From...

by Deborah Radcliff

(IDG) -- A new group of online activists is raising questions about just how far IT people should go to stop illegal activity online.

In mid-December, some 30 seasoned information security professionals, "white hat" hackers and technologists formed Condemned.org, an activist group dedicated to "eradicat[ing] the existence of child pornography, pedophilia, and exploitation on the Internet."

As of its 10th day of operation, Dec. 21, 1999, Condemned claimed to have "eradicated" more than 20 kiddie-porn servers through proper legal channels, according to Kent Browne, a 40-year-old system architect for an East Coast consulting firm and spokesperson for Condemned.

	QUICKVOTE
Do you agree with Condemned's tactics? Yes No View Results

Browne also claims members have hacked into more than 13 servers overseas and erased their hard drives.

Even as some legal experts condemn the attacks, Browne claims technologists are lining up to join the fight.

"Everyone that I have spoken to is so anti-child pornography that they literally beg me to find something for them to do to help," according to Ben Bidner, a security administrator for a Web server group in Australia who founded and administrates the Condemned.org server. He said he launched the site after many frustrations reporting child porn servers to local law enforcement.

Condemned has gathered support from a half dozen Internet service providers, Web development and security companies in Australia and the U.S. such as Geoday Pty Ltd., DuFunk, and Ion12 Web Development.

"Condemned.org is striving not only to rid these servers from the Internet, but to make the public aware that we are here actively opposing child pornography," Bidner said.

Comstar.net, a corporate Internet service provider in Atlanta, has joined the cause, offering the group a free mirror site and connectivity. "It's the best cause I've ever come across on the Internet," said Comstar's chief security officer, Jerry Zepp.

The intention of the site is to make it simple for "normal Internet users" to report offending URLs to the site by filling out a simple template located at the top right side of every Condemned page.

Condemned in turn pushes the information forward to law-enforcement agencies -- local field offices of the FBI when servers are discovered in the U.S., and to the Western Australian Police Web server.

MORE COMPUTING INTELLIGENCE

IDG.net home page

Computerworld's home page

Computerworld Year 2000 resource center

Computerworld's online subscription center

IDG.net's product reviews page

Reviews & in-depth info at IDG.net

E-BusinessWorld

Year 2000 World

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

Condemned is seeking stronger relationships with state, federal and international authorities in the U.S. and Australia, Browne said.

But Condemned also takes action of its own, according to Zepp.

First, Condemned volunteers notify server administrators of the illegal material stored on their machines' hard drives. Most are responsive, especially administrators at free e-mail services and Internet service providers who are unaware of the material until Condemned or others notify them, Browne said.

AOL, for example, has a general policy of terminating an account and all its associated screen names, then notifying law enforcement if it's made aware of illegal images or child porn screen names, according to an AOL spokesperson.

But when neither administrators nor law enforcement responds, Condemned resorts to hacking. While no one at the organization would admit to hacking servers in the U.S., Browne acknowledges that a few Condemned volunteers have taken out 13 overseas sites this way.

"We have hacked some of these sites in areas of the world where there are no laws," Browne explains. "In those countries, we've taken servers completely off-line with buffer overflows or straight exploits written by a couple of guys on our staff. Once we get in, we erase their file directories and everything on their hard drives."

In addition, Browne said he has also taken down over 100 pedophile sites on his own over the past five years, many through hacking.

But according to some experts, such attacks, in addition to being illegal, may be counterproductive.

"Groups that are hacking these sites are making it hard for us to convict the pedophiles behind those sites," according to Parry Aftab, an Internet attorney and president of CyberAngels.org, a six-year-old antipedophile group with 1,400 volunteer members. "If you take down a server, you take away my evidence," he said.

"If someone's using an Internet connection from the U.S. to hack other servers, it's a violation of cyberterrorism laws," said Aftab, who has also authored two books on children's online safety, including the Parent's Guide to Protecting Your Children in Cyberspace, (January 2000, McGraw-Hill). "Heck, I"d love to string up every pedophile on the earth, but we can't do that. We don't live in a lawless society."

Pete Gulotta, special agent for the Baltimore office of the FBI's Innocent Images kiddie porn detail, agrees that taking down overseas sites may impede prosecutions, but wouldn't offer an opinion on the legality of the attacks.

The FBI and Customs officials often work with foreign governments on international investigations, often undercover.

"The problem lies with countries that don't have treaties with the U.S., some of which are in the Pacific Rim," Gulotta explained. "If you have servers in places like that, you're not going to get satisfaction with any law-enforcement effort."

Other security experts are more vehement.

"Certain things in our society are blatantly offensive. And one of those things is kiddie porn," said Winn Schwartau, founder of the security consultancy, Interpac Inc. in Seminole, Fla. "The amount of damage caused by leaving these servers up is far greater than the damage caused by a few hackers."

Jeffrey Hormann, commander of the U.S. Army's Computer Crime Investigative Unit, said the attacks threaten more than just pornographers.

"One of the greatest problems law enforcement has in policing cyberspace is the view that cyberspace is so vastly different than the physical world. So we allow the technical community to take it upon itself to stop groups allegedly involved in child pornography," Hormann said. "But what about online gambling or groups professing hate crimes. Do we allow attacks on their servers too?"

Essentially, laws in the physical world should be applied in cyberspace, he said, adding, "In the physical world, we don 't allow the businessman who's store has been broken into to hunt down and retaliate against the perpetrator."

But Schwartau poses an opposite question.

"On the street, if a woman is assaulted, she's given the legal authority to disarm the perp or do whatever is reasonable to protect herself," he explains. "In cyberspace, disarmament requires a defensive action, an electronic form of using pepper spray. That is going to be the fundamental legal linchpin when hacking kiddie porn sites comes down to some sort of test case."

Perhaps law enforcement's ambivalence is a reflection of public opinion, which lies somewhere to the left of middle.

While researching his book, Future Shock, (February 2000, Avalon), which has chapters on vigilantism and online pedophilia, Schwartau sent nonscientific surveys to 15,000 business contacts and interviewed 120 people. When he asked the question, "Should child porn sites be fair game for online assault?" 29 percent said yes, 58 percent said no and 18 percent said they didn't know.

Thus, while Federal agents don't publicly condone online server assaults, most law enforcement officials turn a blind eye, according to Browne and Schwartau, both of whom have had extensive off-the-record debates over the subject with their law enforcement associates.

"They've (authorities) said to me, 'If you get up before any judge in the world, chances are he has kids and he's not going to convict you,' " Browne explains. "Who would? This is horrid, horrid."