Hacking

The Most Hacker-Active Countries

Section 1. Introduction

The major figures in computer-related cyber-crimes, hackers and their networks, regularly explore and exploit weaknesses in computer systems. Being intelligent and highly skilled, hackers organize cyber-attacks targeted at various objects of major importance, such as banking, government, and healthcare institutions, secret data banks, and social media. These activities have twofold consequences.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

On the one hand, the "hacker culture" encourages IT development and advances cyber security progress. As Robert Moore states in his book Cybercrime: Investigating High-Technology Computer Crime, "today, individuals who claim to be hackers argue that true hackers are interested in furthering computer security and that those who do not conform to this belief system are not hackers in the true sense of the word."

On the other hand, hackers threaten security on a personal and national level by committing crimes related to identity thefts, financial offences, and leaking of confidential information from governmental institutions.

Motivated by a number of different reasons, such as challenge, financial gain, threat, revenge, or excitement, hacker communities actively function all over the world. According to the statistics, in the 4^th quarter of 2014, cyber-attacks originated from 199 unique countries/regions. The top sources of outgoing cyber-attacks were China, the U.S., Taiwan, Russia, and Turkey.

This article will discuss the most hacker-active countries in terms of intensity of outgoing attack traffic. More particularly, this contribution examines hacker communities, penalties applied to cyber-crimes, and government's response to hacking in those countries. The following six most hacker-active countries will be discussed in the two parts of this article. Part I will study China (Section 2), the U.S. (Section 3), and India (Section 4). Part II will examine Russia (Section 5), Turkey (Section 6), and Taiwan (Section 7). Finally, a conclusion is drawn (Section 8).

Section 2. China

At present, China is the largest Internet user in the world with over 640 million people frequently connecting to the Internet. The period since 1994, when the global computer network and the Internet access became available in China, is marked by China's tremendous economic development and active participation in the Internet-related processes.

In addition to being an economic giant, China is also a world leader in cyber crime. In 2014, 41% of all global cyber crime attacks originated from China. It is three times the attack traffic originating from the United States.

Despite of a growing number of companies providing cyber security services for governmental and corporate institutions, hacking in China is still a lucrative work opportunity for skilled IT professionals.

According to the New York Times report concerning the position of hackers in China, IT programmers receive a substantial support from the government. For example, the Chinese Ministry of Education collaborates with Chinese universities for arranging hacking competitions in order to distinguish the best professionals in the field.

The same report announced that the government of China not only promotes hacking, but also employs skilled IT professionals for secret missions. A former prominent Chinese hacker, interviewed by the New York Times, admitted: "I have personally provided services to the People's Liberation Army, the Ministry of Public Security and the Ministry of State Security. If you are a government employee, there could be secret projects or secret missions."

Media continually reports about Chinese state-sponsored cyber-attacks and espionage operations. For example, last year, a group of Chinese hackers assigned to the People's Liberation Army Unit 61398, was charged with stealing U.S. corporate trade secrets. A massive hack in 2015, which attempted to steal the files of about 4 million U.S. federal employees, is also suspected to originate from China.

In the People's Republic of China, cyber-crimes are not addressed by a single law but rather by a set of regulations, such as (1) articles 285–287 of the Criminal Law, (2) Ordinance for Security Protection of Computer Information System, (3) Provisions on Administrative Punishment concerning the Management of Public Security, and (4) Decision Regarding The Maintenance Of Internet Security.

In 2009, China added the term "hacker" to the Criminal Code in order to fight legally against hacking. According to the Chinese criminal law, the maximum punishment imposed on hacking activities is imprisonment of 5 years. It is applied if a hacker interferes, deletes, and alters computer information systems.

The illegal breaking of computer information systems, which intrudes into the fields of state affairs, construction of defense facilities, science, and technology, is penalized with no more than three years of imprisonment (Article 285 of the Criminal Law).

