WEBVTT 00:03.380 --> 00:05.500 Announcement and then we'll get the talk underway. 00:06.620 --> 00:10.160 The tent has been running an hour late. 00:10.160 --> 00:13.300 It is now only running a half hour late. 00:13.320 --> 00:16.600 Again, the tent is now only one half hour late. 00:16.600 --> 00:17.300 Thanks. 00:23.140 --> 00:26.380 The tent is running a half an hour late. 00:26.380 --> 00:29.680 They were an hour behind, but they have picked it up to a half an hour. 00:31.280 --> 00:32.980 So, there you go. 00:33.400 --> 00:36.660 Alright, I'm supposed to get going because we're a little pressed for time. 00:36.660 --> 00:38.700 So, good afternoon to all of you. 00:38.720 --> 00:42.640 My name is Thomas Holt and I'm from the University of North Carolina, Charlotte. 00:42.820 --> 00:53.120 I'm a criminologist by trade and my research focuses primarily on computer crime just generally and computer hacking specifically. 00:53.120 --> 01:01.540 I've spent the better part of the last three years examining the hacker subculture, hacker social organization, and I've tried to get at it in a number of different ways. 01:01.540 --> 01:11.960 I've been interviewing active hackers, I've been looking at web forums, I've been at DEF CON, and one of the things that's really surprised me in all of my research is the relative lack of women. 01:12.100 --> 01:14.740 None of the people that I've interviewed have been female. 01:14.940 --> 01:20.640 Coming to DEF CON, it was apparent there's some sort of a disparity at least in terms of the population differences. 01:20.700 --> 01:26.060 And looking at web forums really, really struck me because there were very few admitted women. 01:26.560 --> 01:32.340 And in looking at one of the largest forums in the data sample I had assembled, I saw this passage. 01:32.340 --> 01:34.060 Now, this is just an excerpt from it. 01:34.840 --> 01:38.820 Sure, this is just an excerpt from a forum that I was looking at. 01:39.320 --> 01:43.060 And some of the names have been changed. 01:43.060 --> 01:45.640 But as you read through it, you can see some interesting things. 01:45.640 --> 01:50.340 The first person asks, How many of you have met any girls who are hackers? 01:50.340 --> 01:53.860 I've never seen some girl who knows a lot about computers and hacking. 01:53.860 --> 01:56.100 Are there any girls who do this? 01:56.100 --> 01:59.460 And the responses don't really suggest there are a lot of them. 01:59.460 --> 02:02.660 Jiggle Billy says, Unfortunately, I've not met any hacker chicks. 02:02.660 --> 02:05.020 The only ones I know about exist in the movies. 02:05.080 --> 02:11.620 The last one there, Goblocks, I am a female hacker and I know a few other female hackers. 02:11.620 --> 02:12.720 That's really it. 02:12.720 --> 02:13.780 That was pretty common. 02:13.780 --> 02:16.860 I only saw a handful of women maybe at most. 02:16.860 --> 02:20.760 And I was looking at six web forums of a variety of populations. 02:20.900 --> 02:22.320 And I thought this is really curious. 02:22.320 --> 02:24.600 Why aren't there women involved in this? 02:24.620 --> 02:28.140 And I thought there must be something more substantial going on. 02:28.140 --> 02:34.000 My interest was even more peaked when some comments were made recently by the president of Harvard. 02:34.000 --> 02:34.640 Lawrence H. 02:34.640 --> 02:47.860 Summers made some comments regarding women in the sciences and suggested that there are genetic differences and some social factors that drive a wedge between the number of women involved in the sciences and the number of men. 02:47.860 --> 02:56.220 We don't have exact transcripts of what he said, but it was enough to really raise the ire of the academic community and in some cases, people outside of it. 02:56.220 --> 02:58.360 And so I thought this is really unusual. 02:58.360 --> 02:59.520 What is driving this? 02:59.520 --> 03:00.660 What's happening? 03:00.660 --> 03:08.200 And I thought this must have some importance not only for women involved in the sciences, but in computer science, engineering, and hacking. 03:08.200 --> 03:11.100 And I thought this really needs to be addressed. 03:11.260 --> 03:19.020 And so one of the things that I started with was looking at the number of women involved in academics for computer science. 03:19.460 --> 03:30.040 We know that for a good period of time, from 1984 to 1995, there was a drop in the number of women who were enrolled in computer science degrees. 