Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/596 Thanks!
And now to our first talk in Hall
one, it's titled, I Feel Like
a Criminal and I have to be God at the
same time.
And it will be about how we as
a community.
There's lots of talk at this
Congress about hacktivism, about hacking,
but there's not a lot of introspection
about what we want to be as a community
and how how we think about ourselves.
And now, Leonia, million
tonnes is going to talk about that.
Please welcome her to the stage.
Hello, good morning. I'm very thankful
for seeing so many people, despite the
fact yesterday was a very it's the last
day there was a toilet party, as I've
heard.
So greatly appreciated that you came
along.
My name is a.. A dancer.
I'm a PhD student in the School of
Politics, International Study and
Philosophy, a very long and dry name in
the Queen's University, Belfast.
And today is the introduction already
said. I'd like to give you a small
insight into my interdisciplinary
research project, which
is looking at security issues around like
hacking hacktivism, but like more
around the issue of how different actors
perceive hacking and hacktivism.
So I'm looking at the policy level of the
European Union, but also, for instance,
at the cyber security sector, whatever
that means.
And like people who call themselves
hackers and hacktivists and what they
think, how they are portrayed
and currently perceived.
And I'd like and with the very
controversial title, I feel like a
criminal and I have to be got at the same
time. It's not that I think I am, but
like it was a quote by one of my
participants. I'd like to give you a
rough overview in the next 45 minutes on
what I found in the course of my study
and before everybody freaks out and says,
oh, my God, it's a social scientist doing
research on this community,
I would like to give a brief
kind of disclaimer.
I'm aware I'm not like doing anything
like cyber CSI, cyber
crime related. I'm not like basically
trying to
bring people to jail or do kind
of armchair psychology or
imitate like this kind of
well known
series. And also very important.
I'm not funded by the JQ because
I'm from Belfast and everybody assumes
that it was a question I got quite
frequently when conducting this study.
And it's different. I would like to make
clear straight away before I start where
I'm standing, how I was funded.
So that is that nobody can accuse me of
any kind of bias.
I was hesitant to include it, but I think
it's important to make clear how research
is basically currently funded.
So what happened to me?
I'm funded by the Department of
Employment and Learning, which is a
government institution in Northern
Ireland. They cover my tuition fees
because the UK just feels like education
shouldn't be free.
At the school of politics, of
international studies and philosophy,
they give me five thousand a year, which
is not enough. That's the reason why I
have a part time job as a tutor and
teaching assistant and I get additional
funding here and there,
like the Larmer University scholarships
and thunder. It's not that I want to bore
you to death with that information.
I just want to emphasize one thing.
None of these people, none of these
organizations had any influence with what
I did not, like, make clear
that they had like certain kind of
interests of finding this.
They simply gave me the money on the
basis of my funding application.
That was it.
So I hope I eliminated any doubt
at this stage.
And I was I really felt like I want to
get this off my chest because it was a
question that got like over the course of
this year multiple times.
And on that basis, I'd like to make
further clear misconception of what
I'm interested in doing and working
on. I'm currently in a field called
Critical Security Studies.
And what that
area is basically doing is it examines
not like what old school security
scholars would have done, like, oh, the
Cold War is over and what are we doing
with the world? It's more about what is
the effect of security politics that we
are
what we are currently having.
So I'm the
I'm interested in analyzing the
consequences and effects of the integrity
of hacking, hacktivism and understanding
of the practice in identi of hackers and
hacktivists.
And very important. What I mean before
that, when I talk about consequences and
effects, is basically
how they are portrayed
and what they are how they are resisting
this kind of portrayal.
And really important is for me through
their eyes by giving them a voice,
because I feel like a lot of the
literature is basically talking about
hackers and hacktivists, but they never
really approached them and asked them,
what do you think?
And that is what I'm keen on doing and
hopefully being able to transport here in
the course of the next hour
or so. The overview of what I'm going to
talk about is I give a brief definition
of hacking hacktivism so I can offend
people with my definition and you can
scrutinize what I'm saying afterward.
In the Q&A, I talk
about incentivisation.
It's a theoretical concept.
I assume not a lot of people have heard
about it. So I think it's important to
talk about what I mean with this.
I'm talking about my method, how I got
it, the data, how analyzed it, the really
important bit about my results.
And then like the question of so what?
Why is the social scientists doing this
research? Why is it we're funding it or
why is it even relevant?
And last but not least, question and
answer session where I hope
I'm able to answer questions which
remain in the course of this talk.
So hackers, it's a very ambiguous
term, hacktivists as well.
You know, you have certain kind of
assumptions around it.
My mom thinks about hackers, something
else, like you guys think about hackers.
And there's also a difference around
countries and they're kind of like
contexts around it.
But what I at least in my thesis,
think about like hackers and hacktivists,
it relates to computer hacking, at least
from my thesis, and comprises activities
ranging from unauthorized.
Says like manipulating technology
for unorthodox means up to the production
of free software, but it's really
important, but I think about hacking is
the technique.
So you may use it for like malicious
reasons, but you don't need to.
And I think that is one aspect.
A lot of people blind out and I guess a
lot of you think as well
the hacktivism part is a bit more tricky
because that is a word where a lot of
people feel offended by.
I think it's like use that as a buzzword
the media uses.
But I think it's a really interesting
aspect to take into account and emerging
both concept, because when we talk about
hackers and hacktivists at this moment of
time, they are both somehow tied
in with a certain kind of perception
around them, how they look like, how they
what they do. So therefore, Murcheson,
for this specific study together, despite
the fact, acknowledged there might be
differences.
So hacktivism for me is a form of
political activism.
I'm through hacking techniques and it's
really important that there's something
around values and ideology.
