Who Hackers Are, What Motivates Them, and How the Practice Has Changed Over Time

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 7.2 Free with a free account

Who Hackers Are, What Motivates Them, and How the Practice Has Changed Over Time

Ethics in Technology · Chapter 7: Hackers, Cyber Warfare, and the Global Battle for Digital SecuritySection 7.2 · lesson 29 of 11616 min · free with a free account

← The Tension Between Public Access to Information and Protecting National InterestsNext lesson: What Happens When Hackers Get Caught: Criminal Charges, Penalties, and Landmark Cases →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Permission, capability, history, and responsible security research.

  • Distinguish creative hacking from criminal intrusion
  • Evaluate authorization and intent separately
  • Compare actors, motives, and defensive priorities
  • Explain ethical testing and coordinated disclosure

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,914 words). Read along, or search it.

Chapter 7

Hackers: People, Motives, and Change

The word hacker can describe technical creativity, or it can describe criminal intrusion. Those meanings overlap in conversation, but cannot replace careful analysis of conduct. This lesson separates permission from purpose, then examines capability, resources, and motivations. We compare individuals, insiders, organized criminal groups, state-sponsored teams, and security researchers. Technical skill can support protective testing or cause harm. Historical changes explain how campus exploration developed alongside telephone misuse and later criminal markets. We also examine ethical hacking, disclosure policies, bug bounties, and other authorized security arrangements. Breach figures illustrate motives, with dates and sample limits explicit. Good intentions do not create permission, although legal requirements and enforcement policies need accurate qualification. Responsible work requires clear boundaries, careful handling, and an effective route for reporting weaknesses. Evaluate a specific act, rather than assuming a label determines whether someone is lawful or trustworthy.

One Word, Two Meanings

Technical Ingenuity and Criminal Intrusion Are Different Uses of “Hacker”

In early computing culture, a hack meant an inventive solution that showed deep understanding. A hacker could make a system behave unexpectedly, improving it or exploring possibilities. The associated outlook valued hands-on investigation, shared knowledge, and understanding systems rather than merely using them. That meaning remains positive in many technical communities, and does not inherently describe an intruder. In common public usage, hacker often means someone who breaks into computers for a harmful purpose. Criminal cases and dramatic reporting made that second meaning familiar to a wider audience. A security researcher and a criminal may recognize similar weaknesses, while using that knowledge differently. The distinction matters for journalism, policy, employment, and organizations responding to reports. Ask what happened, which systems were involved, who granted permission, and what boundaries applied. Then examine the purpose, risks, disclosure route, and relevant legal requirements for the conduct. Skill or the word hacker alone cannot answer those questions about authorization and responsibility.

Authorization and Intent

Permission and Purpose Must Be Evaluated Separately

Hat labels summarize familiar situations, but permission and purpose are separate questions. White-hat work uses owner-authorized testing within agreed boundaries, with findings reported for repair. Gray-hat activity generally involves probing without permission, often with curiosity or a wish to help. Black-hat activity combines unauthorized conduct with harmful purposes such as theft, extortion, or sabotage. A malicious insider can begin with legitimate access, while misusing it in ways that were not permitted. Good intentions do not grant permission, and causing no damage does not automatically make access lawful. Criminal liability still requires the relevant statute's elements, including applicable intent, knowledge, and other conditions. The United Kingdom's unauthorized-access offense includes knowing that the intended access is unauthorized. The Justice Department's CFAA policy directs prosecutors to decline qualifying good-faith security research. That policy does not grant owner permission, blanket immunity, or protection from every other legal claim. Explain these qualifications before treating every unsolicited observation or report as an automatic criminal offense.

Actor Profiles

Capability, Access, Resources, and Objectives Shape the Threat

Actor categories describe capability, access, resources, and organization, rather than moral character alone. A script kiddie uses ready-made tools without much understanding, but can still cause serious harm. Indiscriminate activity often reaches systems because they are exposed or poorly maintained, rather than personally selected. A skilled individual may specialize deeply, relying on knowledge, time, and persistence. An insider's advantage is existing access and knowledge of where valuable information is located. Organized criminal groups divide work among specialists, suppliers, affiliates, and people handling money or negotiations. State-sponsored teams may have substantial resources and strategic objectives, although their capabilities and budgets vary. State teams are not unbeatable or equipped with literally unlimited resources. Security researchers investigate weaknesses under professional arrangements that may be employed, independent, or academic. For defense, compare objectives and actual access, rather than assuming all people sharing a label behave identically. Basic safeguards matter against opportunistic activity, while targeted threats also require detection, containment, and practiced response.

