6

Is ethical (white hat) hacking a Halakhikly permissible profession? What are the halachot which apply to hacking and in particular ethical hacking? What stance would Jewish ethics take on ethical hacking?

For example may one appear as an intruder in order to test a system or make things appear one way when really they are another in order to correct vulnerabilities?

How does Marit Aayn come into play?

Does the Halacha change if the work is not merely commercial but for a national interest or during a war? Like so: https://www.youtube.com/watch?v=nuPZUUED5uk

What about in cases of self-defense? Can one hack to defend oneself?

Can a jew be an ethical hacker?

6
  • 6
    "ethical hacker" has many meninges. hired penetration tester for a company is not like a guy that destroy "black hat" hackers computers. Can you be specific? Commented Jul 24, 2019 at 7:50
  • 1
    Mar'is Ayn is when someone appears as if transgressing Mitzvos, hackers are [not to be] never seen (presumably). Why do you think there's a problem of M"A?
    – Al Berko
    Commented Jul 24, 2019 at 8:51
  • Most ethical hacking is for security reasons or for software testing. On a small scale, a company, is allowed to test the vulnerability of their product to protect their users. customers and employees from economic, data (which relates to economics) or physical harm (e.g. protecting identity theft.)
    – DanF
    Commented Jul 24, 2019 at 14:40
  • 1
    From a legal perspective I can’t see why it’d be prohibited since white-hat hackers are charged by the “victim” in the latter’s interest, so they are not transgressing anything (e.g. If I say to you “Try to pickpocket me; I want to test my vulnerability” and you successfully pickpocket me but return what you’ve stolen and demonstrate how you did it, no stealing was done).... cont.
    – Oliver
    Commented Jul 24, 2019 at 17:40
  • continuation.... The only tentative ethical issue that comes to mind now is if such hacking (pickpocketing) falls under the [debated] issue of “stealing in order to aggravate/repay” (BM 61b) or perhaps more akin to what Iyov/Job did in order to benefit orphans and widows (BB 16b).
    – Oliver
    Commented Jul 24, 2019 at 17:44

1 Answer 1

2

It goes almost without saying that general hacking and revealing, or discovering private information would be strictly prohibited (Remo CM 154:7, Shulchan Aruch HaRav CM, Hilchos Nizkei Mamon, 11)

In the words of Shu"t Benei Banim (3:17):

“Those who break into computer codes or into any protected data store or similar, who are called “hackers” – their sin is severe.”

Although, for our purposes, we need to find out if this is permissible when it is done לתועלת, for good purposes.

The answer to this may be found in an Ibn Ezra on the Torah (Shemos 20:12)

או שנגלה לך סוד שתוכל להצילו מן המות אם תגלהו לו, ואם לא גלית אתה כמו רוצח.

Or, if a secret was revealed to you and you can save someone from death by revealing it to him – if you do not reveal it, you are like a murderer.

Rav Moshe Feinstein ruled (Iggeros Moshe, Y.D. 214) that in such a situation of threat to life privacy may be invaded, and Rav Moshe Shterbach (Teshuvos Ve’hanhagos, 1:869) ruled that this applies even in cases where there is only a vague threat to general safety.

As an addition, it seems clear to me that when hacking in order to retrieve your own information, that was perhaps stolen, or information about your property which is being hidden unrightfully, you would not constitute any issue, as you are not breaching the others privacy unrightfully.

This point could be made from the following Mishna (Kesubos 75a):

ואם יש מרחץ באותה העיר אף מומין שבסתר אינו יכול לטעון מפני שהוא בודקה בקרובותיו.

If that city has a bathhouse, then the husband cannot complain about even secret defects, because he [should have] asked those close to her.

We see here that the legal rights to protect the members of a purchase or marriage trump the values of privacy.

1
  • Good answer, but you do not cover the (perhaps kal v'khomer) case of being paid by a company to break in their own system. I would think permissible, but not explicitly stated here.
    – Mike
    Commented Dec 21, 2021 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .