We're going to give our attention to Helen Thackray. She's not Australian. She's a Ph.D.
student from Bournemouth University in the U.K. and she finds humans and computers
fascinating. She'll now attempt to explain some of the psychological group factors behind why
hackers are always going to hack. Her theme is hackers going to hack, but do they know why?
Let's give her attention.
Hello. Yeah, I'm very definitely English if the accent doesn't give it away for you.
I just wanted to say when I found out in the schedule that I was following Chris, I was
slightly nervous and then following that, good lord, but I just wanted to say that's
an amazing project and I just want to give another round of applause for it because I
think it's such a worthwhile course.
So on to a much lighter topic. Hackers going to hack. Obviously you guys have some
vague interest in this, otherwise you wouldn't be at DEF CON. I have to say this is slightly
surreal for me because last year I was here, it was my first DEF CON, came to the social
engineering village and it just blew me away. It was awesome. And I really love the
emphasis on education, helping people and coming here today and listening to the
talk. Again, it just emphasizes what I do in part of my research, which is looking
at the other side of hacking. Not just the stereotypes, the black hats, the cyber criminals,
but looking at what hackers can do that people don't realize what goes on behind the scenes.
So yeah, my name is Helen Thackray. I'm from Bournemouth University. I've got my main supervisor
John McElhaney in the audience. If you speak to him, he's a lovely, softly-spoken Scottish
man. Sometimes I don't always understand what he's saying. But we muddle through. So just
briefly about me because I'm pretty sure no one's heard of me. I'm a PhD student. I'm at the
end of my second year of research. I've got funding for another year and I hope to finish in
that time because otherwise it's going to get really expensive. I'm from a small, well, I'm
not from, but I study at a small town on the southern coast called Dunedin. It's a small town
called Bournemouth. I drew a red arrow to help you. It's not particularly exciting but the
university makes up for it. If you don't like the C word, cover your ears because I'm in the
field of cyber psychology. I didn't name it. It's not my fault. I also work with cyber
security. So I'm in psychology and computing. Brief shout out to the cyber security research
group headed by Dr. Shemelle Faley who helped with funding for this. Other than that, I'm a
student. I've got no external connections or funding. It's the university funding this
project. So just quickly, I realized I was quite flippant in my bio on the SEO, the social
engineering website. Everyone else was listing all their qualifications and years of
experience and I made a joke about the fact that the university pays me to go on the
internet. I do have a bit of an odd background. I'm very much the social science and human
humanities. My first degree was joint in Italian and politics. The Italian didn't stick so
much but the politics, I got really into political identity, social identity, why people choose
the politics they do, what unites political parties and the whole personality of it. So with
political parties, there's a lot about the identity of the leader, how they present
themselves and I thought that was really interesting. From that, I moved into contemporary
identity and sociology and on a slightly different note, I looked at identity in cancer
patients because you can exist, you have your whole self, you define yourself and then
suddenly you get a diagnosis which completely changes your world. And how do you deal with
that? How do you deal with people treating you differently? And that was really fascinating.
I had some wonderful participants. But it led me to still enjoy social identity and
what it is to be a social scientist. I think it's really fascinating. I think it's really
interesting that people believe makes them them, how they choose, what they choose, what
they do if they can't choose. So how that came about to me studying the Internet or
people on the Internet, I have always been a very curious child. My mother told me the
story when I was about five, coming back from school, kindergarten. There was a house, a
door was open to a house on the street that we were walking down and I decided I wanted
to go in it. And my mother said, well, you can't just go into people's houses. And I said, but,
mom, I'm a very rude and nosy child. I'm going in. And to five-year-old me, that was perfect logic.
I've become less rude about it, but I'm still incredibly nosy. I want to know the answers to
things. I also quite like watching people from a safe distance, which sociology, Internet
research, perfect. Also, I really like lurking on online forums. It's a terrible habit. I've been
doing it since I was about 13. Weirdly, I've been doing it for a long time. I've been doing it for a
long time. On an air gun forum was where I started. And if anyone here is British, you will
know how peculiar that is. The UK has very strict gun laws. Air rifles are allowed for hunting,
pest control, and target practice. As a 12-year-old vegetarian who loved her pet rabbit, I
did not have a lot in common with the people on the air gun site. But I had a neighbor who got
into it. There were jokes going on. Someone had stolen his team mascot and was sending photos,
sending it around the world. It was hilarious.
And I loved it, the joke, the in-jokes. So I started hanging out on this air gun forum, obviously
not talking about air guns ever. But I loved getting to know the characters, the people, the
in-jokes, how they talked about representing themselves as a whole. And without actually
realizing it, I was doing sort of ethnographic research on this community. I was sitting there
reading about them, learning about them. And to be honest, ever since, I've been finding online
communities to do the same things to. I'm kind of creepy.
