Why are the LulzSec hackers being locked up?

Why are the LulzSec hackers being locked up?

A chance to put these young hackers' skills to better use goes wasted, while gangs who rob for personal gain go unpunished


Jake Davis has been jailed for 24 months for his part in masterminding cyber-attacks on major global institutions. Photograph: Metropolitan Police/PA


For lawmakers, illicit downloaders and hackers alike, the internet is one of the few bits of frontier territory left in the world: for the "rogues" there's lots more scope to get away with things not possible in more civilised, everyday reality, while for the lawmakers there's an ungovernable mess.

The problem with frontier justice is, of course, that when it strikes, it tends to be rough. And so it's proved for the four members of the hacking group LulzSec, sentenced in a London court: three were jailed for between two years and 32 months (they'll serve half), with the fourth receiving a suspended 20-month sentence.

Untangling the rights and wrongs of this case is difficult. The group carried out a series of cyber-attacks that caused millions of pounds' worth of damage, particularly on the Sony Playstation network. (And gamers won't have been happy about the disruption to services).

That fact shouldn't be ignored by those mounting a defence of LulzSec: some of the group's actions were political (of which more later), but some were fairly tenuously justified at best. And the consequences were real and expensive: anyone causing that much damage offline would certainly also face jail.

But the rest of the case is far less clear-cut. Three of the four convicted were teenagers at the time of their offence. Computer crime is one of the few areas where teenage pranks can dramatically escalate, a product of the interconnected nature of the internet.

How much should teens be held responsible for the structural vulnerability of internet institutions? How much culpability lies with those who leave architecture as easy to attack as it is? We could continually be locking up teens unless something changes.

The data obtained in the various hacking attacks could have been used for significant large-scale fraud and financial gain. At the time of his arrest, the computer belonging to Jake Davis (the group's spokesman, "Topiary") held more than 750,000 lines of data, including passwords, credit card details and more. There's no sign he ever made any attempt to profit from any of this.

It seems almost uncontroversial to suggest that hacking attacks made without the intent of personal gain should be treated as a very different beast to those by large, professional groups – who, it should be noted, almost universally escape detection and prosecution.

If personal gain wasn't the motivation, what was? And does it matter? While one of the main professed motivations was "the lulz" – hacking for kicks – many LulzSec actions had a political aspect.

LulzSec grew out of Anonymous, the amorphous hacking collective, which rose to prominence (in the mainstream media at least) once it had attacked Paypal and other sites after they joined a credit-card blockade against WikiLeaks.

WikiLeaks, like it or loathe it, had committed no crime, been charged with no crimes, and yet was cut off in all practical terms from funding sources. Attempts to redress the situation in the courts have proven slow and erratic, and any compensation for lost donations certainly hasn't materialised.

Anonymous and the other hacktivists engaged in direct action in the belief the justice system would let them down. And they were right.

The justice system could be letting everyone down again. When it comes to real, serious hacking actions across the web, there are only two shows in town. The first and most extreme comprises state-backed hackers across the world, targeting information systems, trade secrets, and even – in the case of the US and Israel – centrifuges used to enrich uranium.

The other is sophisticated criminal gangs, often operating from Russia, eastern Europe or Africa. These are the guys who'll empty your bank account, hold email accounts to ransom and more.

Instead of either of these groups being arrested and taken through the courts, we're seeing teenage hacktivists put on trial instead. Are they really the ones we should focus on?

And if we are going to arrest and convict them – let's remember the financial damage caused at this point – couldn't we be more creative and constructive with what we do next?

Several of those arrested are clearly gifted. Jake Davis could put many a professional PR to shame. Why waste their skills, and their life prospects, not to mention a wodge of public money, with prison sentences?

In the least imaginative scenario, these guys could be engaging in hundreds upon hundreds of hours of unpaid teaching work, building IT skills. In the most imaginative one, why not get them creating a dotcom startup for the public good?

A chain-gang incubator might seem like a mad idea. But it's no more bizarre or brutal than anything we've done in real life to those who do wrong on the online frontier.



• This article was amended on 17 May 2013. It originally referred to centrifuges inside nuclear reactors. This has now been corrected.