And that makes it distinct for me
to hacking because you can hack your
washing machine because
you want to make coffee with it, but you
can hack the washing machine to set a
perhaps a political statement to, let's
say, Siemens.
And the really important bit, what I also
think a lot of people forget is like
their activities stretch from illegal to
legal. So you can do it both ways,
constructive and constructive.
And what I mean with that is the
idea of like builders and brokers.
And if you're interested in that, there
were all the talks and papers I've
published where where you can read more
about the idea of what I'm thinking
around there and very important is
in aligns with your worldviews and
against. And what I mean with that is
basically, as we see currently,
everybody's really excited when anonymous
the stuff around against ISIS.
But when they do something against your
own government, you basically perhaps
like feel that this is not correct.
So hacktivism is like any kind
of other political activism.
If you are going to an anti-racist
demonstration, you are in alliance
to that. If you are in the KKK,
you certainly wouldn't feel very happy
about that demonstration taking place.
So this is the important bit about
activism. It depends on your world views.
And that is the same with hacktivism.
OK, so the
redebate, which is troubling or
problematic, is the terms are
controversial.
So we all have like the idea
of like the hacker with the balaclava
sitting in front of a desktop, having the
terminal open and
the misrepresentation goes
in the media, politicians even
like the industry, but also like
academia.
And what is happening is that it's often
considered that that's kind of a security
threat. Construction at least like it,
at least in the UK.
Definitely.
This is the starting point for my
research, this idea of like
we have a certain kind of image in mind
about like hackers and hacktivists, and
it's like this frat image
and that is where securitization comes in
or more important in securitization.
And what I mean with that is one does not
simply say security.
Security is really something
which is used in political contexts,
achieving a certain kind of purpose,
having a certain kind of aim and
in synchronization of theory basically
says security issues do not necessarily
reflect the objective material
circumstances of the world.
So if you are, for
instance, if I'm going to macro steps on
the stage and says we have a terrorist
threat, something happens.
And the important bit is security
is like cool constitutional
like ICO.
It relates to something insecure,
just like you have the idea of good and
bad. It requires the opposite.
Security requires an opposite as well.
There's something secure and something
insecure.
And in that regard, they are
relative. And if you consider
something as a security threat,
there must be an opposite to that.
And this is an important starting point
from a research on
what happens with when politicians
or the cybersecurity sector talks about
hacking. What happens with those being
the, you know, the insecurity
level, the hackers and hacktivists,
because they propagate fear and have
an effect.
So my interest is basically to understand
or for the entire organization is
how and why this process
happens and to identify the effects
of it. And the effect is what I
want to talk about today in this talk,
and this is basically what I'm trying to
do and hope to achieve in the next like
30 minutes left.
So coming to the effort, because that's
always a very
interesting aspect, at least in academia.
It's a qualitative research.
And I make straight away the claim I'm
not making any kind of
claims about the community, whatever
that is, it's not generalizable.
It was like based on thirty five
interviews I've conducted in the course
of a research fellowship.
I was in Berlin for three months,
but the interviews were conducted both
face to face, but also digitally using
voice over IP services.
And I have ethical approval
for this study
and they were non-recurring
interviews.
So I've not met those people again,
necessarily. And like, it's
really important they were conducted in
English and in German.
But for the purpose of this talk, all of
the quotes have been translated
to English by myself.
And I know that there's one word which a
lot of people would probably get offended
by. It's called self-identified.
And I know that there are issues around
that and I will touch upon that in the
results section.
But but what I mean with that is
basically anyone who basically talked
to me was made aware in a participant
information sheet, which basically gave
them the
the knowledge that they
were looking for people who call
themselves hackers and activists, and
they were willing to participate.
They would also make clear that, like the
interviews were all recorded and I
transcribed all the interviews on Tale's
they've never have been on a Windows
computer and will ever be.
And if you have more questions around the
ethics and data protection issue,
please feel free to get in contact with
me and analyze the interviews
with semantic analysis,
which is a six step approach.
You can read up on it and basically
looking at like kind of themes in
interviews and the important bit
is about P1.
So in the course of the next slide you
will see Hlophe like P1, P2P,
twelve, whatever that means, participants
plus numbers. So I had coded identifiers
to know where this quote
comes from, but I did not
include any kind of
more information about them, like their
names or the location or anything like
that.
And really important is also that
that I also told my precedent's
that they cannot tell me under any
circumstances, tell me any kind of
incriminating material.
So that limits the results as well,
because they couldn't tell me, like, for
instance, if they would have done
something illegal, which I'm happy they
didn't.
So that is also important for the
further steps in analyzing
my results.
OK, and I'm not providing more
information about my participants because
of the possibility of
social risk involved for the people who
talk to me.
And that's simply
why I provided you with the numbers and
the gender, despite the fact that gender
might be there's a
massive gender inequality here,
but it was really hard to find females,
unfortunately.
OK, so not everybody is
completely excited for the
results. I hope
the results basically are split into
three themes and the themes,
of course, I've identified
and I found them because they were on the
basis of the method I used.
They were different kind of steps I went
through. That these were prominent
topics coming up in all interviews,
and one of them is called identity, and
what I mean with that theme is basically
the misrepresentation of hackers
and hacktivists leads to their
differentiation.
And I will go into depth around
like all of them. But that's just like a
short overview of what you can expect for
the next like 15.
I don't know how many minutes left.
The insecurity topic or theme
is basically the threat to privacy and
security for the community leads
to their investment in more security.
It's like a vicious circle and the last
bit is called system.
And what I mean with that is the mistrust
in authorities and hierarchies
like in the current political system
leads them to conduct activism and
potentially also hacktivism.
OK.
A really important point is also there's
two different dynamics
involved in all those themes.