So my talk today, basically, I'm going to talk about a little bit about social psychology, social
identity. And then I'm going to look more at group processes. So everyone knows that you act in a
certain way depending on who you're around. Like if you're with your mother or your father, maybe
you swear less than you would with your friends. If you're with your partner, you'll be a little
bit more sensitive than you would with maybe your brother.
It all depends. So basically social psychology boils down to all human behavior is influenced by the
presence of others, either whether it's real or imagined. So for example, standing in a lift by
yourself, you might act completely as you want to. You could fart, pick your nose, whatever. Then
you remember that there's a security camera in the top corner. And then you think, ah, someone will
have seen that. You will modify your behavior because you think someone will be able to watch me.
And then you think, ah, someone will have seen that. You will modify your behavior because you think someone will be able to watch me.
And I think one thing that gets forgotten is that when it comes to infosec and cybersecurity, is that this is all
coming from behavioral actions. There is always a wider social context. It doesn't matter what end of
the line you are, there are always people behind the computers. And people are fallible. And open to
influence. So one thing that I do find interesting when I talk about my research is that the group
processes that I'm going to go through, they're a little bit different than what I'm going to go through. They're a
little bit different than what I'm going to go through. They're a little bit different than what I'm going to go through. They're
applicable to hackers and people in hacking communities. But they're also applicable to infosec
practitioners. There are a lot of similarities. Even if you have a very different viewpoint, you've got a
lot of the same skill sets. Coding, finding access, having imaginative creative ways of thinking,
finding and fixing a problem. Not to mention that curiosity. So social identity. Basically, the
world is chaotic and confusing. We make it a lot easier for ourselves. We make it a lot easier for
ourselves by categorizing everything. Some things we put a lot of thought into. Other things we just go
with, well, that looks similar to that. So we want the mental shortcuts. We don't want to use all our
energy up basically analyzing and categorizing every single thing we see. It's too difficult. The
human brain, it just gets exhausted. So we put ourselves and others into groups. And these are
called identity groups. So you might choose to identify yourself. You might choose to identify yourself
as a person. For example, there's a joke that I'm not Australian. I'm not quite sure where that joke's
come from, but I'm not Australian. I'm British. I'm also European. Sod Brexit. I'm also English. I'm a
female. I'm quite posh sounding. I don't like sports. I think my hobbies are just lurking on the
internet, actually. Which is a great hobby.
I fully recommend it. But yes, we all have these different ways that we categorize. Looking at me, you
guys will have mentally categorized me somehow. And yes, I do like tea. It's a wonderful drink. I don't
understand why you guys haven't embraced it fully. I hear there was something about Boston and a
party and it went wrong.
That was Brexit 1776.
Good to know. Thank you. So the identity groups that we put ourselves in, they're important to us. We
get a sense of pride, a sense of self-esteem. If our group looks bad, it reflects badly on us. The
choices that we make, we ascribe to our group, and we want people in our groups to have similarities to
us, whether this is true or not. This is what we tell ourselves. So our self-image is related to the
reputation of the group. Going back to human factors and infosec, one of the tropes that really
bugs me is people who have a lot of experience with the work they do. They're not experts. They're not
like to say people are the weakest link. Now I can't say that's actually wrong because you
know what? Everyone has a bad day. Everyone makes a mistake. I remember last year when I was
listening to Chris talk he told the story of how he actually fell for a phishing scam, an
Amazon link because it came at the right time in the right place when he was stressed and busy
and getting organized for Defcon and he'd ordered things from Amazon. He was expecting emails
from Amazon. He got an email from Amazon and he fell for it. It doesn't matter how well
informed you are, how much you're expecting it, all it needs is the wrong moment, something to go
wrong. You can be having a bad day. It doesn't mean that you're not smart enough or informed
enough to be able to understand. So although people are the weakest link and some people
really, really do need more education on it, we're also, we need to give ourselves more credit
as a species. We've done quite a lot with technology. I mean even just coming to Defcon you
can see people being so inventive and creative.
Basically I'm just being a little cheerleader for the human race. It's not all terrible.
One thing that's emphasized in InfoSec and when thinking about human factors is the fact
that there are very different ways of thinking. So there is the stereotype that computing
likes to be more logical, calculated, analytical and psychology is a bit sort of fluffy and
it's all about emotions and talking about how you feel. I have to be honest, I don't
really want to know how any of you feel.
But I think you can't have just one to make a good security. You need a team of both.
And as my slide shows, I feel that Kirk and Spock are a good example of this. I know it's
slightly flawed because Spock is half human, but go with it. So in terms of having the logic,
you can have the most logical tool. You can create a perfect program. But as a comparison,
what if people decided to make a hammer round instead of with a spade? Well, that would be
a straight handle because that way it's more efficient. You use more of the tree because
you cut off rounds, you hollow it out, you put the hammer on. But you've got a hammer
that a person can't use. That's not a useful tool. So although it may be less efficient
in use of wood for the tree, a straight handle means more people can use it. More people
are going to hit the nail on the head. And that's what you want. So when you're making
a good tool, it has to be understood that it's for human beings. And I think this is
something that's coming to the front more and more in InfoSec discussions. I've been to a
lot of hacking conferences and things like that, and more and more, they're driving home.
