Below are some general comments, and Mr. Glave's correction to the story.
SAN JOSE, California -- The average computer cracker is an obsessive middle-class white male, between 12 and 28 years old, with few social skills and a possible history of physical and sexual abuse. That was the controversial conclusion of Canadian psychologist Marc Rogers, in his "Psychology of a Hacker" session, held late Tuesday at the RSA Data Security Conference.
[Here is a perfect example of unfounded, unresearched, and outright malicious stereotyping. Some expert to quote.]
A former police computer crimes investigator and author of a doctorate focusing on hackers and cyber terrorists, Rogers offered a new taxonomy for network intruders.
[With the lack of understanding on hackers, I'd love to see his criminal investigation record.]
"Hackers have been dubbed the enemy of information security," said Rogers. "They research their targets, they know a lot about us. They are very good at intelligence-gathering or sharing."
In 1998, the Computer Security Institute estimated that intrusions cost corporations US$236 million worth of damage, according to Rogers.
But information systems managers have very little knowledge of what makes a hacker tick. Thus, Rogers developed psychological profiles to aid law enforcement investigators and the legislators who are writing new anti-cracker laws.
[Like most studies of this nature, it suffers from trying to squeeze too many diverse people into too few (and wrong) categories.]
Rogers offered what he called a new taxonomy of hackers, categorizing intruders as newbies or script kiddies (who are beginners), cyberpunks (older, but still antisocial geeks), insiders (disgruntled employees), coders (who actually write the exploits), professionals (hired guns), and full-fledged cyber terrorists.
Computer security experts in attendance hotly contested Rogers' claims, alleging that his work plays to sensationalist fears and creates a stereotype of limited value to investigators.
"He has got the age group, but when it comes to social groups he's got that wrong completely," said Alton Tuttle, a freelance computer security consultant.
"In most social groups you are going to find a baseline of people who were [sexually] abused," he added.
"Statistically, the majority of what he said was wrong," added Peter Shipley , chief security architect for the Big Five firm KPMG. "I know a lot of hackers, [including one who] spends an hour and a half in the gym every day. He is built! I know of women who are knock-down gorgeous who are hackers."
Shipley said that criminal profiles are proven to work to track down serial killers but that "the hacker profile is so diverse and wide that a strong profile could not be useful."
Rogers characterized members of one subgroup he called "cyberpunks" as socially inept, burdened with unresolved anger that they take into cyberspace.
[What does that say about the police officers on #copshop that threaten violence or threaten to abuse their information resources? How about the religious zealots that mailbomb you for not believing in God? Is it fair to say the above statement, acting as if it is a trait of a single group?]
"They relate better to computers than humans," Rogers said. "They can spend hours and days glued to a computer."
He described an incident several years ago when investigators raided a residence, expecting to find a computer left running an automated attack. A machine at that location had been attempting the same routine on a system for days.
What the investigators found instead, Rogers said, was a man suffering from a mental disorder. "He had a porta-potty under the seat, and he was buzzed out on Coca-Cola and candy."
Shipley said that Rogers was going for shock value with such descriptions. "He is trying to paint hackers as 25-year-old men who can't control their bowels."
Rogers said that while there was no empirical evidence linking computer criminals with what he termed computer-addictive disorder, hackers tend to be obsessive types.
Shipley and freelance network engineer Aaron Peterson said that the intense, focused mindset typical of someone trying to model a problem could easily be mischaracterized as obsessive.
Rogers closed out his talk with a grim scenario for corporate America. He said that some crackers claim to be under contract to fix Y2K legacy code and are in a position to introduce all manner of logic bombs and back doors into the "fixed" code.
[Another unfair statement. How many non hackers work around the country on critical systems that have the same power? That's like saying air traffic controllers are in a power to crash airplanes. Duh?! Having the power doesn't make them inherently evil.]
"I think you are going to find a real mish-mash of things happening once the year 2000 rolls along," he said.
Michael King, spokesman for the Hackers Defense Foundation, said he had never heard of such a claim.
"Generally, people won't tell even their best friends something like that," King said. "There are not many [crackers] out there who would let themselves get that carried away."