Insider Risk

Malice, Mistakes, and Compromised Credentials Need Different Remedies

Insider cases need different remedies, because deliberate misuse differs from a mistake or stolen credentials. A malicious insider intentionally misuses legitimate access, perhaps for payment, grievance, or an approaching departure. Least privilege, separated duties, sensitive-access monitoring, and prompt offboarding can reduce opportunities and improve detection. A negligent insider may misdirect a file, expose a share, lose a device, or follow a deceptive message. Training helps, but safer defaults and clear workflows also reduce the chance of harmful mistakes. A compromised identity means an outsider uses a worker's credentials, making activity appear to have a legitimate identity. Strong authentication, unusual-use alerts, containment, and response address that problem more directly than punishment alone. Insider activity can resemble ordinary work, so perimeter controls alone do not solve every access problem. Verizon's twenty twenty-six report described fraudulent remote hiring linked to North Korean IT workers. It estimated about fifteen thousand possible stolen identities, while explicitly acknowledging considerable uncertainty. That is not a worker count. Recruitment verification, human resources, and security need coordinated safeguards.

Motivations

The Same Technique Can Serve Different Objectives

Financial gain includes theft, fraud, extortion, and selling access or data to others. Espionage seeks intelligence, proprietary research, or commercial secrets, often through quiet collection over time. Curiosity and challenge treat a system as a puzzle, without necessarily supplying a malicious purpose. They still do not provide permission to access somebody else's systems or personal data. Status and reputation can motivate someone to prove skill to peers or a larger audience. That can explain public boasting, even when publicity increases the chance of consequences. Grievance and revenge concern a particular employer, institution, or person, rather than an interchangeable target. Ideology can motivate conduct for a political or social cause, which later lessons examine further. These motives can overlap, rather than forming completely separate groups of people. A state-linked actor can seek revenue and intelligence, while a status-seeking individual may also demand payment. Risk analysis should connect objectives with valuable assets, observable behavior, and realistic protective priorities.

Dated Breach Evidence

Financial Motivation Leads, but Sector Mix and Denominators Matter

The twenty twenty-six Verizon breach report gives dated evidence about recorded motives and industry differences. Its overall motive figure listed financial gain in eighty-eight percent, and espionage in thirteen percent. That figure concerns recorded breaches with relevant information, rather than external actors alone. The healthcare summary listed ninety-nine percent financial motivation and two percent espionage. The retail summary listed eighty-five percent financial motivation and nineteen percent espionage. These are overlapping categories, because a breach can involve more than one motive. Their totals therefore need not equal one hundred percent, and should not be forced into exclusive slices. The figures do not describe every hacker, unseen incidents, or a company's attack probability. Industry samples and known-information coverage differ, which limits direct comparison and broad prediction. The contrast still encourages organizations to ask which information and relationships attract particular adversaries. Personal records, payments, trade secrets, and supply arrangements can create different opportunities for revenue or intelligence.

Historical Change

Curiosity, Networks, Markets, and Organized Operations Coexist

Campus computing during the nineteen sixties associated hacking with inventive solutions, exploration, and shared technical understanding. Telephone phreaking extended curiosity to a network that belonged to others and charged for service. Some participants manipulated signaling to obtain unpaid service, making ownership and consent central ethical questions. The important point is historical tension, rather than instruction in how to misuse telephone systems. During the nineteen eighties, home computers, modems, and bulletin boards expanded participation and information sharing. The United States enacted the Computer Fraud and Abuse Act in nineteen eighty-six. The United Kingdom's Computer Misuse Act followed in nineteen ninety, amid growing concern about unauthorized access. Internet growth increased reachable systems, while worms, defacements, and publicized cases shaped the public meaning of hacker. Later criminal markets supported specialists in stolen data, access, tooling, and financial services. State capabilities and legitimate bug bounties expanded during the twenty tens, alongside organized criminal operations. Data-leak extortion and supplier compromise became prominent pressures, while earlier curiosity and responsible research continued too.

Authorized Security Work

Choose an Arrangement That Matches the Organization’s Objective

Ethical security work uses authorization and boundaries that match the owner's objective and authority. A vulnerability disclosure policy invites reports and states permitted scope, handling expectations, and legal assurances. It need not promise payment, while a bug bounty rewards qualifying accepted findings under stated terms. A penetration test is a contracted engagement, against a defined scope and during an agreed period. A red team exercise simulates selected adversary goals to assess detection and response under authorization. A continuous reporting program differs from a bounded testing engagement. Written permission must come from someone entitled to authorize the relevant systems and conduct. Ownership of a website does not automatically authorize testing every connected supplier or cloud service. The historical Hack the Pentagon pilot, in twenty sixteen, invited vetted researchers to selected public-facing websites. It showed government use of research skills, within defined targets and participation conditions. Legitimate work relies on permission, careful practice, and reporting, rather than the researcher's confidence or good character alone.

