1
00:00:00,000 --> 00:00:08,380
We're going to give our attention to Helen Thackray. She's not Australian. She's a Ph.D.

2
00:00:08,400 --> 00:00:13,280
student from Bournemouth University in the U.K. and she finds humans and computers

3
00:00:13,280 --> 00:00:17,860
fascinating. She'll now attempt to explain some of the psychological group factors behind why

4
00:00:17,860 --> 00:00:23,200
hackers are always going to hack. Her theme is hackers going to hack, but do they know why?

5
00:00:23,200 --> 00:00:24,000
Let's give her attention.

6
00:00:30,340 --> 00:00:36,780
Hello. Yeah, I'm very definitely English if the accent doesn't give it away for you.

7
00:00:37,180 --> 00:00:40,900
I just wanted to say when I found out in the schedule that I was following Chris, I was

8
00:00:40,900 --> 00:00:46,320
slightly nervous and then following that, good lord, but I just wanted to say that's

9
00:00:46,320 --> 00:00:50,520
an amazing project and I just want to give another round of applause for it because I

10
00:00:50,520 --> 00:00:51,660
think it's such a worthwhile course.

11
00:00:56,960 --> 00:01:03,280
So on to a much lighter topic. Hackers going to hack. Obviously you guys have some

12
00:01:03,280 --> 00:01:07,180
vague interest in this, otherwise you wouldn't be at DEF CON. I have to say this is slightly

13
00:01:07,180 --> 00:01:12,440
surreal for me because last year I was here, it was my first DEF CON, came to the social

14
00:01:12,440 --> 00:01:18,260
engineering village and it just blew me away. It was awesome. And I really love the

15
00:01:18,260 --> 00:01:23,180
emphasis on education, helping people and coming here today and listening to the

16
00:01:23,180 --> 00:01:27,620
talk. Again, it just emphasizes what I do in part of my research, which is looking

17
00:01:27,620 --> 00:01:32,240
at the other side of hacking. Not just the stereotypes, the black hats, the cyber criminals,

18
00:01:32,520 --> 00:01:39,540
but looking at what hackers can do that people don't realize what goes on behind the scenes.

19
00:01:40,440 --> 00:01:45,900
So yeah, my name is Helen Thackray. I'm from Bournemouth University. I've got my main supervisor

20
00:01:45,900 --> 00:01:52,080
John McElhaney in the audience. If you speak to him, he's a lovely, softly-spoken Scottish

21
00:01:52,080 --> 00:01:59,860
man. Sometimes I don't always understand what he's saying. But we muddle through. So just

22
00:01:59,860 --> 00:02:07,240
briefly about me because I'm pretty sure no one's heard of me. I'm a PhD student. I'm at the

23
00:02:07,240 --> 00:02:11,440
end of my second year of research. I've got funding for another year and I hope to finish in

24
00:02:11,440 --> 00:02:17,640
that time because otherwise it's going to get really expensive. I'm from a small, well, I'm

25
00:02:17,640 --> 00:02:22,060
not from, but I study at a small town on the southern coast called Dunedin. It's a small town

26
00:02:22,080 --> 00:02:28,920
called Bournemouth. I drew a red arrow to help you. It's not particularly exciting but the

27
00:02:28,920 --> 00:02:34,000
university makes up for it. If you don't like the C word, cover your ears because I'm in the

28
00:02:34,000 --> 00:02:39,900
field of cyber psychology. I didn't name it. It's not my fault. I also work with cyber

29
00:02:39,900 --> 00:02:45,920
security. So I'm in psychology and computing. Brief shout out to the cyber security research

30
00:02:45,920 --> 00:02:52,060
group headed by Dr. Shemelle Faley who helped with funding for this. Other than that, I'm a

31
00:02:52,060 --> 00:02:57,020
student. I've got no external connections or funding. It's the university funding this

32
00:02:57,020 --> 00:03:07,320
project. So just quickly, I realized I was quite flippant in my bio on the SEO, the social

33
00:03:07,320 --> 00:03:12,160
engineering website. Everyone else was listing all their qualifications and years of

34
00:03:12,160 --> 00:03:16,740
experience and I made a joke about the fact that the university pays me to go on the

35
00:03:16,740 --> 00:03:22,040
internet. I do have a bit of an odd background. I'm very much the social science and human

36
00:03:22,040 --> 00:03:27,840
humanities. My first degree was joint in Italian and politics. The Italian didn't stick so

37
00:03:27,840 --> 00:03:33,500
much but the politics, I got really into political identity, social identity, why people choose

38
00:03:33,500 --> 00:03:41,760
the politics they do, what unites political parties and the whole personality of it. So with

39
00:03:41,760 --> 00:03:46,580
political parties, there's a lot about the identity of the leader, how they present

40
00:03:46,580 --> 00:03:51,540
themselves and I thought that was really interesting. From that, I moved into contemporary

41
00:03:52,040 --> 00:03:58,220
identity and sociology and on a slightly different note, I looked at identity in cancer

42
00:03:58,220 --> 00:04:05,120
patients because you can exist, you have your whole self, you define yourself and then

43
00:04:05,120 --> 00:04:10,660
suddenly you get a diagnosis which completely changes your world. And how do you deal with

44
00:04:10,660 --> 00:04:15,140
that? How do you deal with people treating you differently? And that was really fascinating.

45
00:04:15,400 --> 00:04:21,580
I had some wonderful participants. But it led me to still enjoy social identity and

46
00:04:21,580 --> 00:04:22,020
what it is to be a social scientist. I think it's really fascinating. I think it's really

47
00:04:22,020 --> 00:04:26,940
interesting that people believe makes them them, how they choose, what they choose, what

48
00:04:26,940 --> 00:04:34,140
they do if they can't choose. So how that came about to me studying the Internet or

49
00:04:34,140 --> 00:04:40,140
people on the Internet, I have always been a very curious child. My mother told me the

50
00:04:40,140 --> 00:04:47,880
story when I was about five, coming back from school, kindergarten. There was a house, a

51
00:04:47,880 --> 00:04:51,900
door was open to a house on the street that we were walking down and I decided I wanted

52
00:04:51,900 --> 00:04:55,860
to go in it. And my mother said, well, you can't just go into people's houses. And I said, but,

53
00:04:55,900 --> 00:05:01,020
mom, I'm a very rude and nosy child. I'm going in. And to five-year-old me, that was perfect logic.

54
00:05:02,000 --> 00:05:06,100
I've become less rude about it, but I'm still incredibly nosy. I want to know the answers to

55
00:05:06,100 --> 00:05:11,020
things. I also quite like watching people from a safe distance, which sociology, Internet

56
00:05:11,020 --> 00:05:18,360
research, perfect. Also, I really like lurking on online forums. It's a terrible habit. I've been

57
00:05:18,360 --> 00:05:21,880
doing it since I was about 13. Weirdly, I've been doing it for a long time. I've been doing it for a

58
00:05:21,880 --> 00:05:26,400
long time. On an air gun forum was where I started. And if anyone here is British, you will

59
00:05:26,400 --> 00:05:32,800
know how peculiar that is. The UK has very strict gun laws. Air rifles are allowed for hunting,

60
00:05:32,980 --> 00:05:39,860
pest control, and target practice. As a 12-year-old vegetarian who loved her pet rabbit, I

61
00:05:39,860 --> 00:05:44,680
did not have a lot in common with the people on the air gun site. But I had a neighbor who got

62
00:05:44,680 --> 00:05:49,780
into it. There were jokes going on. Someone had stolen his team mascot and was sending photos,

63
00:05:49,960 --> 00:05:51,520
sending it around the world. It was hilarious.

64
00:05:51,880 --> 00:05:57,500
And I loved it, the joke, the in-jokes. So I started hanging out on this air gun forum, obviously

65
00:05:57,500 --> 00:06:02,760
not talking about air guns ever. But I loved getting to know the characters, the people, the

66
00:06:02,760 --> 00:06:08,000
in-jokes, how they talked about representing themselves as a whole. And without actually

67
00:06:08,000 --> 00:06:13,260
realizing it, I was doing sort of ethnographic research on this community. I was sitting there

68
00:06:13,260 --> 00:06:18,960
reading about them, learning about them. And to be honest, ever since, I've been finding online

69
00:06:18,960 --> 00:06:21,620
communities to do the same things to. I'm kind of creepy.

70
00:06:23,580 --> 00:06:30,280
So my talk today, basically, I'm going to talk about a little bit about social psychology, social

71
00:06:30,280 --> 00:06:38,260
identity. And then I'm going to look more at group processes. So everyone knows that you act in a

72
00:06:38,260 --> 00:06:43,220
certain way depending on who you're around. Like if you're with your mother or your father, maybe

73
00:06:43,220 --> 00:06:47,720
you swear less than you would with your friends. If you're with your partner, you'll be a little

74
00:06:47,720 --> 00:06:50,160
bit more sensitive than you would with maybe your brother.

75
00:06:52,180 --> 00:06:59,780
It all depends. So basically social psychology boils down to all human behavior is influenced by the

76
00:06:59,780 --> 00:07:04,940
presence of others, either whether it's real or imagined. So for example, standing in a lift by

77
00:07:04,940 --> 00:07:10,320
yourself, you might act completely as you want to. You could fart, pick your nose, whatever. Then

78
00:07:10,320 --> 00:07:15,920
you remember that there's a security camera in the top corner. And then you think, ah, someone will

79
00:07:15,920 --> 00:07:20,100
have seen that. You will modify your behavior because you think someone will be able to watch me.

80
00:07:20,900 --> 00:07:21,860
And then you think, ah, someone will have seen that. You will modify your behavior because you think someone will be able to watch me.

