- Every single day
there's probably thousands of cyberattacks,
but when it takes down large organizations,
that's when people wake up.
- Hundreds of thousands of computers around the world
were hit by a computer virus called,
WannaCry.
- It's the biggest cyberattack of its kind in history.
- [Announcer] Users face a $300 demand to unlock their data.
- WannaCry was a pretty big event.
It became a big deal in the security industry.
A security researcher named MalwareTech
was doing some reverse engineering of WannaCry,
and actually stopped it.
- [Announcer] British authorities say
the spread has slowed,
thanks to an anonymous blogger,
known only as MalwareTech.
- [Narrator] Everyone thought of him as a good guy
using his powers for good.
But sometimes it is hard to tell whether someone's
activities might be good or bad.
- The young researcher who helped stop the spread of the
WannaCry ransomware virus
has been arrested.
- [Narrator] This is Chris Wysopal.
He's the CTO of Vericode.
and he's been hacking for decades.
- Information technology is pervading every single part
of our lives.
And it's important that all those systems are secured.
Look at WannaCry.
MalwareTech actually stopped it.
It wasn't law enforcement that stopped it.
It was someone from the hacker community.
Back in the '90s I was a member of the hacking group
L0pht Heavy Industries or The L0pht,
for short.
- [Narrator] L0pht testified before Congress
about security vulnerabilities on the internet.
- Part of what you're trying to do is demonstrate,
something that you feel like the American people
need to know and that's part of our job also.
- We had a demonstration online
where if you clicked on our website
it would crash your computer.
We all know this is a problem now,
but back then,
the people who were building software
had no idea what this was.
We started to raise awareness within the government,
that the government should probably listen to hackers.
- We think there's a tremendous asset that the hackers
actually bring to the table here,
in understanding.
- This was really the first time where
hackers were looked at as a source of knowledge
that could be helpful for society.
- [Narrator] Their testimony before Congress
couldn't consider the birth
of the modern cyber security industry.
When internet security is compromised
it is often hackers who find a way to solve the problem.
- When WannaCry hit it became a big deal
in the security industry.
That's I think where a lot of people got introduced
to MalwareTech.
He was a good malware researcher doing good work.
- [Narrator] When we caught up with MalwareTech this summer
the once anonymous hacker was still reeling
from his sudden fame and press attention.
- Speak.
- So talk me through what happened,
on the morning of May 12th.
- Where do you want to call I come from?
- How do you run malware without it infecting you?
- I'm named by the name MalwareTech.
That's my Twitter handle.
It's also the name of my blog.
And until recently this was the only name
people knew me by.
- You've been called the man who saved the NHS.
That must be a tremendous buzz for ya.
- I'm kind of a private person.
I don't really like fame,
so being sort of forced into the spotlight
was not great for me,
because my friends did not know about MalwareTech
and the people who knew MalwareTech did not know about me.
- I think it was around two minute machines
which he managed to stop being infected,
which is insane.
- There is this area when you're researching.
It does get you in touch with people that are criminals.
- It was very weird to see kind of the MalwareTech I knew
being thrown into the spotlight like that.
That can get him in a lot of trouble.
The nature of his work is disrupting cyber criminals
and I think that could make him a target.
- Twenty-three year old Marcus Hutchins
has been arrested by the FBI.
- [Narrator] A few weeks after our interview
Marcus Hutchins was arrested for allegedly creating
the piece of malware called Kronos,
which allowed hackers to steal banking credentials
from infected machines.
- Initially it was pretty shocking
because he was known as a malware researcher
that had helped protect people from WannaCry.
- [Narrator] Marcus was arrested in Las Vegas.
It's been reported that he was attending Defcon,
the world's largest hacker conference.
Defcon has traditionally been a bridge
between federal authorities and cyber security researchers
who want to alert the world to potentially
dangerous exploits.
But Marcus' arrest highlights a long-standing tension
in a relationship where trust is critical,
but often lacking.
- Security researchers are going to get close
to criminal enterprises to understand
how that ecosystem works.
It's much like an investigative reporter
that wants to talk to someone who's part
of a criminal organization.
There's knowledge to be learned
from actually directly contacting the criminal element.
The malware researcher is doing this online.
They're interacting online,
maybe through emails,
message boards, websites,
and things like that.
- [Narrator] That gray area is what people
in the cybersecurity industry are worried about
the outcome of the MalwareTech case.
They want to make sure that the authorities don't confuse
legitimate researchers for the very hackers
they are trying to stop.
- We don't know a lot about the case.
This case could be really critical
for the security research community.
Whether he did it or not,
there's going to be some precedence set here.
It's not clear whether he was doing research
or he was participating in causing harm from malware.
So in this case,
people in the security industry are afraid
of areas of security research being illegal.
What that means is,
only people that are criminals are going to understand
how those off-limits areas work.