[00:03.380 --> 00:05.500] Announcement and then we'll get the talk underway. [00:06.620 --> 00:10.160] The tent has been running an hour late. [00:10.160 --> 00:13.300] It is now only running a half hour late. [00:13.320 --> 00:17.300] Again, the tent is now only one half hour late. Thanks. [00:23.140 --> 00:26.380] The tent is running a half an hour late. [00:26.380 --> 00:29.680] They were an hour behind, but they have picked it up to a half an hour. [00:31.280 --> 00:32.980] So, there you go. [00:33.400 --> 00:36.660] Alright, I'm supposed to get going because we're a little pressed for time. [00:36.660 --> 00:38.700] So, good afternoon to all of you. [00:38.720 --> 00:42.640] My name is Thomas Holt and I'm from the University of North Carolina, Charlotte. [00:42.820 --> 00:50.700] I'm a criminologist by trade and my research focuses primarily on computer crime just generally [00:50.700 --> 00:53.120] and computer hacking specifically. [00:53.120 --> 00:57.500] I've spent the better part of the last three years examining the hacker subculture, [00:57.500 --> 01:01.540] hacker social organization, and I've tried to get at it in a number of different ways. [01:01.540 --> 01:05.260] I've been interviewing active hackers, I've been looking at web forums, [01:05.260 --> 01:09.740] I've been at DEF CON, and one of the things that's really surprised me in all of my research [01:09.740 --> 01:11.960] is the relative lack of women. [01:12.100 --> 01:14.740] None of the people that I've interviewed have been female. [01:14.940 --> 01:18.000] Coming to DEF CON, it was apparent there's some sort of a disparity at least [01:18.000 --> 01:20.640] in terms of the population differences. [01:20.700 --> 01:26.060] And looking at web forums really, really struck me because there were very few admitted women. [01:26.560 --> 01:30.980] And in looking at one of the largest forums in the data sample I had assembled, [01:30.980 --> 01:32.340] I saw this passage. [01:32.340 --> 01:34.060] Now, this is just an excerpt from it. [01:34.840 --> 01:38.820] Sure, this is just an excerpt from a forum that I was looking at. [01:39.320 --> 01:43.060] And some of the names have been changed. [01:43.060 --> 01:45.640] But as you read through it, you can see some interesting things. [01:45.640 --> 01:47.180] The first person asks, [01:47.180 --> 01:50.340] How many of you have met any girls who are hackers? [01:50.340 --> 01:53.860] I've never seen some girl who knows a lot about computers and hacking. [01:53.860 --> 01:56.100] Are there any girls who do this? [01:56.100 --> 01:59.460] And the responses don't really suggest there are a lot of them. [01:59.460 --> 02:00.320] Jiggle Billy says, [02:00.320 --> 02:02.660] Unfortunately, I've not met any hacker chicks. [02:02.660 --> 02:05.020] The only ones I know about exist in the movies. [02:05.080 --> 02:07.460] The last one there, Goblocks, [02:07.460 --> 02:11.620] I am a female hacker and I know a few other female hackers. [02:11.620 --> 02:12.720] That's really it. [02:12.720 --> 02:13.780] That was pretty common. [02:13.780 --> 02:16.860] I only saw a handful of women maybe at most. [02:16.860 --> 02:20.760] And I was looking at six web forums of a variety of populations. [02:20.900 --> 02:22.320] And I thought this is really curious. [02:22.320 --> 02:24.600] Why aren't there women involved in this? [02:24.620 --> 02:28.140] And I thought there must be something more substantial going on. [02:28.140 --> 02:30.000] My interest was even more peaked [02:30.000 --> 02:34.000] when some comments were made recently by the president of Harvard. [02:34.000 --> 02:37.180] Lawrence H. Summers made some comments regarding women in the sciences [02:37.180 --> 02:40.920] and suggested that there are genetic differences [02:40.920 --> 02:43.960] and some social factors that drive a wedge [02:43.960 --> 02:46.140] between the number of women involved in the sciences [02:46.140 --> 02:47.860] and the number of men. [02:47.860 --> 02:49.940] We don't have exact transcripts of what he said, [02:49.940 --> 02:53.620] but