This is why I teach my law students how to hack

In the movies, you can tell the best hackers by how they type. The faster they punch the keys, the more dangerous they are. Hacking is portrayed as a highly technical feat, a quintessentially technological phenomenon.

This impression of high-tech wizardry pervades not just our popular culture but also our real-world attempts to combat cybercrime. If cybercrime is a sophisticated high-tech feat, we assume, the solution must be too. Cybersecurity companies hype proprietary tools like “next generation” firewalls, anti-malware software and intrusion-detection systems. Policy experts like John Ratcliffe, a former director of national intelligence, urge us to invest public resources in a hugely expensive “cyber Manhattan Project” that will supercharge our digital capabilities.

But this whole concept is misguided. The principles of computer science dictate that there are hard, inherent limits to how much technology can help. Yes, it can make hacking harder, but it cannot possibly, even in theory, stop it. What’s more, the history of hacking shows that the vulnerabilities hackers exploit are as often human as technical — not only the cognitive quirks discovered by behavioural economists but also old-fashioned vices like greed and sloth.

To be sure, you should enable two-factor authentication and instal those software updates that you’ve been putting off. But many of the threats we face are rooted in the nature of human and group behaviour. The solutions will need to be social too — job creation programmes, software liability reform, cryptocurrency regulation and the like.

For the past four years, I have taught a cybersecurity class at Yale Law School in which I show my students how to break into computers. Having grown up with a user-friendly web, my students generally have no real idea how the Internet or computers work. They are surprised to find how easily they learn to hack and how much they enjoy it. (I do, too, and I didn’t hack a computer until I was 52.) By the end of the semester, they are cracking passwords, cloning websites and crashing servers.

Why do I teach idealistic young people how to lead a life of cybercrime? Many of my students will pursue careers in government or with law firms whose clients include major technology companies. I want these budding lawyers to understand their clients’ issues. But my larger aim is to put technical expertise in its place: I want my students to realise that technology alone is not enough to solve the problems we face.

I start my class by explaining the fundamental principle of modern computing: The distinction between code and data. Code is a set of instructions: “add,” “print my résumé,” “shut the door.” Data is information. Data is usually represented by numbers (the temperature is 80 degrees), code by words (“add”). But in 1936, the British mathematician Alan Turing figured out that code could be represented by numbers as well. Indeed, Turing was able to show how to represent both code and data using only ones and zeros — so-called binary strings.

This groundbreaking insight makes modern computers possible. We don’t need to rebuild our computers for every new programme. We can feed our devices whatever code we like as binary strings and run that program. That zeros and ones can represent both code and data is, however, a blessing and a curse, because it enables hackers to trick computers that are expecting data into accepting and running malicious code instead.

Consider a simple hack I teach my students. An attacker sends an email that has a file attached. Because the file has a “.txt” extension, we assume it is a plain text file — that is, data — perhaps a grocery list or grades on a final exam. But when we open the file, the operating system will not only send the data to the screen, it will also execute the malicious code that the hacker has secretly embedded, allowing him to seize control of your computer.

You can instal security software to lessen this risk. But to eliminate the risk, you would have to prevent computers from treating binary numbers as both code and data — which would mean stopping them from being modern computers.

The good news is that there are promising ways to tackle the human dimensions of the problem — that is, the social, economic and psychological aspects. The bad news is that we have largely failed to pursue them.