Eircom network crack is problem for all of us

No doubt Thursday was gratifying for the hacker who broke into Eircom's network and gained potential access to the user names and passwords of the company's Internet service subscribers.

The story made a splash all day, from print to online news to radio and television. Security specialists were contacted for comments and Eircom was grilled about the break-in. Disconcerted customers, including many small businesses, found they were locked out of their Internet accounts because Eircom changed 30,000 user passwords to protect the accounts.

Many people sat on hold or reached engaged signals when they tried to ring Eircom's help desk to get their new password. Some of the passwords didn't work. A procession of callers to RTE's Liveline programme put an Eircom spokeswoman through the wringer, using the opportunity to voice frustration with other aspects of Eircom's service.

That's why hackers (or more correctly "crackers", the term for people who break into sites as opposed to the adepts originally called "hackers") enjoy cracking high-profile sites. They get off on the buzz of media attention and the embarrassment caused to the primary victim of the crack.

As the spokeswoman pointed out on Liveline, crackers rarely do anything with private information such as user names or credit card numbers gleaned from a successful crack. Many are simply interested in showing they have the technical expertise to stage an effective break-in.

Indeed, many say they primarily wish to demonstrate the inadequacy of the security systems protecting many corporate or government websites. Sometimes they themselves identify, then repair, the vulnerability as part of the crack. Often, particularly skilled crackers despise cracks that cause headaches for thousands of innocent site-users.

What the cracker has done - dramatically - is raise awareness that online security is everybody's problem and should be a national priority. Until now the Republic hadn't experienced a well-publicised, large-scale crack in which thousands of people could have had their accounts compromised. For the most part we could read about high-profile cracks elsewhere and think of them as someone else's problems.

Sadly, people - and, more worryingly, businesses and organisations - rarely are motivated to evaluate security measures until they feel a level of personal threat. This is true for individuals, who often use the same password for all their different computer accounts.

It's also true of companies like Eircom, which clearly did not have an adequate security system in place to address a large-scale crack, or a well-thought-out response programme to handle the aftermath.

Yet not only are we in the midst of a massive, global, computer-reliant movement towards electronic business and government; many people's ordinary, day-to-day communications have also shifted online. As the Government encourages the drive towards an e-commerce-based "information society" future, many people will now be wondering whether company and personal information is safe.

The answer is, predictably, complex. Information can flow more freely in digital form over computer networks and the Internet. However, it can also be protected using encoding programmes giving individuals and businesses the kind of security once available only to governments and surveillance organisations.

That's why the Government's recent e-commerce Bill was so important. It sets out an infrastructural framework in which individuals, businesses and organisations can use encoding programmes for all their communications and transactions. Such programmes and such a system will be the norm in the near future, and should become nearly invisible to the user, no more complex than sending an e-mail is today.

Additionally, companies responsible for people's private information must ensure they have adequate security systems for their networks. They must maintain a clear plan of response in case such systems are breached.

Crackers will always look for weaknesses in security programmes and networks, and, as programmes and networks grow ever larger and more complicated, they will find them. But that doesn't toll the death knell of e-commerce any more than criminals in general have caused commerce in general to fail.

The Eircom crack is an overdue wake-up call reminding people that they will need to bring even more diligence and responsibility to the networked, online world we are creating.

Karlin Lillington is a freelance journalist who specialises in technology