it was enough to really raise the ire of the academic community [02:53.620 --> 02:56.220] and in some cases, people outside of it. [02:56.220 --> 02:58.360] And so I thought this is really unusual. [02:58.360 --> 02:59.520] What is driving this? [02:59.520 --> 03:00.660] What's happening? [03:00.660 --> 03:02.580] And I thought this must have some importance [03:02.580 --> 03:04.920] not only for women involved in the sciences, [03:04.920 --> 03:08.200] but in computer science, engineering, and hacking. [03:08.200 --> 03:11.100] And I thought this really needs to be addressed. [03:11.260 --> 03:13.340] And so one of the things that I started with [03:13.340 --> 03:19.020] was looking at the number of women involved in academics for computer science. [03:19.460 --> 03:25.140] We know that for a good period of time, from 1984 to 1995, [03:25.140 --> 03:30.040] there was a drop in the number of women who were enrolled in computer science degrees. [03:30.280 --> 03:34.080] Subsequently, after 1995, there's been a bit of an increase, [03:34.080 --> 03:36.080] but it's still relatively small. [03:36.080 --> 03:40.340] It was such a problem that many major universities began doing internal studies [03:40.340 --> 03:43.020] to determine why this decline was happening [03:43.020 --> 03:46.980] at MIT, at Stanford, a couple of different places. [03:46.980 --> 03:49.240] And there was no specific answer found. [03:49.240 --> 03:51.960] When we look at the business world, [03:51.960 --> 03:56.340] one thing that we know is that women have been increasingly involved [03:56.340 --> 03:58.560] in different technical occupations, [03:58.560 --> 04:04.480] but they take place in very low-status, low-income technical occupations. [04:04.480 --> 04:06.840] Women have increased, but they're still underrepresented [04:06.840 --> 04:09.900] in computer science and engineering, etc. [04:09.900 --> 04:15.860] In fact, interestingly, the way that women are dispersed in different occupations, [04:15.860 --> 04:19.460] 99% of all dental hygienists are women. [04:19.460 --> 04:22.780] But 3 out of 10 system analysts are female. [04:22.780 --> 04:26.400] 1 out of every 4 computer programmers are women. [04:26.560 --> 04:28.660] And there's even a gap in pay. [04:28.660 --> 04:34.580] We know that women computer scientists are making 17% less than men, [04:34.580 --> 04:38.620] and female computer programmers are earning 13% less. [04:38.900 --> 04:42.700] And if you look at... this is just a very quick slide. [04:42.700 --> 04:45.600] It gives you a real face of what's going on. [04:45.600 --> 04:52.660] This is a track from 1983 to 2001 for employed computer systems analysts by sex. [04:52.720 --> 04:55.440] The blue is women, the red is men. [04:55.440 --> 04:59.040] So there are definitely more men involved in this occupation. [04:59.720 --> 05:01.900] And I thought, this is really odd. [05:01.900 --> 05:02.980] What is going on? [05:02.980 --> 05:07.740] And when we look at women in the computer underground, or women in hacking, [05:07.740 --> 05:10.220] it's even more apparent that there's a disparity. [05:10.360 --> 05:14.460] Research tells us that the computer underground is dominated by men. [05:14.460 --> 05:19.640] If you're familiar with the work of Bruce Sterling, the author of the Hacker Crackdown, [05:19.640 --> 05:21.220] he made a very telling comment. [05:21.220 --> 05:24.400] He said that hacking is a... let me see if I get this right... [05:24.540 --> 05:28.580] a teenage male voyeur thrill power trip activity. [05:28.660 --> 05:33.160] You don't find female computer intruders any more than you will find female voyeurs [05:33.160 --> 05:36.980] who are obsessed with catching glimpses of men's underwear. [05:37.540 --> 05:40.680] Pretty salacious comments, and you can hear pretty much the same thing [05:40.680 --> 05:43.880] from Gail Thackeray, a very famous prosecutor. [05:43.880 --> 05:47.940] And a few sociologists and criminologists who have looked at this issue [05:47.940 --> 05:52.560] have done so very quickly, and they've