Coordinated Disclosure

Agree on Boundaries Before Testing; Reduce Harm Throughout

Coordinated disclosure begins with finding a weakness within an authorized scope and permitted methods. Respect data, availability, and stop conditions, rather than gathering extra evidence merely because it is accessible. The researcher reports through the designated channel, supplying useful information without unnecessary sensitive data. The owner then triages validity, severity, duplicates, and possible effects on users. Engineering repairs the weakness and checks the result, rather than treating acknowledgment as a completed response. A program may provide payment or credit, according to its stated eligibility and reward rules. Publication follows the agreed policy, considering remediation, user protection, timing, and suitable detail. A safe-harbor commitment describes the owner's position toward specified good-faith conduct under its terms. It cannot automatically bind every third party, authorize their systems, or erase unrelated legal requirements. If a lead goes outside permission, stop and seek clarification before extending the testing. The report itself is not automatically the offense; unauthorized access and other conduct require separate legal analysis.

Unresolved Questions

Bounties Create a Legitimate Path Without Settling Every Ethical Issue

Disclosure timing creates a tension between encouraging repair and exposing users before protection is available. Some policies use ninety-day deadlines with qualifications, rather than a universal rule for every weakness. Payment introduces another tension, because buyers seeking secret access may offer more than a vendor's bounty. A legitimate program therefore operates alongside alternative markets, while remaining responsible for fair treatment and safety. Bounty researchers often receive no payment unless a finding qualifies and is accepted under the rules. Duplicate findings, ambiguous scope, and opaque decisions can place substantial financial uncertainty on researchers. Clear terms, fair assessment, and respectful communication help sustain confidence in the program. Organizations also need a monitored reporting channel, trained triage, engineering capacity, and an actual repair process. Reward criteria, disclosure procedures, and legal review should be established before inviting extensive participation. A bounty cannot replace basic patching, authentication, or a team's ability to act on confirmed weaknesses. Opening prematurely can overwhelm staff, leave known defects unresolved, and damage trust with researchers and users.

Worked Decisions

Evaluate Specific Conduct Rather Than a Person’s Label

Consider a student who notices that a college portal may expose other students' records. A helpful purpose does not justify opening classmates' records to prove the suspected weakness. She can report her observation through the published channel, without collecting other people's personal information. The college should assess the facts carefully, rather than treating every report as extortion or criminal conduct. For a manufacturer, basic patching and authentication reduce opportunities for both opportunistic and targeted threats. Monitoring, segmentation, valuable-asset protection, and rehearsed response address risks that prevention alone cannot settle. A new bounty requires reporting, triage, and repair capacity before a large stream of findings arrives. Finally, consider a former intruder applying for a security role, with fairness and customer trust both relevant. Assess offense details, time, rehabilitation, candor, legitimate work, required access, and applicable contractual or legal obligations. Neither automatic rejection nor assuming technical talent proves trustworthiness supplies a reasoned decision. Return to the specific conduct: permission, purpose, potential harm, boundaries, accountability, and responsible alternatives.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Who Hackers Are, What Motivates Them, and How the Practice Has Changed Over Time

What is the difference between white hat, gray hat and black hat hackers?
The labels separate permission from purpose. White-hat hackers test systems with the owner's authorization, within agreed boundaries, and report findings for repair. Gray-hat hackers probe without permission, often out of curiosity or a wish to help. Black-hat hackers act without authorization and for harmful goals such as theft, extortion or sabotage. Good intentions never create permission, so gray-hat probing can still break the law.
What motivates hackers to break into systems?
Financial gain is the most common recorded motive in breach studies, through theft, fraud, extortion and selling stolen access or data. Other motives include espionage against government or trade secrets, curiosity and challenge, status among peers, grievance or revenge against a specific employer, and political or social ideology. Motives often overlap; a state-linked group may seek both intelligence and revenue, so defenders should link likely goals to the assets they hold.
What are the main types of insider threats?
Insider threats come in three main forms. A malicious insider deliberately misuses legitimate access, perhaps for money, a grievance or before leaving. A negligent insider makes a mistake, such as misdirecting a file or falling for a deceptive message. A compromised identity is an outsider using a worker's stolen credentials. Each needs a different fix: least privilege and monitoring, safer defaults and training, or strong authentication and unusual-activity alerts.
What is the difference between a bug bounty, a vulnerability disclosure policy and a penetration test?
A vulnerability disclosure policy invites outside reports and states scope and handling rules, without necessarily paying. A bug bounty pays for qualifying, accepted findings under published terms. A penetration test is a contracted engagement against a defined scope and time period, while a red team simulates a real adversary to test detection and response. All depend on written permission from someone entitled to authorize testing of those systems.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →