Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Gabriella Coleman on Anonymous, hacker history and the evolution of infosec
Guest:
Gabriella Coleman
Published:
Updated:
Duration:
52 min
Episode summary
Gabriella Coleman, a Harvard University anthropology professor, describes how she immersed herself in hacker culture and eventually became embedded in the shadowy and mercurial world of Anonymous, the hacktivist collective she chronicled in her 2015 book, “Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous.” This is such a fascinating episode that explores the often misunderstood history of hacking and how many in this community went from outside agitators to mainstream security researchers. Why you should listen:
Get a better understanding of the history of Anonymous and the role it played in shaping online protests and whistleblowing.
Hear about some of the earliest hacking communities such as the free software hackers and efforts to archive their early writings and magazines.
Get an anthropological perspective on how hackers have evolved from the fringes of the tech world to among the most influential voices in cybersecurity.
Hacker history is at risk of vanishing Much of the record lives in zines, text files, binders, and old chat logs on personal hard drives. Coleman wants to build an open archive as a companion to her curated video portal, Hack Curio.
Trust with Anonymous took months It took six to twelve months before hackers opened up to her, and at one point she spent five hours a day, six days a week on IRC. She avoided chat rooms where hacks were being planned and learned about them afterward.
Anonymous had no single leader Journalists wrote dozens of articles trying to unmask one or two leaders, but operations ran through dedicated channels and skilled organizers. Coleman says the newer claim of a single founder is also wrong.
Minimize collateral damage in leaks Coleman's line is case by case: protect people whose data has nothing to do with the wrongdoing, give the cache to journalists to verify, and release only what is relevant, as the Spanish collective XNet did.
Security problems are now sociotechnical Abuse, harassment, and misinformation are not purely technical issues, so she argues for bringing lawyers, sociologists, and affected people into security work alongside technical hackers.
Topics covered
Bug Bounty
Thought Leadership
Notable quotes
…journalists are amazing. They're kind of like hawks. They come in, swoop, get the data…
But just because something is illegal, I don't think makes it necessarily bad.
…the moment you cower, the moment you're not willing to speak up… that's the minute that I think the hacker spirit is dead and can't be effective in initiating change.
…some of the most important innovations were rhetorical. We're getting people to care. That's a rhetorical issue, not a technical one.
Questions this episode answers
How does an anthropologist study hackers?
Through long-term fieldwork and participant observation. Coleman spent years in project chat rooms, lived with hackers, went to conferences, and took system administration, programming, and copyright classes to follow the conversations. Read this section
Was there a leader or founder of Anonymous?
No. Coleman says some individuals and groups carried more weight, but there was no single person or duo running things, and operations were organized in dedicated channels by savvy organizers. Read this section
Why did Anonymous seem to disappear?
Coleman says the 2010 to 2014 hacktivist period was exceptional, boosted by Twitter and the rise of WikiLeaks. Illegal hacktivism is too risky to sustain as a steady state. Read this section
How did underground hackers become security professionals?
In the 1990s, few academic programs focused on security, so hackers who had broken into systems could credibly offer to secure them. They were openly adversarial toward vendors like Microsoft, and that habit of speaking up still exists. Read this section
Will hackers in mainstream security make the internet safer?
Coleman expects hackers to keep playing a prominent role, but says many current problems are sociotechnical. Bringing more types of people into security work is the way forward. Read this section
About the guest
Gabriella Coleman is an anthropologist who has studied hackers since 1998, starting with free software communities such as Debian. At the time of recording, she had recently become a full professor in the anthropology department at Harvard University and a faculty associate at the Berkman Center for Internet and Society, after teaching at McGill. She chronicled the hacktivist collective Anonymous in her 2015 book Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous.
And I'm Jeremiah Roe. Today, we're gonna be talking to Gabriella Coleman, probably the foremost expert on Anonymous and hacktivism in general. I personally remember Anonymous from back in the day. How about you, Bella?
I actually didn't know a whole lot about Anonymous before this interview. It was something that I kind of heard about but just didn't do a lot of research into. But it's really interesting this idea of using hacking for kind of a specific social mission or for the greater good.
I agree. They were definitely a huge impact in the industry and pushed a lot of initiatives forward for making businesses be responsible for their for their cyber activities.
Yeah. It was really cool to learn more about that organization and mission. So Gabriella recently became a full professor in the department of anthropology at Harvard University and a faculty associate at the Berkman Center for Internet and Society. We'll talk more about some of her latest research after a quick word from our sponsor.