made very, very cursory examinations. [05:52.620 --> 05:58.200] Jordan and Taylor in 1998 suggested that the computer underground is male-dominated, [05:58.200 --> 06:02.780] so much so that they consider it an important component of hacker subculture. [06:02.800 --> 06:08.240] A subsequent study by a guy named Thomas suggested that hacking is a boy culture, [06:08.240 --> 06:10.620] which is all about demonstrating mastery, [06:10.620 --> 06:13.880] whether it's of your physical or your social environment. [06:14.240 --> 06:17.300] Now, this is not to suggest that women don't hack at all. [06:17.300 --> 06:19.540] There have been some famous women hackers. [06:19.840 --> 06:24.140] Susan Thunder, Carmen Karasik, if I'm pronouncing that right. [06:24.140 --> 06:27.420] She's been involved in some hacktivism, but that's about it. [06:27.480 --> 06:31.260] Aside from that, we don't really get a lot of news on women in hacking. [06:31.380 --> 06:35.360] The few journalists who have looked at this problem [06:35.360 --> 06:38.740] have suggested that the number of women is increasing, [06:38.740 --> 06:41.480] but they don't give us any sort of hard and fast numbers. [06:41.820 --> 06:46.620] A publication by Ackerman in 2001 said they're more involved in white hat hacking [06:46.620 --> 06:49.900] and security interests, but that's about it. [06:49.940 --> 06:54.280] The few women who actually discuss issues of gender and hacking [06:54.280 --> 06:59.600] have suggested that there's quite a bit of harassment and difficulty that women face. [06:59.600 --> 07:02.460] A researcher by the name of Gil Boa in 1996 [07:02.460 --> 07:06.160] described a great deal of difficulty that she faced. [07:06.160 --> 07:08.880] Sagan suggested that entry-level female hackers [07:08.880 --> 07:11.780] experienced a great deal of harassment. [07:11.780 --> 07:17.940] And a study from Ipsos-Reid suggested that the population of 18 to 24-year-old women [07:17.940 --> 07:24.420] experienced the most heavy experiences of being hit on or harassed while online. [07:24.860 --> 07:31.140] So, generally speaking, we know that women are involved in academic computer science careers, [07:31.140 --> 07:32.760] but it's relatively small. [07:32.760 --> 07:36.840] We know they're in the workforce, but they face some difficulties and some differences. [07:36.900 --> 07:40.040] And we know that they are very, very absent from the underground. [07:40.220 --> 07:43.300] So, why is this? I know I've only got 15 minutes, [07:43.300 --> 07:46.920] but does anybody have an opinion, maybe, as to why there's this disparity? [07:47.780 --> 07:50.000] You in the way back, you've had your hand up for a while. [07:54.630 --> 07:56.830] Yes, this is primarily based on the U.S. [07:57.590 --> 07:58.750] Yes, you, sir. [08:02.660 --> 08:05.420] Okay, the harassment and difficulty. [08:06.240 --> 08:09.200] Okay, good. Anyone else? [08:10.340 --> 08:11.060] Yes? [08:12.160 --> 08:13.760] Men are threatened? [08:14.060 --> 08:16.680] Okay, well. [08:16.680 --> 08:17.860] Yes, ma'am? [08:19.060 --> 08:20.100] Okay. [08:20.100 --> 08:22.940] These are very interesting questions, yes. [08:27.990 --> 08:30.350] Okay. Others? [08:32.170 --> 08:34.410] Okay, well. [08:36.130 --> 08:39.170] Sure, she just said that she's been shunned by other women. [08:39.170 --> 08:41.810] It's not something that women are expected to do. [08:41.810 --> 08:43.250] Would you say that's a pretty good synopsis? [08:43.410 --> 08:44.930] Yes, and then I've got to go. [08:47.690 --> 08:49.650] So, that's why women don't hack. [09:06.020 --> 09:08.540] Okay, so it's easier to harass women online. [09:08.540 --> 09:10.640] Maybe that's part of why women stay out of it. [09:10.640 --> 09:15.700] Well, since I don't have much time, let me skip ahead to some of the theoretical propositions [09:15.700 --> 09:18.180] that have been given by different researchers. [09:18.180 --> 09:22.060] The first is this notion of psychosexual theories. [09:22.060 --> 09:28.320] Essentially, the idea here is that hacking is