From: Cancer Omega (comega[at]attrition.org) This is just so much effluvia. First of all, I have yet to meet a living soul that is not passionate about _something_, so scratch the "obsessive" part. Secondly, the very term "middle class" is meaningless. Thanks to false class consciousness, _everyone_ considers themselves middle-class; particularly when they're _not_. Third, most computer _users_ are white males between the ages of 12 and 28 years, so scratch the notion that said demographic is even remotely meaningful. Fourth, I have yet to meet any hacker who doesn't have a good repertoire of social skills. Most of them are quite sociable, in fact. Many of them would be deemed Social Role Models when compared to your typical corporate middle-management drone. And last of all, _conservative_ estimates of the incidence of physical and sexual abuse in the general populace are roughly 25% for males and 50% for females.
From: Woodchuck (djv@bedford.net) Bah. The average restaurant patron fits this criterium, except sex. Ok, a while ago (when Vlad the Compiler was looking for hacker-psych profiles) I wrote the following treatise on the PH34R, but felt it off topic. Well, it's on topic now. Note, this is a very rough draft and contains some things presented as 'hard fact' or 'rigorous deduction' that are really very tentative hypotheses. Mr. Rogers' analysis is not worth much as a profile, but is itself data -- an example of the underlying ph34r discussed in my counter rant. The rant is also somewhat disorganized, unlike my usual crystalline essays. *tongue-in-cheek* It presents a much different take on some of the blather that Rogers has amused us with. EXECUTIVE SUMMARY: "A key fact to keep in mind is that this is one of the "few times in history when a society has found itself "CRITICALLY DEPENDENT on a skill which is most strongly "found in people with personalites that that same society "judges inferior, and has historically marginalized and "ridiculed. HACKER SUMMARY: We own their pudgy asses, they don't like it, and there's precious little they can do about it. They know the PH34R. ------------------------------------------------------------------ The material which follows is based mostly on reading this list with attention. * * * * * We've all heard the old saw, "Ask four Jews, get five opinions". Here we get "analyze four hackers, find five subcultures". I bet a typical sociological questionaire (like the "long" census form) would not reveal very much at all, and in fact might closely resemble random results. Some things might come out, though: 0) ZEROTH: recognize that this list is self-selected, and that anyone can self-select. This ain't the Masons, in other words. *) Smart. No dummies here. Mean IQ is probably just above "bright normal". (i.e. ~= to those admitted to 2-nd tier universities on a competitive basis, (ex of 2-nd tier: UIUC, PSU, UC-Berkeley)). *) Education level not commensurate with intelligence. *) There is a tendancy to believe alternative truth-models. *) Underachievment, as measured by things like "job title" and "salary". This and under-education are manifestations of a common underlying psychological constellation. Others have suggested bipolar disorder or ADD. While such disorders may exist on the list, I attribute the underachievement phenomenon to strictly economic/social causes acting on a different characteristic personality constellation. I would say that the typical psychological profile of list members is what is called "Paranoid Personality Trait" (PPT) in DSM. "ADD" is a political artefact. Autism is more characteristic. There is a named disorder, Asperger's Syndrome (http://www.isn.net/~jypsy/whataspe.htm, and http://www.udel.edu/bkirby/asperger/education.html; A's Syndrome is in DSM IV) which is to "autism" as "Paranoid Personality Trait" is to "Paranoia". This "syndrome" (usually those who "have" it do not call it a disorder, but rather "the ability to concentrate on a problem in isolation") is much more characteristic of list members than ADD, which, frankly, is found among the stupid. Asperger's Syndrome people are average and above in intelligence. The pop-media computer geek/nerd is a charicature of Asperger's Syndrome; Bill Gates exhibits most of the DSM IV Asperger's Syndrome stigmata. Again, these acronyms and syndromes, unless a clear physiological cause (e.g. schizophrenia) can be found, are snake oil; their sole validity is taxonomic, being convenient names for constellations of traits. It is only in this sense that I use them, and in this sense, the typical personality of a DC-stuff subscriber seems to lie closer to a vector sum of Paranoid Personality Trait and Asperger's Syndrome than to anything else that I could pull from my ass on short notice. I would suspect that a certain number of the younger list members have been misdiagnosed by their grade school "teachers" as obsessive-compulsive or ADHD, to their detriment. So what you have, psychologically, is raw material that in layman's parlance, is slightly paranoid, intelligent (often highly so, but often overestimating this intelligence due to hyperlexia), and able to focus energy on a problem, to the exclusion of "normal" life. Again, I emphasize that I am not describing a pathological state, but am describing the direction in which some hypothetical vector of personality may point. *) A history of weak, transient sexual/marital relationships. Various sexual perversions are probably over-represented, and "stable longterm heterosexual monogamy" under-represented. There is an over-representation of autoerotic/voyeurish/fetichist psychosexual modalities. [I can buzz like a bee, bub.] *) The political orientation is mostly some flavor of anarchy. This ranges from left-Bakunin/Kropotkin , through right-Libertarian. The one shared belief seems to be that laws are evil, but necessary in some form. This contrasts with the statist who believes that laws are a good idea. This general orientation is consistent with PPT. There is a tendancy to mock grade-school political tracts and the beliefs arising therefrom. There is also a signigicant neo-Fascist/ Technocrat strain here, not self-identified as such; I believe that this strain is probably derived from "Ayn Rand", a minor school of late 19th Russian philosophy, masquerading in our time as "original work". [Ooh! That pesky 'chuck said that Ayn is DERIVATIVE!!!!. He ducks in his burrow for cover, locking and loading in a single smooth movement, yellow incisors nipping nervously, anticipatingly.] * * * * * Most importantly, this "inner raw material" is acted on by the social milieu in which the hacker was acculturated and lives. The single most determinative external force is, naturally, the relationship of the hacker to economic production. A key fact to keep in mind, is that this is one of the few times in history when a society has found itself CRITICALLY DEPENDENT on a skill which is most strongly found in people with personalites that that same society judges inferior, and has historically marginalized and ridiculed. We are now so dependent on these substandard personalities, that their import in large numbers, even from ethnic groups historically barred from immigration, is implemented with crisis-like government schemes. *All attempts to nurture geekish-hacker skills in normal people have failed.* The most interesting such attempt is the ongoing government/industrial project to deskill programming by deconstructing the hackish skill to its putative component parts, and then to reduce these component parts to rote behaviors, which can be taught in a few weeks to the typical "normal" and "bright-normal" droid. It is no accident that the Department of Defense has taken the lead in this deskilling, with the Ada language as its vehicle. No software of any technical importance has been developed in this manner; the Windows pseudo-OS is a primary example. The current counter-example is Linux. *solving the programmer shortage by hiring stupid, uneducated and disinterested people is a failing strategy; so now we are desperate to import geeks from Taiwan and South Asia. In many ways, it is as if society awoke one morning and discovered that an entire culture hinged critically on the behaviors of jugglers and chess masters. BWAHAHAHA Y2K-phobia-hysteria is a sublimated/etherealized expression of the true fear, or more idiomatically, the ph34r. The ph34r arises because the anal-compulsives who are in "power" have discovered that the *complete infrastructure* of the country, nay, world they fancy they "rule" is, in fact, controlled by software written by the very people they cut their political teeth on as grammar school bullies. *Complete infrastructure* Fifty years too late, this dawns on the likes of Al Gore, possibly the slowest rate of clue diffusion yet documented. All hail Discordia. The ph34r comes from the demonstrable fact that the geeks who wrote this code, right down to the embedded controllers in the Whitehouse condom machines, are ALL CRAZY. Moreover, they're the wrong kind of crazy. They're the kind of crazy that doesn't follow instructions, colors outside the lines, farts in elevators, reads science fiction, considers R. A. Wilson to be a middle-of-the-road social scientist, and tears the tags off their mattresses. How many billion lines of code, all of it written by people who smoke dope, or, worse, don't need to smoke dope... Ph33l the ph34r. It's a tangible, concrete thing. The ph34r can be quantified. The rate of clue-diffusion is key. The bullies' part of the system has small rate constants; they are trying to control delicate feedback loops with characteristic frequencies several orders of magnitude greater than those of the bullies. The ph34r is the discovery that although the control levers are still attached to the machine, nothing happens when they are pulled. Nothing expected happens, that is. *) The most common class origin of list members and of geekdom in general seems to be petit-bourgeoisie or professional. There are some from the working class, fewer still from