Announcement and then we'll get the talk underway.
The tent has been running an hour late.
It is now only running a half hour late.
Again, the tent is now only one half hour late. Thanks.
The tent is running a half an hour late.
They were an hour behind, but they have picked it up to a half an hour.
So, there you go.
Alright, I'm supposed to get going because we're a little pressed for time.
So, good afternoon to all of you.
My name is Thomas Holt and I'm from the University of North Carolina, Charlotte.
I'm a criminologist by trade and my research focuses primarily on computer crime just generally
and computer hacking specifically.
I've spent the better part of the last three years examining the hacker subculture,
hacker social organization, and I've tried to get at it in a number of different ways.
I've been interviewing active hackers, I've been looking at web forums,
I've been at DEF CON, and one of the things that's really surprised me in all of my research
is the relative lack of women.
None of the people that I've interviewed have been female.
Coming to DEF CON, it was apparent there's some sort of a disparity at least
in terms of the population differences.
And looking at web forums really, really struck me because there were very few admitted women.
And in looking at one of the largest forums in the data sample I had assembled,
I saw this passage.
Now, this is just an excerpt from it.
Sure, this is just an excerpt from a forum that I was looking at.
And some of the names have been changed.
But as you read through it, you can see some interesting things.
The first person asks,
How many of you have met any girls who are hackers?
I've never seen some girl who knows a lot about computers and hacking.
Are there any girls who do this?
And the responses don't really suggest there are a lot of them.
Jiggle Billy says,
Unfortunately, I've not met any hacker chicks.
The only ones I know about exist in the movies.
The last one there, Goblocks,
I am a female hacker and I know a few other female hackers.
That's really it.
That was pretty common.
I only saw a handful of women maybe at most.
And I was looking at six web forums of a variety of populations.
And I thought this is really curious.
Why aren't there women involved in this?
And I thought there must be something more substantial going on.
My interest was even more peaked
when some comments were made recently by the president of Harvard.
Lawrence H. Summers made some comments regarding women in the sciences
and suggested that there are genetic differences
and some social factors that drive a wedge
between the number of women involved in the sciences
and the number of men.
We don't have exact transcripts of what he said,
but it was enough to really raise the ire of the academic community
and in some cases, people outside of it.
And so I thought this is really unusual.
What is driving this?
What's happening?
And I thought this must have some importance
not only for women involved in the sciences,
but in computer science, engineering, and hacking.
And I thought this really needs to be addressed.
And so one of the things that I started with
was looking at the number of women involved in academics for computer science.
We know that for a good period of time, from 1984 to 1995,
there was a drop in the number of women who were enrolled in computer science degrees.
Subsequently, after 1995, there's been a bit of an increase,
but it's still relatively small.
It was such a problem that many major universities began doing internal studies
to determine why this decline was happening
at MIT, at Stanford, a couple of different places.
And there was no specific answer found.
When we look at the business world,
one thing that we know is that women have been increasingly involved
in different technical occupations,
but they take place in very low-status, low-income technical occupations.
Women have increased, but they're still underrepresented
in computer science and engineering, etc.
In fact, interestingly, the way that women are dispersed in different occupations,
99% of all dental hygienists are women.
But 3 out of 10 system analysts are female.
1 out of every 4 computer programmers are women.
And there's even a gap in pay.
We know that women computer scientists are making 17% less than men,
and female computer programmers are earning 13% less.
And if you look at... this is just a very quick slide.
It gives you a real face of what's going on.
This is a track from 1983 to 2001 for employed computer systems analysts by sex.
The blue is women, the red is men.
So there are definitely more men involved in this occupation.
And I thought, this is really odd.
What is going on?
And when we look at women in the computer underground, or women in hacking,
it's even more apparent that there's a disparity.
Research tells us that the computer underground is dominated by men.
If you're familiar with the work of Bruce Sterling, the author of the Hacker Crackdown,
he made a very telling comment.
He said that hacking is a... let me see if I get this right...
a teenage male voyeur thrill power trip activity.
You don't find female computer intruders any more than you will find female voyeurs
who are obsessed with catching glimpses of men's underwear.
Pretty salacious comments, and you can hear pretty much the same thing
from Gail Thackeray, a very famous prosecutor.
And a few sociologists and criminologists who have looked at this issue
have done so very quickly, and they've made very, very cursory examinations.
Jordan and Taylor in 1998 suggested that the computer underground is male-dominated,
so much so that they consider it an important component of hacker subculture.