And one attempt, the external and
internal. It's not the most sexy
like definition I could find,
but what I mean is with external what
participants think is happening.
So they were often saying, you know,
society thinks this and that's what they
think is going on at the internal
dynamic. Is this resistance.
So what are they doing against that?
And I will talk about both
processes for each of the themes.
OK.
So coming to the first theme called
Identity, which I personally think
is really fascinating and one
of my favorite themes and the external
aspect is
to make you again, like
think of it, the first identifying myths
about the misrepresentation leads to
differentiation.
And in the external aspect is basically
that due to the process of just
happening, they feel pushed out of sort
of a sphere of legitimacy by
participants.
And one of the first themes or issues
which comes up in interviews quite
frequently is the other.
So participants talked a lot about like
the aspect that they are considered as
like this associated with that negative
connotation of like, you know, the
hackers are the criminals.
We're the we are somehow
put in a categorization as a participant
said prejudice and free a categorization
that is lopsided, broad, and where a lot
of people would fit in.
So it's like a lot of the participants
spoke about it. So, you know, it's so
skewed towards one perspective that we
have, like, no possibility
to be considered anything else.
And that's also duality of perception.
That is where the quote they used for the
talk of
this presentation comes from.
I feel like a criminal.
I have to be God at the same time.
So they are basically often both
like heroes, like, you know,
my mom thinks they can do anything when
they touch her computer, but they can
also be they are also that negative
aspect of like the the criminal
or the terrorist whatsoever.
And I think it's really interesting.
I don't know if you've seen that Facebook
meme about the shooting of immigrants and
it's the same kind of the trading US
hacker. You're both like heroes
and like this incredible magicians.
But at the same time, you're the readers
who, you know, break every computer.
That is an interesting dynamic.
Salter talks about like that in regards
to her in a book about the U.S.,
How Anonymous is often portrayed as like
that Falck Devil, that boogeyman
we're using to basically
emphasize their otherness.
And that does not necessarily correspond
to what my participants perceive them
get a thing.
And it used a quote to basically
exemplify this.
It's from the Daily Mail, which is a very
high quality newspaper in the UK,
is the stereotypical
portrayed portrayal and that goes along
with an equation.
And so there's a there's the idea of
like they are the cultural outsiders,
they are the terrorists, the weirdos, the
sociopaths.
And it's really interesting because if
you read the book and Greenwald, he spoke
about the same thing I with Chelsea
Manning, Edward Snowden, Assange,
where basically their personal life got
to their political actions, got entangled
with like their mental health or
they were Nazis, delusional, anything
like that.
And the same thing. Basically, my
participants emphasized that the hackers,
you know, as it says, a baby faced,
they're young, they have black hoodies,
sit in the cellar are weirdos.
And I mean, like if you read the news and
especially quality newspapers like that,
you will find those stereotypes.
And this is one of the best examples I
can think of.
So this personality disorder
is often there and they feel like it's
a lot of participants were speaking out
against this equation of being the
terrorists, of being the weirdos.
Another aspect which is happening,
according to them, is scapegoating.
And I call that instrumentalise.
It's the purposeful attempt to pull them
towards that. And that's a quote, the
stupid word they use cyber,
cyber warfare, cyber warrior, all
this nonsense.
And funny enough, the ceasefire,
which is like an American military
organization company related
to the state, uses, you know, that cyber
word as well, support the war fighter
in cyberspace.
And I know that the word here is very
controversial.
There's cool stickers around lying around
here about the whole word cyber, but it's
basically hackers, cyber.
All those words are into and brought into
the context. Basically get funding,
make people think of like, oh, I need to
buy a new McAfee product or
whatever. And that is another aspect.
But this been spoke about the
scapegoating, like the hacker word is
used in job to basically make
in cybersecurity with love hacktivists,
for instance, because they are going to
help them sell all kinds of crap.
So it's basically a word used to
get money rolling.
And another example, this year
and CNBC, there was an article making
money in the war against hackers.
So that is another dynamic which
of which participants emphasized is
taking place.
Now, what is basically
then the resistance?
How do they counteract this process?
And that is super fascinating for me.
One aspect is a broadening of the term.
So I bet if
I ask everyone in here what hacking
or hacktivism is, I will not get a
coherent answer from anyone.
And that was the same. I have identified
with the participants.
So all of them were emphasizing basically
it's a broad concept.
We talk about innovating about, like
providing shortcuts.
I'm still to finding the truth.
So it's like some people consider it as
an art of understanding the world.
People call a hacktivism online
rebellion. I could give you tons of
quotes around the issue, but what it
means basically is it's very diverse and
it's completely contrary to what the
media portrays, what the politicians
portray, what my mom thinks of hackers.
It's like two different things,
basically.
And the other thing is being a hacker and
activist is a mindset and it's
an attitude.
And I think that is really interesting to
basically think about, like who is
working in the industry and our old
people working in these three hackers.
And there seems to be not the case of
these tech participants emphasized
that. Some of them, you know, you can
study computer science to science, but
you don't need to be a hacker.
There's a difference here. There's a
different kind of mindset.
And that is like encompassed to the
broadening of the term, which goes
against the narrowing.
And the lump sided aspect to
the other side is basically doing
good. A thing is they distinguish
themselves so often.
My participants highlighted a diversity,
so they set about legal, illegal, white,
black, positive, negative, all of that.
And so basically the emphasis emphasize
not every hacker's a black hat.
And what is really important here is
also that there's legal ways of being a
hacker. And I mean, like everyone here
knows that. But I still want to emphasize
this is a research done for a broader
academic audience, which does not know
that. So.
So they talk, for instance, about like,
you know, I mean, what we calls might be
a bit damaged, but that might be physical
damage you can do when you bomb.