a way for boys and young men to sublimate others, [09:28.320 --> 09:31.640] to dominate others, and impose their will on them. [09:31.680 --> 09:37.720] And, in a sense, basically, if you can't penetrate another person, why not penetrate a system? [09:37.720 --> 09:39.660] I know that sounds really harsh. [09:39.700 --> 09:45.920] But, an attorney for a hacker named Ehud Tenenbaum, if you're familiar with that guy, [09:45.920 --> 09:49.800] suggested that, in the past, we used to boast about the girls we have. [09:49.800 --> 09:53.500] Nowadays, kids boast about their ability to hack into different systems. [09:53.940 --> 09:59.860] And this notion has been furthered by the stereotype of the socially inept young male hacker. [09:59.860 --> 10:05.260] Someone who can't relate to others, but can get along very, very well with hardware and software. [10:05.260 --> 10:09.680] And this is even furthered by some very esoteric notions about cyberspace, [10:09.680 --> 10:13.700] or the matrix being a womb-like environment, a feminine place. [10:13.700 --> 10:18.100] But it gets a little abstract from there, and it's a little difficult to explain. [10:18.100 --> 10:20.200] So, let me just move on to the next one. [10:20.200 --> 10:22.320] Gender role socialization. [10:22.420 --> 10:25.660] This is something that some of you have already talked about. [10:25.680 --> 10:30.940] It's basically the idea that there are shaping relationships between technology and gender. [10:30.980 --> 10:35.780] Technology has a way of affecting the way that we relate to one another. [10:35.780 --> 10:41.120] The argument here is basically that technology, especially computer technology, [10:41.120 --> 10:43.540] has some very male characteristics. [10:43.840 --> 10:49.420] It requires self-confidence, assertiveness, analytical thinking, very cold logic. [10:49.420 --> 10:53.000] Whereas this is in direct contrast to more feminine traits. [10:53.000 --> 10:56.340] The ideas of nurturing, caring, protection, emotion. [10:56.340 --> 10:58.600] If you're familiar with the work of Sherry Turkle at all, [10:58.600 --> 11:02.040] she talks about hard mastery versus soft mastery. [11:02.040 --> 11:07.900] Hard mastery is the direct imposition of your will on something else through planned attacks. [11:07.900 --> 11:11.840] Whereas soft mastery is more of a free-form kind of interaction, [11:11.840 --> 11:15.400] more something of a conversation than a monologue. [11:15.400 --> 11:18.260] But this is just one sort of argument. [11:18.500 --> 11:22.740] And as a result of these gender role characteristics, [11:22.740 --> 11:26.120] it affects the way that we are pushed into different things. [11:26.120 --> 11:31.160] Because of the way that we view technology, that has a way of keeping women out. [11:31.160 --> 11:36.040] Women who do decide to go into these careers can face a great deal of difficulty. [11:36.040 --> 11:40.620] They might face discrimination, they might face a number of different challenges. [11:40.620 --> 11:45.760] In fact, this is furthered by the notion of cyberspace as a wild west frontier. [11:45.760 --> 11:50.680] If you've read Gibson or Barlow, the discussion of hacking as a place, [11:50.680 --> 11:54.920] or pardon me, cyberspace as a place for the cowboy, the outlaw. [11:54.920 --> 11:59.180] Women don't really have a strong place within cyberspace in that regard. [11:59.180 --> 12:05.360] And another researcher named Susan Herring has suggested that the language of cyberspace is gendered. [12:05.360 --> 12:11.260] It's very male-oriented. It focuses on conflict, on adversarial forms of communication. [12:11.260 --> 12:15.840] And if you don't use these sorts of language, if you don't use these linguistic traits, [12:15.840 --> 12:18.580] then you are not going to be treated in the same way. [12:18.580 --> 12:22.240] You're going to be shunned, you're going to be criticized, or what have you. [12:22.740 --> 12:25.780] And there are also structural arguments that are made. [12:25.780 --> 12:30.720] Essentially, women have not had the