81
00:07:21,880 --> 00:07:30,860
And I think one thing that gets forgotten is that when it comes to infosec and cybersecurity, is that this is all

82
00:07:30,860 --> 00:07:36,060
coming from behavioral actions. There is always a wider social context. It doesn't matter what end of

83
00:07:36,060 --> 00:07:44,560
the line you are, there are always people behind the computers. And people are fallible. And open to

84
00:07:44,560 --> 00:07:49,920
influence. So one thing that I do find interesting when I talk about my research is that the group

85
00:07:49,920 --> 00:07:51,860
processes that I'm going to go through, they're a little bit different than what I'm going to go through. They're a

86
00:07:51,880 --> 00:07:52,100
little bit different than what I'm going to go through. They're a little bit different than what I'm going to go through. They're

87
00:07:52,100 --> 00:07:57,880
applicable to hackers and people in hacking communities. But they're also applicable to infosec

88
00:07:57,880 --> 00:08:01,760
practitioners. There are a lot of similarities. Even if you have a very different viewpoint, you've got a

89
00:08:01,760 --> 00:08:07,080
lot of the same skill sets. Coding, finding access, having imaginative creative ways of thinking,

90
00:08:07,660 --> 00:08:17,440
finding and fixing a problem. Not to mention that curiosity. So social identity. Basically, the

91
00:08:17,440 --> 00:08:21,860
world is chaotic and confusing. We make it a lot easier for ourselves. We make it a lot easier for

92
00:08:21,880 --> 00:08:26,360
ourselves by categorizing everything. Some things we put a lot of thought into. Other things we just go

93
00:08:26,360 --> 00:08:31,000
with, well, that looks similar to that. So we want the mental shortcuts. We don't want to use all our

94
00:08:31,880 --> 00:08:39,440
energy up basically analyzing and categorizing every single thing we see. It's too difficult. The

95
00:08:39,440 --> 00:08:46,780
human brain, it just gets exhausted. So we put ourselves and others into groups. And these are

96
00:08:46,780 --> 00:08:51,860
called identity groups. So you might choose to identify yourself. You might choose to identify yourself

97
00:08:51,880 --> 00:08:57,980
as a person. For example, there's a joke that I'm not Australian. I'm not quite sure where that joke's

98
00:08:57,980 --> 00:09:09,900
come from, but I'm not Australian. I'm British. I'm also European. Sod Brexit. I'm also English. I'm a

99
00:09:09,900 --> 00:09:18,860
female. I'm quite posh sounding. I don't like sports. I think my hobbies are just lurking on the

100
00:09:18,860 --> 00:09:21,800
internet, actually. Which is a great hobby.

101
00:09:21,880 --> 00:09:28,640
I fully recommend it. But yes, we all have these different ways that we categorize. Looking at me, you

102
00:09:28,640 --> 00:09:34,620
guys will have mentally categorized me somehow. And yes, I do like tea. It's a wonderful drink. I don't

103
00:09:34,620 --> 00:09:39,340
understand why you guys haven't embraced it fully. I hear there was something about Boston and a

104
00:09:39,340 --> 00:09:40,380
party and it went wrong.

105
00:09:41,440 --> 00:09:43,480
That was Brexit 1776.

106
00:09:44,820 --> 00:09:51,660
Good to know. Thank you. So the identity groups that we put ourselves in, they're important to us. We

107
00:09:51,660 --> 00:09:59,460
get a sense of pride, a sense of self-esteem. If our group looks bad, it reflects badly on us. The

108
00:09:59,460 --> 00:10:06,500
choices that we make, we ascribe to our group, and we want people in our groups to have similarities to

109
00:10:06,500 --> 00:10:13,200
us, whether this is true or not. This is what we tell ourselves. So our self-image is related to the

110
00:10:13,200 --> 00:10:19,360
reputation of the group. Going back to human factors and infosec, one of the tropes that really

111
00:10:19,360 --> 00:10:21,640
bugs me is people who have a lot of experience with the work they do. They're not experts. They're not

112
00:10:21,660 --> 00:10:27,660
like to say people are the weakest link. Now I can't say that's actually wrong because you

113
00:10:27,660 --> 00:10:33,080
know what? Everyone has a bad day. Everyone makes a mistake. I remember last year when I was

114
00:10:33,080 --> 00:10:37,240
listening to Chris talk he told the story of how he actually fell for a phishing scam, an

115
00:10:37,240 --> 00:10:41,080
Amazon link because it came at the right time in the right place when he was stressed and busy

116
00:10:41,080 --> 00:10:45,020
and getting organized for Defcon and he'd ordered things from Amazon. He was expecting emails

117
00:10:45,020 --> 00:10:50,900
from Amazon. He got an email from Amazon and he fell for it. It doesn't matter how well

118
00:10:50,900 --> 00:10:55,460
informed you are, how much you're expecting it, all it needs is the wrong moment, something to go

119
00:10:55,460 --> 00:11:00,880
wrong. You can be having a bad day. It doesn't mean that you're not smart enough or informed

120
00:11:00,880 --> 00:11:08,400
enough to be able to understand. So although people are the weakest link and some people

121
00:11:08,400 --> 00:11:13,280
really, really do need more education on it, we're also, we need to give ourselves more credit

122
00:11:13,280 --> 00:11:17,740
as a species. We've done quite a lot with technology. I mean even just coming to Defcon you

123
00:11:17,740 --> 00:11:20,640
can see people being so inventive and creative.

124
00:11:22,300 --> 00:11:25,680
Basically I'm just being a little cheerleader for the human race. It's not all terrible.

125
00:11:26,720 --> 00:11:32,760
One thing that's emphasized in InfoSec and when thinking about human factors is the fact

126
00:11:32,760 --> 00:11:37,320
that there are very different ways of thinking. So there is the stereotype that computing

127
00:11:37,320 --> 00:11:44,480
likes to be more logical, calculated, analytical and psychology is a bit sort of fluffy and

128
00:11:44,480 --> 00:11:49,000
it's all about emotions and talking about how you feel. I have to be honest, I don't

129
00:11:49,000 --> 00:11:50,340
really want to know how any of you feel.

130
00:11:52,860 --> 00:11:59,640
But I think you can't have just one to make a good security. You need a team of both.

131
00:11:59,840 --> 00:12:05,020
And as my slide shows, I feel that Kirk and Spock are a good example of this. I know it's

132
00:12:05,020 --> 00:12:11,200
slightly flawed because Spock is half human, but go with it. So in terms of having the logic,

133
00:12:11,300 --> 00:12:17,140
you can have the most logical tool. You can create a perfect program. But as a comparison,

134
00:12:17,720 --> 00:12:20,880
what if people decided to make a hammer round instead of with a spade? Well, that would be

135
00:12:20,900 --> 00:12:24,220
a straight handle because that way it's more efficient. You use more of the tree because

136
00:12:24,220 --> 00:12:27,820
you cut off rounds, you hollow it out, you put the hammer on. But you've got a hammer

137
00:12:27,820 --> 00:12:32,600
that a person can't use. That's not a useful tool. So although it may be less efficient

138
00:12:32,600 --> 00:12:36,680
in use of wood for the tree, a straight handle means more people can use it. More people

139
00:12:36,680 --> 00:12:40,440
are going to hit the nail on the head. And that's what you want. So when you're making

140
00:12:40,440 --> 00:12:46,340
a good tool, it has to be understood that it's for human beings. And I think this is

141
00:12:46,340 --> 00:12:50,880
something that's coming to the front more and more in InfoSec discussions. I've been to a

142
00:12:50,900 --> 00:12:56,720
lot of hacking conferences and things like that, and more and more, they're driving home.

143
00:12:56,880 --> 00:13:03,780
You have to think about the people. It's the human element that needs to be worked on really.

144
00:13:05,780 --> 00:13:10,740
So this might be a little controversial. I fully understand that there are very different

145
00:13:10,740 --> 00:13:17,420
definitions and everyone has their own interpretations. But for the point of this talk and for simplicity,

146
00:13:17,660 --> 00:13:20,600
when I say hacker, I'm referring to a computer hacker.

147
00:13:20,900 --> 00:13:26,980
And someone who has the ability to access a computer system without permission, without

148
00:13:26,980 --> 00:13:32,500
admission. They can find their way around. They can be creative. I put hacktivist there as well

149
00:13:32,500 --> 00:13:37,660
because I think it's a separate thing. Political, social dissatisfaction means that they're using

150
00:13:37,660 --> 00:13:42,000
computers for a purpose related to that. They're not just doing it for the curiosity. They're not

151
00:13:42,000 --> 00:13:50,400
just doing it to get access. They have a different motive. Other thing, I definitely feel that

152
00:13:50,400 --> 00:13:55,400
a hacker is not the same as a cyber criminal. People that are doing their scams in order to get

153
00:13:55,400 --> 00:14:02,200
money, that's not a hacker. So when it comes to the hacker's social identity, it's quite a

154
00:14:02,200 --> 00:14:06,120
difficult thing to define because, of course, everyone has their own interpretation. There are so

155
00:14:06,120 --> 00:14:13,100
many different subcategories, black hat, white hat, gray hat, ethical, skid, elite. There are some

156
00:14:13,100 --> 00:14:16,860
people that say that ethical hackers don't exist. There are some people that say skids don't

157
00:14:16,860 --> 00:14:20,380
exist. It all gets very subjective. So I think it's important to understand that there's a lot of

158
00:14:20,400 --> 00:14:24,720
people out there. So hackers, they're an imagined community. This is a sociological term. It

159
00:14:24,720 --> 00:14:29,700
was coined by, I want to say, Benedict Anderson in Australia when he was talking about

160
00:14:29,700 --> 00:14:33,980
nationalism because there were people all across Australia that were united in the idea that

161
00:14:33,980 --> 00:14:38,040
they were Australian, even if they were from different ethnic backgrounds, different political

162
00:14:38,040 --> 00:14:45,040
views, what it meant to be Australian. So there was no physical or geographical connection. It's

163
00:14:45,040 --> 00:14:50,380
just a socially constructed community. And it's created through the strong interests of the

164
00:14:50,380 --> 00:14:54,780
community, strong choice of interest and identity. And if that doesn't fit to hacking, I don't

165
00:14:54,780 --> 00:15:02,200
know what does. And as you can see, from being a part of this, hackers create groups. They give

166
00:15:02,200 --> 00:15:11,120
expertise, support, training, guidance, encouragement, so much to help people get further, which I

167
00:15:11,120 --> 00:15:17,520
think is amazing. So just briefly, this is someone else's diagram, but I really like it, so I

168
00:15:17,520 --> 00:15:20,360
use it. He says, I don't know what to do. I don't know what to do. I don't know what to do. I don't

169
00:15:20,380 --> 00:15:26,800
basically, Cbrooke broke up into five basic categories. This does not cover all definitions, all

170
00:15:26,800 --> 00:15:32,200
possibilities, all motivations, but bear with me. Breaking it up into these five basic

171
00:15:32,200 --> 00:15:37,820
categories, you can see the different reasons why people might get involved in hacking. Those are in

172
00:15:37,820 --> 00:15:43,760
the bracket around the outside. The more sophisticated the level is, the closer to the edge of

173
00:15:43,760 --> 00:15:49,760
the circle. And the type is by the dots. So, for example, if you hack for prestige, you're a coder.