Like it's not that anyone would do that,
but, like, I just give an equivalent
here. So they oppose also
certain kind of hacks, which they're
often accused of.
So, for instance, against the media or
private individual or critical
infrastructures, all words politicians
would use to basically construct the
picture of like these hackers, which is a
specific kind of athea, are doing
so they're distinguishing themselves very
important is also they reclaim and clean
the term. And I think that is really
interesting in regards to, for instance,
how they distinguish between hacking,
cracking, despite the fact I acknowledge
that not everybody loves that term.
And also they are focusing on like
official organization.
I mean, we're here at the CCC, the
technology organization, the
F f like Patriot through the Net, all
of that. So there there's ways of like
keeping it clean, but being in an
organization which uses the term
and basically therefore we are reclaiming
the word. And there was a quote and
there was multiple quotes where people
said, for example, the CCC managed to
make it a positively connotative turn,
which is not the case in many other
countries.
And I can say that this is certainly the
case in the U.K.
And also people were emphasizing hackers
have a good reputation in Germany, which
goes along with the idea that, you know,
this is one of the oldest and largest
hacker communities in the world.
And what comes out here is like the idea
of self identity.
And that is really fascinating because
there seems in my participants being a
flexible identity around like
despite the fact everybody agreed
to talk to me, knowing
that I look for people who call
themselves hackers and activists.
Now, nearly every time people said,
well, you know, I'm not
would not run around calling myself a
hacker or but despite the fact
acknowledge I'm falling into this
category.
So people would say I never introduced
myself like this.
And there's one aspect.
For instance, I would not define myself
as a hacker. And I'm, for instance,
talking to them and the politicians
because, you know, it has negative
connotations to it.
That is really an important aspect
because there seems to be something going
on between security researchers versus
hackers and the term is used
here as well.
But read the news magazines.
When are they referring to hackers and
when are they referring to security
researchers doing the same thing?
But like, suddenly it might swaps
in the media. And so, for instance, one
participant said, I've been asked by an
immigration officer once if I was a
hacker, and that was kind of funny.
I told him I was computer security
researcher. I'm I'm not sure what exactly
he meant by Hacker.
And this has happened to other friends.
And there are other person says, for
instance, there were some situations
where I'm a hacktivist or all the times
when I'm a security guy.
And that is interesting.
I'm I acknowledge
social identity theory.
It's a psychological theory is basically
saying, you know, you can have shifting
identities.
For instance, I could say, for instance,
you're the audience and you're
the audience. I'm the speaker.
But I could make another identity
salient. I could say I'm a female.
So all of the other females in this room
might identify with that.
And I create a different kind of cattery.
I could say I'm an academic and some of
their other identities in the room
where you feel aligned to the same thing
seems to happen here.
But what is really interesting is
that the security researcher seems to be
kind of a lifebelt you fall back to if
you want to introduce yourself in a
different kind of term.
And I think that is very interesting to
think about.
So in that regard, it's like a Mobius
ribbon.
Why am I using this idea?
Because, you know, the flexible idea of
identity, people always consider identity
as being like a coin.
You add on one side you're black or
you're white, but in fact, you're like a
hacker and the security researcher.
You have day jobs like I don't know what
you're doing when you leave today.
Tomorrow you might be a tester, be like a
software engineer or anything like that,
but you can have different shifting
identities. And there's a really
important aspect.
Research has have to acknowledge
that that is not just like one thing.
And that kind of stable
and really important is here that there's
two dynamics, which is a consequence
of like the hacker idea being portrayed
as that negative. On the one side, you
can't call yourself a hacker because it
has negative connotations.
And that was seen by people being
basically saying, oh, I would never talk
to a politician using that term.
But the other thing is meritocracy.
Everyone here, it's like I give you
an example.
I would you know, people would never call
themselves experts.
You would be like, absolutely.
And that was a word someone use.
It would be presumptuous to call yourself
a hacker. And that's the same thing.
There's must be something everybody
acknowledges. Be on a hacker conference.
But not not a lot of people would run
around saying, I'm a hacker.
You feel aligned and associated with your
identity, but you're not, like, fully
in it. And there's a similar equivalent,
like an LGBT member in Russia
currently would not run around
necessarily saying, oh, I'm gay.
But they feel associated with LGBT
and that dislike that negative
connotation aspect, the meritocracy
aspect. Is more related to the expert
aspect that, you know, you can't use that
term because, you know, you would be
considered like an asshole.
And so
that is like the way they resist by
having that they step back word of
security research or anything which is
currently acknowledged as legitimate.
Now, coming to the second theme in
security and what happens here, as I
said, the threat to privacy and security
leads to an increase of insecurity.
It's a vicious circle.
And what happens externally is erosion
of the rule of law.
I don't need to say a lot about that.
I mean, all of the talks basically
emphasize this.
And people talked about the rights are
getting circumscribed.
Internet has been criminalized.
But the really important bit is like my
participants emphasize, that this is a
fallacy.
Risks are inevitable.
People would choose a false sense of
security over the necessity of privacy.
And they are basically criticizing
that. Their version of law is basically
you have to choose either security or
like freedom.
And that is a really like that is
a very important aspect of what's going
on in the interviews.
They also emphasize in the course of this
the exaggeration, overestimation of
threats. We currently see everything is
hyped up. And I love that quote.
Like General Alexander goes Anonymous,
could take down the power grids.
Bullshit.
It's complete bullshit.
It's so far from anybody's technological
capability and we see that quite often.
I love also the quote because I could use
bullshit in a context and not need to
basically justify myself using it.
But like, they basically use
the idea that, like you, you
really instrumentalise scapegoat
hacker in a context of like a political
speech to make the average
citizen or person be
thinking, oh, I need to do this or that,
and we need to be scared of them.