You have to think about the people. It's the human element that needs to be worked on really.
So this might be a little controversial. I fully understand that there are very different
definitions and everyone has their own interpretations. But for the point of this talk and for simplicity,
when I say hacker, I'm referring to a computer hacker.
And someone who has the ability to access a computer system without permission, without
admission. They can find their way around. They can be creative. I put hacktivist there as well
because I think it's a separate thing. Political, social dissatisfaction means that they're using
computers for a purpose related to that. They're not just doing it for the curiosity. They're not
just doing it to get access. They have a different motive. Other thing, I definitely feel that
a hacker is not the same as a cyber criminal. People that are doing their scams in order to get
money, that's not a hacker. So when it comes to the hacker's social identity, it's quite a
difficult thing to define because, of course, everyone has their own interpretation. There are so
many different subcategories, black hat, white hat, gray hat, ethical, skid, elite. There are some
people that say that ethical hackers don't exist. There are some people that say skids don't
exist. It all gets very subjective. So I think it's important to understand that there's a lot of
people out there. So hackers, they're an imagined community. This is a sociological term. It
was coined by, I want to say, Benedict Anderson in Australia when he was talking about
nationalism because there were people all across Australia that were united in the idea that
they were Australian, even if they were from different ethnic backgrounds, different political
views, what it meant to be Australian. So there was no physical or geographical connection. It's
just a socially constructed community. And it's created through the strong interests of the
community, strong choice of interest and identity. And if that doesn't fit to hacking, I don't
know what does. And as you can see, from being a part of this, hackers create groups. They give
expertise, support, training, guidance, encouragement, so much to help people get further, which I
think is amazing. So just briefly, this is someone else's diagram, but I really like it, so I
use it. He says, I don't know what to do. I don't know what to do. I don't know what to do. I don't
basically, Cbrooke broke up into five basic categories. This does not cover all definitions, all
possibilities, all motivations, but bear with me. Breaking it up into these five basic
categories, you can see the different reasons why people might get involved in hacking. Those are in
the bracket around the outside. The more sophisticated the level is, the closer to the edge of
the circle. And the type is by the dots. So, for example, if you hack for prestige, you're a coder.
You're not hacking for the would. If you're not hacking for an application, you're hacking for a
doing it for any particular reason apart from to show that you are the best of the best of the
best. You're doing it to prove that you can. And it doesn't matter what, you know, the general
public think, what the noobs think. You're doing it to show other people that you know who have
the skills that you can do it too. Recreation, people that are just, you know, having a look
around, playing, doing it for fun. Revenge, crowd sources, insider threats, things like
that. Profits, in my mind, that's the most boring category because it tends to just be the
criminals. Although I feel there should be some sort of subcategory for people who are in the
business of information security. But there you go. And then ideology, you've got the
hacktivists, cyber warriors, people fighting for a cause. So back to the social psychology of
individuals and groups. I just thought this quote was quite apt from Men in Black. Agent K
said...
I don't think that's the entire truth, but I think it can be agreed that people behave very
differently by themselves versus in a big group. When it comes to the panic, I'm not going to be
discussing mass panic behavior changes in that because that's an entirely different thing. But
you bring people together in a group, it changes things. So, for example, I'm going to say you
guys are group A. You guys are group B. You guys are group C. You guys are group D. You guys
are group A. You guys are group B. I'm going to come back to that. So one of the things, more
common things that you might have heard of when it comes to group changes is group think. It's
from the 1970s. And basically, it's a psychological need to have consensus. It doesn't
matter if you have to suppress disagreement. It doesn't matter if you have to ignore
individuals' opinions. You don't look at all the information, but you want consensus. You
want agreement. Symptoms of it are the group thinks that they're invulnerable.
Regardless of the reality. They collectively rationalize their decisions. Even if there is
evidence to the contrary, they, you know, disregard that. They have stereotyped views of
different groups rather than, you know, looking at what they're actually made up of. There is
the group pressure to conform. And people tend to self-censorship. So even if they don't agree,
they will suppress their own views. No one else has to say anything to them. But to stay in the
group, they will stay quiet. Group thinks have been found to be more powerful than group
think. It's more common when the groups are tightly bonded, more cohesive, especially in a
high-pressure situation. If there's a lot of pressure on, they need a decision quickly, group
think emerges. However, group think also reduces the possibility of success. So they come to a
conclusion, it's more likely to be wrong. And the pressure for agreement makes people think more
irrationally. It makes them vulnerable. It's just generally not a good thing.
Informational influence. So this is the desire to be correct. No one wants to be wrong. No one wants
to stand up in front of a crowd like this and say the wrong thing. This is why I have names and dates
in there. So I can say it wasn't me that said this. This is the study. Sources are important.
