Kids in Hong Kong and other highly surveilled states worry infosec careers are just asking for trouble
(2021/05/07)
- Reference: 1620364279
- News link: https://www.theregister.co.uk/2021/05/07/asia_ethical_hacking/
- Source link:
Black Hat Asia Asian nations in which governments are keen on citizen surveillance struggle to develop ethical hackers, as prospective workers fear their activities may be misunderstood, according to security specialist Mika Devonshire.
Devonshire spent much of 2019 and 2020 in Hong Kong, working as a digital forensics and incident response specialist at Blackpanda and serving as assistant faculty at Hong Kong University.
“The climate on the University of Hong Kong campus in the fall of 2019 was a bit different that you are used to on a university campus," she said at the Black Hat Asia 2021 security conference yesterday.
[1]
[2]
[3]
Referring to the Anti-Extradition Law Amendment Bill Movement as China sought to [4]take more control of the special administrative region, and the high level of surveillance and detainment accompanying the protests, Devonshire said she “got to thinking about how that would impact anyone’s education at that pivotal time in your life when you are trying to develop your career path and how you will enter the workforce and move forward.”
Devonshire said students she met feared ISP monitoring and felt that participating in capture-the-flag events or hackathons could make them look deviant.
[5]Average convicted British computer criminal is young, male, not highly skilled, researcher finds
[6]So it appears some of you really don't want us to use the word 'hacker' when we really mean 'criminal'
[7]Computer security world in mourning over death of Dan Kaminsky, aged 42
In a list Devonshire provided of the world's ten most surveilled countries, Asia took four positions. China topped her list, with Singapore, Hong Kong, and India coming in fourth, ninth, and tenth respectively. Western countries also rated "highly." The USA came in second, the UK third, and Australia fifth.
The desire to avoid attention and pursue a perceived “safer career” understandably led many to career paths away from infosec. Devonshire said Asia is short 2.4 million cybersecurity trainees, a huge slice of the world's four million vacancies.
Devonshire asserted that following best practices and developing a well-regarded professional biography can prevent a trainee from having their behavior and intentions misunderstood. However, reports from her students revealed a lack of legal understanding and a feeling that the laws in place were not clear.
[8]
She cited other reasons students eschew the industry as a lack of prestige, waning long-term interest, and the impression that a career in ethical hacking would lead one to only one potential employer – the state. ®
Get our [9]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/06/30/hong_kong_tech_hub_future/
[5] http://www.theregister.com/2021/04/13/uk_computer_misuse_act_conviction_analysis/
[6] http://www.theregister.com/2021/03/09/debate_hacker_result/
[7] http://www.theregister.com/2021/04/25/dan_kaminsky_obituary/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://whitepapers.theregister.com/
Devonshire spent much of 2019 and 2020 in Hong Kong, working as a digital forensics and incident response specialist at Blackpanda and serving as assistant faculty at Hong Kong University.
“The climate on the University of Hong Kong campus in the fall of 2019 was a bit different that you are used to on a university campus," she said at the Black Hat Asia 2021 security conference yesterday.
[1]
[2]
[3]
Referring to the Anti-Extradition Law Amendment Bill Movement as China sought to [4]take more control of the special administrative region, and the high level of surveillance and detainment accompanying the protests, Devonshire said she “got to thinking about how that would impact anyone’s education at that pivotal time in your life when you are trying to develop your career path and how you will enter the workforce and move forward.”
Devonshire said students she met feared ISP monitoring and felt that participating in capture-the-flag events or hackathons could make them look deviant.
[5]Average convicted British computer criminal is young, male, not highly skilled, researcher finds
[6]So it appears some of you really don't want us to use the word 'hacker' when we really mean 'criminal'
[7]Computer security world in mourning over death of Dan Kaminsky, aged 42
In a list Devonshire provided of the world's ten most surveilled countries, Asia took four positions. China topped her list, with Singapore, Hong Kong, and India coming in fourth, ninth, and tenth respectively. Western countries also rated "highly." The USA came in second, the UK third, and Australia fifth.
The desire to avoid attention and pursue a perceived “safer career” understandably led many to career paths away from infosec. Devonshire said Asia is short 2.4 million cybersecurity trainees, a huge slice of the world's four million vacancies.
Devonshire asserted that following best practices and developing a well-regarded professional biography can prevent a trainee from having their behavior and intentions misunderstood. However, reports from her students revealed a lack of legal understanding and a feeling that the laws in place were not clear.
[8]
She cited other reasons students eschew the industry as a lack of prestige, waning long-term interest, and the impression that a career in ethical hacking would lead one to only one potential employer – the state. ®
Get our [9]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/06/30/hong_kong_tech_hub_future/
[5] http://www.theregister.com/2021/04/13/uk_computer_misuse_act_conviction_analysis/
[6] http://www.theregister.com/2021/03/09/debate_hacker_result/
[7] http://www.theregister.com/2021/04/25/dan_kaminsky_obituary/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJUPviKNRWwCCuoP-XLmYwAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://whitepapers.theregister.com/
Re: National Security Law
Anonymous Coward
I stopped messing about with stuff on the internet back in 1994. Nothing malicious. I was just curious how things worked back then and wanted to see how far the rabbit hole went. I seem to remember a couple of high profile cases where people who tried to see what's what got locked up. That was the end of my foray into the dark (white hat) arts. I still know a thing or two to be fair.
National Security Law
From my point of view, the National Security Law is quite clear, even though the administration doesn't seem to realise just how broad it is. Two provisions, taken together, make it risky to do any sort of information security: it allows covert surveillance by the national security department of the police (Article 43(6)), and interfering with the performance of duties of state power is an offence of Subversion (Article 22(3)). Suppose a user in your company is under surveillance, you run your anti-virus scanner and remove spyware from their machine... guess who goes to jail for Subversion? If you sourced the scanner from a foreign company, that might also be Collusion with a foreign power under Article 29.
As this law has worldwide jurisdiction, then researchers in the foreign company developing the scanner might also have committed an offence.
Oh, and as this would involve state secrets (there's no point in using a covert surveillance tool that isn't secret), the trial could be conducted in secret.
Don't worry, I'm sure the trial will be conducted to the highest standard of Chinese justice.