But the really important bit is like
that.
People think we need to look skeptical
when the government calls something a
security threat and that they have
mistaken the security issue because
this results in a climate of suspicion
both externally by politicians
and others, but also within that
community.
People said a lot about like
that. They have like problems
getting stopped at airports are anxious
when people ring the doorbell or face
personal repercussions, such as like
freedom of travel.
And that is really interesting
that the participants basically feel that
form of losing control over their own
safety, privacy and independence, which
is fascinating by our community, which is
so focused on like being in charge of
their own like devices,
their technology, etc..
So what happens,
therefore, is a resistance to these
processes is
the investment in more security.
And that is a really, really insightful
way of like talking about it.
And I think more people need to
acknowledge that hacking hacktivism is
a form of an ecosystem.
People are participants basically said
they are the security in the
system.
So while politicians talk about hackers
as this negative threat, as the
frightening aspect, participants say,
for instance, hackers would find a
security loophole. The manufacturers then
forced to close the security loophole
where other hackers or the same hackers
come along and would find new security
loopholes. It's a vicious circle.
It's an ongoing process of improvement,
awareness raising.
And a participant said the equivalent
would be product testing.
Nobody would think of like
using a car where the belt hasn't been
tested, but like hacking
that is considered as like that problem
where you can try to
find a security loophole because, you
know, we would rather not know.
And then the really important part comes
here, the irresponsibility aspect
about it. So my participants emphasized
it's not my responsibility.
I'm not liable for, you know, the
loopholes.
I'm not increasing the risk.
The risk is already inevitable.
Software has already or hardware has
already been produced,
which has a flaw.
And so, for instance, about this one said
not to hack is the biggest security risk
of all because someone will exploit
the thing.
So and I think that is an important
aspect to to think about, because if
I look at data from politicians, they are
thinking rather not tell
the security loophole exists,
whereas they basically emphasize, no,
it already is there.
We need to basically make it seen
by everyone.
And I thought that was a new way of
thinking of security and insecurity and
a contact.
The other aspect is that this personal
security, they are emphasizing I mean, we
all use signal tor whatever.
So this investment, individual security
of using encryption software, disguised
one's personal identity stands in huge
contrast to what the state is currently
trying to do.
So I used I did interviews
with people working the cybersecurity
sector like the managements, and they
often say like centralization.
They rather have everything like
basically in their own hands,
sell that product to a customer
and then like make sure that everything
is safe, but the customer has nothing to
do and. The other way happens here, like
they are completely saying, I want to
take security in my own hands.
So there is
like that contradicts like the security
perception we see with, like other
actors. And that means just that we can't
really find a way of, like, talking to
each other.
And I personally, when I was
in that regard, if it's not somehow then
also helping the personal security of the
public security that hackers and
hacktivists are so emphasizing this
personal security for themselves, because
as I just said, we have tools
like Tor Signal, et cetera.
OK, coming to the last
theme, which
is really emerging from that
technological side, I just emphasized
that they are not just developing
technological alternatives for
participants, but they also engage in
political the political system work
closely. So system here just doesn't
refer just to political system, but
technological system as well.
And so the mistrust in authorities and
hierarchies, that is the argument that
this is in this theme is
basically leading to certain kind of
activist forums to resistance
form.
And that applies so technically and
so politically, so externally.
What happens is they are not perceived as
like the same kind of equivalent to other
actors. And that is obvious because
we see we all know the wonderful term
public private partnership,
but that misses the third actors,
according to participants, and that is
the civil society, which my participants
consider hackers to be part of
and hack this to be part of.
So what they criticize is in the
political sphere is the lack.
So what happens is the lack of
ability to get hurt because governments
are out of touch with the definition of a
hacker and what it would be.
So I quote a participant said,
that's all just old man with
bullet points or
they are like other people said, for
instance, they're like my parents.
They happily get a tablet and learn how
to use Google, but that's it.
So the lack of knowledge of politicians
is also criticized,
and that also makes it hard for them to
get involved in those two dynamics.
And that's the reason why politicians
often used in the street to get like help
and like writing policy
statements, as we all know.
And but the problem is the industry is
focusing also on the wrong kind of
experts. According to my participants,
they talk about business, blah.
And I guess everybody
here in this room knows who they're
talking about. They're talking about the
management who are like perhaps like
have studied computer science, been in
the business for like 50 or 30 years
now for 30 years.
And now there have been like out of touch
with the technology for my participants.
And they're more interested in, like
gaining like more
income rather than like on the technology
itself. And it's a huge, huge
moneymaking machine we're producing.
And a really big critique is on the
revolving door.
So what I mean with that, remember, this
was me with that is like this, how these
two spheres basically reproduce
themselves. You have people going to
secret services and
working. They're stepping out, going into
industry, probably selling the government
products and like then
making money with it and going back
into the political sphere
and in a certain
kind of.
Yeah, in the NSA or
GHQ or whatever.
So there's that revolving that they are
basically two spheres, but they're
missing the third actor.
The other thing is what happens to
skepticism and that relates to
power and privileges, both on a technical
side but also on a political side.
And I think that was really insightful,
at least for political science like
myself, because like there's not just
a doubt in the network infrastructure.
So, for instance, people said,
you know, the Internet is very, very
valuable at every single level and it's
screwed over already.
But there's also that comparison between,
you know, you can attack like a technical
system on the top level, which would get
you access to everything.
But the same thing would apply to
political level.
If you bribe Angela
Merkel now, you know, you could achieve
higher things as well.
And I think that the relation between
hacking, not just as the technological
aspect and hacking also like a political
sphere is important to emphasize because
it is taking place.
