Data Havens and UFO Hacking

This probably dates me but is too good to pass up. The once-upon-a-time data haven of Sealand has offered political asylum to the guy who hacked into NASA and DoD computers in search of UFO information.

From Personal Computer World (UK)

North Sea 'state' offers McKinnon asylum

Sealand may not be enough to save 'most prolific hacker' from extradition
Emil Larsen, Personal Computer World 26 Apr 2007

Gary Mckinnon, who faces extradition to the US for allegedly hacking into military computers, has been offered asylum by the self-styled breakaway state of Sealand, it was claimed at the Infosec security conference today.

The "state", a World War II fort known as Roughs Tower in the North Sea just north of the Thames, was declared an independent principality in 1967 by a former major called Paddy Roy Bates. He dubbed himself Prince Roy.

Mckinnon sat on a ‘hackers panel’ at Infosec to debate new changes to the Computer Misuse Act. The claim about Sealand was made by one of his fellow panellists, a "security analyst" identified only as Mark.

Mckinnon, described by American prosecuters as the most prolific hacker of all time, spoke only twice, first to introduce himself and then when asked if companies often overstate the value of damage done by hackers.

Mckinnon said they did. He added the US could only have extradited him from the UK, if it could show his the offence was "worth a year in prison in both countries".

He added that to merit that sentence the damage had to amount to $5,000 dollars. The damage he was accused of causing came to exactly that so US military were "obviously not shopping in PC World".

McKinnon's lawyers have said they plan an appeal to the House of Lords against Home Secretary John Reid's granting of a US request to extradite McKinnon.

Why This Blog?

I started this blog to try to help move information security theory and practice forward as both an intellectual discipline and professional practice area. Information security as a discipline is very new, as are the technologies involved and the professional disciplines of computer science, network implementation, and information management upon which information security builds. And computers and networks have evolved rapidly, which has required information security theory and practice to evolve rapidly in an attempt to keep pace.

Because all American statutory, regulatory, and common law is based at least to some extent on experience (and preferably on precedent), information security legal theory is not well-developed. As a result, no settled standards exist for allocating losses and settling disputes when security fails. In many cases nobody really knows how to determine whether someone has been negligent or has failed to meet regulatory requirements; sometimes, it is difficult to determine even what those duties are. Therefore, a legal theory of information security can’t just summarize existing legislation, precedent, and secondary authorities—it must weave together relevant strands of activity and thought.

This is what I want to try to do in this blog, I hope with my readers' help. I've been working on this for some years now, and it's a fascinating and I hope ultimately useful exercise. I plan to post, as and when I can, on not only current events and issues of interest to information security compliance and risk management, but also on some of the history of this field. I think this history has been neglected, to our disadvantage - we've learned a few things already, and it's worth it to try to remember them, even as we invent new tricks to deal with new problems.