In order to crack down the cyber-crimes with a greater force, in 2011, China's Supreme People's Court and Supreme People's Procuratorate issued a legal interpretation concerning cyber-crimes, which states that persons who hack 20-100 computers or steal information from 10 to 50 online payment accounts, will be punished with 3 years in the prison. Hackers who commit bigger crimes will be sentenced up to 7 years in jail.

Despite the aforementioned legal threats for cyber criminals, hacking in China prospers in various areas within official, criminal, and corporate worlds. Due to the immense influence and exceptional position of hackers in China, hacking is not a top-secret domain, but an openly discussed topic in universities, Internet forums, and trade shows.

According to Wen Weiping, an associate professor at the Department of Information Security of Peking University, hackers from overseas frequently use China's hacker-friendly reputation in order to hide the location of non-Chinese cyber-attack traffic. The professor notes: "hackers usually launch attacks by controlling other computers, making it very difficult to locate the source of attacks."

Section 3. The U.S.

The U.S., one of the major targets of foreign cyber-attacks, regularly experiences attacks directed towards critical infrastructures, such as Pentagon, White House, or Capitol. In the U.S., cyber security is defended by the FBI, which investigates cyber-based terrorism, espionage, computer intrusions, and major cyber fraud in cooperation with public and private partners.

According to the Internet Crime Report submitted by the FBI, in 2014, the FBI's Internet Crime Complaint Center received approximately 22.000 Internet crime-related complaints per month. IT security experts distinguish two budding Internet crime trends, namely, (1) stealing personal data from social media platforms (via click-jacking, doxing, and pharming) and (2) exploitation of the vulnerabilities of virtual currency systems. Other frequently reported Internet crimes in the U.S. involve auto fraud, government impersonation, email scam, intimidation/extortion scam, real estate fraud, confidence fraud, romance scam, etc.

Despite the legal measures against hackers taken by the U.S. government, the potential of highly skilled IT specialists is acknowledged and often used in forming state-supported hacker groups. The National Security Agency participates in the international cyber warfare with a unit called Tailored Access Operations (TAO), which employs about 1000 military and civilian hackers. TAO aims at monitoring, infiltrating, and gathering intelligence of foreign computers. According to information provided by confidential sources to foreignpolicy.com, TAO has been penetrating Chinese computer networks for 15 years, thus generating intelligence information about various processes inside the People's Republic of China. TAO exercises a similar employment strategy as the one used by China. The potential unit members, a generation of highly proficient IT specialists, are hunt in the major hacker conferences in the U.S.

The main laws referring to cyber-crimes and forbidding the practice of hacking on the federal level are stated in the 18 United States Code (USC). For example, the subsection 1029 of the USC, "Fraud and related activity in connection with access devices" forbids the unauthorized access to computer systems. The subsection 1030 "Fraud and related activity in connection with computers" prohibits the unauthorized access to government's computer network. Moreover, each U.S. state is permitted to apply additional substantive criminal laws, which would regulate the use of computers at the state level.

Since cyber-crimes range in their scope, the potential penalties in the U. S. for cyber criminals also differ. While the minor computer-related crimes can be punished with a fine, the more sophisticated cyber-attacks may lead to significant financial penalties, probation, and imprisonment of up to 20 years.

In one of the major U. S. computer related crime cases, a hacker was sentenced for 20 years in jail and fined $25.000 for stealing 90 million credit and debit card numbers from the major U.S. retailers. Serious penalties also accompany quiet original crimes. A hacker was sentenced for 10 years in prison after he accessed the personal e-mail accounts of Hollywood industry stars, such as actresses Scarlett Johansson, Mila Kunis, a singer Christina Aguilera, and posted their personal photos online.

Section 4. India

When a number of Facebook groups, such as "Hire Professional Hackers in India", promise to provide services like hacking email passwords or spying partners and employees, one can assume that hacking is not a secret in the country of IT superpower.

Despite the fact that Indian grassroots hacker groups, (e.g., Cyber Army), have been performing cyber-attacks against Pakistan and Bangladesh based on political motives for years, the Indian hacker culture is much related to white hat hacking. Although ethical hackers are widely debated among Internet security specialists, their reputation and insights into cyber security vulnerabilities are very popular in India. Indian websites post lists of top Indian ethical hackers, and the main figures, like Ankit Fadia or Rahul Tyagi, are highly influential in the IT communities. They release books with tips on network security, host TV shows, and train future ethical hackers and information security specialists.