And so the focus of decentralization,
distribution, Tetrarchy, that is one
aspect which we see like on a
technological side, but also to emphasize
on politically should be done.
And the best example, of course, is
anonymous because the media
still struggles to define them and
talk about them.
The other aspect is hypocrisy.
And there's one dynamic about like
interviews emphasized that there's a
public private sector applying hacking
methods. For instance, Apex did that
with the U.S.
against Pirate Bay.
But there's also other examples, like on
anonymous servers, et cetera.
But this applies a double standard
because participants were really
frustrated because they government
obviously have security specialists
or security researchers who are allowed
to do this, but they
use are still applicable
to the same laws, but.
But they they suddenly have to license
to hack, so to say, and they really
wonder, what is the security problem?
Because like if people say we can't use
deadly attack, is it the activity
decriminalize?
Is it the actor or is it the intention?
And that is not clear.
And I think that is a discussion we need
to have.
And the other aspect is the hypocrisy
around, like, for instance, exploits
because governments are allowed to have
them to portray serial days and
they don't operate in the legal
framework. They try the community to
basically put in.
And so for for
my participants, is then the preservation
of security, not according to Internet,
not a shirt by intelligence service, but
by this community here.
So and how did they resist
this process?
One aspect and I think that is very
interesting, perhaps you perhaps
this is something people know here, but
have never been really focused or made
aware of, no collaboration,
and as the rejection to work for the
state institution like police or
intelligence agencies, and that is,
according to my persistence, very strong
in Germany, where you basically
would not like work for them or should
not work for them.
And they are aware that, you know, NSA
employees or did you say you or the
institution employees, hackers and that
they have them.
But there's a difference.
So they are distinct here ideologically,
again, between like different kind of
people.
And there's really an important aspect of
internal disciplinary, internal policing.
And a president said, if you're working
for the FBI and the United States of
America because you think the technology
they are using is absolutely awesome
because you're technically interested,
there's an app that is absolutely
legitimate, independently of
the purpose. However, if you do the same
thing in Germany, then people will kick
you out of. And that meant the
communication Congress.
You're simply not allowed to think that
is is awesome because it's evil.
So what this person basically emphasized
is that there's certain kind of
differences. And people spoke about an
American hacker, a European hacker.
There's a different kind of mindsets.
And it makes it hard to speak about a
hacker community, at least for me as a
researcher. And I'm still struggling with
how to phrase around that.
But there seems to be that dynamic of
like how to keep it clean again
here in this aspect and to last
dynamics are one aspect
is polarization.
So one is that the hacker scene has
become politicized over the course of the
last years. And we see that very well.
Like yesterday in Frank's talk was like
how the hacker community is involved in
politics and looks at social and
political questions.
And they also think of themselves, my
participants, as a counterpart to the
industry, which is so influential, like
more than moneymaking machine rather than
like the social and political output.
And so people are involved in advocacy.
I mean, you've seen the noisy square,
like with EFF, et cetera.
So to support digital rights online.
And the other aspect is hacktivism.
And that is an interesting one.
And I hadn't thought of that before I
started this research like that.
So there seems to be a two way dynamic
and one aspect for the hacker community
who has over the course of the last
years, decades become politicized.
But according to my participants, there's
a new kind of a younger generation online
which they call hacktivists, or I mean,
the term as technology is very
controversial. But what they mean is
that, one, you can have a hacker
group becoming politicized, too.
There's a new dimension of like people
coming in, calling themselves hacktivists
and free is also that I would
probably consider myself as both.
Yet I'm coming initially more from the
traditional hacking scene.
So the third aspect is then basically
that people have focused, have become
like hacker and activist at the same
time.
And interesting about the younger
generation aspect is then that would
explain why people a lot of like old
school hackers, whatever you mean with
that. But at least my participants
would think like why they are not
that open to that term because
it's like different suddenly.
And it's also a way to counterbalance the
devaluation of traditional protest form
that is currently taking place, because
you can do it demonstrations, a lot of
you know, and then you can still
basically not
get anything done.
So activism might be that like option
out of the process.
So that was a lot of information
to take in and to break it down
quickly. So we talked about identity and
security system and there's different
kind of dynamic internally and
externally. So externally is what is
happening. So they have to criminological
order the creative cultural outsiders and
scapegoated.
And therefore internally, what happens is
they're broadening the term.
They distinguish themselves, they're
reclaiming the term.
And they also have that flexible identity
of like being both a security researcher,
hacker or whatever you call them as well.
That aspect is the other insecurity.
So the erosion of law, feeling a sense of
security, exaggeration, etc.
and how they contract that is
by basically emphasizing we are an
ecosystem, we belong all together.
There's a false sense of security.
We rather choose like basically security
or freedom, and
they invest in their own privacy and
security technology.
And last but not least system their basic
emphasizing that there's a missing third
factor which are and like skepticism
of societal and technology system and
hypocrisy.
And they resist, but basically no
collaboration with police.
Internal discipline and politicization
and hacktivism potentially.
OK, now you might say,
well, interesting, you are able
to talk for an hour, but what do we do
for that or what do we take for it
on one side? What I hope with this
research in my PhD
in general is to uncover the
practices that are currently taking place
in that wonderful cybersecurity
sector, whatever that is.
So I'm interested in to make sense
of that bullshit bingo that is being
taken place and to identify
what hacking activity means to different
actors and how that basically contradicts
or correlates.
And that's basically where I'm standing
with this research and why I did it with
those three actors.
And that's what I'm interested to do,
is basically it's a sociology of group of
people that so far have predominantly
been only talked about as
just make a quick Google search often
takes place the hackers, but nobody talks
about who they are on has approached
them. And I think one aspect I do
want to personally say I'm aware of
Fifi's blog about, like you shouldn't
talk to social scientists.