The cybersecurity talent gap is growing. Is your organization feeling its effects? Instead of spending time on an exhausting search for your next candidate, get help today with on demand security tasks available at the click of a button. Synack campaigns match the tasks you need done with a capable, skilled researcher. Go to synack.com/campaigns. That's synack.com/campaigns. Welcome to
the show, Gabriella. We're really excited to chat with you today. My name is Bella DeShantz-Cook, and this is my my cohost here, Jeremiah. How are you today?
we're super excited to get to chat with you today. I'm just gonna jump right right into it. So you're an anthropologist who studies hacking and hackers, and you've done a lot of work studying the group Anonymous. What drew you into this world in the first place?
So I started studying hackers around 1998. And I was a very traditional anthropologist working on medical healing in Guyana, South America. And lo and behold, I came across something called the copyleft, which is a license that was invented by free software hackers, not in the security world, but nevertheless, a sort of domain where hacking is thriving. And, you know, I was just floored. I was floored that a bunch of technically minded people who, in this case, created free software, were also innovating in the legal realm. And I found this to be a puzzle. Why was it that people who might be considered to have a kind of engineering mindset would go beyond technology to solve, in this case, a problem with intellectual property law?
They wanted access, they found patents and copyrights too restrictive, and said: You know what? We're just going to reinvent the law. That is what attracted me initially to the world of free software hacking. And over time, I got to see how there's very different types of hacking. Breakers and builders and hacktivists and biohackers and you know, they have very different histories and lineages. But that spirit of being willing to think outside the box, technically and also in non technical domains, is what interested me in this world. So as I got to learn more and more about hacking and its different variants, I continued to be sort of amazed by the sort of technical, but also political impact of hacking, even when hackers weren't trying to be political.
Sometimes they are, sometimes they're not. But whether they have that intention or not, they are refiguring a lot in different arenas from journalism finance, to security, to law. And so that is what got me in. And at the time, as a young female anthropologist who jumped in into this world, it was a bit heretical for me to do so, because most anthropologists had to, you know, leave their own country to do research to be seen as a kind of respectable anthropologist. But I couldn't help myself because there weren't that many people in the trenches doing ethnographic work. And so that's why I decided to stay. And here I am twenty years later. So I have a question. I just... I guess just for, like, my personal understanding. Obviously, I I know a a good amount about cybersecurity hacking as a
person who's in the industry, kind of a technical person in the industry. And I I know what the word anthropology means. But I guess I'm wondering what exactly does it mean to study hackers and hacking from an anthropologist perspective?
So an anthropologist generally does long term fieldwork. And what that means is that in some capacity or fashion, you really integrate yourself with the people that you're studying. You know, anthropologists sometimes study like objects or commodities like sugar, right? And that's how they enter into a topic. But traditionally, even though the field has changed a lot, the idea is that you really immerse yourself in the world or group that you're studying. And so my first project, which was on free and open source software, I spent a lot of time on chat rooms where people were gathering for the project and to do development.
I studied Debian, among other things. But I also lived with hackers and geeks as well, and went to conferences, right? So for a couple years, my whole life was literally about free software, hanging out with free software people, interviewing them, going where they went, right? So it's kind of embedding yourself in that world to participate in it. There's a term called participant observation. That's the main kind of methodology of anthropology. And so you participate, you observe, and you really gain a kind of holistic perspective of the world you study. So that is what kind of sets anthropology apart is almost its methodology more than anything else.
That's really interesting. I can imagine, like, being in that environment, I don't know, as sort of like someone specifically there to kind of study and observe. I can imagine that being really interesting.
Very interesting. Very puzzling. I mean, I could barely follow conversations. I had to take system administration classes. I took programming classes. I took copyright and patent classes.
And you'll also be working with the Berkman Center for Internet and Society. Will you be teaching the same types of courses that you taught at McGill or where you've been teaching for a while? Or are you going to be focused more on research?
I'll be doing a lot of teaching as well. Three courses. I taught three courses at McGill. I'll also be doing a lot of research. I think one of the exciting things about being at Harvard is that the Boston Cambridge area is a really important area for the history of hacking, right? MIT is where the term hack came into being. If you know the history of phone phreaking, right? The phreaks are the kind of precursors. Harvard students were really part of that history. There were some really important phreaking at Harvard. The L0pht, right, was based out of Cambridge. Some of the L0pht guys are still in the area. So this means is that it will allow me in my teaching, I teach a course dedicated to hackers, sometimes I call it hackers the class, is that I can draw on the amazing pool of people in the area and history as part of my coursework.