03:30.280 --> 03:36.080 Subsequently, after 1995, there's been a bit of an increase, but it's still relatively small. 03:36.080 --> 03:46.980 It was such a problem that many major universities began doing internal studies to determine why this decline was happening at MIT, at Stanford, a couple of different places. 03:46.980 --> 03:49.240 And there was no specific answer found. 03:49.240 --> 04:04.480 When we look at the business world, one thing that we know is that women have been increasingly involved in different technical occupations, but they take place in very low-status, low-income technical occupations. 04:04.480 --> 04:09.900 Women have increased, but they're still underrepresented in computer science and engineering, etc. 04:09.900 --> 04:19.460 In fact, interestingly, the way that women are dispersed in different occupations, 99% of all dental hygienists are women. 04:19.460 --> 04:22.780 But 3 out of 10 system analysts are female. 04:22.780 --> 04:26.400 1 out of every 4 computer programmers are women. 04:26.560 --> 04:28.660 And there's even a gap in pay. 04:28.660 --> 04:38.620 We know that women computer scientists are making 17% less than men, and female computer programmers are earning 13% less. 04:38.900 --> 04:42.700 And if you look at... this is just a very quick slide. 04:42.700 --> 04:45.600 It gives you a real face of what's going on. 04:45.600 --> 04:52.660 This is a track from 1983 to 2001 for employed computer systems analysts by sex. 04:52.720 --> 04:55.440 The blue is women, the red is men. 04:55.440 --> 04:59.040 So there are definitely more men involved in this occupation. 04:59.720 --> 05:01.900 And I thought, this is really odd. 05:01.900 --> 05:02.980 What is going on? 05:02.980 --> 05:10.220 And when we look at women in the computer underground, or women in hacking, it's even more apparent that there's a disparity. 05:10.360 --> 05:14.460 Research tells us that the computer underground is dominated by men. 05:14.460 --> 05:21.220 If you're familiar with the work of Bruce Sterling, the author of the Hacker Crackdown, he made a very telling comment. 05:21.220 --> 05:24.400 He said that hacking is a... let me see if I get this right... 05:24.540 --> 05:28.580 a teenage male voyeur thrill power trip activity. 05:28.660 --> 05:36.980 You don't find female computer intruders any more than you will find female voyeurs who are obsessed with catching glimpses of men's underwear. 05:37.540 --> 05:43.880 Pretty salacious comments, and you can hear pretty much the same thing from Gail Thackeray, a very famous prosecutor. 05:43.880 --> 05:52.560 And a few sociologists and criminologists who have looked at this issue have done so very quickly, and they've made very, very cursory examinations. 05:52.620 --> 06:02.780 Jordan and Taylor in 1998 suggested that the computer underground is male-dominated, so much so that they consider it an important component of hacker subculture. 06:02.800 --> 06:13.880 A subsequent study by a guy named Thomas suggested that hacking is a boy culture, which is all about demonstrating mastery, whether it's of your physical or your social environment. 06:14.240 --> 06:17.300 Now, this is not to suggest that women don't hack at all. 06:17.300 --> 06:19.540 There have been some famous women hackers. 06:19.840 --> 06:24.140 Susan Thunder, Carmen Karasik, if I'm pronouncing that right. 06:24.140 --> 06:27.420 She's been involved in some hacktivism, but that's about it. 06:27.480 --> 06:31.260 Aside from that, we don't really get a lot of news on women in hacking. 06:31.380 --> 06:41.480 The few journalists who have looked at this problem have suggested that the number of women is increasing, but they don't give us any sort of hard and fast numbers. 06:41.820 --> 06:49.900 A publication by Ackerman in 2001 said they're more involved in white hat hacking and security interests, but that's about it. 06:49.940 --> 06:59.600 The few women who actually discuss issues of gender and hacking have suggested that there's quite a bit of harassment and difficulty that women face. 06:59.600 --> 07:06.160 A researcher by the name of Gil Boa in 1996 described a great deal of difficulty that she faced. 07:06.160 --> 07:11.780 Sagan suggested that entry-level female hackers experienced a great deal of harassment. 