However, not all of the hackers in India are ethical. Global IT security specialists place the importance of Indian hackers just next to Chinese cyber warriors and signal about their engagement in the international espionage and intellectual property thefts.

Indian hackers were accused of international cyber espionage when a series of cyber spying attacks called "Operation hangover" were conducted towards both civilian corporations and objects of national security-interest, such as Porsche Holdings, Delta Airlines, The Chicago Mercantile Exchange, the Norwegian telecom Telenor, U.S. law firms, and Pakistani targets. The hacker group operated for three years and organized phishing attacks.

Simultaneously with the increasing number of online transactions in India, the concerns about network security are becoming more pertinent. Consequently, the Indian IT industry expands and demands for more skilled computer security specialists. The Indian information security companies invite highly skilled IT professionals by offering an attractive remuneration. Currently, the annual salary of chief information security officers ranges from $20.000 to $130.000, when the income of ethical hackers is $3000 - $24.000 per year.

Despite the fact that Indian political leaders publicly announce concerns of cyber security, the legal basis related to cyber-crimes is limited and the penalties are mild. According to section 66 of the Indian Information Technology Act (2000), committing computer-related crimes is punished with imprisonment of up to three years or with fine, which may extend up to two lakh rupees (about $3000), or with both.

REFERENCES

Books and Academic Articles:

1. Carr, Jeffrey. Inside cyber warfare: Mapping the cyber underworld. O'Reilly Media, Inc., 2011.
2. Engebretson, Patrick. The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy. Elsevier, 2013.
3. Holt, Thomas and Schell, Bernadette. Hackers and Hacking: A Reference Handbook. ABC-CLIO, 2013.
4. Jordan, Tim. Hacking: Digital Media and Technological Determinism. John Wiley & Sons, 2013.
5. Schema, Mike. Hacking Web Apps: Detecting and Preventing Web Application Security Problems. Newnes, 2012.
6. Simpson, Michael. Hands-On Ethical Hacking and Network Defense. Cengage Learning, 2012.

Online sources:

1. http://www.internetlivestats.com/internet-users/china/
2. http://www.china.org.cn/china/2011-08/30/content_23310096.htm
3. http://www.nytimes.com/2014/07/10/world/asia/chinese-hackers-pursue-key-data-on-us-workers.html?_r=0
4. http://www.nytimes.com/2013/05/23/world/asia/in-china-hacking-has-widespread-acceptance.html
5. http://economictimes.indiatimes.com/news/defence/cyber-security-industry-headed-for-solid-growth-in-india-report/articleshow/47554622.cms
6. http://www.forbes.com/sites/andygreenberg/2013/05/21/its-not-just-china-indian-hacker-group-spied-on-targets-in-pakistan-u-s-and-europe/
7. http://www.reuters.com/article/2013/07/26/us-usa-hackers-creditcards-idUSBRE96O0RI20130726
8. https://www.fbi.gov/losangeles/press-releases/2012/florida-man-convicted-in-wiretapping-scheme-targeting-celebrities-sentenced-to-10-years-in-federal-prison-for-stealing-personal-data
9. http://foreignpolicy.com/2013/06/10/inside-the-nsas-ultra-secret-china-hacking-group/
10. http://www.fmprc.gov.cn/ce/cgvienna/eng/dbtyw/jdwt/crimelaw/t209043.htm
11. https://www.fbi.gov/news/news_blog/2014-ic3-annual-report
12. http://www.hoover.org/sites/default/files/uploads/documents/0817999825_35.pdf

Co-Author:

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Rasa Juzenaite works as a project manager in an IT legal consultancy firm in Belgium. She has a Master degree in cultural studies with a focus on digital humanities, social media, and digitization. She is interested in the cultural aspects of the current digital environment.