A subsequent study by a guy named Thomas suggested that hacking is a boy culture,
which is all about demonstrating mastery,
whether it's of your physical or your social environment.
Now, this is not to suggest that women don't hack at all.
There have been some famous women hackers.
Susan Thunder, Carmen Karasik, if I'm pronouncing that right.
She's been involved in some hacktivism, but that's about it.
Aside from that, we don't really get a lot of news on women in hacking.
The few journalists who have looked at this problem
have suggested that the number of women is increasing,
but they don't give us any sort of hard and fast numbers.
A publication by Ackerman in 2001 said they're more involved in white hat hacking
and security interests, but that's about it.
The few women who actually discuss issues of gender and hacking
have suggested that there's quite a bit of harassment and difficulty that women face.
A researcher by the name of Gil Boa in 1996
described a great deal of difficulty that she faced.
Sagan suggested that entry-level female hackers
experienced a great deal of harassment.
And a study from Ipsos-Reid suggested that the population of 18 to 24-year-old women
experienced the most heavy experiences of being hit on or harassed while online.
So, generally speaking, we know that women are involved in academic computer science careers,
but it's relatively small.
We know they're in the workforce, but they face some difficulties and some differences.
And we know that they are very, very absent from the underground.
So, why is this? I know I've only got 15 minutes,
but does anybody have an opinion, maybe, as to why there's this disparity?
You in the way back, you've had your hand up for a while.
Yes, this is primarily based on the U.S.
Yes, you, sir.
Okay, the harassment and difficulty.
Okay, good. Anyone else?
Yes?
Men are threatened?
Okay, well.
Yes, ma'am?
Okay.
These are very interesting questions, yes.
Okay. Others?
Okay, well.
Sure, she just said that she's been shunned by other women.
It's not something that women are expected to do.
Would you say that's a pretty good synopsis?
Yes, and then I've got to go.
So, that's why women don't hack.
Okay, so it's easier to harass women online.
Maybe that's part of why women stay out of it.
Well, since I don't have much time, let me skip ahead to some of the theoretical propositions
that have been given by different researchers.
The first is this notion of psychosexual theories.
Essentially, the idea here is that hacking is a way for boys and young men to sublimate others,
to dominate others, and impose their will on them.
And, in a sense, basically, if you can't penetrate another person, why not penetrate a system?
I know that sounds really harsh.
But, an attorney for a hacker named Ehud Tenenbaum, if you're familiar with that guy,
suggested that, in the past, we used to boast about the girls we have.
Nowadays, kids boast about their ability to hack into different systems.
And this notion has been furthered by the stereotype of the socially inept young male hacker.
Someone who can't relate to others, but can get along very, very well with hardware and software.
And this is even furthered by some very esoteric notions about cyberspace,
or the matrix being a womb-like environment, a feminine place.
But it gets a little abstract from there, and it's a little difficult to explain.
So, let me just move on to the next one.
Gender role socialization.
This is something that some of you have already talked about.
It's basically the idea that there are shaping relationships between technology and gender.
Technology has a way of affecting the way that we relate to one another.
The argument here is basically that technology, especially computer technology,
has some very male characteristics.
It requires self-confidence, assertiveness, analytical thinking, very cold logic.
Whereas this is in direct contrast to more feminine traits.
The ideas of nurturing, caring, protection, emotion.
If you're familiar with the work of Sherry Turkle at all,
she talks about hard mastery versus soft mastery.
Hard mastery is the direct imposition of your will on something else through planned attacks.
Whereas soft mastery is more of a free-form kind of interaction,
more something of a conversation than a monologue.
But this is just one sort of argument.
And as a result of these gender role characteristics,
it affects the way that we are pushed into different things.
Because of the way that we view technology, that has a way of keeping women out.
Women who do decide to go into these careers can face a great deal of difficulty.
They might face discrimination, they might face a number of different challenges.
In fact, this is furthered by the notion of cyberspace as a wild west frontier.
If you've read Gibson or Barlow, the discussion of hacking as a place,
or pardon me, cyberspace as a place for the cowboy, the outlaw.
Women don't really have a strong place within cyberspace in that regard.
And another researcher named Susan Herring has suggested that the language of cyberspace is gendered.
It's very male-oriented. It focuses on conflict, on adversarial forms of communication.
And if you don't use these sorts of language, if you don't use these linguistic traits,
then you are not going to be treated in the same way.
