#Hacktivity2021 // Hackers Deserve Rights

## Overview Chloe Madji, co-founder of Hacking is Not a Crime, delivers a passionate talk on securing rights and protections for ethical hackers. She argues that public perception conflates hackers (security researchers) with attackers (malicious actors), a dangerous misunderstanding perpetuated by media, outdated legislation, and socially constructed beliefs that undermines both hacker safety and organizational security.

## Key Topics

**Hacker vs. Attacker Distinction** Madji establishes that hackers use their skills to keep systems secure, stay within scope, and exploit only with permission—unlike attackers who use identical skills to harm, extort, exploit without permission, and act with criminal intent. This terminology distinction is foundational to the entire talk, as public conflation of the two groups drives the crisis.

**Socially Constructed Beliefs and Human Behavior** Drawing from cognitive science, Madji explains how beliefs form through media exposure (movies, news, social media) and how the amygdala generates threat responses while the prefrontal cortex makes conscious decisions. She uses a metaphor of people with pink hair being stereotyped as dangerous to illustrate how face-to-face conversations and alternative narratives can challenge ingrained biases. The research evidence presented shows that personal video testimonies from advocates are effective tools for shifting perception.

**The Kevin Case and DJI Bug Bounty Failure** Madji recounts a real case where Kevin found a serious bug in DJI's bug bounty program. Despite staying in scope and receiving a 30k USD award offer, the contract provided no legal protection. When Kevin expressed concerns and DJI's internal communications (calling him a PR threat) were accidentally included in emails, he was effectively threatened with litigation under the Computer Fraud and Abuse Act. Kevin publicly released all correspondence, forcing DJI to withdraw the lawsuit—illustrating both the danger hackers face and the power of transparency.

**Media and Terminology Problems** Madji demonstrates how even searches for "ethical hacker" vs. "criminal hacker" return identical imagery: hoodies, basements, darkness. She provides examples of harmful headlines misusing "hacker" when they mean "attacker" (e.g., "Hacker Starting to Leak Patient Therapy Notes"). She recommends kindly correcting journalists via direct messages or comments, sending letters to copy desks, and providing feedback to marketing teams that misuse terminology.

**Computer Fraud and Abuse Act (CFAA) Critique** Madji details the CFAA's severe problems: passed in 1984 before the internet existed, written with extreme vagueness allowing prosecutorial misuse, containing redundancies enabling repeated charges for the same act, and never involving hacker community representation during its creation. She emphasizes the law was born from fear—specifically Ronald Reagan's reaction to the movie WarGames—rather than thoughtful policy. While the CFAA hasn't been used federally against hackers recently, state and local governments and private companies still wield it as a weapon.

**The Aaron Schwarz Case** Madji recounts the 2011 case where US attorney Carmen Ortez prosecuted Aaron Schwarz for downloading millions of scholarly articles from JSTOR via MIT's network as civil disobedience—arguing taxpayer-funded research should be accessible. He faced 35 years in prison and $1 million in fines (compared to 25 years for second-degree murder). After a 17-month legal battle with no end in sight, Schwarz died by suicide at age 26; his family attributed his death to the prosecutorial charges. Madji uses this as the prime example of why the CFAA must change.

**Vulnerability Disclosure Policies (VDP) as Critical Infrastructure** Madji states 94% of Forbes Global 2000 companies lack VDPs, and 1 in 4 hackers do not report vulnerabilities due to lack of protection. Effective VDPs must include: clear in-scope vs. out-of-scope definitions (written for English learners, not attorneys); direct security team contact information; dedicated personnel managing submissions; and timely communication. She names BugCrowd, HackerOne, and disclose.tv as resources, emphasizing VDPs reduce breaches and allow diverse hackers to find bugs security teams miss.

## Technical Details

**Cognitive Science Foundation** The amygdala operates subconsciously to flag potential threats based on learned associations, while the prefrontal cortex consciously evaluates whether to act on that threat. Socially constructed beliefs feed the amygdala's threat database; challenging these requires conscious deliberation and exposure to counter-narratives.

**CFAA Specifics** Passed in 1984, the Act predates modern internet infrastructure and was never updated. Its vagueness allows prosecutors to stack charges; a single hack can be charged multiple times under different CFAA clauses, compounding penalties drastically.

**Quantified Problems** - 94% of Forbes Global 2000 have no vulnerability disclosure policies - 25% of hackers don't report vulnerabilities (likely due to fear and lack of protection) - Aaron Schwarz: 35-year sentence vs. 25 years for second-degree murder (non-violent act)

## Takeaways

**Immediate Actions** 1. **Contact media:** Politely correct terminology in press articles and social media; send letters to copy desk editors requesting consistent hacker/attacker distinction 2. **Challenge visual stereotypes:** When appearing publicly about hacking, avoid hoodies and dark basement imagery; present hackers as ordinary professionals 3. **Know your representatives:** Vote and contact local legislators about outdated anti-hacking laws; Hacking is Not a Crime offers support for these conversations 4. **Check VDPs:** Use disclose.tv to audit organizations; advocate for comprehensive disclosure policies wherever you work or engage 5. **Volunteer:** Support organizations like EFF, Cavalry, C3 CTI League, Disclosed.io, and Hacking is Not a Crime 6. **Share stories:** Submit video testimonies to Hacking is Not a Crime's advocacy project to humanize ethical hackers

**Systemic Change** The speaker argues that improving legislation (especially CFAA reform), ensuring hacker representation in policy discussions, implementing universal vulnerability disclosure policies, and shifting media narratives will reduce both breaches and prosecutions of ethical researchers. Protection and belonging convert would-be malicious actors into ethical participants.

**Core Message** Change begins with individual action: empathetic outreach to journalists, engaging local representatives, volunteering time to advocacy, and challenging one's own biases about hackers. "Change starts with you and me."