Honeypots: a sticky legal landscape?(catching computer hackers)

I. INTRODUCTION

With today's enhanced focus on cybersecurity, governments and businesses are looking for effective tools to prevent and detect attacks on their critical information systems. Effectiveness needs to be measured not only in terms of technological feasibility but also in terms of legality. One innovative technique is the use of so-called "honeypots": vulnerable computer systems or networks designed to be attractive to hackers as a target for intrusion. Honeypots can not only deflect the attention of hackers from an organization's "real" system, but they can also provide investigators with the ability to gather detailed and contemporaneous forensic evidence about the hackers.

An intruder into a honeypot may be obtaining access simply as an intellectual challenge or in order to facilitate more serious criminal activities, such as the storage of child pornography or the launching of "denial-of-service" attacks against other systems. Whatever the ultimate purpose of the intrusion, under the laws of most industrialized nations, obtaining unauthorized access to the honeypot should itself be a criminal offense.

Concerns have been raised in technical literature and chat rooms, however, about the legal risks associated with the operation of a honeypot. Uncertainty about the legality of honeypots may deter their use as a tool in the fight against criminal and terrorist attacks against critical information systems. This Article examines two key areas of concern: entrapment and privacy. As with much technological development, there is a need to apply existing legal rules to the innovative scenario to assess the legal risks involved in such activities.

As is obvious from its moniker, honeypots are designed to attract visitors. By attracting a potential criminal or terrorist, however, a honeypot may be viewed as a form of entrapment. (1) Such a finding would render the use of a honeypot as an evidential tool ineffective. Section II of this article reviews the doctrine of entrapment from a comparative law perspective. The operation of a honeypot also enables access to communications between hackers when carried out via the honeypot. (2) Such access raises questions concerning lawful interception or other privacy concerns. Section III examines the relevant privacy rules in the United States and the United Kingdom.

Key problems when pursuing those engaged in criminal activities across the Internet are identifying the perpetrator and obtaining sufficient evidence to commence legal proceedings. Honeypots can be an effective tool in addressing these problems. The legal implications of such techniques, however, need to be considered during the design and implementation of the honeypot; section IV makes some recommendations for those considering using a honeypot.

II. WHAT IS A HONEYPOT?