WannaCry Hero in FBI Custody

Can a good guy do bad things? Can a bad guy do something good that benefits millions of people? These sound like the sub-texts for the latest film in the Marvel universe, but they're actually questions that many in the cybersecurity world are asking after the arrest of Marcus Hutchins last week.

If you don't know the name, Hutchins is the malware researcher who, pretty much by accident, shut down WannaCry with a single, simple act. Known and respected in the security researcher community, Hutchins was launched into much wider view when he kept the ransomware attack from spreading beyond its two-day limits.

Hutchins returned to the headlines last week when he was arrested in Las Vegas after attending (or, according to some stories, just being in the vicinity of) DEF CON.

It took a couple of days to figure out why he had been arrested, but the FBI ultimately said that he is accused of creating, then selling, the code for Kronos malware, an unpleasant little keylogger that grabbed banking details from users' computers.

That's about all people outside the law enforcement community (and Hutchins' legal team) know for sure. We've been told, by various sources, that he admitted to creating the software, that he never had anything to do with the software, that he plans to plead "not guilty" to all six charges, and that he's guilty as sin. We should find out more tomorrow, when he has his first real court date, but until then it's all conjecture.

Not surprisingly, the security research world has erupted in panic, anger and chaos at the news, and the case does bring up some very interesting aspects of the way that security research happens. It's important to ask the question: Is the current model of security research sustainable in the changing world of today's Internet?

The current situation, in which there are white hat hackers who are presumed to work on the side of justice, legal proceedings and apple pie; black hat hackers, who should be feared and loathed by all honest and respectable people; and grey hat hackers who play both sides of the street, is an artifact of cybersecurity's relative youth as a discipline. It's entirely possible that the roles will become more codified as the field matures.

You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What's less certain is whether that will be a good thing. Most of the white hat hackers I know are fully capable (from a skills point of view) of creating horrible malware and vulnerability exploits. They must be if they're to figure out how to stop the black hat hackers. And many black hat hackers will have good causes that they can support, using their skills to support human rights or human tragedies.

It's interesting that Hutchins' arrest comes shortly after the Black Hat speech that kicked off a discussion about the possibility of expanding security's portfolio to include abusive behavior as well as acts of breaking and entering. It's looking like 2017 could well be remembered as a year in which the role of security -- and the roles of security researchers -- were examined and redefined to fit the needs of a changing world.

We'll know more soon, and Security Now will keep you posted. In the meantime, let us know what you think about the situation: Is there a reason to keep the old hat-based definition system going? Should we redefine information security entirely? Meet me in the comment section and let me know your thoughts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.