And I'm completely aware that there's a
lot of, like, scumbags out there who
probably do research for malicious
purpose. But I do think it's interesting
for a community that is so focused on,
like, you know, show me your data, show
me your code, your stats, you
you basically lose out of basically not
talking to social scientists, but
basically getting screwed over by all the
shitload of publications were basically
just say those hackers.
So I got that off my chest as well.
The other thing is like I want to do a
study and a critique on what the
securitization of this current system
does to groups of people, and this
is not just hackers.
It takes place with immigrants, with
any kind of group which is often
marginalized and want to counterbalance
the dominant research, folky, folksy.
And this was basically mentioned
yesterday by people say or
two days ago by conter storytelling.
And I think that is an important way of
approaching this research as well.
I want to the mystery demystify
the position of hackers and activists.
Perhaps, you know, there's a way of
reclaiming the word, making it not that
malicious again.
And last but not least also to glorifying
it like not making it that criminal
activity. My mom thinks I'm currently
always doing research on and
last but not least, an ability to develop
code in hacking is one possible and
valuable form of involvement of people
in the political and social discourse.
And I hope that this research contributes
to that. And I'm looking forward to your
questions. Answer sessions.
And I'm really like my attempt was
basically to talk about
not just do the research, but also come
here and basically show what I have
found. And I'm happy for any kind of
feedback, criticism you might have.
And I'm thank you for basically
listening.
Thanks for a great talk.
We now have about 15 minutes for Q&A, so
please, as always, line up at
the microphones here.
And also, of course, if you're out there
in cyberspace, you can go
on the ISC, you can go on Twitter to ask
questions. We have a cyber real
world interface here just for you.
And we'll actually start with the
Internet.
Yeah, the Internet has got one question
so far what are your views
about responsible disclosure agreements
in regards to hackers and criminal
activity, especially when the idea
also includes monetary rewards?
So the question is basically what
I think my opinion is on them
doing that. OK,
I guess that is an option.
My interest was not like to identify what
is correct or wrong.
My interest was more like, what do
hackers think that's currently happening
and how they perceived themselves.
Disclosure was an issue more in
whistleblowing terms.
The money aspect was not coming
into play. But what people said is that
they were sick of like like releasing
bugs and letting people know and then
nobody doing anything upon that.
So perhaps the money reward
is helpful. I don't know if that
is answering that question, but that was
what was in the data, basically.
Microphone number one, please.
Thank you for your talk in
one of your first slides, you contrasted
the term constructive, not with
destructive, but with deconstructive.
Was that intentional?
And is there a distinction?
I haven't thought of that.
I just felt like deconstruct so
constructive is also a term like in
social sciences, used to basically talk
about socially constructive aspects.
But
I didn't do it on purpose.
I just meant like basically to build a
breaker distinction that is often used
and perhaps it's a better way to
phrase it. But I think I will think about
that if if I should have used a different
term.
Number two, please, in
your talk, you in
your methodology, but also in the answers
of of your participants, you seem to
convolute the political statements
that are made by politicians and
the views of individual government
employees held internally.
And for someone who is not within
government, I can imagine that's
difficult to distinguish.
But my experience is that there's
actually quite a lot of disparity between
the two. Is there any incentive
that you detected or that you feel within
yourself to search for such disparities?
Well, the thing is, like this is not a
study on the political discourse.
All I was referring to is what my
participants talked is happening.
I did see that like in a previous study
on the political discourse and
acknowledge that you can work in an
organization because you just have to do
a daily work job where you get paid
for but don't agree with the organization
at the same thing is happening.
If that was aspect of security
researcher, people who perhaps
think of themselves as hackers belonging
to that community can work on a day to
day job in certain kind of industries
they completely hate.
You know, they can be in a company which
uses cyber all the time.
But the the
important aspect is basically
that they still you can still disagree
with that, but make a criticism
around the issue of like what goes
on. And that is what happened here.
But I didn't make a statement about the
politicians or the political discourse or
the people working government in itself.
It was more about the hacker hacktivists
site and they can potentially work in
governments.
But what seems more to happen is that
they would refuse to do that.
I don't know if that is answering the
question.
OK, not exactly, because what I'm
I'm Dutch and from the Netherlands,
my experience is that there's actually a
lot of interfacing with the government,
from the hacker community, not so much
having them work inside the government.
And that's an entire different interface
to the government than via the political
discourse.
Oh, yeah. No, you're absolutely right.
That takes place. I mean, the CCC is the
best example you can, you know, be
consulted for certain kind of policies.
If you want to have, like, the electoral
computer in your in your constituency or
not. Definitely know that that takes
place. And the people said that that was
the issue around the third actor being
missing. And they do try to
engage with that. And that was the slight
of politicization that they are involved
in activism and advocacy.
But there's still a suspicion and that is
completely legitimate. I hope that is not
answering that.
Yeah,
no one plays.
Hi, thank you for your talk.
I was wondering if you could
contrast or compare
the hacktivism with
other kinds of activism that we've been
seeing, because in a sense, of
course, activists are some form of
activists. But you also mentioned, for
instance, the LGBT community
and in a sense, I
feel like, OK, hackers seem like experts
on this technical field and see
themselves like that.
And that's something similar.
Like LGBT people know
a lot about their experiences with
discrimination on that field.
Black Lives Matter activists actually
know about racism compared to some,
I don't know Republican politicians.
So in a sense,
this I was just wondering
if you've also maybe done previous
research on other kinds
of activism or if you know of that
research and could compare it a bit,
what is the same?
What are the differences?
So the thing is, the tricky
part about the term and the concept of
hacktivism is where do you differentiate
between normal activism, what we consider
and activism? Now, my answer
to that is hacktivism.