The other thing I hope to do too is I have recently been really interested in archiving Hacker History, even though it's a recent history. And even though a lot of it exists in documentation, whether it's zines or text files. Nevertheless, a lot of it is vanishing as well. And I would really like to just start creating a archive that is accessible to other researchers and other hackers as well. So it'll be a few years before I can get that off the ground. I see that as a kind of companion to a project that I started a couple of years ago called Hack Curio, which is a video portal into Hackerdom. And that features short little snippets of videos with texts, and it also kind of documents history, but it's very curated.
It's almost like a museum. Whereas what I hope to do is create a much bigger archive that is abundant, a kind of cornucopia of archives and information that others can tap into.
So like, I was thinking about this a little bit before our conversation about how, like, how do you get the documents that are deemed important or worth preserving related to hacker culture? Like, how do you find them? How do you know what is useful or just kind of nonsense on the Internet? How does that work?
So some of the documents I have were given to me, actually, by people I interviewed for a recent history project on the professionalization of the hacker. And so as I interviewed people, someone was like, oh, I have a binder full of information. It's everything from advertising around security to very niche news clips, regional news clips from Denver, for example, on hacking, right? And so he gave me two huge binders. I also know that one member of the L0pht, I won't say his name, just in case he doesn't want it known. He's kind of an archivist. He has a lot of amazing information. And hopefully, once I have something set up, I can compel him to donate it. So currently, it's mostly personal relations, right?
But then I think once and if something is set up, then people who are out in the world, right, who may have a box of zines or some hard drives with some old and important chat logs. I mean, logs are really, really important for hacker history. They might be willing to donate. And in terms of what's worthwhile and what's not, it's sometimes always hard to tell, right? Usually, I think an archivist takes most everything, and then hopes that later others will find a kind of use for it, right? But, you know, the worry is, if you don't take it, then then it'll just stay in that basement and the basement will flood and and then that's the end of it.
So for those those that aren't necessarily aware as to what zines are or or kind of what this style of documentation is or information sharing. Maybe you could elaborate elaborate a little bit more. I'm I'm also interested in hearing a bit more about this as well.
Sure. I mean, hackers, again, back to my maybe first original point that they're famous for technology, fixing, breaking, fixing or breaking technology, but in fact, they do so much more. And one of the things that hackers are famous for, at least in certain circles, was and is still the writing of zines, right? And so some of the famous ones are things like Phrack or 2,600, some are print, some are online. But you know, those are like two very famous ones. There's hundreds of other ones as well. Right? And others like Yipple, the youth international party line, which was part of the phreak scene that came before. And these zines mix technical issues with cultural and political commentary as well.
Right? And small little groups like Bao had their own zine. So it was a way to kind of congeal the micro group, right? And so a lot of hacker history exists in those zines. And it's not just in the English speaking world, right? The French had their own zines as well. The Dutch had their own zines. And so again, while a lot is known about the famous ones like Phrack in 2600, there's still so much more to dive into. And just as an interesting aside, I heard that Phrack published recently for the first time in five years.
Wow. How cool. With regard to, you know, going back to kind of your class, you know, this is all kind of intertwined with information sharing, historical context, creating an archive for the hacker culture, and all of this stuff. And I'm just kind of curious with the new teaching role that you're gonna be doing, I would imagine that most of these students would be maybe nontechnical. And so to me, the hacker culture is obviously just exceedingly interesting, but I work in this realm. And so I'm I'm kind of curious as to those individuals that are nontechnical. What interest... What what do you think would interest them the most about hacking? And are they coming into your classes with sort of a lot of knowledge that you've seen? Or are they just kind of there to get the basics?
For the most part, people come in with very little knowledge, and I would actually say they're chock full of stereotypes. And that's what makes teaching a class on hackers so fun is like, you could sort of just see those stereotypes explode, you know, week after week after week after week after week. Right? So in that sense, it's a really kind of satisfying course to teach, precisely because they really have a narrow, very narrow vision of what hacking is. It's usually, you know, the criminal and perhaps Mr. Robot, right? Those are those are the two. And they are really surprised that there's so much depth and breadth. And then, you know, I am very lucky. I do bring in a lot of people from the hacker world to participate in class, either online or in person.
And that is this whole other dimension, because I think that there's a, whether it's this podcast or things like Mr. Robots, I mean, the public does have more opportunities to come across more realistic pictures of hackers than ever before. But I still think that most people think that hackers are really like these mad geniuses, somewhat pathological, lonely, not- not quite fully human, you know? And then, like when they come across individuals, you know? And I do try to get a good cross section, not just white dudes, because there are a lot of white dudes in the hacker world. They're just like, Oh my gosh, humans, humans. They're they're humans and they're doing this really interesting stuff. Right? So it's just incredibly satisfying.