same opportunities as men in the workforce. [12:30.720 --> 12:36.560] Women's participation in labor has been based solely on the opportunities made available to them. [12:36.560 --> 12:39.040] For instance, when you think of World War II, [12:39.040 --> 12:43.520] women were needed, well, anyone was needed to fill roles working in factories. [12:43.520 --> 12:47.280] Women took on this role, but once the boys returned back home, [12:47.280 --> 12:52.380] women were expected to go back into the home, become homemakers, what have you. [12:52.440 --> 12:56.700] So, women's roles have been affected by technology, [12:56.700 --> 13:01.200] and structurally, women are not necessarily able to get good-paying jobs. [13:01.200 --> 13:02.940] Their opportunities have been limited, [13:02.940 --> 13:07.100] and it's further affected by being tied back into some of the gender role arguments [13:07.640 --> 13:11.120] that it's hard to advance in your career if you have to raise a family, [13:11.120 --> 13:13.480] if you have to have kids, that kind of thing. [13:13.480 --> 13:14.960] It makes things difficult. [13:15.400 --> 13:18.960] So, these are just some of the theories that have been postulated. [13:19.420 --> 13:20.980] What do you think of them? [13:20.980 --> 13:24.680] Do any of these make sense? Do they jive with your personal experiences? [13:24.680 --> 13:25.380] Yes, sir. [13:47.890 --> 13:48.690] Okay. [13:51.560 --> 13:53.820] So, because of the ubiquity of technology, [13:53.820 --> 13:56.500] these structural arguments don't really make much sense anymore. [13:57.400 --> 13:58.780] Okay. You, sir. [14:41.180 --> 14:41.800] Okay. [14:41.800 --> 14:44.060] So, the differences in how we deal with boys and girls [14:44.060 --> 14:46.700] who are sort of maybe socially awkward is different, [14:46.700 --> 14:50.240] and that might drive the reason why men are involved in it more disproportionately. [14:50.620 --> 14:51.760] Does that sum it up pretty well? [14:51.760 --> 14:52.580] Okay. You, ma'am. [15:09.220 --> 15:09.960] Okay. [15:09.960 --> 15:12.580] So, you think that these gender role issues are very important, [15:12.580 --> 15:15.400] that we don't necessarily give it to girls. [15:22.730 --> 15:23.290] Okay. [15:23.290 --> 15:26.390] So, then you've had some very, very personal experiences with it. [15:26.390 --> 15:26.950] Okay. [15:27.350 --> 15:28.730] You, sir, over there with glasses. [15:55.740 --> 15:56.580] Okay. [15:57.300 --> 16:00.020] So, the way that computer science programs are set up [16:00.020 --> 16:01.700] are also sort of structured [16:01.700 --> 16:05.280] because we don't push women into math and that sort of thing at an early age. [16:05.280 --> 16:08.420] Maybe that's going to keep them from getting involved in the academic portion of it. [16:08.420 --> 16:09.640] You, ma'am, in the black shirt. [16:58.890 --> 17:01.170] Okay. So, women have not only had as much time, [17:01.170 --> 17:03.210] but there's a different attitude, perhaps, as well. [17:03.470 --> 17:03.950] Okay. [17:03.950 --> 17:05.150] You, sir, and then I've got to end. [17:41.550 --> 17:42.150] Okay. [17:42.750 --> 17:44.810] So, even in a whole other country in France [17:44.810 --> 17:48.330] that there's experience that's available to both men and women, [17:48.330 --> 17:50.890] but by the time they hit the university age, things change. [17:50.910 --> 17:54.350] So, again, it might have something to do with the gender socialization. [17:54.670 --> 17:58.530] Well, I don't have a very specific answer as to which one of these explains it best. [17:58.530 --> 18:00.930] And to be personally very frank with you, [18:00.930 --> 18:04.990] we need good research that's going to examine the female hacker's perspective. [18:04.990 --> 18:06.470] We don't really have it yet. [18:06.470 --> 18:08.830] People haven't focused on it very heavily. [18:08.930 --> 18:12.350] And to that end, what we're going to need is good research. [18:12.350 --> 18:16.950] And one of the best ways to do this sort of research is qualitative