174
00:15:49,860 --> 00:15:50,360
You're not hacking for the would. If you're not hacking for an application, you're hacking for a

175
00:15:50,380 --> 00:15:53,920
doing it for any particular reason apart from to show that you are the best of the best of the

176
00:15:53,920 --> 00:16:00,780
best. You're doing it to prove that you can. And it doesn't matter what, you know, the general

177
00:16:00,780 --> 00:16:04,840
public think, what the noobs think. You're doing it to show other people that you know who have

178
00:16:04,840 --> 00:16:09,940
the skills that you can do it too. Recreation, people that are just, you know, having a look

179
00:16:09,940 --> 00:16:16,620
around, playing, doing it for fun. Revenge, crowd sources, insider threats, things like

180
00:16:16,620 --> 00:16:23,220
that. Profits, in my mind, that's the most boring category because it tends to just be the

181
00:16:23,220 --> 00:16:27,740
criminals. Although I feel there should be some sort of subcategory for people who are in the

182
00:16:27,740 --> 00:16:32,440
business of information security. But there you go. And then ideology, you've got the

183
00:16:32,440 --> 00:16:39,760
hacktivists, cyber warriors, people fighting for a cause. So back to the social psychology of

184
00:16:39,760 --> 00:16:46,060
individuals and groups. I just thought this quote was quite apt from Men in Black. Agent K

185
00:16:46,060 --> 00:16:46,600
said...

186
00:16:52,160 --> 00:16:58,220
I don't think that's the entire truth, but I think it can be agreed that people behave very

187
00:16:58,220 --> 00:17:04,160
differently by themselves versus in a big group. When it comes to the panic, I'm not going to be

188
00:17:04,160 --> 00:17:08,940
discussing mass panic behavior changes in that because that's an entirely different thing. But

189
00:17:08,940 --> 00:17:14,420
you bring people together in a group, it changes things. So, for example, I'm going to say you

190
00:17:14,420 --> 00:17:16,600
guys are group A. You guys are group B. You guys are group C. You guys are group D. You guys

191
00:17:16,600 --> 00:17:21,580
are group A. You guys are group B. I'm going to come back to that. So one of the things, more

192
00:17:21,580 --> 00:17:26,320
common things that you might have heard of when it comes to group changes is group think. It's

193
00:17:26,320 --> 00:17:31,780
from the 1970s. And basically, it's a psychological need to have consensus. It doesn't

194
00:17:31,780 --> 00:17:35,180
matter if you have to suppress disagreement. It doesn't matter if you have to ignore

195
00:17:35,180 --> 00:17:41,400
individuals' opinions. You don't look at all the information, but you want consensus. You

196
00:17:41,400 --> 00:17:45,960
want agreement. Symptoms of it are the group thinks that they're invulnerable.

197
00:17:46,600 --> 00:17:52,280
Regardless of the reality. They collectively rationalize their decisions. Even if there is

198
00:17:52,280 --> 00:17:57,820
evidence to the contrary, they, you know, disregard that. They have stereotyped views of

199
00:17:57,820 --> 00:18:02,420
different groups rather than, you know, looking at what they're actually made up of. There is

200
00:18:02,420 --> 00:18:07,160
the group pressure to conform. And people tend to self-censorship. So even if they don't agree,

201
00:18:07,440 --> 00:18:12,000
they will suppress their own views. No one else has to say anything to them. But to stay in the

202
00:18:12,000 --> 00:18:16,580
group, they will stay quiet. Group thinks have been found to be more powerful than group

203
00:18:16,600 --> 00:18:22,240
think. It's more common when the groups are tightly bonded, more cohesive, especially in a

204
00:18:22,240 --> 00:18:26,600
high-pressure situation. If there's a lot of pressure on, they need a decision quickly, group

205
00:18:26,600 --> 00:18:33,260
think emerges. However, group think also reduces the possibility of success. So they come to a

206
00:18:33,260 --> 00:18:40,580
conclusion, it's more likely to be wrong. And the pressure for agreement makes people think more

207
00:18:40,580 --> 00:18:44,500
irrationally. It makes them vulnerable. It's just generally not a good thing.

208
00:18:47,100 --> 00:18:52,320
Informational influence. So this is the desire to be correct. No one wants to be wrong. No one wants

209
00:18:52,320 --> 00:18:56,600
to stand up in front of a crowd like this and say the wrong thing. This is why I have names and dates

210
00:18:56,600 --> 00:19:01,900
in there. So I can say it wasn't me that said this. This is the study. Sources are important.

211
00:19:04,280 --> 00:19:09,620
We instinctively look to other people to see how we should behave. What is acceptable? What is the

212
00:19:09,620 --> 00:19:15,660
norm? So for example, if you go to the U.K. and you see people queueing, you queue properly. Not

213
00:19:15,660 --> 00:19:16,740
not that that's a pet peeve or anything.

214
00:19:18,200 --> 00:19:20,620
You get the information and news from the group.

215
00:19:20,680 --> 00:19:25,080
You tend to believe it because you assume the judgment of other peoples

216
00:19:25,080 --> 00:19:26,840
is going to be more reliable than your own.

217
00:19:27,740 --> 00:19:30,040
Therefore, the group view is the correct view.

218
00:19:30,500 --> 00:19:32,800
You don't want to be excluded from the group.

219
00:19:32,880 --> 00:19:33,980
You don't want to be the odd one out.

220
00:19:34,080 --> 00:19:35,300
You don't want to be the difficult one.

221
00:19:35,380 --> 00:19:37,080
You want to be accepted as part of a group.

222
00:19:37,420 --> 00:19:39,900
Therefore, you behave as they would want you to.

223
00:19:41,760 --> 00:19:45,380
Similarly, you've got the normative influence, pressure to conform to the norms.

224
00:19:45,380 --> 00:19:51,060
So, for example, online you have this by obeying the laws of a forum.

225
00:19:51,260 --> 00:19:53,500
I don't know if anyone's actually sat down and read them,

226
00:19:53,560 --> 00:19:54,900
but I go on a lot of hacking forums.

227
00:19:55,240 --> 00:19:56,540
I read all the rules.

228
00:19:56,780 --> 00:19:57,980
All of them are very similar.

229
00:19:58,140 --> 00:20:00,720
All of them saying, don't do this, don't do this, it's illegal,

230
00:20:01,060 --> 00:20:04,720
no money, no anything else, and then everyone ignores it, obviously.

231
00:20:06,440 --> 00:20:07,340
But they say it.

232
00:20:08,460 --> 00:20:09,720
That's not how they behave, though.

233
00:20:09,780 --> 00:20:12,340
So they have the written rules, and then they have the norms.

234
00:20:13,440 --> 00:20:15,340
So even if an individual doesn't agree with,

235
00:20:15,380 --> 00:20:18,780
the norm of the group, they still won't speak up because they want to stay in the group.

236
00:20:20,720 --> 00:20:25,520
It's also been found that if people express an opinion and other people say,

237
00:20:25,640 --> 00:20:29,900
yeah, no, I agree, then that will encourage the person to give a stronger opinion,

238
00:20:30,160 --> 00:20:36,560
a more polarized opinion, and there are links to groupthink and the conflict between groups.

239
00:20:37,700 --> 00:20:41,140
Also, a very important factor as to whether or not people conform to the norm,

240
00:20:41,760 --> 00:20:45,360
which rhymes, is whether or not they're being watched by a larger group.

241
00:20:45,380 --> 00:20:48,320
You behave better if you think there are security cameras around.

242
00:20:48,460 --> 00:20:50,020
This is why people have fake cameras.

243
00:20:52,100 --> 00:20:59,520
Yeah, so, it's interesting how we can ascribe certain behaviors to other people

244
00:20:59,520 --> 00:21:03,460
because that's who they are, but ourselves, no, we're different, we're better.

245
00:21:03,520 --> 00:21:04,560
We know our motives.

246
00:21:04,900 --> 00:21:08,820
We judge others by their actions, ourselves by our intentions,

247
00:21:09,140 --> 00:21:14,000
and I love this cartoon, XKCD, for those that don't know, but you probably do.

248
00:21:15,380 --> 00:21:18,360
Because, yeah, everyone might be thinking exactly the same thing as you.

249
00:21:18,880 --> 00:21:20,160
Why is no one saying anything?

250
00:21:20,340 --> 00:21:21,520
Why is no one disagreeing?

251
00:21:22,580 --> 00:21:23,820
But you don't.

252
00:21:23,820 --> 00:21:24,680
Why don't you?

253
00:21:26,200 --> 00:21:27,540
So, you're in this group.

254
00:21:27,660 --> 00:21:28,600
You want to stay in this group.

255
00:21:30,100 --> 00:21:31,300
You belong to this group.

256
00:21:31,420 --> 00:21:36,360
Because you belong to the group, you want to feel good about being in this group.

257
00:21:36,560 --> 00:21:38,720
So, group A, you guys are some snappy dresses.

258
00:21:38,920 --> 00:21:39,780
You're all looking good there.

259
00:21:39,980 --> 00:21:40,860
That's very nice.

260
00:21:42,520 --> 00:21:44,180
So, you find good things about the group,

261
00:21:45,380 --> 00:21:48,880
have to also discriminate and find negative things about the other group.

262
00:21:50,040 --> 00:21:50,920
No offense, guys.

263
00:21:51,040 --> 00:21:51,760
I love the bunny ears.

264
00:21:53,700 --> 00:21:57,680
That becomes a them versus us, just social categorization.

265
00:21:57,900 --> 00:22:01,120
So, by putting you in two groups and saying slightly different things,

266
00:22:02,280 --> 00:22:07,980
you might feel more like a group than you would if I just left you all alone

267
00:22:07,980 --> 00:22:09,160
and not said anything about it.

268
00:22:09,340 --> 00:22:13,860
But just by putting people into a group, they assume the group identity.

269
00:22:14,160 --> 00:22:15,360
If I'd said all blue-eyed people,

270
00:22:15,380 --> 00:22:17,840
go to the left, all brown-eyed people, go to the right,

271
00:22:17,960 --> 00:22:19,780
there would be a bigger group.

272
00:22:19,980 --> 00:22:20,780
They would be the majority.

273
00:22:21,000 --> 00:22:23,260
The minority might feel that it's not so fair.

274
00:22:23,480 --> 00:22:25,640
Everyone in the brown-eyed group could have a chair,

275
00:22:25,740 --> 00:22:27,400
but all the blue-eyes have to stand.

276
00:22:27,740 --> 00:22:28,420
That's not fair.

277
00:22:28,520 --> 00:22:29,200
Why would you do that?

278
00:22:29,420 --> 00:22:35,940
And you can create tensions and rivalry and competitiveness that doesn't need to be there

279
00:22:35,940 --> 00:22:38,660
just by arbitrarily grouping and categorizing people.

280
00:22:39,920 --> 00:22:41,480
Stereotyping also exaggerates the difference.

281
00:22:43,740 --> 00:22:45,360
It can also make you think that you've got more than one group.

282
00:22:45,360 --> 00:22:46,980
You've got more in common with another group than you actually have.

283
00:22:47,980 --> 00:22:52,660
So, groups, as with giving a stronger opinion because you're in a group,

284
00:22:52,760 --> 00:22:53,960
they become more polarized.

285
00:22:54,260 --> 00:22:56,180
So, you can go to more of an extreme.

286
00:22:56,460 --> 00:23:01,100
I think politics is a great example of this, but I'm not going to go into politics.

287
00:23:03,440 --> 00:23:06,520
So, when you're in a group, how do you, especially online,

288
00:23:06,820 --> 00:23:09,000
how do you know if you're in a group or not?

289
00:23:09,240 --> 00:23:11,440
I mean, there's no list where you sign up your name.

290
00:23:11,660 --> 00:23:14,820
There's no, I mean, you can actually register for forums,

291
00:23:14,860 --> 00:23:15,340
and you can be able to do that.

292
00:23:15,360 --> 00:23:16,460
There's no group member in that sense.

293
00:23:16,900 --> 00:23:21,000
But, for example, 4chan, Triforcing, they've come up with a way to signal

294
00:23:21,000 --> 00:23:23,100
whether you are in or out.

295
00:23:23,940 --> 00:23:26,920
And I quite like this as an example because I think it's quite clever.

296
00:23:27,620 --> 00:23:30,460
So, the Triforce, I'm sure most people are familiar with.

297
00:23:30,560 --> 00:23:34,700
It's from a video game, and it's basically placing those three little red triangles correctly.

298
00:23:35,340 --> 00:23:37,800
If you copy and paste it, it will come out incorrectly.

299
00:23:39,460 --> 00:23:45,200
So, what they like to do is someone starts the thread with the Triforce,

300
00:23:45,360 --> 00:23:49,180
someone copies and pastes, it looks correct until they hit submit,

301
00:23:49,460 --> 00:23:50,960
then it comes out wonky.

302
00:23:51,100 --> 00:23:53,600
Everyone can see that they don't know how to Triforce.

303
00:23:54,320 --> 00:23:56,180
It's a way of outing yourself.

304
00:23:56,460 --> 00:23:59,160
Not that it particularly matters on 4chan because everyone's called anonymous,

305
00:24:01,380 --> 00:24:04,700
but in this picture, in this example, someone had said,

306
00:24:04,780 --> 00:24:06,280
oh, here's one that you can copy and paste.

307
00:24:06,620 --> 00:24:10,740
Another person did the correct Triforcing to make it seem believable,

308
00:24:10,900 --> 00:24:14,020
then someone tried to copy and paste, got it wrong, everyone laughed.

309
00:24:15,360 --> 00:24:19,440
So, there's subtle ways that you show whether you're in the group or not.

310
00:24:19,700 --> 00:24:22,820
People that are wearing DEFCON t-shirts from previous years,

311
00:24:22,920 --> 00:24:25,040
they're saying, I've been coming to here for years.

312
00:24:25,240 --> 00:24:29,740
People with loads of badges around their neck, I'm involved in all these different villages,

313
00:24:30,000 --> 00:24:32,500
and I've been to all these different talks, I've done these different challenges.

314
00:24:32,860 --> 00:24:35,120
There's ways that you are telling people you are part of the group.

315
00:24:36,600 --> 00:24:40,580
So, when it comes to conflict within groups, why does it happen?

316
00:24:40,640 --> 00:24:43,420
You've got a big, happy group A, why would you guys all fall out?

317
00:24:45,360 --> 00:24:47,140
You could disagree about what's acceptable.

318
00:24:47,840 --> 00:24:51,220
You could say, you know, sitting there, playing on your phone,

319
00:24:51,400 --> 00:24:54,760
that's not what group A does, you need to go to group B if you want to do that.

320
00:24:57,600 --> 00:25:00,120
I'm not sure you should start doing that.

321
00:25:00,400 --> 00:25:02,400
This is the conflict within groups.

322
00:25:04,120 --> 00:25:05,980
We've done against groups.

323
00:25:06,420 --> 00:25:09,200
So, people can have different motivations, different goals.

324
00:25:09,340 --> 00:25:14,400
When it came to 4chan merging into becoming anonymous because the hacktivist group Anonymous,

325
00:25:14,400 --> 00:25:20,380
it started on 4chan, started out people trolling and pranking and generally having a good time.

326
00:25:20,560 --> 00:25:22,800
And then some people were like, hey, let's use this for a cause.

327
00:25:23,220 --> 00:25:29,160
Let's do this to wind up, you know, people that we don't like, like Scientology, Church of Scientology.

328
00:25:30,340 --> 00:25:35,300
And it got to a point where the original prankers were like, well, I don't want to be doing this for a good cause.

329
00:25:35,400 --> 00:25:36,480
I just want it to be a nuisance.

330
00:25:37,000 --> 00:25:41,260
And so they had to split between the people that wanted to prank and the people that wanted to have a good cause.

331
00:25:41,800 --> 00:25:47,960
When a group gets too big and too diverse, it's natural that it falls apart to a degree.

332
00:25:48,100 --> 00:25:53,120
There's only so many resources around and cooperation can turn into competition.

333
00:25:54,700 --> 00:26:02,900
It's also, especially in the hacking situation, it's interesting how people divide along what is and isn't acceptable in order to achieve the goals.

334
00:26:03,100 --> 00:26:06,060
So it's black hat hackers versus white hat hackers.

335
00:26:06,380 --> 00:26:10,860
How real it is can be hard to tell from my point of view.

336
00:26:12,820 --> 00:26:17,360
One of the other things that a group process that affects people is impression management.

337
00:26:18,420 --> 00:26:20,120
Groups want to control how they're seen.

338
00:26:20,220 --> 00:26:20,740
They have a brand.

339
00:26:20,900 --> 00:26:21,560
They have a reputation.

340
00:26:22,540 --> 00:26:24,160
And they have to maintain it.

341
00:26:24,240 --> 00:26:30,260
They have to control the information that goes out, influence the perception that other people have.

342
00:26:31,140 --> 00:26:34,260
The use of this in online media is really interesting.

343
00:26:34,400 --> 00:26:35,620
Twitter is great for it.

344
00:26:35,880 --> 00:26:38,440
Some people are very, very careful about what they tweet.

345
00:26:38,620 --> 00:26:39,320
It has to be approved.

346
00:26:39,320 --> 00:26:42,480
Others, Donald Trump, not so careful.

347
00:26:42,940 --> 00:26:46,500
Not so, I know, sorry, I said I wouldn't do politics, but it's hilarious.

348
00:26:47,860 --> 00:26:54,240
Yeah, so even when you're just coming to DEF CON presenting yourself, you are presenting yourself.

349
00:26:54,740 --> 00:26:56,460
There is no two ways about it.

350
00:26:58,740 --> 00:27:00,800
Also, when you come to these groups, trust.

351
00:27:01,060 --> 00:27:03,080
It's an interesting one in hacking communities.

352
00:27:03,540 --> 00:27:06,200
Oh, I've got so much fun with this.

353
00:27:07,060 --> 00:27:09,300
Trust requires the individual's trust.

354
00:27:09,320 --> 00:27:10,120
You're able to relinquish control.

355
00:27:10,720 --> 00:27:13,060
You put yourself in the hands of another somehow.

356
00:27:13,500 --> 00:27:18,440
So, for example, if you've got the plane here, you put yourself in the trust of the pilot.

357
00:27:18,700 --> 00:27:21,500
You trusted that the airline had checked that he was qualified.

358
00:27:21,840 --> 00:27:22,880
He'd actually done the test.

359
00:27:22,980 --> 00:27:23,600
He could actually fly.

360
00:27:24,000 --> 00:27:25,540
Everyone made it, as far as we know.

361
00:27:25,640 --> 00:27:26,800
So that's looking good.

362
00:27:27,680 --> 00:27:30,420
There is also the expectation that others will reciprocate.

363
00:27:30,500 --> 00:27:35,680
So, for example, getting on the airplane, they expect that you will behave as a good airplane passenger

364
00:27:35,680 --> 00:27:38,760
and, you know, not get really drunk and harass.

365
00:27:39,320 --> 00:27:39,960
Flight attendants.

366
00:27:41,700 --> 00:27:43,960
Online, you don't get the visual cues of trust.

367
00:27:44,000 --> 00:27:48,760
You can't see how a person is standing, how they're talking, if they're doing shifty eye movements.

368
00:27:49,340 --> 00:27:51,340
All you have is what they give you.

369
00:27:51,420 --> 00:27:52,180
It might be a photo.

370
00:27:52,280 --> 00:27:53,120
It might be text.

371
00:27:53,320 --> 00:27:55,520
But it can be manipulated so much more easily.

372
00:27:56,120 --> 00:28:00,680
And it's really interesting looking at what does and doesn't encourage trust online.

373
00:28:00,980 --> 00:28:04,320
One of the things is reciprocation with information.

374
00:28:04,700 --> 00:28:08,340
So if you're sat there talking to a stranger on a chat and you're telling them all about your life

375
00:28:08,340 --> 00:28:10,800
and they're just responding like, yep, okay, all right,

376
00:28:11,280 --> 00:28:15,420
at some point you're going to think, well, either they're not interested or this is just a really weird interaction.

377
00:28:16,480 --> 00:28:21,480
If they start telling you things about their life, you feel a lot closer to them.

378
00:28:21,560 --> 00:28:22,700
You feel that there's more of a bond.

379
00:28:22,780 --> 00:28:23,540
There's more trust.

380
00:28:24,080 --> 00:28:26,560
And this is how people can be manipulated so easily.

381
00:28:26,680 --> 00:28:29,920
I think in the U.K., at least, there's been a big rise in dating scams

382
00:28:31,520 --> 00:28:35,960
because people are looking for these sort of connections, for friendships, and they trust.

383
00:28:36,780 --> 00:28:38,320
One of the sad things about social media,

384
00:28:38,340 --> 00:28:40,780
social engineering is that, I mean, a lot of people,

385
00:28:41,460 --> 00:28:44,940
I really like here that they emphasize that it's not the person's fault.

386
00:28:45,280 --> 00:28:48,900
It's that they're not taught or prepared well enough.

387
00:28:49,120 --> 00:28:54,600
But there is an element of taking advantage of someone's naivety and, you know, good nature and their trust.

388
00:28:55,400 --> 00:28:56,740
And it's quite sad.

389
00:28:57,860 --> 00:29:03,060
But going back to hacking, group membership is a strong predictor of trust behavior.

390
00:29:03,280 --> 00:29:06,280
If you belong to the same group as someone else, you are more likely to trust them.

391
00:29:06,460 --> 00:29:07,320
So, for example,

392
00:29:07,320 --> 00:29:10,360
walking around Las Vegas, if you see people with their DEF CON badge,

393
00:29:10,600 --> 00:29:13,060
you might be more inclined to start a conversation with them.

394
00:29:13,140 --> 00:29:14,120
Say, hey, you're at DEF CON.

395
00:29:14,560 --> 00:29:15,200
What's your background?

396
00:29:15,380 --> 00:29:15,720
What do you do?

397
00:29:16,380 --> 00:29:21,600
I mean, because it is DEF CON, some people will be a little bit more wary of what they say.

398
00:29:22,480 --> 00:29:25,380
But there's still the element of we are in this same group,

399
00:29:25,540 --> 00:29:30,040
this group within the wider group of all tourists and workers in Las Vegas.

400
00:29:32,140 --> 00:29:35,680
So the fact that you are all here at DEF CON means that you already have something here in common.

401
00:29:37,060 --> 00:29:40,560
What's been interesting in the research I've been doing, in interviews I've been doing,

402
00:29:40,700 --> 00:29:44,980
when I ask about trust, everyone immediately says, don't trust on the Internet.

403
00:29:45,180 --> 00:29:45,800
No trust.

404
00:29:45,980 --> 00:29:46,700
Don't trust anyone.

405
00:29:47,040 --> 00:29:47,760
They could be a dog.

406
00:29:48,340 --> 00:29:50,040
But how far does that actually go?

407
00:29:50,120 --> 00:29:54,180
How far can you actually get interacting with other people if you have literally zero trust?

408
00:29:54,480 --> 00:29:56,880
And when I pointed this out to them and given examples,

409
00:29:57,220 --> 00:30:02,160
it's been quite interesting how they found that very hard to reconcile with their idea of I don't trust anyone.

410
00:30:02,620 --> 00:30:05,660
There was one person I was talking to who had, you know,

411
00:30:06,000 --> 00:30:08,780
created their own forum and it was towards the darker side.

412
00:30:10,120 --> 00:30:13,020
And he was quite openly talking with me.

413
00:30:13,400 --> 00:30:16,020
And I said, so do you run it all yourself, like 24 hours a day?

414
00:30:16,080 --> 00:30:16,920
He said, no, no, I have admin.

415
00:30:17,280 --> 00:30:19,440
I was like, but you said you don't trust anyone.

416
00:30:19,640 --> 00:30:20,580
He was like, no, I don't trust them.

417
00:30:20,700 --> 00:30:23,220
I was like, but do you check what they're doing all the time?

418
00:30:23,260 --> 00:30:25,820
And he said, no, no, okay, yeah, I trust them to do the admin.

419
00:30:26,220 --> 00:30:29,240
I was like, okay, so where does the line of trust stop?

420
00:30:29,320 --> 00:30:32,560
You trust them with your website, what you have created.

421
00:30:32,700 --> 00:30:35,420
You trust that they will uphold the rules and the norms.

422
00:30:36,280 --> 00:30:38,440
So what don't you trust them with?

423
00:30:38,900 --> 00:30:42,440
And if it comes down to, you know, your personal identity,

424
00:30:42,620 --> 00:30:45,100
well, you wouldn't trust most people on the Internet with that.

425
00:30:45,260 --> 00:30:47,640
So it's interesting.

426
00:30:48,020 --> 00:30:49,900
Trust is tricky.

427
00:30:51,180 --> 00:30:54,420
So how is this relevant to why hackers are going to hack?

428
00:30:55,040 --> 00:30:59,380
Basically, I just wondered how many of you were really aware of all the different things

429
00:30:59,380 --> 00:31:02,660
that might be influencing you without you actually thinking about it.

430
00:31:02,720 --> 00:31:04,480
So, for example, what you've chosen to wear today.

431
00:31:04,480 --> 00:31:06,760
If you're wearing a DEF CON T-shirt, like I said before,

432
00:31:06,940 --> 00:31:10,000
maybe you want to tell others you've been here previously.

433
00:31:10,520 --> 00:31:11,760
You know what you're doing.

434
00:31:11,940 --> 00:31:15,240
If you're wearing a company T-shirt, you're saying, yep, I'm a part of this company.

435
00:31:15,300 --> 00:31:16,080
I support what they do.

436
00:31:16,420 --> 00:31:20,900
If you're wearing, I don't know, a sports brand, then maybe you're saying you're sporty.

437
00:31:21,020 --> 00:31:21,440
I'm not sure.

438
00:31:22,880 --> 00:31:24,680
Why did you choose the talks that you went to?

439
00:31:25,440 --> 00:31:29,200
If you've come to this talk, then hopefully you've got some vague interest in social engineering

440
00:31:29,200 --> 00:31:32,000
or social psychology, human factors.

441
00:31:32,440 --> 00:31:34,200
If you've gone to one of the really technical ones,

442
00:31:34,540 --> 00:31:35,860
then you're saying that you're technical.

443
00:31:36,020 --> 00:31:39,480
But what if you went because your friends wanted to go?

444
00:31:40,140 --> 00:31:41,280
Or the people that you're with?

445
00:31:41,460 --> 00:31:43,240
Or you just didn't want to go sit in a room by yourself.

446
00:31:43,680 --> 00:31:45,240
You wanted to be with other people.

447
00:31:45,460 --> 00:31:47,340
So you let them influence your decision.

448
00:31:49,980 --> 00:31:52,640
Have you had any disagreements with the people that you came here with?

449
00:31:52,760 --> 00:31:54,780
If you didn't come here with anyone, you have so much freedom.

450
00:31:54,880 --> 00:31:55,220
It's wonderful.

451
00:31:56,400 --> 00:31:57,880
If you did, there's peer pressure.

452
00:31:58,000 --> 00:31:59,440
What if you don't want to go out and party?

453
00:31:59,560 --> 00:32:00,580
What if you want to go sleep?

454
00:32:00,680 --> 00:32:02,240
Because let's be honest, it's tiring.

455
00:32:03,840 --> 00:32:05,740
Some people probably really disagree with that.

456
00:32:06,480 --> 00:32:07,980
Which, also, there's disagreement.

457
00:32:08,820 --> 00:32:10,200
So there's all these different things.

458
00:32:10,380 --> 00:32:13,180
What keeps you coming back to DEF CON in the different days?

459
00:32:13,380 --> 00:32:15,800
Is it that you want to be a part of this social identity?

460
00:32:16,060 --> 00:32:18,260
Is it the curiosity you want to find out, you want to learn?

461
00:32:18,460 --> 00:32:20,880
Is it the sense of community that you want to be a part of?

462
00:32:21,140 --> 00:32:25,680
There are all these different group factors that keep people coming back to hacking.

463
00:32:31,320 --> 00:32:33,940
It's one of the things that my research really aims to get into.

464
00:32:35,340 --> 00:32:37,000
So, again, how does this affect you?

465
00:32:37,160 --> 00:32:39,540
Well, when it comes to trust, would you trust the person next to you?

466
00:32:42,340 --> 00:32:45,620
Not, for example, with your home address or your mother's maiden name,

467
00:32:45,760 --> 00:32:48,660
which I've never understood because my surname is my mother's maiden name.

468
00:32:49,460 --> 00:32:51,500
But would you give them your wallet and go to the toilet?

469
00:32:52,820 --> 00:32:53,180
Yes.

470
00:32:54,320 --> 00:32:55,340
The person who said yes.

471
00:32:55,680 --> 00:32:56,300
Would you trust that next to someone you know?

472
00:32:57,540 --> 00:32:58,620
Okay. Well, that's...

473
00:33:01,040 --> 00:33:03,320
Married to you, trusting your wallet with your wife, that's...

474
00:33:06,520 --> 00:33:08,180
Anyway, before I get my...

475
00:33:08,640 --> 00:33:10,840
Before I start a domestic...

476
00:33:13,000 --> 00:33:14,920
So, when you're talking to other people at DEF CON,

477
00:33:14,980 --> 00:33:18,100
how much do you tell them about yourself, about where you're from, about what you're doing?

478
00:33:18,200 --> 00:33:21,120
I have to say I'm always a little bit wary telling people about what I do

479
00:33:21,120 --> 00:33:24,960
because, mostly, because I have to say, yeah, I'm here to study you.

480
00:33:26,100 --> 00:33:28,060
I get a mixed response to that.

481
00:33:29,240 --> 00:33:31,660
But how you present yourself is also important.

482
00:33:32,480 --> 00:33:34,680
So, group influence. Is it good? Is it bad?

483
00:33:35,200 --> 00:33:37,160
I'm going to give a very psychological answer.

484
00:33:37,420 --> 00:33:40,860
It depends. It can be. It depends.

485
00:33:41,680 --> 00:33:44,560
Cyber security, they'd say, it depends on what the group's doing.

486
00:33:44,880 --> 00:33:48,480
If they're encouraging you to do naughty bad things, then they are bad.

487
00:33:49,980 --> 00:33:54,180
But, more importantly, regardless of whether you're doing good or bad,

488
00:33:54,180 --> 00:33:55,960
can you recognize when you're being influenced?

489
00:33:57,100 --> 00:33:59,980
Do you actually think critically when your friends are trying to persuade you

490
00:33:59,980 --> 00:34:01,480
to do something that you don't want to do?

491
00:34:01,600 --> 00:34:03,760
Do you stop and think, well, maybe this isn't a great idea.

492
00:34:03,980 --> 00:34:06,340
Maybe I should just go and do what I want to do.

493
00:34:07,360 --> 00:34:12,800
And I think this is especially important in the whole era of fake news

494
00:34:12,800 --> 00:34:14,600
and social media tunnel vision.

495
00:34:15,100 --> 00:34:16,920
Don't dismiss information from other groups.

496
00:34:17,400 --> 00:34:20,920
In fact, sometimes it's really useful to look at information from other groups,

497
00:34:21,000 --> 00:34:21,980
see where they're coming from.

498
00:34:22,100 --> 00:34:22,840
You might not agree,

499
00:34:22,840 --> 00:34:25,960
but you get a better overall perspective.

500
00:34:27,180 --> 00:34:29,120
So, a little bit of self-promotion briefly.

501
00:34:29,540 --> 00:34:30,440
My research.

502
00:34:31,080 --> 00:34:34,960
So, as I said, I'm in the second year of a three-year studentship

503
00:34:34,960 --> 00:34:35,840
at Bournemouth University.

504
00:34:36,480 --> 00:34:38,920
I have no qualifications in psychology or computing,

505
00:34:39,160 --> 00:34:41,040
but I'm actually doing all right at this.

506
00:34:42,980 --> 00:34:44,580
I'm so glad this is being recorded.

507
00:34:46,020 --> 00:34:50,620
So, my research is on the psychological influence of group processes online.

508
00:34:50,860 --> 00:34:52,580
All the things I've been talking about,

509
00:34:52,840 --> 00:34:56,020
I want to see how far they go from offline to online,

510
00:34:56,680 --> 00:34:59,700
because that's something that we're really not understanding at the moment,

511
00:34:59,760 --> 00:35:02,480
how psychology changes when people go online,

512
00:35:02,620 --> 00:35:03,900
how the human behavior changes.

513
00:35:04,600 --> 00:35:06,500
There's things like online disinhibition.

514
00:35:06,540 --> 00:35:09,800
People behave differently because they think they're protected by anonymity

515
00:35:09,800 --> 00:35:11,180
because they're behind a computer screen.

516
00:35:11,320 --> 00:35:12,600
You can become a keyboard warrior,

517
00:35:13,360 --> 00:35:16,200
or in the instance of that famous YouTube comment,

518
00:35:16,400 --> 00:35:17,380
a Navy SEAL commando.

519
00:35:19,240 --> 00:35:21,540
The other thing is, what is the hacker identity?

520
00:35:22,840 --> 00:35:24,920
There is a lot of different opinion,

521
00:35:25,100 --> 00:35:28,560
but there's also a lot of misconceptions.

522
00:35:29,520 --> 00:35:32,100
People do think a hacker is a cyber criminal.

523
00:35:32,240 --> 00:35:32,920
It's not the case.

524
00:35:33,020 --> 00:35:34,880
Some people can hack without actually breaking the law.

525
00:35:35,200 --> 00:35:37,700
I don't know if they enjoy it, but they do.

526
00:35:38,680 --> 00:35:41,440
You don't have to accept the negative stereotypes as fact.

527
00:35:41,800 --> 00:35:44,280
The hooded figure crouching over a keyboard.

528
00:35:44,560 --> 00:35:45,920
You know what? Lots of people wear hoodies.

529
00:35:46,000 --> 00:35:46,760
They're damned comfortable.

530
00:35:48,740 --> 00:35:50,540
So, what's the point of my research?

531
00:35:50,540 --> 00:35:53,180
I want to inform and educate,

532
00:35:53,480 --> 00:35:56,540
not just the general public, because they do need it,

533
00:35:56,640 --> 00:35:58,500
but also people that are involved in these communities,

534
00:35:58,760 --> 00:36:00,320
people that might be vulnerable to influence,

535
00:36:00,480 --> 00:36:02,700
people that come looking for a sense of belonging

536
00:36:03,360 --> 00:36:04,980
and then are at risk of manipulation.

537
00:36:05,500 --> 00:36:07,000
They had it in Anonymous,

538
00:36:07,180 --> 00:36:09,980
where there were people that got prosecuted

539
00:36:09,980 --> 00:36:11,720
for taking part in the DDoS attacks.

540
00:36:12,280 --> 00:36:15,220
They later said they were told to download the software,

541
00:36:15,400 --> 00:36:15,980
click the button.

542
00:36:16,120 --> 00:36:17,880
They didn't really understand what they were doing.

543
00:36:18,800 --> 00:36:20,620
I mean, partly that's their fault,

544
00:36:20,680 --> 00:36:23,120
because don't trust people on the Internet.

545
00:36:23,380 --> 00:36:27,380
But there is also an element of they were being manipulated.

546
00:36:27,620 --> 00:36:29,260
They wanted to be a part of a cause.

547
00:36:29,920 --> 00:36:31,880
They wanted to do something worthwhile.

548
00:36:32,200 --> 00:36:33,020
They wanted to help.

549
00:36:33,400 --> 00:36:35,160
And people took advantage of this

550
00:36:35,160 --> 00:36:37,020
to use them basically as cannon fodder.

551
00:36:38,400 --> 00:36:41,800
I also think we're raising a generation of coding.

552
00:36:41,860 --> 00:36:44,040
There's so much emphasis on computer science,

553
00:36:44,320 --> 00:36:45,980
learning, all of these things.

554
00:36:45,980 --> 00:36:48,840
We also need to teach the younger generation

555
00:36:48,840 --> 00:36:51,100
responsibility for your online behavior

556
00:36:51,100 --> 00:36:52,240
and your online actions.

557
00:36:52,520 --> 00:36:54,540
It's not disconnected from the real world.

558
00:36:54,600 --> 00:36:55,520
There are consequences.

559
00:36:55,800 --> 00:36:58,000
You can end up in jail for something you tweet.

560
00:36:59,060 --> 00:37:00,640
I think it's also really important

561
00:37:00,640 --> 00:37:03,860
to emphasize human factors in cybersecurity.

562
00:37:04,360 --> 00:37:06,240
It's not just about the programs.

563
00:37:06,340 --> 00:37:07,020
It's about people.

564
00:37:07,820 --> 00:37:09,480
I think there's a definite need

565
00:37:09,480 --> 00:37:11,080
for informing policy and legislation.

566
00:37:12,080 --> 00:37:13,780
Possibly this is me just being cynical,

567
00:37:13,940 --> 00:37:15,800
but I don't like the idea

568
00:37:15,980 --> 00:37:17,400
that governments and corporations

569
00:37:17,400 --> 00:37:19,180
would be in charge of the Internet,

570
00:37:19,460 --> 00:37:20,540
because as we all know,

571
00:37:20,640 --> 00:37:22,720
he who controls the Internet controls the universe.

572
00:37:27,160 --> 00:37:30,100
And I think that research such as this,

573
00:37:30,300 --> 00:37:33,380
you can go with evidence and say,

574
00:37:33,520 --> 00:37:35,640
you know you think that all the bad people are doing this?

575
00:37:35,840 --> 00:37:37,140
Here's what they're actually doing.

576
00:37:37,300 --> 00:37:40,220
They're creating things to help locate

577
00:37:40,220 --> 00:37:42,680
and find people that are trafficking children.

578
00:37:43,080 --> 00:37:44,540
They're doing good things.

579
00:37:44,540 --> 00:37:47,340
It's not all devious evil

580
00:37:47,340 --> 00:37:49,460
just because you don't understand it.

581
00:37:49,920 --> 00:37:52,640
The last, latest thing to really annoy me

582
00:37:52,640 --> 00:37:56,220
was Theresa May's words about encryption

583
00:37:56,220 --> 00:37:57,980
and how she wanted a backdoor.

584
00:37:58,180 --> 00:37:59,980
And I think you just don't understand.

585
00:38:00,480 --> 00:38:02,600
You know, there is no backdoor

586
00:38:02,600 --> 00:38:03,860
that only lets in the good guys.

587
00:38:05,420 --> 00:38:07,500
And finally, I think it's really important

588
00:38:07,500 --> 00:38:10,840
for cyber sociological knowledge to be expanded.

589
00:38:10,960 --> 00:38:11,960
It's new.

590
00:38:12,120 --> 00:38:13,100
It's interesting.

591
00:38:13,880 --> 00:38:14,940
And I'm sorry,

592
00:38:15,020 --> 00:38:16,980
but you guys are a really fascinating community

593
00:38:16,980 --> 00:38:17,720
to do it with.

594
00:38:18,960 --> 00:38:20,780
So how does the Internet change the behavior?

595
00:38:21,380 --> 00:38:23,660
I've already been able to write a paper

596
00:38:23,660 --> 00:38:25,880
on how to go about this sort of research,

597
00:38:25,960 --> 00:38:26,840
how to expand it.

598
00:38:26,900 --> 00:38:27,500
It's bizarre.

599
00:38:28,140 --> 00:38:30,380
But this is such a new area.

600
00:38:32,020 --> 00:38:33,140
How am I doing my research?

601
00:38:33,960 --> 00:38:35,320
Well, I look on forums a lot.

602
00:38:35,380 --> 00:38:36,260
I don't know if I've mentioned that.

603
00:38:37,060 --> 00:38:37,740
I observe.

604
00:38:37,900 --> 00:38:39,160
I come to conferences like this.

605
00:38:39,280 --> 00:38:40,040
I talk.

606
00:38:40,120 --> 00:38:40,560
I watch.

607
00:38:41,280 --> 00:38:42,200
I make notes.

608
00:38:43,100 --> 00:38:43,920
Always anonymous.

609
00:38:44,060 --> 00:38:46,720
Never write down names, dates, or anything like that.

610
00:38:46,900 --> 00:38:47,920
I do online surveys.

611
00:38:48,100 --> 00:38:49,520
I ask people to fill in things.

612
00:38:49,800 --> 00:38:51,160
And I'm currently doing interviews.

613
00:38:51,960 --> 00:38:53,820
And when I'm doing all these things,

614
00:38:53,880 --> 00:38:55,420
what I'm looking for is examples of trust,

615
00:38:55,580 --> 00:38:57,020
decision-making, risk-taking,

616
00:38:57,720 --> 00:38:59,420
looking for similarities, differences,

617
00:38:59,720 --> 00:39:00,420
patterns in behavior.

618
00:39:01,580 --> 00:39:03,440
One thing that I really feel that is important

619
00:39:03,440 --> 00:39:06,220
in my research is the privacy and anonymity of hackers.

620
00:39:06,860 --> 00:39:08,620
I want to know how far they are aware

621
00:39:08,620 --> 00:39:09,420
of the group processes.

622
00:39:10,400 --> 00:39:12,160
I'm very aware of the possibility

623
00:39:13,100 --> 00:39:14,400
of participation and being trolled.

624
00:39:14,400 --> 00:39:16,560
In one of my early surveys,

625
00:39:16,720 --> 00:39:19,600
I had someone respond that they identified as a dolphin.

626
00:39:21,020 --> 00:39:23,620
And when asked why they use the internet,

627
00:39:23,800 --> 00:39:24,860
it was to hide their flippers.

628
00:39:26,280 --> 00:39:28,380
Someone else also gave their sexual identity

629
00:39:28,380 --> 00:39:29,420
as a jar of mayonnaise.

630
00:39:30,880 --> 00:39:32,540
I could be behind with the times.

631
00:39:32,700 --> 00:39:33,240
I don't know.

632
00:39:34,200 --> 00:39:36,960
There's also the potential risk of backlash.

633
00:39:37,160 --> 00:39:39,000
I'm standing up here giving all these opinions.

634
00:39:40,100 --> 00:39:41,340
People might not like it.

635
00:39:41,340 --> 00:39:44,260
They could decide to prank me,

636
00:39:44,300 --> 00:39:44,900
dox me, whatever.

637
00:39:46,220 --> 00:39:47,420
So far, it hasn't happened.

638
00:39:48,100 --> 00:39:49,020
Abuse on the forums?

639
00:39:49,260 --> 00:39:50,360
Yes, there has been some of that.

640
00:39:50,460 --> 00:39:53,320
I have been referred to with various four-letter words.

641
00:39:53,560 --> 00:39:55,720
And some people have said quite mean things about my mom.

642
00:39:56,800 --> 00:39:58,960
But she has assured me that they are not true.

643
00:40:01,240 --> 00:40:03,500
The data I'm collecting has been through online surveys.

644
00:40:03,960 --> 00:40:06,060
I've got really good responses from them.

645
00:40:06,120 --> 00:40:08,460
People have asked questions about it.