And I I think teaching about hacking is just one of the reasons. I mean, obviously, I do love the research, but the but the teaching is incredibly satisfying for that reason.
I can imagine. So interestingly enough, it had been a while since I had I had heard the term anthropologist. And so I had to look it up again to see what anthropology is about. So I'm gonna unabashedly admit to that. And as I looked at it... Because initially, it just didn't make a lot of sense to me. I'm like, that's so that's so unique that, you know, an anthropology professor would would want to write books on the hacking culture. And and then as I looked into it, I'm like, wait. No. No. No. It's not. It makes total sense. And I just... I find it exceedingly interesting from the perspective of a unique outsider coming into this culture, maybe not necessarily having the background into it, maybe dead. I don't know. I don't wanna assume. But, you know, I just I just find that to be really interesting in and of itself. And in the process of diving deep into the culture, you naturally become embedded with the things that the culture cares about, you know, with the people, with the lifestyle, with a number of things.
And so through that, you've developed a number of connections in the industry, and in particular, people who aligned with the group Anonymous. And so did that take a lot of time to build that trust within these specialized groups of the culture? And are you still in touch with them? And what part did they... I I know a lot of questions, but what part did they take in your book? Hacker, hoaxer, whistleblower, and spy?
You've described the kind of anthropological relationship very well, which is, you know, we're not disinterested researchers. Because we become embedded, we start to care about many of the issues that hackers care about. That might be security, that might be privacy, that might be accountability, and you form personal relationships. I mean, literally, you become friends with some of the people, you write them letters of recommendation, you go to their court cases, right? You become embedded. You know, some people will call that kind of bias. Others will say, No, that affords you a very unique perspective that other researchers can't have. So let's back up. Anonymous, unlike studying free software hackers, was much harder at some level. With the free software community, they were like, Oh, yay, you want to learn about Linux?
And Anonymous, at at some level, when I was there between 2018 and '14 was also welcoming. I was on the chat rooms initially. And in the case of the kind of hacktivist node that came into being 2010 and '11, They had a channel dedicated to reporters and to researchers, because they wanted attention. And people like myself could act as a gofer and broker. And I was I brokered a lot of not deals, but I opened the doors for journalists, right? So it was handy for me to be around. But it was incredibly hard for a couple reasons. First of all, was very chaotic. So it was very hard to understand what was going on. People, you know, went by handles. And it was hard to sort of know what- know what was true, what was false, what was going on.
Not everyone involved in the hacktivist era that I was studying was engaged in illegal action. In fact, would say the majority were not. They were mostly organizers, media makers, but Anonymous became famous for their, you know, high stakes, high risk hacking. And that was something I was very interested in and wanted to learn about. And it took a very long time between six months to twelve months before some of the hackers started to open up to me in interviews or let me into some secret chat rooms, right? And as an anthropologist, unlike a journalist, journalists are amazing. They're kind of like hawks. They come in, swoop, get the data, you know, I'm just like, I'll sit for three months, you know, and wait, and just watch and then hope the data like lands in my lap.
And it did. It took a long time and I got a lot of information. And I didn't want to be in the chat rooms while they were organizing hacks. That was just too risky for everyone. But certainly, wanted to learn about it after the fact. And over time, I was able to gain that access. And then even later, I mean, this is this is this points to this kind of long term commitment and the long term relationships that the anthropologists form. I mean, at a certain point, people in Anonymous got arrested. And like I mentioned, I went to some of their trials, I got to know some of them. And after I got to know some of these individuals in person, then a number of them also gave me some logs or information much later, but in time for my book, right?
And so it was just very, very challenging for that reason. But it was also great insofar as at the time, I was actually teaching a little bit less. I had some fellowships and that afforded me the time so that I could be present on IRC, for example, the chat rooms, six days a week, five hours a day. I mean, that's a lot of time. I can't do that right now. I wish I could, right? And just form those sorts of relationships that are... They helped me really understand what was going on and make sense of these worlds.
Earlier you mentioned you might need to take time to understand what's true or maybe not be able to know what's true or not true. And you also kind of talked about journalists getting information from these kinds of groups. And I think obviously, it's it's so important for journalists to get accurate truthful information, but... And and, you know, verify their information before sharing it out and not be spreading misinformation. What does that look like for an anthropologist? Like, what is your, you know, responsibility or need to get truthful information? Is it the same kind of requirement or different?
