Security hacker

A security hacker, also called a security researcher, finds ways to break through or get around computer and network defenses, often by exploiting weaknesses. Their reasons vary widely: making money, making a political statement, causing damage, gathering intelligence, meeting a challenge, having fun, or testing a system’s flaws to help build better protections.

The community around these hackers is known as the network hacker subculture, hacker scene, or computer underground. It got its start in the 1960s with phone phreaking and grew through the microcomputer BBS scene of the 1980s. The magazine *2600: The Hacker Quarterly* and the newsgroup alt.2600 are key parts of this world.

The term “hacker” first appeared in a 1980 *Psychology Today* article titled “The Hacker Papers,” which included commentary by Philip Zimbardo and came from a Stanford Bulletin Board discussion about computer addiction. In the 1982 film *Tron*, the character Kevin Flynn says he’s “been doing a little hacking here” using software called CLU. By 1983, “hacking” was already computer jargon for breaking security, but the public wasn’t really aware of it. That changed with the film *WarGames*, which showed a teenager breaking into NORAD’s computer, making people worry that hackers—especially teens—could threaten national security. That same year, a Milwaukee teen gang called The 414s broke into systems across the U.S. and Canada, including Los Alamos National Laboratory, Sloan-Kettering Cancer Center, and Security Pacific Bank. The case got huge media attention, and 17-year-old Neal Patrick became the gang’s spokesman, even appearing on the cover of *Newsweek* under the headline “Beware: Hackers at play.” Under pressure from the press, Congressman Dan Glickman called for an investigation and started working on new anti-hacking laws. On September 26, 1983, Neal Patrick testified before the U.S. House of Representatives about the dangers of hacking, and six computer-crime bills were introduced that year.

The term “hacker” as a label for a computer criminal got a boost from Clifford Stoll’s 1988 article “Stalking the Wily Hacker” in *Communications of the ACM*. Later that year, Robert Tappan Morris Jr. released the Morris worm, and the media latched onto the word. Stoll’s 1989 book *The Cuckoo’s Egg* cemented it in the public mind.

There’s a long-running debate over what “hacker” really means. Many computer programmers argue it should only refer to someone with deep computer knowledge, and that “cracker” is the right term for those who break into systems—whether criminal black hats or security-focused white hats. A 2014 article noted that the general public still mostly uses “hacker” to mean a black-hat criminal. The culture around hackers is often called the “computer underground.”

In computer security, a hacker focuses on how systems are protected. This can include people who try to strengthen security by finding weaknesses, as well as those who break in for unauthorized access. Some in the subculture see their goal as fixing security problems and use “hacker” positively. White-hat hackers are ethical hackers who use their skills helpfully, and they’ve become essential to the information security field.

Different groups within the computer underground use different labels to set themselves apart. Eric S. Raymond, author of *The New Hacker’s Dictionary*, says these people should be called “crackers.” But those in the underground see themselves as hackers and try to include Raymond’s views in a broader hacker culture—something Raymond strongly rejects. Instead of a simple hacker/cracker split, they see a spectrum: white hat, grey hat, black hat, and script kiddie. They usually reserve “cracker” for more malicious acts. Ralph D. Clifford defines cracking as gaining unauthorized access to a computer to commit another crime, like destroying data. These subgroups can also be defined by whether their activities are legal.

A white-hat hacker breaks security for non-malicious reasons—testing their own system, doing penetration tests or vulnerability assessments for clients, or working for a security software company. This is essentially the same as an ethical hacker, and there are now certifications, courses, and online training for it.

A black-hat hacker breaks computer security mainly out of malice or for personal gain. Richard Stallman coined the term to contrast the criminal hacker with the playful, exploratory spirit of hacker culture.