One of the more bizarre concepts in the United States legal system is that one can go to jail for providing a means for other people to commit crimes. Take Taylor Huddleston, for example. He was arrested because he wrote some tools used by malicious hackers:
The visitors were from the FBI, and after a 90-minute search of his house, they left with his computers, only to return two months later with handcuffs. Now free on bond, Huddleston, 26, is scheduled to appear in a federal courtroom in Alexandria, Virginia on Friday for arraignment on federal charges of conspiracy and aiding and abetting computer intrusions.
Huddleston, though, isn’t a hacker. He’s the author of a remote administration tool, or RAT, called NanoCore that happens to be popular with hackers. NanoCore has been linked to intrusions in at least 10 countries, including an attack on Middle Eastern energy firms in 2015, and a massive phishing campaign last August in which the perpetrators posed as major oil and gas company. As Huddleston sees it, he’s a victim himself—hackers have been pirating his program for years and using it to commit crimes. But to the Justice Department, Huddleston is an accomplice to a spree of felonies.
Brian Krebs offered a bit more legal analysis than the Daily Beast article. If you’re wondering why the Federal Bureau of Investigations (FBI) went after Huddleston for writing a remote administration tool and not, say, TeamViewer, it’s because he advertised his product on a hacker forum:
Huddleston makes the case in Poulsen’s story that there’s a corporate-friendly double standard at work in the government’s charges, noting that malicious hackers have used commercial remote administration tools like TeamViewer and VNC for years, but the FBI doesn’t show up at their corporate headquarters with guns drawn.
But Nixon notes that RATs sold on Hackforums are extremely dangerous for the average person to use on his personal computer because there are past cases when RAT authors divert infected machines to their own botnet.
Now that you have the history of the case and the legal analysis, I’m going to provide the libertarian analysis.
Let’s assume the FBI’s accusation that Huddleston build a remote administration tool specifically for the malicious hacker market is true. Under libertarianism a crime doesn’t exist unless a victim exists so who were Huddleston’s victims? The people whose computers were hacked? While they were victims, they were victims of the malicious hackers, not Huddleston.
“But, Chris,” I hear some statist exclaim, “he built a tool used by hackers?!” That doesn’t matter. The existence of the tool itself is not a crime. A gun manufacturer isn’t charged with conspiracy and aiding and abetting a murderer when one of its guns is used by a murderer. An automobile manufacturer isn’t charged with conspiracy and aiding and abetting a bank robbery when one of its automobiles is used as a getaway car for a gang of bank robbers. So why are software tools treated differently?
I can hear our statist interrupting us again, “But, Chris, guns and automobiles have legitimate purposes! Hacker tools don’t!” First of all, that’s not true. Hacker tools have legitimate purposes. They’re often used by penetration testers. Second of all, that doesn’t matter. Every tool can be used for legitimate and illegitimate purposes. A gun can be used to defend an innocent life or to take one. An automobile can be used to drive to work or as a getaway vehicle for a crime. A remote administration tool can be used by a support technician to fix a user’s problem remotely or to configure a computer for botnet activities. Tools have no morality, only users do.
Under the arbitrary legal system us denizens of the United States suffer, manufacturers of certain tools can be charged for aiding and abetting criminals who used those tools while manufacturers of other tools can’t be. The only thing that determines whether a manufacturer can or can’t be charged is the opinion of a body of politicians. If they believe that the tools you manufacture have legitimate purposes, you might enjoy legal protections. If not, you might find yourself being arrested by the FBI because somebody used one of the tools you made to commit a crime. Under libertarian principles, a person can only be charged with a crime when a victim can be directly tied to their actions. What I can’t figure out is why most people seem to find an entirely arbitrary legal system more favorable than a consistent one.