If a security vendor breaks into a malicious site, is it hacking?

A security researcher I spoke with at the RSA Conference this week described an investigation his company had undertaken recently of a malicious Web site that had victimized dozens of people in this country and elsewhere.

A lot of the very specific details he shared about the site and how it was structured and what sort of data files it contained could have only come from him or his counterparts having broken into the site themselves. That perhaps explains why the PR folks at the company are now so anxious I don't write anything about it until they clear everything with their legal folks.

Based on the information provided by the security vendor, the site certainly deserves to be taken offline and probably will, by law enforcement soon enough. The question is does that make the practice right? Is it okay for security researchers and vendors to break into a site, however good the justification might be, without some sort of legal oversight or permission? It's not a particularly new question for sure, but it's one that is becoming more important to address with cyber crooks running rampant on the Web these days.

One benefit to being a crime fighter on the Internet is that you don't really need a search warrant to enter a Web site run by criminals and poke around to see what you can find. You don't even need to be in law enforcement.

Okay, maybe legally speaking you might need something. But the fact is no one's going to notice-or even care--if a security researcher or White Hat were to break into a malicious Web site to see what's there and figure out how to protect against it and other similar sites.

If the bad guys do notice someone poking around, they are hardly going to run to the cops. All they are going to do is abandon that place and go somewhere else to continue their nefarious activities.

That probably explains why the security vendor I spoke with is by far not the only one to do this sort of investigation. A lot of the public data on the bad guys and their tactics that exists in the industry today has no doubt come from similar snooping, and monitoring and break-ins by security researchers. Few though are likely to admit openly that they are breaking in to other systems or adopting tactics similar to those used by the hackers themselves to get at the data because they are unsure of their legal standing.

Going forward, there might be less reason for them to carry out such tasks themselves. There's growing talk about the need for the U.S. government to develop an offensive cyber warfare capability designed to strike back at those who mean to do harm to the country's interests in cyber space.

Those capabilities most likely exist already. If a security vendor can do it, there's little doubt that an agency such as the National Security Agency for instance, doesn't already know how to do it--and isn't to some extent already. So when people talk about the need for a cyber-offense capability what they are likely referring to is the need for a formal legal framework for implementing such a strategy. Such a framework would obviously need to address questions about justifiability and proper attribution and define clearly what a proper course of action would be.