You you need to do something with
technology which has a form of hack.
So you can't just tweet that or you can't
just use a blog or it needs to be a bit
more like technically involvement there.
And now we can talk about the U.S.
being that or not, but it has been termed
as such. And it is some form of like
using technology, like out of a place
and context. It was not meant to be.
And the difference I see with hacking and
all activism is simply the tools you use.
It's still achieving the same kind of
sending a political message.
And some people use like direct action
in an offline way and
other people use perhaps hacked activism
so the LGBT community could
use hacktivism as a technique to do
something. So that is my difference here.
You don't need to be a hacker to be a
hacktivist. And that is also the last
slide about this new kind of form
of activism coming into play.
So perhaps we will see more of that in
the future. I have no clue.
And perhaps the term will become more
concrete because at this moment of time,
it's just like a word you throw around,
just like I did in this sense, because
it is obviously that some people use that
term for themselves and who might be in
this room at this moment in time or
wherever, but they still perhaps
are associated. You can associate
yourself with the hacker community as a
hacktivist, but you can be LGBT.
You're a feminist using that tool as
well. So that's kind of a funny
way of considering that it's just a
technique in that regard for me.
I hope that answers that.
Thank you. Yeah.
And now for cyber space.
Do you have a question?
Yes, cyberspace has a question.
You're at a. Conference and you're trying
to hack public perception, would
you self identify as a hacker?
No,
I got that question at one
stage that, like, perhaps you
you can hack like I personally think
you can hack Ginder, you can hack like
social class. You can do that.
Probably in the course of my research,
people would call me then like being
biased if I would run around calling
myself a hacker. And as I said, the
whole meritocracy aspect, you can be
quite like an asshole if you say,
oh, I'm a hacker.
So I'm I
would rather abstain.
I would call myself rather a social
scientist, having observed that, then
using that term to step on someone's
toe and say, running around with that
term.
Any more questions?
This is your last chance.
The Internet again.
You know, the Internet is full of
questions.
In your research, were there any positive
things?
In your research, were there any
participants that sought that support
or help because of issues of depression
or lack of identity?
So I'm a bit reluctant, I don't know if I
should answer that or not, because, you
know, like, then I could get more
questions around who are they will be
doing and.
I rather abstained, giving that
information.
More Internet, yes, I'm not coming
up with these, I'm just forwarding them.
Did you see a cultural origin
of the hacker?
Who've
could come back and ask what is cultural
origin, and that that would be a very
social science way of like debating.
I I don't know, like so the
question I get a lot, so what is the
stereotypical hacker?
But then I would end up doing the same
thing like the whole research does.
Like, I don't know.
I think the community is very diverse.
It would be far too easy to just think
you all sit down at home in front of a
computer with the terminal opening a
Balaklava. I don't know if you do
have no proof of that, but
I don't know, cultural origin.
So what I think is really interesting is
what I saw in the interviews was that
aspect, that mindset, that attitude.
That seems to be something which
develops. You know,
that is what I mean. You can find a
computer scientists, you know, having
studied programing, doing his or
her day to day job, you know, but then
there's a different kind of attitude.
And where this comes from, I have no clue
that will be interesting.
But I'm sure, like there would be no
openness to statistical analysis
on the community here.
So it will remain open.
And I couldn't answer that question
sufficiently.
I just say no to everything.
No, sorry.
More Internet, you have just a
quick follow up to the depression
issue and the
question wasn't who had the issue,
but just if it happened and how
it was dealt with.
So if my participants had it,
no, oh, yeah, I
that was not a question I would ask so I
wouldn't know and I wouldn't like to
imply that.
Microphone number one, please.
All right, thanks for your talk.
So you mentioned the
sociology community that was, I
mean, doing research on hacking,
perhaps. Yeah, yeah.
And you referred to some of the as a
result in a way.
So just the questions are, how big is
that research community?
How many people are you talking about
and what kind of publications
do they do these other social institutes
of what could be possible titles
of their publications? What do they
learn?
There you go. There was the stepping
stone, not the stepping stone, the one
where stumble across.
And so when I said sociology,
so I said I feel called creating security
studies, sociology.
Anthropology does a really good perhaps I
did them in injustice by saying
sociology.
I'm in social sciences in general.
So there's a lot of people who do
incredibly good work like and I
try to be and try to talk to people
and represent them.
But I'm more referring to that aspect.
The field I'm currently in is that
security research in our international
relations, political science, who more
tends to talk about cybersecurity and
then using hackers is like an example of
why we should invest more money, get
more funding into the universities, blah,
blah, blah, and that that is the field
and how many there
are. I mean, like I can only
talk about, like the literature review
of them for my PhD thesis on the field
of insects.
And there are a few people who
who are critical, like there's a new
publication, 2005 on Anonymous
and the integrity of Anonymous in
international relations.
That's quite good, but will happen again
is like it was researchers sitting down
having a thought and writing up a paper.
But I was more interested in basically
stepping back and giving the floor to
people saying their own things.
And that, I think is not happening.
I don't know of that.
Many, like Gabriella Coleman does that.
I mean, she has like in her book,
given a lot of quotes of like people in
et cetera.
So it happens.
And I think sociology, anthropology is a
field where it goes on quite well.
But I think like, for instance, this old
school, old school I scholars
who perhaps sit in like prestigious
universities in the US and think of like
more cybersecurity are more using
hackers as a way of like justifying,
you know, more funding or intrusion and
security. So how much publications
we're talking about, I would not know.
I have no list of that.
But we can I can show you my
my list of papers
I admire and list of papers, which is far
higher, where I feel like they're going
in the wrong direction.
Thank you.
And we are out of time.
Please, once again, thank Lanie.