The audio is still available online, and the talk is worth hearing if only for the final line: "The Huns didn’t know how to build a Rome -- they only knew how to sack it".

Quoting from his talk:

4:00: "My suspicion is that if we as a community aren't able to change that mindset in house, we're going to have the brutal jackboots of the government going to come along and do it for you... you don't want to be in the situation five years from now where what you've got is some senior guy from the FBI telling you how all those security tools you have been using for years are illegal now. And that's where it's going to go down if you're not careful".

Do we really think the same people who brought us the Patriot Act, Guantanamo and Rendition are not currently licking their lips, and preparing to "save us" from the evil hackers?

Ranum went on to warn:

07:29: "I believe the public at large is getting sick and tired of hacking... It's no longer your companies IS department that has got a problem with people getting into your firewall... It's starting to happen. Joe Average is starting to wake up and realise that the hackers and script kiddies are not his friend and what generally happens in America when Joe Average wakes up is he lashes out in anger by calling up congressmen and so forth and you get stupid knee jerk legislation out of Washington so unless we can clean this problem up.... we going to have Washington helping us with knee jerk legislation.... either way the situation is going to have to change once Joe Average gets involved".

His talk also made specific mention of the folly of attacking news/media sites. "Don't bite the hand that feeds you," he said.

The LulzSec hacks hit all three marks so perfectly, it almost reads like a script (and has to get conspiracy theorists wondering).

1. Target the media: CHECK
2. Target government installations: CHECK
3. Target Joe Average: CHECK

When average people get their Facebook accounts hacked because some site they once used was compromised by some people they never met, anger levels are bound to rise.

Ranum predicted that the next stage would be governments using the change in public sentiment to "take the fight to the attackers", that governments would target the supply chains regulating the creation and use of security tools.

Some good might come out of the recent attacks, and mega-corps like Sony may finally have learned (through crisis) the insanity of not having a CSO role, but Governments rarely leave a crisis unexploited. It's the perfect setup for them to offer us a cure, to step in and "save" us, and in this case, I fear that that the cure will be far worse than the condition we are in.

o