I would say there's some similarities, but also some differences. Generally, anthropologists aren't publishing for CNN or CBS or The Atlantic. I mean, we publish opinion pieces here and there, we get quoted, right? So when a journalist gets something wrong, and it's published in a mainstream piece, I mean, the ramifications are really substantial, right? And the stakes are really, really high. And currently, there's a big battle over like whether there was a founder of Anonymous or not. And a lot of journalists actually are publishing, I think, just straight up false information. And it's been very hard to correct the record, Right? So an anthropologist doesn't necessarily have the same type of impact.
I mean, I did write one popular book, it was read a lot. But a lot of academic publications are read for like, by like 20 people, right? So even if there are some some lies, it's not going to percolate out. That said, you know, an anthropological analysis, on the one hand, I do think tries to get matters of fact, you know, correct. On the other hand, unlike a journalist, I can theorize how secrecy and telling lies works in the collective. Right? And that's part of my analysis. And even point to, you know, some of the hoaxes, for example, that happened, some of which maybe I was writing about when I didn't know it was hoax, later I did, right? So there's a lot more freedom for an academic and anthropologist to kind of treat knowledge in different registers than a journalist.
Right? And do feel for journalists, I mean, they're working under much tighter deadlines. Right? So sometimes it's really, really hard to verify information in a week, a month or two, whereas some of the stuff I verified after four years, you know? I mean, I didn't publish my book for years, in part because I was avoiding writing, but also because I was waiting on things. Right? And journalists don't have that luxury. But I do mention, do think journalists, you know, the standards matter because part of the current distrust in the journalistic regime stems from some mistakes, right? And some mistakes happen, but they can be corrected, right? And more and more journalists do that, which is great.
So context matters. And I think from a context or perspective of context, I think anthropologists, you know, especially in the culture world, would have much more context than, say, a journalist would. And truth is embedded in these really complex issues, in these very intricate, like, interdomain things that happen in in the world of hacker culture. Context has the truth. It's not just black and white. It's just the truth is so much more than, and I could see where anthropology has a huge role in that.
No. I mean, you you bring up an excellent point too, which is certainly we can all agree on certain facts. Like, I was born on X date, I'm not going to dox myself. But that could be verified. I think that's true, right? But so many things that are in the realm of truth, don't have that clarity. That's the nature of knowledge, you know, whether it's a kind of scientific take on the nature of bacteria, I teach on the history of science. And it's like, you know, the bacteria is treated as simply an agent of infection for decades and decades. And then scientists are like, well, there's this thing called the microbiome, right? And that's a different type of truth, but hard to see from the vantage point of a different type of truth.
And I would say when it comes especially to social worlds, right? A lot of issues that people think facts, be adjudicated simply through facts, right? And yet, you know, of course with journalism, you try to get the base facts correct. But nevertheless, there there is a lot open for interpretation and context really helps us understand situations. Right?
Do you have any examples that you recall of, you know, having been so engrossed in this culture in Anonymous? You recall any examples of things that journalists did get wrong in the moment that maybe did have some negative impact?
I mean, Anonymous became very famous in the end of two thousand ten, two thousand eleven, for example, where there were many distributed denial of service attacks, for example, against PayPal and MasterCard in 2010, in support of WikiLeaks, or later against security firms at the hands of LulzSec and then AntiSec, a couple of journalists were hell bent on finding like the single or two hackers who did everything. The leaders, the leaders, the leaders. And it is certainly the case, anyone who knows any organization, that certain individuals or groups often carry more weight or power. Sometimes there's multiple groups and part of the organizational dynamics has to do with how they clash.
Right? But there wasn't a single person or even two who were the single or duo movers and shakers. And there were literally, you know, dozens of articles trying to identify these two people. And again, if you were in the chat rooms, you saw that there were dedicated channels for particular operations. And actually, some of the reasons some of the operations were so successful had to do with some of the very savvy organizers, right, who could herd the cats, the Hacker cats. And it was so hard to convince them. And, you know, I don't know if this had terrible ramifications, but I do think it reinscribes a vision of power and hierarchy that naturalises it, which I don't think is a good thing.