We instinctively look to other people to see how we should behave. What is acceptable? What is the
norm? So for example, if you go to the U.K. and you see people queueing, you queue properly. Not
not that that's a pet peeve or anything.
You get the information and news from the group.
You tend to believe it because you assume the judgment of other peoples
is going to be more reliable than your own.
Therefore, the group view is the correct view.
You don't want to be excluded from the group.
You don't want to be the odd one out.
You don't want to be the difficult one.
You want to be accepted as part of a group.
Therefore, you behave as they would want you to.
Similarly, you've got the normative influence, pressure to conform to the norms.
So, for example, online you have this by obeying the laws of a forum.
I don't know if anyone's actually sat down and read them,
but I go on a lot of hacking forums.
I read all the rules.
All of them are very similar.
All of them saying, don't do this, don't do this, it's illegal,
no money, no anything else, and then everyone ignores it, obviously.
But they say it.
That's not how they behave, though.
So they have the written rules, and then they have the norms.
So even if an individual doesn't agree with,
the norm of the group, they still won't speak up because they want to stay in the group.
It's also been found that if people express an opinion and other people say,
yeah, no, I agree, then that will encourage the person to give a stronger opinion,
a more polarized opinion, and there are links to groupthink and the conflict between groups.
Also, a very important factor as to whether or not people conform to the norm,
which rhymes, is whether or not they're being watched by a larger group.
You behave better if you think there are security cameras around.
This is why people have fake cameras.
Yeah, so, it's interesting how we can ascribe certain behaviors to other people
because that's who they are, but ourselves, no, we're different, we're better.
We know our motives.
We judge others by their actions, ourselves by our intentions,
and I love this cartoon, XKCD, for those that don't know, but you probably do.
Because, yeah, everyone might be thinking exactly the same thing as you.
Why is no one saying anything?
Why is no one disagreeing?
But you don't.
Why don't you?
So, you're in this group.
You want to stay in this group.
You belong to this group.
Because you belong to the group, you want to feel good about being in this group.
So, group A, you guys are some snappy dresses.
You're all looking good there.
That's very nice.
So, you find good things about the group,
have to also discriminate and find negative things about the other group.
No offense, guys.
I love the bunny ears.
That becomes a them versus us, just social categorization.
So, by putting you in two groups and saying slightly different things,
you might feel more like a group than you would if I just left you all alone
and not said anything about it.
But just by putting people into a group, they assume the group identity.
If I'd said all blue-eyed people,
go to the left, all brown-eyed people, go to the right,
there would be a bigger group.
They would be the majority.
The minority might feel that it's not so fair.
Everyone in the brown-eyed group could have a chair,
but all the blue-eyes have to stand.
That's not fair.
Why would you do that?
And you can create tensions and rivalry and competitiveness that doesn't need to be there
just by arbitrarily grouping and categorizing people.
Stereotyping also exaggerates the difference.
It can also make you think that you've got more than one group.
You've got more in common with another group than you actually have.
So, groups, as with giving a stronger opinion because you're in a group,
they become more polarized.
So, you can go to more of an extreme.
I think politics is a great example of this, but I'm not going to go into politics.
So, when you're in a group, how do you, especially online,
how do you know if you're in a group or not?
I mean, there's no list where you sign up your name.
There's no, I mean, you can actually register for forums,
and you can be able to do that.
There's no group member in that sense.
But, for example, 4chan, Triforcing, they've come up with a way to signal
whether you are in or out.
And I quite like this as an example because I think it's quite clever.
So, the Triforce, I'm sure most people are familiar with.
It's from a video game, and it's basically placing those three little red triangles correctly.
If you copy and paste it, it will come out incorrectly.
So, what they like to do is someone starts the thread with the Triforce,
someone copies and pastes, it looks correct until they hit submit,
then it comes out wonky.
Everyone can see that they don't know how to Triforce.
It's a way of outing yourself.
Not that it particularly matters on 4chan because everyone's called anonymous,
but in this picture, in this example, someone had said,
oh, here's one that you can copy and paste.
Another person did the correct Triforcing to make it seem believable,
then someone tried to copy and paste, got it wrong, everyone laughed.
So, there's subtle ways that you show whether you're in the group or not.
People that are wearing DEFCON t-shirts from previous years,
they're saying, I've been coming to here for years.
People with loads of badges around their neck, I'm involved in all these different villages,
and I've been to all these different talks, I've done these different challenges.
There's ways that you are telling people you are part of the group.
So, when it comes to conflict within groups, why does it happen?
You've got a big, happy group A, why would you guys all fall out?
You could disagree about what's acceptable.
You could say, you know, sitting there, playing on your phone,
that's not what group A does, you need to go to group B if you want to do that.
I'm not sure you should start doing that.
This is the conflict within groups.