07:11.780 --> 07:24.420 And a study from Ipsos-Reid suggested that the population of 18 to 24-year-old women experienced the most heavy experiences of being hit on or harassed while online. 07:24.860 --> 07:32.760 So, generally speaking, we know that women are involved in academic computer science careers, but it's relatively small. 07:32.760 --> 07:36.840 We know they're in the workforce, but they face some difficulties and some differences. 07:36.900 --> 07:40.040 And we know that they are very, very absent from the underground. 07:40.220 --> 07:41.660 So, why is this? 07:41.660 --> 07:46.920 I know I've only got 15 minutes, but does anybody have an opinion, maybe, as to why there's this disparity? 07:47.780 --> 07:50.000 You in the way back, you've had your hand up for a while. 07:54.630 --> 07:56.830 Yes, this is primarily based on the U.S. 07:57.590 --> 07:58.750 Yes, you, sir. 08:02.660 --> 08:05.420 Okay, the harassment and difficulty. 08:06.240 --> 08:07.980 Okay, good. 08:07.980 --> 08:09.200 Anyone else? 08:10.340 --> 08:11.060 Yes? 08:12.160 --> 08:13.760 Men are threatened? 08:14.060 --> 08:16.680 Okay, well. 08:16.680 --> 08:17.860 Yes, ma'am? 08:19.060 --> 08:20.100 Okay. 08:20.100 --> 08:22.940 These are very interesting questions, yes. 08:27.990 --> 08:29.090 Okay. 08:29.250 --> 08:30.350 Others? 08:32.170 --> 08:34.410 Okay, well. 08:36.130 --> 08:39.170 Sure, she just said that she's been shunned by other women. 08:39.170 --> 08:41.810 It's not something that women are expected to do. 08:41.810 --> 08:43.250 Would you say that's a pretty good synopsis? 08:43.410 --> 08:44.930 Yes, and then I've got to go. 08:47.690 --> 08:49.650 So, that's why women don't hack. 09:06.020 --> 09:08.540 Okay, so it's easier to harass women online. 09:08.540 --> 09:10.640 Maybe that's part of why women stay out of it. 09:10.640 --> 09:18.180 Well, since I don't have much time, let me skip ahead to some of the theoretical propositions that have been given by different researchers. 09:18.180 --> 09:22.060 The first is this notion of psychosexual theories. 09:22.060 --> 09:31.640 Essentially, the idea here is that hacking is a way for boys and young men to sublimate others, to dominate others, and impose their will on them. 09:31.680 --> 09:37.720 And, in a sense, basically, if you can't penetrate another person, why not penetrate a system? 09:37.720 --> 09:39.660 I know that sounds really harsh. 09:39.700 --> 09:49.800 But, an attorney for a hacker named Ehud Tenenbaum, if you're familiar with that guy, suggested that, in the past, we used to boast about the girls we have. 09:49.800 --> 09:53.500 Nowadays, kids boast about their ability to hack into different systems. 09:53.940 --> 09:59.860 And this notion has been furthered by the stereotype of the socially inept young male hacker. 09:59.860 --> 10:05.260 Someone who can't relate to others, but can get along very, very well with hardware and software. 10:05.260 --> 10:13.700 And this is even furthered by some very esoteric notions about cyberspace, or the matrix being a womb-like environment, a feminine place. 10:13.700 --> 10:18.100 But it gets a little abstract from there, and it's a little difficult to explain. 10:18.100 --> 10:20.200 So, let me just move on to the next one. 10:20.200 --> 10:22.320 Gender role socialization. 10:22.420 --> 10:25.660 This is something that some of you have already talked about. 10:25.680 --> 10:30.940 It's basically the idea that there are shaping relationships between technology and gender. 10:30.980 --> 10:35.780 Technology has a way of affecting the way that we relate to one another. 10:35.780 --> 10:43.540 The argument here is basically that technology, especially computer technology, has some very male characteristics. 10:43.840 --> 10:49.420 It requires self-confidence, assertiveness, analytical thinking, very cold logic. 10:49.420 --> 10:53.000 Whereas this is in direct contrast to more feminine traits. 10:53.000 --> 10:56.340 The ideas of nurturing, caring, protection, emotion. 10:56.340 --> 11:02.040 If you're familiar with the work of Sherry Turkle at all, she talks about hard mastery versus soft mastery. 11:02.040 --> 11:07.900 Hard mastery is the direct imposition of your will on something else through planned attacks. 11:07.900 --> 11:15.400 Whereas soft mastery is more of a free-form kind of interaction, more something of a conversation than a monologue. 11:15.400 --> 11:18.260 But this is just one sort of argument. 