What is a hacker?

Two meanings of "hacker"

The word has two meanings that people still argue about. The older one describes a person who enjoys understanding systems deeply and finding clever ways to stretch them. The IETF's Internet Users' Glossary (RFC 1392, 1993) defines a hacker as a person who delights in having an intimate understanding of the internal workings of a system, and notes that the word is often misused to mean "cracker." The Jargon File, a long-running dictionary of programmer slang, makes the same distinction.

The newer, everyday meaning is someone who breaks into computers. News reports almost always use this one. On Tunnelcheck we use "hacker" in the everyday sense when talking about attacks, and say "security researcher" for people who look for flaws with permission.

Where the word came from

The Tech Model Railroad Club at MIT, founded in 1946, describes itself as the birthplace of the term "hack." In the late 1950s and 1960s its members used "hack" for a clever or playful piece of engineering, and some of them went on to work on MIT's early computers. Journalist Steven Levy's 1984 book *Hackers: Heroes of the Computer Revolution* traced how that culture spread and summed up its values, such as free access to information and judging people by their work, as the "hacker ethic."

By the 1980s, as home computers and modems spread, "hacker" in the press came to mean people breaking into systems. Groups such as Germany's Chaos Computer Club, founded in 1981, kept the older idea alive by demonstrating flaws in public and publishing their own hacker ethics.

White hat, grey hat and black hat

The labels come from old Western films, where heroes wore white hats and villains black ones. They are rough categories. Other terms you'll see include hacktivist (someone who hacks for a political cause), script kiddie (someone who uses tools written by others without understanding them) and state-sponsored or nation-state actor (hackers working for a government). Our hackers overview describes real examples.

Ethical hacking and responsible disclosure

Companies pay security testers to attack their own systems and find weaknesses before criminals do. Many run bug bounty programs that reward outside researchers for reporting flaws. The standard practice is coordinated vulnerability disclosure: the researcher tells the vendor privately, gives it time to fix the flaw, and then the details are published. CISA runs a coordinated disclosure process for flaws that affect many vendors or critical systems.

What the law says in the US: the CFAA

The main US federal anti-hacking law is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, first passed in 1986. It makes it a crime to access a computer "without authorization" or to "exceed authorized access," and to cause damage, commit fraud or traffic in passwords, among other things.

Two recent changes narrowed how it applies:

• Van Buren v. United States (2021). The Supreme Court held that a person "exceeds authorized access" when they enter parts of a computer, such as files or databases, that are off-limits to them. It does not cover someone who misuses information they were entitled to reach.
• Justice Department policy (2022). In May 2022 the department told federal prosecutors not to charge good-faith security research under the CFAA, meaning research done to test or fix a flaw in a way designed to avoid harm.

States have their own computer crime laws too, and other federal laws, such as wire fraud and identity theft statutes, often appear in hacking cases.

What the law says in the UK: the Computer Misuse Act

The UK's Computer Misuse Act 1990 makes it an offense to access a computer without authorization (section 1), to do so with intent to commit further crimes (section 2), and to do unauthorized acts that impair a computer's operation (section 3). Later amendments added offenses for making or supplying tools for these crimes. Unlike the US, the UK has no formal statutory defense for security research, which researchers' groups have long asked the government to add.

How to protect yourself from malicious hackers

Most attacks on individuals are opportunistic. Criminals use leaked passwords, phishing and unpatched software because they work at scale. Unique passwords in a password manager, multi-factor login, automatic updates and caution with unexpected messages stop most of them. See our cybersecurity basics.