[00:00.000 --> 00:02.920] So, first of all, thank you so much for coming out. [00:03.160 --> 00:08.100] Quinn and I are delighted to be here and represent Temple University at The Eleventh HOPE today. [00:09.860 --> 00:12.740] First and foremost, we want to thank a few folks. [00:13.080 --> 00:16.080] HOPE 10 for allowing us to conduct our research here. [00:16.280 --> 00:18.840] We were here two years ago, did interviews and focus groups. [00:19.060 --> 00:20.880] And I don't know if Bernie's here yet. [00:20.880 --> 00:22.560] He just called saying he was running late. [00:22.760 --> 00:29.380] But a special shout out to Bernie because he actually got us the support letter to get us to be able to do this research. [00:30.080 --> 00:35.520] HOPE 11 for providing us with the opportunity to present our research work here today. [00:35.800 --> 00:38.220] We are very grateful to have been given this platform. [00:38.520 --> 00:47.880] And the Temple Merit Scholarship 2015, which supported Quinn last summer and allowed him to help me immensely with analyzing our data sets. [00:49.360 --> 00:56.400] So, it comes as no surprise that there are interrelationships between media, crime, and criminal justice. [00:56.400 --> 01:07.760] The media socially constructs and embeds stereotypes, moral panics, and generates conventional wisdom that collectively shape the general public's perception of the world around them. [01:08.260 --> 01:14.580] This has been an issue that the technical and hacking communities have identified, as can be seen here. [01:14.900 --> 01:25.280] When the dictionary definitions of media and hype are combined, you come up with a means of communication that widely influences people with dramatic and questionable methods. [01:27.000 --> 01:35.960] These communities are cognizant of the media hype and have also pointed out the differences between real-life hacking and media depictions of hacking. [01:36.380 --> 01:39.700] So, how do the media depict cybercrime and cybercriminals? [01:41.060 --> 01:46.380] Some academics have already examined this issue through media content analysis. [01:46.840 --> 01:54.780] One interesting piece is by David Wall, where he identifies seven myths that are portrayed by the media about cybercrime and cybercriminals. [01:55.320 --> 01:59.060] Quinn will go over each one of these in great detail later. [02:01.140 --> 02:11.520] What we wanted to do was build on Wall's myths and get the hacking community's input on media depictions of hacking, myths and stereotypes, and ultimately, consequences. [02:12.060 --> 02:13.440] We have three objectives. [02:14.000 --> 02:17.040] First, we want to capture the hackers' stories and backgrounds. [02:17.340 --> 02:23.720] We want to get their essence, which we presented as our first objective, hacker narrative. [02:24.520 --> 02:36.000] Second, we wanted to get the hacking community's opinions about the typical myths and stereotypes and media portrayals of cybercrime and cybercriminals in the news, movies, and TV shows. [02:36.700 --> 02:43.800] Here, we ask the hacking community to assess Wall's myths, and we present this as our second objective, a myth analysis. [02:44.520 --> 02:55.500] Third, we discuss our other interesting themes that emerged in our datasets, which captures how the hacking community feels in general about the way that it is being represented. [02:55.860 --> 03:16.860] We cover issues such as the use of the term hacker and hacking, gender and race portrayals, the polarization of hacking, the emphasis on the hack versus the hacker, issues with the news and movies, the evolution of hacker portrayals, and ultimately, the impact the media has had on the hacking community. [03:17.340 --> 03:21.420] We present all of this as our third objective, the hacker's perspective. [03:23.000 --> 03:25.500] We started off by doing a media analysis. [03:25.880 --> 03:31.840] We looked at eight media pieces, four movies, two documentaries, and two TV shows that are listed here chronologically. [03:32.560 --> 03:39.160] Other academics have done a more in-depth analysis, such as the piece by Gordon that's listed below, in case anyone's interested. [03:41.520 --> 03:44.600] As I mentioned earlier, we are at HOPE 10, two years ago. [03:44.700 --> 03:47.400] So we did a combination of interviews and mini-focus groups. [03:47.600 --> 03:54.480] We had a total of 20 interviewees, 17 males, three females, all of whom self-identified as hackers. [03:54.480 --> 04:05.880] Each interview lasted for about 45 minutes, and we asked participants about how they felt about those seven myths and also media portrayals about their community. [04:07.520 --> 04:11.760] As with any research, our study has some unavoidable limitations. [04:12.320 --> 04:17.060] With regards to interviews, there is the issue of self-selection bias. [04:17.060 --> 04:20.600] We spoke with individuals who identified themselves as hackers. [04:21.160 --> 04:23.460] However, this is actually a positive. [04:23.880 --> 04:30.480] We wanted to capture the hacker narrative, and ultimately being a hacker is something you feel