646
00:40:08,480 --> 00:40:09,360
They want to know about the ethics,

647
00:40:09,620 --> 00:40:10,840
why I'm doing the research,

648
00:40:10,840 --> 00:40:11,960
what it's going to be used for.

649
00:40:12,220 --> 00:40:13,720
Some people are obviously very cynical

650
00:40:13,720 --> 00:40:16,160
that my research can be used to infiltrate groups

651
00:40:16,160 --> 00:40:21,140
by agencies and law enforcement and things like that.

652
00:40:21,440 --> 00:40:23,760
The trouble with research is once it's out there,

653
00:40:23,840 --> 00:40:24,760
it's available to everyone.

654
00:40:25,100 --> 00:40:26,060
It's not my intention.

655
00:40:26,260 --> 00:40:28,880
I don't like the surveillance state.

656
00:40:31,100 --> 00:40:32,420
But it's a risk.

657
00:40:33,940 --> 00:40:35,140
So, just briefly,

658
00:40:35,300 --> 00:40:37,600
I'm going to share some of my initial results

659
00:40:37,600 --> 00:40:38,480
that I've got so far.

660
00:40:38,660 --> 00:40:40,260
I did an online survey.

661
00:40:41,060 --> 00:40:43,600
Across 30 websites and subreddits,

662
00:40:43,680 --> 00:40:45,120
I had over 150 responses,

663
00:40:45,320 --> 00:40:46,640
which I thought was pretty good,

664
00:40:46,760 --> 00:40:49,460
considering that not everyone wants to tell a researcher

665
00:40:49,460 --> 00:40:50,340
everything they do online.

666
00:40:51,200 --> 00:40:52,800
Four forums banned me entirely,

667
00:40:53,020 --> 00:40:55,000
but they were forums related to cracking.

668
00:40:55,200 --> 00:40:57,620
So I get the feeling that they didn't really care

669
00:40:57,620 --> 00:41:01,140
about anything that I might want to say.

670
00:41:02,280 --> 00:41:04,300
Unsurprisingly, the majority were male,

671
00:41:04,480 --> 00:41:06,940
6% female, 2% transgender.

672
00:41:07,820 --> 00:41:10,160
The age range was 16 to 63,

673
00:41:10,160 --> 00:41:11,540
which I thought was a pretty good spread.

674
00:41:11,780 --> 00:41:13,660
One thing that I think is often overlooked

675
00:41:13,660 --> 00:41:15,640
is that there is an older generation of hackers.

676
00:41:15,740 --> 00:41:19,260
Hacking and computers have been around for 30, 40 years.

677
00:41:19,760 --> 00:41:21,160
Some people don't stop.

678
00:41:21,320 --> 00:41:23,220
Some people just get older, have families, children,

679
00:41:23,420 --> 00:41:24,280
legitimate jobs.

680
00:41:24,420 --> 00:41:25,760
They can still enjoy hacking.

681
00:41:26,780 --> 00:41:29,820
So the stereotype of teenagers messing around in their room,

682
00:41:29,920 --> 00:41:30,620
true to a degree,

683
00:41:30,800 --> 00:41:33,680
but I think it's missing the point.

684
00:41:33,880 --> 00:41:36,960
The average age of all the people that took my survey

685
00:41:36,960 --> 00:41:37,520
was 30.

686
00:41:40,160 --> 00:41:42,000
So I don't know what that tells you.

687
00:41:42,780 --> 00:41:43,260
Millennials.

688
00:41:45,200 --> 00:41:47,000
So hopefully you can see this all right.

689
00:41:47,060 --> 00:41:49,360
One of the questions that I asked was,

690
00:41:49,540 --> 00:41:50,700
do you consider yourself a hacker?

691
00:41:50,780 --> 00:41:53,040
Bearing in mind every single forum or subreddit

692
00:41:53,040 --> 00:41:53,940
I posted this on,

693
00:41:54,060 --> 00:41:57,480
I had found through searching for hacking, cracking, coding,

694
00:41:58,640 --> 00:42:00,240
white hat, black hat, skid,

695
00:42:00,260 --> 00:42:01,820
all these different things,

696
00:42:01,900 --> 00:42:03,620
as many different variables as I could think of,

697
00:42:03,660 --> 00:42:05,920
everything was related in some way to hacking.

698
00:42:07,300 --> 00:42:08,960
Over 150 did the survey.

699
00:42:08,960 --> 00:42:12,300
52% said that they would say that they were a hacker.

700
00:42:13,260 --> 00:42:14,380
Just over half.

701
00:42:14,520 --> 00:42:16,080
I found that really interesting.

702
00:42:16,200 --> 00:42:18,560
On these websites specifically for hacking,

703
00:42:19,000 --> 00:42:22,720
just under half the people didn't think that they were a hacker.

704
00:42:24,460 --> 00:42:27,200
So of the people that said yes, that 52%,

705
00:42:27,200 --> 00:42:29,520
I asked them to categorize themselves further.

706
00:42:30,800 --> 00:42:33,260
So gray hat, white hat, cyberpunk,

707
00:42:33,420 --> 00:42:35,040
hacktivist, other, I disagree.

708
00:42:35,860 --> 00:42:38,940
Black hat, script kiddie, elite, and cracker.

709
00:42:39,520 --> 00:42:44,060
To be honest, I thought I disagree would have more responses.

710
00:42:44,440 --> 00:42:47,720
Just to say they could select more than one option,

711
00:42:47,820 --> 00:42:50,200
so please don't try and make sense of the percentages.

712
00:42:50,460 --> 00:42:56,040
It's the percentages of that number of participants, not of.

713
00:42:56,660 --> 00:43:00,240
So obviously a lot of people categorize themselves as a gray hat

714
00:43:00,240 --> 00:43:01,400
as well as other things.

715
00:43:02,480 --> 00:43:04,480
That's kind of fascinating for me

716
00:43:04,480 --> 00:43:07,920
because that's such an ill-defined thing.

717
00:43:07,920 --> 00:43:10,040
Black hat, yes, you can say black.

718
00:43:10,220 --> 00:43:12,820
You do nefarious things, dark.

719
00:43:13,200 --> 00:43:15,660
White hat, you have to be ethical, pure, everything else.

720
00:43:15,820 --> 00:43:17,260
Gray, it could be anywhere in between.

721
00:43:17,620 --> 00:43:18,780
You could be bang in the middle.

722
00:43:18,900 --> 00:43:20,300
You could be just a shade lighter.

723
00:43:20,800 --> 00:43:21,760
What does it mean?

724
00:43:21,880 --> 00:43:25,360
What are they actually categorizing themselves as?

725
00:43:27,720 --> 00:43:31,060
So I also did a couple of questions on privacy anonymity.

726
00:43:32,020 --> 00:43:34,060
Shockingly, people in hacking communities

727
00:43:34,060 --> 00:43:36,240
think that privacy is important

728
00:43:36,240 --> 00:43:37,940
and it should be protected

729
00:43:37,940 --> 00:43:40,080
and they take precautions with it.

730
00:43:40,680 --> 00:43:42,100
The same with anonymity.

731
00:43:42,360 --> 00:43:44,200
Anonymity is an important feature of the internet.

732
00:43:44,320 --> 00:43:45,040
It should be protected

733
00:43:45,040 --> 00:43:48,280
and they take steps to make sure that they are anonymous online.

734
00:43:50,060 --> 00:43:51,600
Then it got a bit more interesting.

735
00:43:52,100 --> 00:43:55,820
Online security should take priority over personal privacy.

736
00:43:56,120 --> 00:43:57,820
There was a mixed feeling about this.

737
00:43:58,360 --> 00:44:01,700
And then I asked if people try and find flaws and weaknesses

738
00:44:01,700 --> 00:44:03,140
and a lot of people said yes.

739
00:44:05,440 --> 00:44:05,940
Now,

740
00:44:06,240 --> 00:44:07,720
this next slide,

741
00:44:07,840 --> 00:44:10,920
when I presented this to the computing side,

742
00:44:12,320 --> 00:44:15,080
they had more of a surprise reaction.

743
00:44:15,900 --> 00:44:16,380
So,

744
00:44:16,860 --> 00:44:18,240
I don't know how well you can see,

745
00:44:18,300 --> 00:44:19,020
but the blue lines

746
00:44:19,020 --> 00:44:22,320
are that the weaknesses and flaws should be exposed.

747
00:44:22,680 --> 00:44:25,020
The green lines are that they should be exploited.

748
00:44:26,360 --> 00:44:29,220
Bearing in mind the idea that all hackers are bad and evil

749
00:44:29,220 --> 00:44:30,100
and do bad things,

750
00:44:30,600 --> 00:44:33,140
it's very surprising that actually a lot of them,

751
00:44:33,180 --> 00:44:33,560
the majority,

752
00:44:33,880 --> 00:44:35,240
say that they should be exposed.

753
00:44:35,240 --> 00:44:36,060
But exploited,

754
00:44:36,240 --> 00:44:38,220
there's not a strong agreement there.

755
00:44:39,320 --> 00:44:39,800
So,

756
00:44:39,900 --> 00:44:42,400
it's obviously not as black and white

757
00:44:42,400 --> 00:44:43,600
as people would like to believe,

758
00:44:43,780 --> 00:44:46,700
which ties in nicely with the grey hats being the highest category.

759
00:44:48,280 --> 00:44:48,760
So,

760
00:44:48,780 --> 00:44:49,540
what am I doing next?

761
00:44:50,120 --> 00:44:52,200
I'm conducting interviews with volunteers.

762
00:44:52,320 --> 00:44:53,660
If anyone would like to volunteer,

763
00:44:53,820 --> 00:44:54,820
then that would be super.

764
00:44:55,880 --> 00:44:58,160
If you think I've said something really ridiculous,

765
00:44:58,420 --> 00:44:58,900
tell me,

766
00:44:58,960 --> 00:44:59,920
but tell me why.

767
00:45:00,540 --> 00:45:03,120
Don't just send me messages saying that you think I'm an idiot.

768
00:45:03,580 --> 00:45:04,280
That's rude.

769
00:45:04,280 --> 00:45:06,140
And I've been taught not to be rude.

770
00:45:07,360 --> 00:45:09,760
My next surveys are going to focus more on trust,

771
00:45:10,000 --> 00:45:10,640
decision making,

772
00:45:11,160 --> 00:45:12,840
how people work in groups.

773
00:45:13,000 --> 00:45:14,160
If you think there's something I've overlooked,

774
00:45:14,420 --> 00:45:14,780
tell me.

775
00:45:14,800 --> 00:45:16,260
I can only do better research,

776
00:45:16,360 --> 00:45:18,540
which will go out to the general public,

777
00:45:18,680 --> 00:45:20,860
if people help me.