You're going to be shunned, you're going to be criticized, or what have you.
And there are also structural arguments that are made.
Essentially, women have not had the same opportunities as men in the workforce.
Women's participation in labor has been based solely on the opportunities made available to them.
For instance, when you think of World War II,
women were needed, well, anyone was needed to fill roles working in factories.
Women took on this role, but once the boys returned back home,
women were expected to go back into the home, become homemakers, what have you.
So, women's roles have been affected by technology,
and structurally, women are not necessarily able to get good-paying jobs.
Their opportunities have been limited,
and it's further affected by being tied back into some of the gender role arguments
that it's hard to advance in your career if you have to raise a family,
if you have to have kids, that kind of thing.
It makes things difficult.
So, these are just some of the theories that have been postulated.
What do you think of them?
Do any of these make sense? Do they jive with your personal experiences?
Yes, sir.
Okay.
So, because of the ubiquity of technology,
these structural arguments don't really make much sense anymore.
Okay. You, sir.
Okay.
So, the differences in how we deal with boys and girls
who are sort of maybe socially awkward is different,
and that might drive the reason why men are involved in it more disproportionately.
Does that sum it up pretty well?
Okay. You, ma'am.
Okay.
So, you think that these gender role issues are very important,
that we don't necessarily give it to girls.
Okay.
So, then you've had some very, very personal experiences with it.
Okay.
You, sir, over there with glasses.
Okay.
So, the way that computer science programs are set up
are also sort of structured
because we don't push women into math and that sort of thing at an early age.
Maybe that's going to keep them from getting involved in the academic portion of it.
You, ma'am, in the black shirt.
Okay. So, women have not only had as much time,
but there's a different attitude, perhaps, as well.
Okay.
You, sir, and then I've got to end.
Okay.
So, even in a whole other country in France
that there's experience that's available to both men and women,
but by the time they hit the university age, things change.
So, again, it might have something to do with the gender socialization.
Well, I don't have a very specific answer as to which one of these explains it best.
And to be personally very frank with you,
we need good research that's going to examine the female hacker's perspective.
We don't really have it yet.
People haven't focused on it very heavily.
And to that end, what we're going to need is good research.
And one of the best ways to do this sort of research is qualitative research.
Qualitative research from an academic standpoint involves interviews,
asking very open-ended questions
and allowing the person to describe what their experiences have been,
why they've been through the things that they've been through,
why they've experienced it, and what their rationalizations are
for why things work the way that they do.
And what I'd like to do, one thing that I'm currently performing,
is a research project examining female hackers.
I've got a good sample of men going,
and what I'd like to do is augment that with women
to really get at this issue of gender and hacking,
because we don't, frankly, have it.
What I'm doing currently is performing interviews.
They can be done via email, by phone, or in person,
depending upon if you're in the Charlotte or North Carolina area,
which many of you probably are not.
And it's a very simple sort of thing.
I ask very open-ended questions.
You can be as frank about it as you want.
And it allows you to tell me a great deal about your own personal experiences with hacking.
It takes less than 90 minutes, regardless of how you do it,
unless you're very long-winded, unless you have a lot to say,
or unless you're a very slow typist.
So it kind of depends upon you.
And it allows you to talk about a subject you may not otherwise be able to talk about.
If you're in a forum and you don't like to admit to people,
yes, I am a woman, because maybe you're afraid that it might affect you in a different way.
Or if you just really want to find somebody to brag to about all that you've done,
then great, you've got the opportunity through me.
And since this is a university research project,
there are very intensive protections that are available.
If you've looked at the DEFCON disk at all for this presentation,
you can see the institutional review board protections that I have to provide to you by law.
And if I violate it, then it's my butt on the line.
Basically what that means is I don't collect any identifying information about you.
I don't want to know what your name is. I don't want your phone number.
The only thing I want to know is, are you a man? Are you a woman?
How old are you? And that's it.
So there are other protections I can talk about.
One last thing to mention, there are benefits if you do this.
I don't have big money, so it's $10.
If you complete a survey, and it's $10, you can refer someone to me who can complete one.
This is my contact information.
I'm using a very simple email address for this, genderandhackingatyahoo.com,
or you can call me.
If you're interested in participating, if you think you know someone who would be, pass it along.
Because I would love to be able to provide you all with some information.
Maybe advance our understanding of what's going on at a theoretical level.
So I've got to go. Thank you.