We've done against groups.
So, people can have different motivations, different goals.
When it came to 4chan merging into becoming anonymous because the hacktivist group Anonymous,
it started on 4chan, started out people trolling and pranking and generally having a good time.
And then some people were like, hey, let's use this for a cause.
Let's do this to wind up, you know, people that we don't like, like Scientology, Church of Scientology.
And it got to a point where the original prankers were like, well, I don't want to be doing this for a good cause.
I just want it to be a nuisance.
And so they had to split between the people that wanted to prank and the people that wanted to have a good cause.
When a group gets too big and too diverse, it's natural that it falls apart to a degree.
There's only so many resources around and cooperation can turn into competition.
It's also, especially in the hacking situation, it's interesting how people divide along what is and isn't acceptable in order to achieve the goals.
So it's black hat hackers versus white hat hackers.
How real it is can be hard to tell from my point of view.
One of the other things that a group process that affects people is impression management.
Groups want to control how they're seen.
They have a brand.
They have a reputation.
And they have to maintain it.
They have to control the information that goes out, influence the perception that other people have.
The use of this in online media is really interesting.
Twitter is great for it.
Some people are very, very careful about what they tweet.
It has to be approved.
Others, Donald Trump, not so careful.
Not so, I know, sorry, I said I wouldn't do politics, but it's hilarious.
Yeah, so even when you're just coming to DEF CON presenting yourself, you are presenting yourself.
There is no two ways about it.
Also, when you come to these groups, trust.
It's an interesting one in hacking communities.
Oh, I've got so much fun with this.
Trust requires the individual's trust.
You're able to relinquish control.
You put yourself in the hands of another somehow.
So, for example, if you've got the plane here, you put yourself in the trust of the pilot.
You trusted that the airline had checked that he was qualified.
He'd actually done the test.
He could actually fly.
Everyone made it, as far as we know.
So that's looking good.
There is also the expectation that others will reciprocate.
So, for example, getting on the airplane, they expect that you will behave as a good airplane passenger
and, you know, not get really drunk and harass.
Flight attendants.
Online, you don't get the visual cues of trust.
You can't see how a person is standing, how they're talking, if they're doing shifty eye movements.
All you have is what they give you.
It might be a photo.
It might be text.
But it can be manipulated so much more easily.
And it's really interesting looking at what does and doesn't encourage trust online.
One of the things is reciprocation with information.
So if you're sat there talking to a stranger on a chat and you're telling them all about your life
and they're just responding like, yep, okay, all right,
at some point you're going to think, well, either they're not interested or this is just a really weird interaction.
If they start telling you things about their life, you feel a lot closer to them.
You feel that there's more of a bond.
There's more trust.
And this is how people can be manipulated so easily.
I think in the U.K., at least, there's been a big rise in dating scams
because people are looking for these sort of connections, for friendships, and they trust.
One of the sad things about social media,
social engineering is that, I mean, a lot of people,
I really like here that they emphasize that it's not the person's fault.
It's that they're not taught or prepared well enough.
But there is an element of taking advantage of someone's naivety and, you know, good nature and their trust.
And it's quite sad.
But going back to hacking, group membership is a strong predictor of trust behavior.
If you belong to the same group as someone else, you are more likely to trust them.
So, for example,
walking around Las Vegas, if you see people with their DEF CON badge,
you might be more inclined to start a conversation with them.
Say, hey, you're at DEF CON.
What's your background?
What do you do?
I mean, because it is DEF CON, some people will be a little bit more wary of what they say.
But there's still the element of we are in this same group,
this group within the wider group of all tourists and workers in Las Vegas.
So the fact that you are all here at DEF CON means that you already have something here in common.
What's been interesting in the research I've been doing, in interviews I've been doing,
when I ask about trust, everyone immediately says, don't trust on the Internet.
No trust.
Don't trust anyone.
They could be a dog.
But how far does that actually go?
How far can you actually get interacting with other people if you have literally zero trust?
And when I pointed this out to them and given examples,
it's been quite interesting how they found that very hard to reconcile with their idea of I don't trust anyone.
There was one person I was talking to who had, you know,
created their own forum and it was towards the darker side.
And he was quite openly talking with me.
And I said, so do you run it all yourself, like 24 hours a day?
He said, no, no, I have admin.
I was like, but you said you don't trust anyone.
He was like, no, I don't trust them.
I was like, but do you check what they're doing all the time?
And he said, no, no, okay, yeah, I trust them to do the admin.
I was like, okay, so where does the line of trust stop?
You trust them with your website, what you have created.
You trust that they will uphold the rules and the norms.
So what don't you trust them with?
And if it comes down to, you know, your personal identity,
well, you wouldn't trust most people on the Internet with that.
So it's interesting.
Trust is tricky.
So how is this relevant to why hackers are going to hack?
Basically, I just wondered how many of you were really aware of all the different things
that might be influencing you without you actually thinking about it.