Because sometimes, you know, groups come together autonomously ly and organise themselves by consensus, and there isn't simply just someone pulling the levers. So you know, there is a kind of high stakes around how we imagine power. And that's why it matters. And I always had this theory that journalists, well, some journalists had this kind of vision because editors have so much power over certain journalists and stories they can make or break or kill a story. Right? Whereas, for example, academics actually have a lot more autonomy, I would say. I don't have a boss who's going to make or break my work at all. Right? So that's one example that was quite recurrent. And recently, there's now a new narrative that there was a single founder of Anonymous, the trolls and the early hacktivists. And that's just wrong in terms of historical record.
And again, the stakes are that no, actually, this is precisely interesting, because of the ways that so many different individuals and groups come together and often very chaotic ways to make things happen. We should try to understand how that works.
So that's that's really interesting that that you kind of described that. And, you know, not to stay on Anonymous, but I... I'm really interested in this particular group and sort of their historical context. And so there's a piece about Anonymous that maybe, you know, most people haven't been focusing on because they haven't been in the news recently. But there was a good portion of time there where they were in the news quite a bit. There were tons of videos about them. There's lots of information about them online. Again, you mentioned some of the attacks that the collective groups perpetrated together, such as large distributed denial of services and online protests and organizations. And then all of a sudden, it kinda seems like they vanished. And then, you know, people maybe forget about them. And so I'm just kinda curious from your perspective or from your research, what have you seen as to why that's happened?
So the heyday of Anonymous was certainly between 2008 twenty fourteen and fifteen. And even referring to Anonymous as a kind of singular thing in that period is a mischaracterization, just because there is, yeah, these different groups and eras and moments, and we don't have time to go into them, but really just interesting dynamic collective, really, and really hard to understand those changes unless you were embedded in the ground. It'd be very hard to come in after the fact and piece it together in a way that again, I think with open source you can do. In some ways, the hacktivist interventions between 2010 and '14 were exceptional.
They were also partly indebted to the rise of things like social media and Twitter. Anonymous were really good at getting the word out. They used the platform in very media savvy ways that now many different groups know how to use Twitter in that way. But they were kind of really at the front forefront. They were also quite big, in part because WikiLeaks was quite big as well as a phenomena, a whistleblowing platform with major geopolitical consequence. And it was also interesting because Anonymous, especially in 2011 and '12, did so many operations and hacks and DDoSing. I mean, it was just hard to keep up. And it was exceptional insofar as I just think that when it comes to something like illegal actions related to hacktivism, the norm would never be a steady state of action.
With regards to that, that particular piece risk, right? I just want to touch on that for a moment. Like with with I think I think you've had some amazing experience inside the hacking culture in the world and and looking at a lot of the different pieces that that you've worked on throughout the years. I think it's... I think, you know, it's it's certainly impressive. I I I just... From from your perspective with being embedded with a lot of these groups, where's the line drawn for you, particularly?
It almost has to be a case by case basis. Certainly, if there's collateral damage. So if information is dumped, and a lot of people whose information is exposed had nothing to do with, let's just say the corruption, wrongdoing, malfeasance that's being exposed, protect them. You know, don't dump that data. Give the cash to a journalist, so they could verify that everything is sound, but only release what is relevant. XNet, a collective in Spain has done precisely that. Anonymous wasn't so good at doing that. They were good at showing the world that you can hack and get information that is publicly relevant, you know. And while hackers really innovated this hack leaking technique, I mean, there have been some prior break ins in the analogue era.
The Citizens Commission to expose the FBI who broke into an FBI field office in 1971, showed the existence of a massive disinformation programme COINTELPRO. So break ins sometimes are okay, right? But I think there are better ways to do it, right? And so minimising privacy violations and collateral damage, I think is really, really important. But just because something is illegal, I don't think makes it necessarily bad. Right? And so just briefly, there was, I think, a lot of actions in the Anonymous world, whether it's showcasing rape culture, or some of the hacks and leaks, which I supported. And yet even some of the actions I supported, there were dimensions that yeah, sure, I thought they crossed the line, but not so much so that I would just discount what they're doing entirely.
I think that idea of like, just because it's illegal doesn't necessarily mean it's wrong. It sort of feels to me like a lot of where cybersecurity and hacker culture, like, came from initially, which on that note, you've written a paper with, Matt Goerzen, who is a security reacher... Researcher at, Data and Society. And the paper is about the evolution of the professional security hacker, which of course is like right what we're talking. It's so relevant to what we're talking about and very relevant to Jeremiah and I. In a way, the paper kind of explores how hackers are becoming mainstream and are gaining this new credibility in information security and more widely in society. So I was wondering if you could talk a little bit about how you think the old underground world of hacking continues to influence the newer and more corporate and acceptable community of security researchers.