peasant/rural proletariat types. Typically a dc-stuff member was socialized in an urban center. I know of no one on the list who could be characterized as aristocrat, or big- or international- bourgeoisie. Current social class (or the class which students will enter) is heavily professional, secondarily worker (technicians) and thirdly petit-bourgeois small proprietors. I have a feeling that many list members are de-classed, i.e. currently occupy economic roles (or are being trained for roles) that are inferior to those of their parents. This is a general phenomenon in Euro-Am culture, but is probably intensified here, since a common occupation of list members is "computer programmer", which is no longer strictly a professional occupation, but is currently being recast as a skilled or semi-skilled technical worker's job, i.e. a proletarian job, with the attendant loss of status. (Education for the "programmer" role no longer includes university studies, or what is called a "liberal" education, but is shunted through short technical schools of the 4-th and 5-th tier of education. [junior colleges, proprietary sub-collegiate "technical institutes", and so on]). Consequently, younger list members see no "future" as "members of the labor force", adopting a proletarian attitude towards their work ("it's just a job"), and a correct but non-militant confrontational attitude towards their managers ("Dilbert"), who, being "professional" class, having university educations, and large (much larger) salaries, are seen as distant, and occupying roles in society to which the "programmer" or "network admin" cannot reasonably aspire. The young "programmer" I hypothesize to be a proletarian, a frustrated professional. [Note the new emphasis on proprietary certificates of competance, a diagnostic of this change. Programmers are now "awarded" narrowly defined certificates ("Internet Explorer Installation Specialist"); this is something seen in the mechanical trades, and among such service workers as hairdressers. Only doctors are certified this way among the professions, with a proliferation of "diplomas" and "certificates".] In common with other skilled proletarians, there is one fundamental political bifurcation: those who identify themselves as bourgeios/professional, adopting the trappings of that class, and those who do not. Those who do not are likely recruits for "hackerdom". Since the hacker has been *always* poorly acculturated, even 'abused', and is of the personality type that is the "lawful prey" of bullies and teachers, formal intellectual recognition of the alienation of their labor and politicization along sound class lines takes place in a subject already predisposed to a dialectic view of his social relationships. The particular form that the personality develops is affected by the particular culture in which it grows; the American "loner-hero" mythic archtype (the cowboy, e.g.) is adaptable, in fact that very word enjoys a certain limited usage as a synonym for "geek". Russian hackers may be expected to adhere to a different model; the archtypical hacker there probably fits either the "romantic bandit" type or the "peasant radical (Stenka Razin)", or the extremely ph34rsome "mad monk". The Japanese probably views himself as a Ronin, a kind of wandering samurai. These self-identifications are important to bear in mind. Further collateral discussion can be found in Colin Wilson's interesting books, "The Outsider" (a direct discussion of social alienation) and his "History of Crime" [not the exact title, sorry], this latter being a thought-provoking discussion of the peculiar appearance in late industrial society of a certain kind of serial killer. (None known in world history before Jack the Ripper.) The type of the "serial cyber terrorist" might be an etherealization of the serial murderer. American members of this list seem to have an unusally high affinity for firearms and other weapons; the mythic type of "cowboy" is always armed. In general, there is an interest in martial arts, with firearms and other weapons, or empty-hand. The most common self-description of hacker is "a person intensely interested in how things work". The Freudian interpretation of this is obvious, and suggestive: the desire to observe the copulation of the parents, and to explain it. Although this might be an Ur-cause of hackery, the experiences of infancy do not explain why this trait continues unabated, (even intensified) in adulthood, i.e. in the period of socialization. *Middle aged men* are observed in unusual numbers who have late adolescent features, not seen previously. It is a peculiarity of American culture that social class is pretended not to exist, except as a statement of income level, Americans tending to believe that a worker whose wages are higher than the salary of a manager or the profits of a bourgeois, is of the same or higher class, tellingly called a "tax bracket". The resistance to the abandonment of these outward signs of social status is the single largest subjective