11:18.500 --> 11:26.120 And as a result of these gender role characteristics, it affects the way that we are pushed into different things. 11:26.120 --> 11:31.160 Because of the way that we view technology, that has a way of keeping women out. 11:31.160 --> 11:36.040 Women who do decide to go into these careers can face a great deal of difficulty. 11:36.040 --> 11:40.620 They might face discrimination, they might face a number of different challenges. 11:40.620 --> 11:45.760 In fact, this is furthered by the notion of cyberspace as a wild west frontier. 11:45.760 --> 11:54.920 If you've read Gibson or Barlow, the discussion of hacking as a place, or pardon me, cyberspace as a place for the cowboy, the outlaw. 11:54.920 --> 11:59.180 Women don't really have a strong place within cyberspace in that regard. 11:59.180 --> 12:05.360 And another researcher named Susan Herring has suggested that the language of cyberspace is gendered. 12:05.360 --> 12:06.980 It's very male-oriented. 12:06.980 --> 12:11.260 It focuses on conflict, on adversarial forms of communication. 12:11.260 --> 12:18.580 And if you don't use these sorts of language, if you don't use these linguistic traits, then you are not going to be treated in the same way. 12:18.580 --> 12:22.240 You're going to be shunned, you're going to be criticized, or what have you. 12:22.740 --> 12:25.780 And there are also structural arguments that are made. 12:25.780 --> 12:30.720 Essentially, women have not had the same opportunities as men in the workforce. 12:30.720 --> 12:36.560 Women's participation in labor has been based solely on the opportunities made available to them. 12:36.560 --> 12:43.520 For instance, when you think of World War II, women were needed, well, anyone was needed to fill roles working in factories. 12:43.520 --> 12:52.380 Women took on this role, but once the boys returned back home, women were expected to go back into the home, become homemakers, what have you. 12:52.440 --> 13:01.200 So, women's roles have been affected by technology, and structurally, women are not necessarily able to get good-paying jobs. 13:01.200 --> 13:13.480 Their opportunities have been limited, and it's further affected by being tied back into some of the gender role arguments that it's hard to advance in your career if you have to raise a family, if you have to have kids, that kind of thing. 13:13.480 --> 13:14.960 It makes things difficult. 13:15.400 --> 13:18.960 So, these are just some of the theories that have been postulated. 13:19.420 --> 13:20.980 What do you think of them? 13:20.980 --> 13:22.760 Do any of these make sense? 13:22.760 --> 13:24.680 Do they jive with your personal experiences? 13:24.680 --> 13:25.380 Yes, sir. 13:47.890 --> 13:48.690 Okay. 13:51.560 --> 13:56.500 So, because of the ubiquity of technology, these structural arguments don't really make much sense anymore. 13:57.400 --> 13:58.040 Okay. 13:58.040 --> 13:58.780 You, sir. 14:41.180 --> 14:41.800 Okay. 14:41.800 --> 14:50.240 So, the differences in how we deal with boys and girls who are sort of maybe socially awkward is different, and that might drive the reason why men are involved in it more disproportionately. 14:50.620 --> 14:51.760 Does that sum it up pretty well? 14:51.760 --> 14:51.920 Okay. 14:51.920 --> 14:52.580 You, ma'am. 15:09.220 --> 15:09.960 Okay. 15:09.960 --> 15:15.400 So, you think that these gender role issues are very important, that we don't necessarily give it to girls. 15:22.730 --> 15:23.290 Okay. 15:23.290 --> 15:26.390 So, then you've had some very, very personal experiences with it. 15:26.390 --> 15:26.950 Okay. 15:27.350 --> 15:28.730 You, sir, over there with glasses. 15:55.740 --> 15:56.580 Okay. 15:57.300 --> 16:05.280 So, the way that computer science programs are set up are also sort of structured because we don't push women into math and that sort of thing at an early age. 16:05.280 --> 16:08.420 Maybe that's going to keep them from getting involved in the academic portion of it. 16:08.420 --> 16:09.640 You, ma'am, in the black shirt. 16:58.890 --> 16:59.370 Okay. 16:59.370 --> 17:03.210 So, women have not only had as much time, but there's a different attitude, perhaps, as well. 17:03.470 --> 17:03.950 Okay. 17:03.950 --> 17:05.150 You, sir, and then I've got to end. 17:41.550 --> 17:42.150 Okay. 17:42.750 --> 17:50.890 So, even in a whole other country in France that there's experience that's available to both men and women, but by the time they hit the university age, things change. 