So it's a fascinating history. I mean, so a number of security researchers, professionals today hail from the underground, and a portion were were literally outlaws insofar as they were breaking the law. And they weren't necessarily doing malicious things as they were owning systems. But nevertheless, by virtue of the laws, they were doing illegal things, but they learned a lot, right? And in the era, this is the 90s, where there weren't that many programs in academic circles that concentrated security. And so these people were in a good position to say, hey, you know, we know how to secure your systems, which are terrible, because we can get it. Right? And what's interesting about the history is that they were very adversarial. They spoke up, they said Microsoft, your shit stinks, you know, sorry.
Yeah. It was really bad. You know? It was really bad. And Microsoft was just like, the problem is you. We won't even have like a security department. Right?
And so and and so here were people who were potentially cast in a negative light by virtue of being a hacker still speaking up. And I I mentioned this because we'll get to the present, which is, you know, I don't think the infosec world is as adversarial as it was in the 90s, you know? That said, people do still speak up in very visible and powerful ways. I think of someone like Katie Moussouris. Am I pronouncing her last name correctly?
I know. I'm so sometimes with with names, I'm like, I'm not sure how I say that name. But Katie Moussouris, she is a pioneer behind bug bounty programs. She's the CEO of Luta Security. You know, she helps set up bug bounty programs in different places. Yet, she's also very critical about how they're executed and their limits, right? And we'll say so very, very visibly and dramatically in talks and in writing. And it's that spirit of speaking up, of sort of saying like, okay, I was part of this world that helped, you know, cement bug bounties. They're powerful, they're important, but how they're being rolled out and implemented is really shortsighted. And I'm going to say so. And I will say that I do think that a lot of hackers, whether they hail from the 1990s, or more recent ones that are part of the infosec world, speak up and say what's wrong.
And that's so important, because the moment you cower, the moment you're not willing to speak up, whether it's in a kind of boardroom, whether it's on Twitter, whether it's by presenting a paper at Black Hat or DEFCON, that's the minute that I think, you know, the hacker spirit is dead and can't be effective in initiating change.
With that whole adversarial sort of change that we've seen happen throughout the years, I think that also partially aligns with the fact that, you know, mainstream has become more acceptable of the hacker culture and the fact that security is a big deal, not just because I say it is, not just because Bella says it is, but because people are be... Becoming affected by these things. Over and over, we're seeing throughout the years, you know, mass mass data dumps happening, mass data leaks happening, people becoming compromised, their personal information, financial information, all of this stuff getting leaked and and it affecting real people's lives. To that point, you know, we have a recent sort of thing that's happened in Missouri, right, where, the Missouri governor has has threatened to prosecute a a journalist for looking at the freely available source code on any website.
For those who aren't aware, go to any website, press F12, you're gonna get the source code. And he's saying that's illegal, and he's going to prosecute somebody for that. That's the kind of adversarial mindset that's caused tension through the hacker culture throughout the years. What... What's what's your perspective there?
Yeah. So you've just captured, first of all, why it's important to be adversarial, and so far as you are going to come across roadblocks like the Missouri governor, who just is one among many possible roadblocks where there's an interest in shining the light elsewhere, right? Because, you know, in the end, it's the Missouri government or the school board that was irresponsible, right? They were the responsible ones. And so in order to deflect responsibility, it's very easy to place it on the journalist, the hacker who found the flaw. And again, like as a journalist, you're a little bit more protected. Just the term hacker, you know, again, for so many conjures criminality.
So it's very, very easy to do that deflective work. And I think it's, you know, if you look at the history, there's a lot more protections today, whether it's because of precedence, whether it's because of the EFF, who has published the coders rights project, right, which really outlines why it's important to protect hackers, whether it's the work of Jennifer Granick, who has protected many hackers, right? And yet that spectre always looms, right? That spectre always looms. And you know what, just whether it's the threat of legal action, I mean, who wants to fork over $50,000 to defend themselves? That's a lot of money. Right? So yeah, many don't end up in jail, but the legal threat is real. And yet, you know, there's always going to be parties who don't want to hear that they were inadequate in their security protocols, right?
And so they'll always pull this move. But it's important for the community to band together. And the more that it's done collectively, the more chance that these, you know, silly shenanigans won't work.
So ultimately, do you think that hackers getting more involved in traditional cybersecurity work is going to improve security and make the internet safer for everyone?