impediment to tax reform in the USA; I hypothesize that the current two-tiered tax structure powerfully reinforces a subconscious class identification, and that a single-rate tax structure would be *seen* as a positive "reform", but *felt* as declassing by most Americans. High bracket individuals will see themselves levelled with laborers, and the laborer will see the outward symbol of his advancement destroyed. Americans who are petit-bourgeois, or consider themselves petit-bourgeois, fear declassing more than any other identifiable social phenomenon. This fear is, consequently, a most significant eigenvector of the political control matrix; hackers are among those who have at least semi-consciously realized that "a middle-class life" is denied them. [Introduction of single-rate income tax will be, I further hypothesize, the single most reliable indicator of the "New World Order"'s solidification in the US. In the UK, it is the destruction of the House of Lords, an event long since accomplished in the US with direct election of Senators. The "New World Order", the ancient dream of the international bourgeoisie, is, from a micro-economic viewpoint, the global levelling of wage rates to strictly reflect costs of production, to achieve a 'rationalized' global cost of production for a given item. A single-rate tax will send the *subliminal* message, "You're all niggers now". Think about it, American, don't you feel a vaguely identified, but none-the-less strong, feeling of social stress when you discover that you should be using the 1040-EZ tax form instead of the one for "real people"?] Hacker-as-cyber-nigger might prove to be a fruitful line of inquiry. Many outward "hacker traits" are characteristic of lumpenproletariat culture. Many hacker "ways" provoke the host culture in ways similar to racism. A bafflingly large fraction of the American proletariat self-identify as bourgeoises, though they own no property, and derive all their income from wages. [The culture-myth says that social class is based on income level rather than income source. Since it is a straightforward matter to change one's income level (work harder, get more schooling), but nearly impossible to change one's income source (from wages to real property or profit, for example), a myth of social mobility coexists disharmoniously with a reality of social stasis.] Misidentifying one's own social class [or believing a contra-demonstrated myth of social mobility] leads to a state of cognitive dissonance, which in the young American manifests in characteristic ways. One such way is the "young hacker" phenomenon, i.e. the "cyberpunk". The "hacker" tends to deny the myth, without knowing exactly what to do about it. Some know *what* to do, but not *how* to do it. The increase of "hactivism", *significantly, arising first among non-Americans, i.e. Chinese and Mexicans*, may serve as a culture-model to channel the American hacker into political activity. A rash of repressive law aimed at hackerdom will, of course, increase the perceived need for such law. Positive feedback, with a lag an order of magnitude smaller than the time constants of the law-making process. The warped perceptions of social class can be seen in any discussion by Americans concerning Bill Gates. Objectively, Gates is a leading member of the international bourgeoisie, a class whose separate existence is denied by the American culture-myth. So, subjectively, Americans identify Gates as a petit-bourgeois, i.e. a small proprietor, and discuss his behavior in the light of the laws and rules of small proprietors. Most hackers identify Gates as "evil", but do not articulate this strong, visceral dislike on an objective class basis, usually criticizing Gates for rogue-petit-bourgeois behavior (crushing competitors with government force, for example). Gates-threads end up in an argument, typically, over whether Gates adheres, should adhere, or be forced to adhere, to the ethical standards of a small bakery shop. It is Gates-as-bandit vs. Gates-as-bidnethman. Curiously, European criticism centers around Gates-as-tyrant or enemy of the people. [The common jpeg of Gates morphed into a 1930's Nazi poster is of European origin, and circulates most widely in Europe, in particular E. Europe, where most of the intelligentsia makes a Marxist analysis of such things, regardless of their political party. A common US Gates-morphing depicts Gates as an armed commando, i.e. a bandit of low social class origins.] * * * * * * In summary: We Await Silent Trystero's Empire[0], d00d! We are the W.A.S.T.E.d ones, the disposessed, the alienated, the disinherited, the thrown away, the furtive, the hunted, the forgotten, the damaged, and the feared. We are armed, dangerous, unorganized, diverse and dispersed. We eat your mother's liver. Some yuppy forgot Sun Tzu's important little maxim: Never wound an enemy slightly. Society needs us. BWAHAHAHAHAHHA * * * * * * [0] "The Crying of Lot 49", Thomas Pynchon. Read and understand.
And the corrected version of Mr. Glave's story.