research. [18:16.970 --> 18:20.690] Qualitative research from an academic standpoint involves interviews, [18:20.690 --> 18:22.190] asking very open-ended questions [18:22.190 --> 18:26.350] and allowing the person to describe what their experiences have been, [18:26.350 --> 18:29.650] why they've been through the things that they've been through, [18:29.650 --> 18:32.530] why they've experienced it, and what their rationalizations are [18:32.530 --> 18:35.250] for why things work the way that they do. [18:35.510 --> 18:39.150] And what I'd like to do, one thing that I'm currently performing, [18:39.150 --> 18:41.990] is a research project examining female hackers. [18:41.990 --> 18:44.150] I've got a good sample of men going, [18:44.150 --> 18:46.590] and what I'd like to do is augment that with women [18:46.590 --> 18:50.450] to really get at this issue of gender and hacking, [18:50.450 --> 18:52.510] because we don't, frankly, have it. [18:52.610 --> 18:55.470] What I'm doing currently is performing interviews. [18:55.470 --> 18:58.250] They can be done via email, by phone, or in person, [18:58.250 --> 19:01.950] depending upon if you're in the Charlotte or North Carolina area, [19:01.950 --> 19:03.730] which many of you probably are not. [19:04.230 --> 19:06.290] And it's a very simple sort of thing. [19:06.290 --> 19:08.330] I ask very open-ended questions. [19:08.330 --> 19:10.650] You can be as frank about it as you want. [19:10.770 --> 19:15.770] And it allows you to tell me a great deal about your own personal experiences with hacking. [19:15.830 --> 19:18.290] It takes less than 90 minutes, regardless of how you do it, [19:18.290 --> 19:21.290] unless you're very long-winded, unless you have a lot to say, [19:21.290 --> 19:23.430] or unless you're a very slow typist. [19:23.430 --> 19:25.210] So it kind of depends upon you. [19:25.730 --> 19:30.010] And it allows you to talk about a subject you may not otherwise be able to talk about. [19:30.010 --> 19:32.450] If you're in a forum and you don't like to admit to people, [19:32.450 --> 19:36.150] yes, I am a woman, because maybe you're afraid that it might affect you in a different way. [19:36.150 --> 19:40.130] Or if you just really want to find somebody to brag to about all that you've done, [19:40.130 --> 19:43.010] then great, you've got the opportunity through me. [19:43.370 --> 19:46.870] And since this is a university research project, [19:46.870 --> 19:49.290] there are very intensive protections that are available. [19:49.290 --> 19:52.850] If you've looked at the DEFCON disk at all for this presentation, [19:52.850 --> 19:58.390] you can see the institutional review board protections that I have to provide to you by law. [19:58.390 --> 20:01.030] And if I violate it, then it's my butt on the line. [20:01.190 --> 20:05.090] Basically what that means is I don't collect any identifying information about you. [20:05.090 --> 20:07.670] I don't want to know what your name is. I don't want your phone number. [20:07.670 --> 20:10.530] The only thing I want to know is, are you a man? Are you a woman? [20:10.530 --> 20:12.130] How old are you? And that's it. [20:12.250 --> 20:14.870] So there are other protections I can talk about. [20:14.870 --> 20:17.470] One last thing to mention, there are benefits if you do this. [20:17.470 --> 20:19.450] I don't have big money, so it's $10. [20:19.450 --> 20:24.290] If you complete a survey, and it's $10, you can refer someone to me who can complete one. [20:24.290 --> 20:26.390] This is my contact information. [20:26.430 --> 20:30.490] I'm using a very simple email address for this, genderandhackingatyahoo.com, [20:30.490 --> 20:31.490] or you can call me. [20:31.490 --> 20:36.130] If you're interested in participating, if you think you know someone who would be, pass it along. [20:36.130 --> 20:39.970] Because I would love to be able to provide you all with some information. [20:39.970 --> 20:43.810] Maybe advance our understanding of what's going on at a theoretical level. [20:43.810 --> 20:46.090] So I've got to go. Thank you.