17:50.910 --> 17:54.350 So, again, it might have something to do with the gender socialization. 17:54.670 --> 17:58.530 Well, I don't have a very specific answer as to which one of these explains it best. 17:58.530 --> 18:04.990 And to be personally very frank with you, we need good research that's going to examine the female hacker's perspective. 18:04.990 --> 18:06.470 We don't really have it yet. 18:06.470 --> 18:08.830 People haven't focused on it very heavily. 18:08.930 --> 18:12.350 And to that end, what we're going to need is good research. 18:12.350 --> 18:16.950 And one of the best ways to do this sort of research is qualitative research. 18:16.970 --> 18:30.770 Qualitative research from an academic standpoint involves interviews, asking very open-ended questions and allowing the person to describe what their experiences have been, why they've been through the things that they've been through, why they've experienced it, 18:30.770 --> 18:35.250 and what their rationalizations are for why things work the way that they do. 18:35.510 --> 18:41.990 And what I'd like to do, one thing that I'm currently performing, is a research project examining female hackers. 18:41.990 --> 18:52.510 I've got a good sample of men going, and what I'd like to do is augment that with women to really get at this issue of gender and hacking, because we don't, frankly, have it. 18:52.610 --> 18:55.470 What I'm doing currently is performing interviews. 18:55.470 --> 19:03.730 They can be done via email, by phone, or in person, depending upon if you're in the Charlotte or North Carolina area, which many of you probably are not. 19:04.230 --> 19:06.290 And it's a very simple sort of thing. 19:06.290 --> 19:08.330 I ask very open-ended questions. 19:08.330 --> 19:10.650 You can be as frank about it as you want. 19:10.770 --> 19:15.770 And it allows you to tell me a great deal about your own personal experiences with hacking. 19:15.830 --> 19:23.430 It takes less than 90 minutes, regardless of how you do it, unless you're very long-winded, unless you have a lot to say, or unless you're a very slow typist. 19:23.430 --> 19:25.210 So it kind of depends upon you. 19:25.730 --> 19:30.010 And it allows you to talk about a subject you may not otherwise be able to talk about. 19:30.010 --> 19:36.150 If you're in a forum and you don't like to admit to people, yes, I am a woman, because maybe you're afraid that it might affect you in a different way. 19:36.150 --> 19:43.010 Or if you just really want to find somebody to brag to about all that you've done, then great, you've got the opportunity through me. 19:43.370 --> 19:49.290 And since this is a university research project, there are very intensive protections that are available. 19:49.290 --> 19:58.390 If you've looked at the DEFCON disk at all for this presentation, you can see the institutional review board protections that I have to provide to you by law. 19:58.390 --> 20:01.030 And if I violate it, then it's my butt on the line. 20:01.190 --> 20:05.090 Basically what that means is I don't collect any identifying information about you. 20:05.090 --> 20:06.550 I don't want to know what your name is. 20:06.550 --> 20:07.670 I don't want your phone number. 20:07.670 --> 20:09.590 The only thing I want to know is, are you a man? 20:09.590 --> 20:10.530 Are you a woman? 20:10.530 --> 20:11.250 How old are you? 20:11.250 --> 20:12.130 And that's it. 20:12.250 --> 20:14.870 So there are other protections I can talk about. 20:14.870 --> 20:17.470 One last thing to mention, there are benefits if you do this. 20:17.470 --> 20:19.450 I don't have big money, so it's $10. 20:19.450 --> 20:24.290 If you complete a survey, and it's $10, you can refer someone to me who can complete one. 20:24.290 --> 20:26.390 This is my contact information. 20:26.430 --> 20:31.490 I'm using a very simple email address for this, genderandhackingatyahoo.com, or you can call me. 20:31.490 --> 20:36.130 If you're interested in participating, if you think you know someone who would be, pass it along. 20:36.130 --> 20:39.970 Because I would love to be able to provide you all with some information. 20:39.970 --> 20:43.810 Maybe advance our understanding of what's going on at a theoretical level. 20:43.810 --> 20:45.270 So I've got to go. 20:45.270 --> 20:46.090 Thank you.