So, for example, what you've chosen to wear today.
If you're wearing a DEF CON T-shirt, like I said before,
maybe you want to tell others you've been here previously.
You know what you're doing.
If you're wearing a company T-shirt, you're saying, yep, I'm a part of this company.
I support what they do.
If you're wearing, I don't know, a sports brand, then maybe you're saying you're sporty.
I'm not sure.
Why did you choose the talks that you went to?
If you've come to this talk, then hopefully you've got some vague interest in social engineering
or social psychology, human factors.
If you've gone to one of the really technical ones,
then you're saying that you're technical.
But what if you went because your friends wanted to go?
Or the people that you're with?
Or you just didn't want to go sit in a room by yourself.
You wanted to be with other people.
So you let them influence your decision.
Have you had any disagreements with the people that you came here with?
If you didn't come here with anyone, you have so much freedom.
It's wonderful.
If you did, there's peer pressure.
What if you don't want to go out and party?
What if you want to go sleep?
Because let's be honest, it's tiring.
Some people probably really disagree with that.
Which, also, there's disagreement.
So there's all these different things.
What keeps you coming back to DEF CON in the different days?
Is it that you want to be a part of this social identity?
Is it the curiosity you want to find out, you want to learn?
Is it the sense of community that you want to be a part of?
There are all these different group factors that keep people coming back to hacking.
It's one of the things that my research really aims to get into.
So, again, how does this affect you?
Well, when it comes to trust, would you trust the person next to you?
Not, for example, with your home address or your mother's maiden name,
which I've never understood because my surname is my mother's maiden name.
But would you give them your wallet and go to the toilet?
Yes.
The person who said yes.
Would you trust that next to someone you know?
Okay. Well, that's...
Married to you, trusting your wallet with your wife, that's...
Anyway, before I get my...
Before I start a domestic...
So, when you're talking to other people at DEF CON,
how much do you tell them about yourself, about where you're from, about what you're doing?
I have to say I'm always a little bit wary telling people about what I do
because, mostly, because I have to say, yeah, I'm here to study you.
I get a mixed response to that.
But how you present yourself is also important.
So, group influence. Is it good? Is it bad?
I'm going to give a very psychological answer.
It depends. It can be. It depends.
Cyber security, they'd say, it depends on what the group's doing.
If they're encouraging you to do naughty bad things, then they are bad.
But, more importantly, regardless of whether you're doing good or bad,
can you recognize when you're being influenced?
Do you actually think critically when your friends are trying to persuade you
to do something that you don't want to do?
Do you stop and think, well, maybe this isn't a great idea.
Maybe I should just go and do what I want to do.
And I think this is especially important in the whole era of fake news
and social media tunnel vision.
Don't dismiss information from other groups.
In fact, sometimes it's really useful to look at information from other groups,
see where they're coming from.
You might not agree,
but you get a better overall perspective.
So, a little bit of self-promotion briefly.
My research.
So, as I said, I'm in the second year of a three-year studentship
at Bournemouth University.
I have no qualifications in psychology or computing,
but I'm actually doing all right at this.
I'm so glad this is being recorded.
So, my research is on the psychological influence of group processes online.
All the things I've been talking about,
I want to see how far they go from offline to online,
because that's something that we're really not understanding at the moment,
how psychology changes when people go online,
how the human behavior changes.
There's things like online disinhibition.
People behave differently because they think they're protected by anonymity
because they're behind a computer screen.
You can become a keyboard warrior,
or in the instance of that famous YouTube comment,
a Navy SEAL commando.
The other thing is, what is the hacker identity?
There is a lot of different opinion,
but there's also a lot of misconceptions.
People do think a hacker is a cyber criminal.
It's not the case.
Some people can hack without actually breaking the law.
I don't know if they enjoy it, but they do.
You don't have to accept the negative stereotypes as fact.
The hooded figure crouching over a keyboard.
You know what? Lots of people wear hoodies.
They're damned comfortable.
So, what's the point of my research?
I want to inform and educate,
not just the general public, because they do need it,
but also people that are involved in these communities,
people that might be vulnerable to influence,
people that come looking for a sense of belonging
and then are at risk of manipulation.
They had it in Anonymous,
where there were people that got prosecuted
for taking part in the DDoS attacks.
They later said they were told to download the software,
click the button.
They didn't really understand what they were doing.
I mean, partly that's their fault,
because don't trust people on the Internet.
But there is also an element of they were being manipulated.
They wanted to be a part of a cause.
They wanted to do something worthwhile.
They wanted to help.
And people took advantage of this
to use them basically as cannon fodder.
I also think we're raising a generation of coding.
There's so much emphasis on computer science,
learning, all of these things.
We also need to teach the younger generation
responsibility for your online behavior
and your online actions.
It's not disconnected from the real world.
There are consequences.
You can end up in jail for something you tweet.
I think it's also really important
to emphasize human factors in cybersecurity.
