Ethics - not just a place north of London.

[Wayne]

Yeah yeah yeah, I've been talking a lot lately about the BSides stuff. It's a great way to bring in new people to what we do though. This time around I'm not only going to be giving my talk, but have an entire 9 hour slot for baiting. In all honesty, I don't think something like this has ever been done before. Sure, we did a smaller version in Bristol a few weeks back, but this time we have a huge amount of time to do this. Kudos to BSides Bristol BTW for basically saying "You have two and a half hours to do what you want". BSides Newcastle however has gone above and beyond on this, not only giving us a space for baiting but supplying computers, software and even a prize for the best call. I digress though. What I want to talk about is the talk I'm going to give before it. More specifically, one particular part of it.

Anyone can bait. It's actually not that difficult. Grab a computer, grab some email addresses to write to and you're away. What's more difficult is to bait ethically. We need to put aside any thoughts on the scammers and focus purely on the scams. I have met people who wanted to bait purely because the scammers are from a different country, and have made sure to let the site they were on know about it. People like that are NOT welcome. I've met people who only care about the "trophies" to the point of faking them. Again I've called them out on it as we don't want that kind of crap making us look bad. Others have tried baiting purely for the attention. Nope, not a good idea either. Let me tell you why you should want to be a baiter, and why baiting ethically is so important.

We don't hack for one thing. That's not to say we don't know HOW to hack. You have to know your enemy, and some scammers will in fact use hacking techniques. We need to know how to hack to know how to prevent hacking. So then, why don't we hack? It's actually very simple. On occasion we get contacted by members of law enforcement asking for more information about a scam we've reported or wanting to know how we identified the real person behind a scam. If we turned around and said that we'd hacked the scammer's system then there's nothing they can do with that information. However, if we use perfectly legal methods to work out who the scammer really is, that they can work with. Sometimes it's as simple as doing a search of the scammer's phone number or email address, leading to their actual profile. You'd be surprised just how much information you can find with nothing more than a Google search of one of the bits of information you have about a scammer. For example, a scammer recently joined our forum and with some smart searching we can all but tell what brand of toothpaste they use.

We don't send any kind of virus to a scammer. If you do that, the virus is going to want to spread via their email list. That then spreads via the email lists of all those people, and eventually it ends up in my inbox because I was helping someone who was a victim of the scammer. I'm able to spot it as a virus, but how many others didn't and are now infected because someone though it'd be a good idea to send a virus to a scammer.

We don't do this for the glory or money. Next year marks the 20th anniversary of my starting on this path. Have I made a whole bunch of money? I wish! I'm not going to deny the fact I've had people pay my expenses to attend events, but having your expenses paid and being paid are two different things. On one you make a profit, on the other you break even. In fact, by the time you take into account things like stopping off at a service station to get something to eat during an 8 hour drive, you're working at a loss, plus you've had a crappy burger that's only going to leave you hungry an hour later, and your wallet a whole lot lighter. I can safely say that I have put more into doing this financially than I've taken out. And yes, I've appeared on TV a number of times. We do that purely to get the word out about the scams. Every time I've done one, the only conversation after is how much it got the story across, not how my (lack of) hair looked.

So then, we don't do this for the money or the fame, we don't hack and we don't do this because we want to punish people in other countries. Why do we do this?

We do this because we hate the scams. Not the scammers. In fact I've said a number of times in the past that I don't even remember the names of the scammers. It's not important. What is important is the scam and the effect it could have on innocent people. We want to do the right thing, and we want to do it the right way. We want to gather evidence we can give to law enforcement. We want that evidence to be used by them to arrest scammers. We want to encourage others to bait and bait the right way. We know that we need to be "whiter than white" in order to do so. You know what it's better than? Sending the police proof of a scammer's real identity only to be told there's nothing they can do with it as it was obtained by hacking. If we all do what we do using legitimate methods and for legitimate reasons we can cause real damage to the scammers. If not, then we're doing more harm than good.