From: James Glave (james@wired.com) To: dc-stuff@dis.org Date: Thu, 21 Jan 1999 12:11:02 -0800 Subject: CORRECTION: Cracking the Mind of a Hacker I'm the author of the "Mr. Rogers" story that has seen much debate here. I just had a conversation with Marc Rogers, who pointed out an error in the story. I have corrected the error, and disclosed the correction at the foot of the story. Basically, I misunderstood that thRogers' vivd description of the hacker as obsessive and a victim of abuse ONLY applied to one subgroup of hackers that he termed "cyberpunks." He said that there is no way to paint all hackers with the same brush. Here's the full text of the corrected version: http://www.wired.com/news/news/technology/story/17427.html Cracking the Mind of a Hacker by James Glave 8:25 a.m. 20.Jan.99.PST SAN JOSE, California -- The most visible breed of computer cracker is an obsessive middle-class white male, between 12 and 28 years old, with few social skills and a possible history of physical and sexual abuse. That was the controversial conclusion of Canadian psychologist Marc Rogers, in his "Psychology of a Hacker" session, held late Tuesday at the RSA Data Security Conference. A former police computer crimes investigator and author of a doctorate focusing on hackers and cyber terrorists, Rogers offered a new taxonomy for network intruders. "Hackers have been dubbed the enemy of information security," said Rogers. "They research their targets, they know a lot about us. They are very good at intelligence-gathering or sharing." In 1998, the Computer Security Institute estimated that intrusions cost corporations US$236 million worth of damage, according to Rogers. But information systems managers have very little knowledge of what makes a hacker tick. Thus, Rogers developed psychological profiles to aid law enforcement investigators and the legislators who are writing new anti-cracker laws. Rogers offered what he called a new taxonomy of hackers, categorizing intruders as newbies or script kiddies (who are beginners), cyberpunks (older, but still antisocial geeks), insiders (disgruntled employees), coders (who actually write the exploits), professionals (hired guns), and full-fledged cyber terrorists. Rogers said that while the cyberpunk hackers are the most visible -- largely because they are most frequently caught in the act -- it is impossible to generalize all hackers as having the same characteristics. Still, computer security experts in attendance hotly contested Rogers' claims, alleging that his work plays to sensationalist fears and creates a stereotype of limited value to investigators. "He has got the age group, but when it comes to social groups he's got that wrong completely," said Alton Tuttle, a freelance computer security consultant. "In most social groups you are going to find a baseline of people who were [sexually] abused," he added. "Statistically, the majority of what he said was wrong," added Peter Shipley, chief security architect for the Big Five firm KPMG. "I know a lot of hackers, [including one who] spends an hour and a half in the gym every day. He is built! I know of women who are knock-down gorgeous who are hackers." Shipley said that criminal profiles are proven to work to track down serial killers but that "the hacker profile is so diverse and wide that a strong profile could not be useful." Rogers characterized members of one subgroup he called "cyberpunks" as socially inept, burdened with unresolved anger that they take into cyberspace. "They relate better to computers than humans," Rogers said. "They can spend hours and days glued to a computer." He described an incident several years ago when investigators raided a residence, expecting to find a computer left running an automated attack. A machine at that location had been attempting the same routine on a system for days. What the investigators found instead, Rogers said, was a man suffering from a mental disorder. "He had a porta-potty under the seat, and he was buzzed out on Coca-Cola and candy." Shipley said that Rogers was going for shock value with such descriptions. "He is trying to paint hackers as 25-year-old men who can't control their bowels." Rogers said that while there was no empirical evidence linking computer criminals with what he termed computer-addictive disorder, hackers tend to be obsessive types. Shipley and freelance network engineer Aaron Peterson said that the intense, focused mindset typical of someone trying to model a problem could easily be mischaracterized as obsessive. Rogers closed out his talk with a grim scenario for corporate America. He said that some crackers claim to be under contract to fix Y2K legacy code and are in a position to introduce all manner of logic bombs and back doors into the "fixed" code. "I think you are going to find a real mish-mash of things happening once the year 2000 rolls along," he said. Michael King, spokesman for the Hackers Defense Fund, said he had never heard of such a claim. "Generally, people won't tell even their best friends something like that," King said. "There are not many [crackers] out there who would let themselves get that carried away." Editor's Note: This story has been corrected. In the original article, Rogers' description of the cyberpunk -- the most visible group of hackers -- was inadvertantly applied to all hackers. Wired News regrets the error. James Glave, News Editor, Wired News http://www.wired.com +1 (415) 276-8430