It's not just about the programs.
It's about people.
I think there's a definite need
for informing policy and legislation.
Possibly this is me just being cynical,
but I don't like the idea
that governments and corporations
would be in charge of the Internet,
because as we all know,
he who controls the Internet controls the universe.
And I think that research such as this,
you can go with evidence and say,
you know you think that all the bad people are doing this?
Here's what they're actually doing.
They're creating things to help locate
and find people that are trafficking children.
They're doing good things.
It's not all devious evil
just because you don't understand it.
The last, latest thing to really annoy me
was Theresa May's words about encryption
and how she wanted a backdoor.
And I think you just don't understand.
You know, there is no backdoor
that only lets in the good guys.
And finally, I think it's really important
for cyber sociological knowledge to be expanded.
It's new.
It's interesting.
And I'm sorry,
but you guys are a really fascinating community
to do it with.
So how does the Internet change the behavior?
I've already been able to write a paper
on how to go about this sort of research,
how to expand it.
It's bizarre.
But this is such a new area.
How am I doing my research?
Well, I look on forums a lot.
I don't know if I've mentioned that.
I observe.
I come to conferences like this.
I talk.
I watch.
I make notes.
Always anonymous.
Never write down names, dates, or anything like that.
I do online surveys.
I ask people to fill in things.
And I'm currently doing interviews.
And when I'm doing all these things,
what I'm looking for is examples of trust,
decision-making, risk-taking,
looking for similarities, differences,
patterns in behavior.
One thing that I really feel that is important
in my research is the privacy and anonymity of hackers.
I want to know how far they are aware
of the group processes.
I'm very aware of the possibility
of participation and being trolled.
In one of my early surveys,
I had someone respond that they identified as a dolphin.
And when asked why they use the internet,
it was to hide their flippers.
Someone else also gave their sexual identity
as a jar of mayonnaise.
I could be behind with the times.
I don't know.
There's also the potential risk of backlash.
I'm standing up here giving all these opinions.
People might not like it.
They could decide to prank me,
dox me, whatever.
So far, it hasn't happened.
Abuse on the forums?
Yes, there has been some of that.
I have been referred to with various four-letter words.
And some people have said quite mean things about my mom.
But she has assured me that they are not true.
The data I'm collecting has been through online surveys.
I've got really good responses from them.
People have asked questions about it.
They want to know about the ethics,
why I'm doing the research,
what it's going to be used for.
Some people are obviously very cynical
that my research can be used to infiltrate groups
by agencies and law enforcement and things like that.
The trouble with research is once it's out there,
it's available to everyone.
It's not my intention.
I don't like the surveillance state.
But it's a risk.
So, just briefly,
I'm going to share some of my initial results
that I've got so far.
I did an online survey.
Across 30 websites and subreddits,
I had over 150 responses,
which I thought was pretty good,
considering that not everyone wants to tell a researcher
everything they do online.
Four forums banned me entirely,
but they were forums related to cracking.
So I get the feeling that they didn't really care
about anything that I might want to say.
Unsurprisingly, the majority were male,
6% female, 2% transgender.
The age range was 16 to 63,
which I thought was a pretty good spread.
One thing that I think is often overlooked
is that there is an older generation of hackers.
Hacking and computers have been around for 30, 40 years.
Some people don't stop.
Some people just get older, have families, children,
legitimate jobs.
They can still enjoy hacking.
So the stereotype of teenagers messing around in their room,
true to a degree,
but I think it's missing the point.
The average age of all the people that took my survey
was 30.
So I don't know what that tells you.
Millennials.
So hopefully you can see this all right.
One of the questions that I asked was,
do you consider yourself a hacker?
Bearing in mind every single forum or subreddit
I posted this on,
I had found through searching for hacking, cracking, coding,
white hat, black hat, skid,
all these different things,
as many different variables as I could think of,
everything was related in some way to hacking.
Over 150 did the survey.
52% said that they would say that they were a hacker.
Just over half.
I found that really interesting.
On these websites specifically for hacking,
just under half the people didn't think that they were a hacker.
So of the people that said yes, that 52%,
I asked them to categorize themselves further.
So gray hat, white hat, cyberpunk,
hacktivist, other, I disagree.
Black hat, script kiddie, elite, and cracker.
To be honest, I thought I disagree would have more responses.
Just to say they could select more than one option,
so please don't try and make sense of the percentages.
It's the percentages of that number of participants, not of.
So obviously a lot of people categorize themselves as a gray hat
as well as other things.
That's kind of fascinating for me
because that's such an ill-defined thing.
Black hat, yes, you can say black.
You do nefarious things, dark.
White hat, you have to be ethical, pure, everything else.
Gray, it could be anywhere in between.
You could be bang in the middle.
You could be just a shade lighter.
What does it mean?
What are they actually categorizing themselves as?
So I also did a couple of questions on privacy anonymity.