778
00:45:21,660 --> 00:45:22,620
And of course,

779
00:45:22,620 --> 00:45:23,700
I'm always going to lurk more.

780
00:45:25,200 --> 00:45:25,640
So,

781
00:45:25,700 --> 00:45:27,520
my conclusion for my research so far,

782
00:45:27,780 --> 00:45:30,000
hackers are actually interested and informed groups.

783
00:45:31,380 --> 00:45:32,880
People want to share their thoughts.

784
00:45:33,020 --> 00:45:34,260
People want to improve the interest.

785
00:45:34,260 --> 00:45:34,820
They want to know more about the internet and security.

786
00:45:35,300 --> 00:45:37,440
I worry about where the internet is going.

787
00:45:37,640 --> 00:45:40,960
I like that there are people that take an active interest

788
00:45:40,960 --> 00:45:45,560
in making sure it goes in a fair and equal direction.

789
00:45:47,300 --> 00:45:48,160
Being a hacker,

790
00:45:48,280 --> 00:45:48,980
being aware of security,

791
00:45:49,220 --> 00:45:50,040
being aware of the risks,

792
00:45:50,160 --> 00:45:51,680
it doesn't make you infallible to the influence.

793
00:45:51,940 --> 00:45:53,020
Being aware of the group processes,

794
00:45:53,180 --> 00:45:54,100
you can still be vulnerable.

795
00:45:54,980 --> 00:45:56,480
I think it's important to highlight

796
00:45:57,840 --> 00:46:00,060
the significance of social psychology,

797
00:46:00,700 --> 00:46:02,500
especially in online communities and,

798
00:46:02,600 --> 00:46:03,480
I mean, social engineering.

799
00:46:03,480 --> 00:46:04,740
It's right there.

800
00:46:05,460 --> 00:46:07,600
And just to bear in mind that

801
00:46:07,600 --> 00:46:08,820
you can have different identities,

802
00:46:08,900 --> 00:46:10,080
different motivations,

803
00:46:10,140 --> 00:46:11,340
but ultimately,

804
00:46:11,460 --> 00:46:12,640
we're all in the same social space.

805
00:46:13,500 --> 00:46:14,860
Thank you very much for listening.

806
00:46:21,040 --> 00:46:23,540
I have four minutes left.

807
00:46:23,700 --> 00:46:24,860
Does anyone have any questions?

808
00:46:28,540 --> 00:46:29,060
Yes?

809
00:46:30,920 --> 00:46:31,440
Naughty.

810
00:46:33,560 --> 00:46:35,720
You just said one more time.

811
00:46:35,800 --> 00:46:36,760
You can't then say another.

812
00:46:38,680 --> 00:46:39,320
Naughty.

813
00:46:42,240 --> 00:46:43,900
Your research is very interesting.

814
00:46:44,000 --> 00:46:46,220
Have you found any interesting differences

815
00:46:46,220 --> 00:46:48,580
between groups in terms of values,

816
00:46:48,640 --> 00:46:51,040
how they see themselves or unexpected results?

817
00:46:51,720 --> 00:46:54,080
So did everyone hear that?

818
00:46:55,040 --> 00:46:57,720
What are the differences between groups?

819
00:46:58,200 --> 00:46:59,900
Are there any interesting results?

820
00:47:00,860 --> 00:47:03,460
So far, when people have categorized groups,

821
00:47:03,460 --> 00:47:03,860
they tend to categorize themselves.

822
00:47:04,160 --> 00:47:05,980
They tend to be dismissive of the other groups,

823
00:47:06,100 --> 00:47:07,860
which fits with the traditional,

824
00:47:08,100 --> 00:47:09,320
I like my group,

825
00:47:09,360 --> 00:47:10,900
I don't like anyone that's not in my group.

826
00:47:12,980 --> 00:47:16,200
The easiest, most obvious one of that

827
00:47:16,200 --> 00:47:17,760
is black hats versus white hats.

828
00:47:18,860 --> 00:47:19,940
It's interesting, actually.

829
00:47:20,020 --> 00:47:22,460
There's quite a lot of derision towards script kiddies

830
00:47:22,460 --> 00:47:23,560
in forums.

831
00:47:23,660 --> 00:47:26,380
That's often used in a derogative term.

832
00:47:27,140 --> 00:47:29,580
But people still identify themselves as script kiddies,

833
00:47:30,380 --> 00:47:31,980
which is kind of interesting.

834
00:47:31,980 --> 00:47:33,860
I mean, it's not supposed to be something

835
00:47:33,860 --> 00:47:34,600
that you aspire to,

836
00:47:34,700 --> 00:47:35,420
but they're still saying,

837
00:47:35,560 --> 00:47:36,240
yep, that's me.

838
00:47:36,660 --> 00:47:39,440
So I'm sure there's a lot more to come.

839
00:47:40,340 --> 00:47:40,740
Okay.

840
00:47:41,220 --> 00:47:41,700
Yeah?

841
00:47:42,380 --> 00:47:43,360
You were in Germany.

842
00:47:43,580 --> 00:47:45,200
Your research is quite fascinating

843
00:47:45,200 --> 00:47:48,040
because you are doing research,

844
00:47:48,160 --> 00:47:49,540
you know, like, people have done

845
00:47:49,540 --> 00:47:50,920
a tremendous amount of research

846
00:47:50,920 --> 00:47:52,500
on groups in the real world.

847
00:47:52,920 --> 00:47:55,120
Your research is in the virtual world.

848
00:47:55,420 --> 00:47:57,260
Were there any points bearing you,

849
00:47:57,400 --> 00:47:58,760
from varying contrasts,

850
00:47:58,820 --> 00:48:01,260
that, like, how the behaviors

851
00:48:01,260 --> 00:48:01,920
are going to differ?

852
00:48:03,020 --> 00:48:04,220
There's the aim to.

853
00:48:04,560 --> 00:48:07,720
Mostly I'm using social psychological theory

854
00:48:07,720 --> 00:48:09,940
to see if the behaviors match.

855
00:48:11,340 --> 00:48:12,660
In terms of comparing,

856
00:48:13,000 --> 00:48:14,940
it's quite difficult to think of scenarios

857
00:48:14,940 --> 00:48:15,760
where it would be.

858
00:48:16,180 --> 00:48:16,840
I mean, I've had people,

859
00:48:18,020 --> 00:48:20,060
there's a forensic psychologist at my university

860
00:48:20,060 --> 00:48:21,900
who started talking to me about criminology

861
00:48:21,900 --> 00:48:24,060
and how you compare hacking communities

862
00:48:24,060 --> 00:48:25,580
and crime gangs.

863
00:48:26,200 --> 00:48:27,120
And I was like,

864
00:48:27,160 --> 00:48:29,820
that's not quite what we're doing here.

865
00:48:29,820 --> 00:48:33,020
So I think there's definitely

866
00:48:33,020 --> 00:48:35,460
a research area there,

867
00:48:35,560 --> 00:48:37,480
but you've got to be careful with it

868
00:48:37,480 --> 00:48:39,920
because you could go down the wrong track.

869
00:48:42,240 --> 00:48:42,960
Yep?

870
00:48:43,220 --> 00:48:44,720
Did you make an attempt

871
00:48:44,720 --> 00:48:47,120
to cross-check your data

872
00:48:47,120 --> 00:48:49,960
that you got from surveys

873
00:48:49,960 --> 00:48:53,080
with non-survey-based data

874
00:48:53,080 --> 00:48:55,140
to be less subjective?

875
00:48:55,760 --> 00:48:57,040
The trouble is,

876
00:48:57,120 --> 00:48:58,820
there isn't a whole lot of data

877
00:48:58,820 --> 00:48:59,740
about hackers.

878
00:49:00,100 --> 00:49:01,660
You guys are kind of secretive.

879
00:49:03,340 --> 00:49:05,500
I am trying,

880
00:49:06,020 --> 00:49:08,640
and there are various other studies out there.

881
00:49:08,700 --> 00:49:10,800
There was a paper from a few years back

882
00:49:10,800 --> 00:49:12,460
where people had done data collection

883
00:49:12,460 --> 00:49:13,120
here at DEF CON.

884
00:49:13,700 --> 00:49:14,660
It's a terrible paper.

885
00:49:16,160 --> 00:49:17,820
I'm not going to say what it is, actually,

886
00:49:17,880 --> 00:49:19,020
because I'm still being recorded.

887
00:49:21,160 --> 00:49:23,300
But no, I disagree with their methodology.

888
00:49:23,460 --> 00:49:24,460
I disagree with their conclusions.

889
00:49:24,740 --> 00:49:25,380
I think the whole thing

890
00:49:25,380 --> 00:49:26,520
was very poorly thought through.

891
00:49:26,520 --> 00:49:28,120
And that's the trouble,

892
00:49:28,240 --> 00:49:30,400
even when you can find other data,

893
00:49:30,540 --> 00:49:33,400
is that it might not actually

894
00:49:33,400 --> 00:49:34,940
have been as well done as it could have been.

895
00:49:35,500 --> 00:49:36,520
One more question?

896
00:49:36,900 --> 00:49:37,480
Yeah?

897
00:49:38,520 --> 00:49:40,480
In studying online communities,

898
00:49:40,820 --> 00:49:41,820
were you making a distinction

899
00:49:41,820 --> 00:49:44,820
between members who meet up

900
00:49:44,820 --> 00:49:47,160
in face-to-face interactions

901
00:49:47,160 --> 00:49:49,080
like at DEF CON or .

902
00:49:49,080 --> 00:49:52,240
And those that are purely online

903
00:49:52,240 --> 00:49:55,120
with no face-to-face opportunity?

904
00:49:55,720 --> 00:49:57,920
So my focus is the purely online,

905
00:49:58,220 --> 00:50:00,180
but I ask about offline extensions

906
00:50:00,180 --> 00:50:02,200
and I treat it as such.

907
00:50:02,480 --> 00:50:04,440
So I ask how they got into it,

908
00:50:04,460 --> 00:50:05,300
whether they were introduced

909
00:50:05,300 --> 00:50:06,240
by an offline connection

910
00:50:06,240 --> 00:50:08,320
or if they made the offline connections

911
00:50:08,320 --> 00:50:09,460
through the online.

912
00:50:09,980 --> 00:50:11,600
So I try and find it out that way.

913
00:50:13,240 --> 00:50:14,820
I think that's it.

914
00:50:14,940 --> 00:50:16,120
If anyone has any other questions,

915
00:50:16,240 --> 00:50:17,340
feel free to come find me.

916
00:50:17,400 --> 00:50:19,920
All my contact details are up there

917
00:50:19,920 --> 00:50:21,100
and I love getting messages.

918
00:50:21,440 --> 00:50:22,100
Thank you.

919
00:50:25,120 --> 00:50:25,660
Thank you.