Why do young people start and continue with ethical hacking? A qualitative study on individual and social aspects in the lives of ethical hackers

• Published date: 01 November 2023
• Author: Judith E. Noordegraaf,Marleen Weulen Kranenbarg
• Date: 01 November 2023
• DOI: http://doi.org/10.1111/1745-9133.12650

DOI: ./- .

SPECIAL ISSUE ARTICLE

CYBERCRIME AND CYBERSECURITY

Why do young people start and continue with

ethical hacking? A qualitative study on

individual and social aspects in the lives of

ethical hackers

Judith E. Noordegraaf1Marleen Weulen Kranenbarg2

NFIR B.V.,The Hague, the Netherlands

Department of Criminology, Vrije

Universiteit (VU) Amsterdam,

Amsterdam, the Netherlands

Correspondence

Marleen Weulen Kranenbarg,

Department of Criminology Vrije

Universiteit (VU) Amsterdam, De

Boelelaan ,  HV Amsterdam, the

Netherlands.

Email: m.weulenkranenbarg@vu.nl

Abstract

Research Summary: This qualitative interview study

examined individual and social aspects in the lives of

 hackers who started with ethical hacking before the

age of . We examined what motivated and stimulated

them to start with ethical hacking and how and why they

continued. Results show that individual aspects, such

as an early interest in ICT (Information and Commu-

nication Technology), the motivation to make systems

more secure, and thinking of reporting vulnerabilities

as a moral duty, contribute to the initiation of ethical

hacking. Social aspects, such as role models, mainly

play a role in the further development of the ethical

hacking career.For example, peers, parents, friends, and

hacker communities have a motivating and stimulat-

ing effect on young ethical hackers. Similarly, positive

reactions from public and private system owners can fur-

ther stimulate the development and self-image of ethical

hackers.

Policy Implications: In contrast to criminal hackers,

ethical hackers improve cybersecurity, for example, by

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and

reproduction in any medium, providedthe original work is properly cited.

©  The Authors. Criminology & Public Policypublished by Wiley Periodicals LLC on behalf of American Society of Criminology.

Criminology & Public Policy. ;:–. wileyonlinelibrary.com/journal/capp 803

804 NOORDEGRAAF  WEULEN KRANENBARG

reporting weaknesses or errors in computer systems.

Nowadays, an increasing number of public and private

organizations around the world are creating cyberse-

curity policies and practices around ethical hacking.

The interest in hacking usually arises at an early age,

making it important to gain knowledge about what stim-

ulates and motivates young people to start and continue

with ethical hacking, to inform these policies and prac-

tices. Our results show that recognition and reactions

from system owners are important in the ethical hack-

ing career. Our recommendationsbased on these results

could stimulate more young people to take the ethical

path. Simultaneously, this increases the security of pub-

lic and private organizations, reducing opportunities for

criminal hackers.

1 INTRODUCTION

The explosive growth of the use of Information and Communication Technology (ICT) systems

has many advantages (Palmer, ), but as systems become more advanced and complex, the

number of possible vulnerabilities in a system is increasing. Such vulnerabilities in systems cre-

ate opportunities for hacking (Ruiter & Bernaards, ; Testa et al., ). Hacking is a growing

problem for public and private organizations and law enforcementin countries all over the world,

especially since hacking is often used as a stepping stone for other criminal purposes, such as plac-

ing malware or changing data (Stol et al., ). However, hacking is considered to be criminal

when the intrusion into a system is commissioned by the system owner,for example, when a com-

pany wants to test how secure its systems are. This is tested using a so-called penetration test or

pen test, a common cybersecurity practice (Steinmetz, ). A pen test is generally performed by

ethical hackers who work at a cybersecurity company.

There are also ethical hackers who report discovered vulnerabilities to system owners on their

own initiative (Harms, ), through dedicated policies such as Coordinated Vulnerability Dis-

closure (CVD) or bug bounty programs that actively encourage hackersto look for vulnerabilities.

The Netherlands has been a pioneer in developing and implementing these CVD policies (NCSC,

). Recently,other countries also started to formalize this type of ethical hacking. For example,

in the United States, the Department of Justice announced on May th, , that ethical hack-

ers will no longer be prosecuted under the Computer Fraud and Abuse Act (The National Law

Review, ).

To test the security of systems, ethical hackers use the same techniques as criminal hackers

(Harms, ; Steinmetz, a, ). The difference between ethical hackersand criminal hack-

ers is that ethical hackers test systems to make sure criminal hackers cannot abuse them.In this

way, ethical hackers play a prominent role in cybersecurity (Harms, ). This means there is a

need for these types of hackers nowadays, because of the increasing vulnerabilities in systems.