Shockingly, people in hacking communities
think that privacy is important
and it should be protected
and they take precautions with it.
The same with anonymity.
Anonymity is an important feature of the internet.
It should be protected
and they take steps to make sure that they are anonymous online.
Then it got a bit more interesting.
Online security should take priority over personal privacy.
There was a mixed feeling about this.
And then I asked if people try and find flaws and weaknesses
and a lot of people said yes.
Now,
this next slide,
when I presented this to the computing side,
they had more of a surprise reaction.
So,
I don't know how well you can see,
but the blue lines
are that the weaknesses and flaws should be exposed.
The green lines are that they should be exploited.
Bearing in mind the idea that all hackers are bad and evil
and do bad things,
it's very surprising that actually a lot of them,
the majority,
say that they should be exposed.
But exploited,
there's not a strong agreement there.
So,
it's obviously not as black and white
as people would like to believe,
which ties in nicely with the grey hats being the highest category.
So,
what am I doing next?
I'm conducting interviews with volunteers.
If anyone would like to volunteer,
then that would be super.
If you think I've said something really ridiculous,
tell me,
but tell me why.
Don't just send me messages saying that you think I'm an idiot.
That's rude.
And I've been taught not to be rude.
My next surveys are going to focus more on trust,
decision making,
how people work in groups.
If you think there's something I've overlooked,
tell me.
I can only do better research,
which will go out to the general public,
if people help me.
And of course,
I'm always going to lurk more.
So,
my conclusion for my research so far,
hackers are actually interested and informed groups.
People want to share their thoughts.
People want to improve the interest.
They want to know more about the internet and security.
I worry about where the internet is going.
I like that there are people that take an active interest
in making sure it goes in a fair and equal direction.
Being a hacker,
being aware of security,
being aware of the risks,
it doesn't make you infallible to the influence.
Being aware of the group processes,
you can still be vulnerable.
I think it's important to highlight
the significance of social psychology,
especially in online communities and,
I mean, social engineering.
It's right there.
And just to bear in mind that
you can have different identities,
different motivations,
but ultimately,
we're all in the same social space.
Thank you very much for listening.
I have four minutes left.
Does anyone have any questions?
Yes?
Naughty.
You just said one more time.
You can't then say another.
Naughty.
Your research is very interesting.
Have you found any interesting differences
between groups in terms of values,
how they see themselves or unexpected results?
So did everyone hear that?
What are the differences between groups?
Are there any interesting results?
So far, when people have categorized groups,
they tend to categorize themselves.
They tend to be dismissive of the other groups,
which fits with the traditional,
I like my group,
I don't like anyone that's not in my group.
The easiest, most obvious one of that
is black hats versus white hats.
It's interesting, actually.
There's quite a lot of derision towards script kiddies
in forums.
That's often used in a derogative term.
But people still identify themselves as script kiddies,
which is kind of interesting.
I mean, it's not supposed to be something
that you aspire to,
but they're still saying,
yep, that's me.
So I'm sure there's a lot more to come.
Okay.
Yeah?
You were in Germany.
Your research is quite fascinating
because you are doing research,
you know, like, people have done
a tremendous amount of research
on groups in the real world.
Your research is in the virtual world.
Were there any points bearing you,
from varying contrasts,
that, like, how the behaviors
are going to differ?
There's the aim to.
Mostly I'm using social psychological theory
to see if the behaviors match.
In terms of comparing,
it's quite difficult to think of scenarios
where it would be.
I mean, I've had people,
there's a forensic psychologist at my university
who started talking to me about criminology
and how you compare hacking communities
and crime gangs.
And I was like,
that's not quite what we're doing here.
So I think there's definitely
a research area there,
but you've got to be careful with it
because you could go down the wrong track.
Yep?
Did you make an attempt
to cross-check your data
that you got from surveys
with non-survey-based data
to be less subjective?
The trouble is,
there isn't a whole lot of data
about hackers.
You guys are kind of secretive.
I am trying,
and there are various other studies out there.
There was a paper from a few years back
where people had done data collection
here at DEF CON.
It's a terrible paper.
I'm not going to say what it is, actually,
because I'm still being recorded.
But no, I disagree with their methodology.
I disagree with their conclusions.
I think the whole thing
was very poorly thought through.
And that's the trouble,
even when you can find other data,
is that it might not actually
have been as well done as it could have been.
One more question?
Yeah?
In studying online communities,
were you making a distinction
between members who meet up
in face-to-face interactions
like at DEF CON or .
And those that are purely online
with no face-to-face opportunity?
So my focus is the purely online,
but I ask about offline extensions
and I treat it as such.
So I ask how they got into it,
whether they were introduced
by an offline connection
or if they made the offline connections
through the online.
So I try and find it out that way.
I think that's it.
If anyone has any other questions,
feel free to come find me.
All my contact details are up there
and I love getting messages.
Thank you.
Thank you.