Hackers and the security community have been pioneers in terms of getting organisations, whether it's the government or Microsoft, to care about security, and have also innovated methods and tools from, you know, Satan, to Lofcrack, to many recent ones. And I think they'll continue to play a really prominent and important role. I also think that today's internet is different. And many of the security issues and vulnerabilities are not simply technical, but sociotechnical, right? What do you do about abuse and harassment? What do you do about misinformation? And in this regard, I think that enlarging the pool of the types of people participating and thinking through security is the way to go.
So obviously, like, the technical folks are really important. And actually, in the history of just technical security, some of the most important innovations were rhetorical. We're getting people to care. That's a rhetorical issue, not a technical one. I think hackers were extremely savvy in that department. That was- this is what the report we're releasing is partly about. But it's really, really important to also get the lawyers, the sociologists, those affected by abuse and vulnerability at the table. And we see that happening as well. I do think that sometimes, you know, I'm obviously, people can probably tell a fan of the hacker world, but there are some blind spots from time to time. And sometimes there's a kind of prioritising of the technical, right? Is there a technical solution?
And it's elegant and great if you can get that technical solution. But it's also important to see where the limits of technical solutions lie, right? And so that's what I would say is yes, they have a prominent role. But the more open they are to getting different types of stakeholders and participants at the table to deal with some of the really, really, really thorny issues around sociotechnical vulnerabilities, the better.
So you've recently called or you've you've stated that one of the most important phenomena of global culture and politics in the late twentieth and early twenty first century is around this realm of hacker culture and your anthropological views that you've developed from that. I'm just kind of curious. Where do you where do you think it goes from here? You know, based off of your experience, what trends have you been noticing from the movement forward? And, will we see more instances of of hackers driving politics in your perspective?
There's so many different ways to hack today and many different types of technologists who are part of these autonomous or semi autonomous communities, right? I mean, in InfoSec, right, where you might work for a corporation, but if you're going to, you know, DEFCON or different hacker conferences or the Chaos Computer Club camp in Germany, you have these autonomous spaces where you come together, and you decide on your own values. And that's well in the live in the hacker world, in different domains. So it's hard to say how exactly things will play out. You know, if you'd asked me fifteen years ago about the rise of Anonymous, I could have never predicted that, right?
But nevertheless, I'm not surprised that hackers have refigured journalism with whistleblowing platforms. I'm not surprised that hackers were at the forefront of establishing the protocols for the security industry. In the world of finance, I mean, it's really something else to see the blockchain developers and Ethereum developers change everything from how finance happens to how smart contracts are going to happen, right? And that I think is going to be incredibly impactful, actually, in the next five to ten years. That's a domain that undeniably is going to both create new my- it's going to create new modalities for financial transactions, legal transactions, but also, exactly, organizations. I mean, Ethereum allows for, you know, high powered capitalism, but also allows for co ops.
And there's a big thriving scene around using Ethereum for creating co collectives. So that's one domain, I think that there's going to be a lot of activity. And then I do think that the hacking and leaking and the breaches of the last ten years are going to continue for the next decade, right? Security is not going to kind of catch up. And while hacktivists are one group doing the hacks and leaks, we've seen some recent ones with Anonymous, hacking Epic, the internet service provider, now nation states are involved in hacking and leaking.
No, exactly. So it's just, they're going to continue to be impactful. It's hard to predict how, but the more that there's journalists and academics who are existing alongside these communities, getting to know them, you know, well, and not just swooping in from time to time, the better we'll understand what impact they're having in the present.
They can Google my name, Gabriella Coleman. My website gabriellacoleman.org will come up. I'm on Twitter. Biella Coleman is my Twitter handle. And then, you know, maybe you can find me in my office if if you figure it out. I I, for many years, had a fake office number just to keep the Scientologists away.
It reminds me of the, like... I feel like every person who works in technology has a, like, dream life that they would live if they weren't sitting at their computer. It reminds me of that.
According to a recent survey, 95% of security professionals believe that the cyber talent gap has not improved in recent years. The number of open security jobs today is quickly approaching 4,000,000. Perhaps you're feeling the effects of the talent shortage in your security operations. What tasks are you struggling to get done? Whether it's performing due diligence on an m and a target, working through vulnerability checklists, or checking testing boxes off for compliance, Synack campaigns can connect you with a researcher capable of getting the job done. Don't spend any more time writing job descriptions and sifting through candidate resumes. Let us connect you with the right talent to augment your internal team. Get your backlog tasks taken care of and fulfill any specialty your team needs with Synack campaigns. Synack researchers are available twenty four seven and campaigns can be launched at the click of a button in the Synack platform. Reach out today at synack.com/campaigns.