you can identify with. [04:31.100 --> 04:33.680] As noted earlier, we only had 20 participants. [04:33.980 --> 04:39.600] Of course, if we have more interviews, we might end up with a different analysis than what we are sharing with you here today. [04:40.780 --> 04:45.140] And there is also concern that in many focus groups, participants could influence each other. [04:45.440 --> 04:54.680] And of course, we cannot rule out the fact that each participant may have been impacted by media at some point or another in his or her life. [04:55.300 --> 05:03.260] With regards to media analysis, as noted earlier, we only had eight media pieces, which raises the question, how representative is this of the media? [05:03.560 --> 05:08.420] So we tried to mitigate these issues collectively the best possible way that we could. [05:08.420 --> 05:12.040] We cross-checked individual interviews with many focus group data. [05:12.340 --> 05:19.980] And for the most part, both had generated similar content, which indicates that there was minimal participant influence in many focus groups. [05:20.700 --> 05:28.060] For the media analysis, we employed a partial stratified sampling and selected media content across a broad genre and time period. [05:28.220 --> 05:32.540] And also compared it against the interview and many focus group data. [05:33.320 --> 05:37.820] Finally, we intersected our media analysis with the interview focus group analysis. [05:38.220 --> 05:44.960] And we found a good set of similarities, but also some discrepancies, which Quinn will share with you shortly. [05:45.440 --> 05:49.680] So we followed our disciplinary protocols and analyzed our data. [05:50.300 --> 05:53.340] And as social scientists, that is something that we do. [05:53.600 --> 05:57.200] We like to understand our surroundings and the people who live in them. [05:57.380 --> 06:02.060] We collect the data, analyze, and then quote-unquote report our findings. [06:02.440 --> 06:03.940] But do we get it right? [06:04.480 --> 06:07.100] Do we really understand the communities that we study? [06:07.680 --> 06:11.840] Do we confer with them to ask if we represent them accurately? [06:11.840 --> 06:15.020] And this is ultimately at the heart of our talk today. [06:15.400 --> 06:17.780] So please do engage with us. [06:18.000 --> 06:20.640] We are here to get feedback and learn from you. [06:21.180 --> 06:24.880] We have passed out index cards, or they're at the back of the room. [06:25.160 --> 06:33.860] So if you could, if you don't get a chance in the Q&A to get to us, and if you have comments, please take one of those cards and fill that out. [06:34.400 --> 06:39.120] And towards the end of the presentation, we will list out some other ways that you can reach out to us. [06:39.760 --> 06:49.980] Now, rather than providing you with just the interview excerpts, we are actually using the interviewees' voices themselves to stay true to the hacking community. [06:50.500 --> 06:52.560] A little note on the audio, though. [06:53.580 --> 06:57.080] Everything has been anonymized to the best of our abilities. [06:58.660 --> 07:01.300] And there is a fair bit of background noise. [07:01.440 --> 07:03.560] This was done at the last hope, after all. [07:03.920 --> 07:06.460] But we've cleaned it up in the best possible way. [07:06.460 --> 07:11.440] And what we're sharing with you today is hopefully the best quality audio clips that we have. [07:11.800 --> 07:14.800] So I'm going to pass it to Quinn now, who's going to share our findings with you. [07:16.280 --> 07:16.440] All right. [07:16.520 --> 07:17.280] Thank you, Aunshul. [07:17.820 --> 07:22.560] So for our first objective, the hacker narrative, we wanted to look at what makes someone a hacker? [07:22.960 --> 07:24.840] Why do people identify as a hacker? [07:24.980 --> 07:28.180] And what are kind of some of those common themes that run through the hacking community? [07:28.580 --> 07:33.720] So I'm going to start by playing you some audio from these interviews, and then we'll talk about it for a minute afterwards. [07:40.920 --> 07:50.440] I started identifying myself as a hacker after I installed Linux for the first time in 2001. [07:50.820 --> 07:52.880] Because that's hot shit. [07:53.460 --> 07:58.660] Because installing Linux is an incredibly empowering feeling. [07:59.120 --> 08:03.520] So when I was a kid, right, I was like 5'6 and 80 pounds. [08:03.860 --> 08:06.380] I mean, you know, there wasn't a lot you could do outside. [08:06.880 --> 08:09.760] I hadn't interested in reading and absorbing information. [08:09.940 --> 08:16.780] So for me, when my dad brought home an 80-86 old computer, it was like, well, here's a new challenge. [08:16.880 --> 08:18.060] Here's something I haven't seen. [08:18.380 --> 08:20.720] And that challenge just keeps sucking me back in. [08:21.200 --> 08:22.500] My dad was an engineer. [08:23.340 --> 08:35.340] So we had a computer in the house, and he would tinker around with things, and tinker around with some of the bar, like, in television and whatnot, reprogram it, so that he'd teach me, and I got into it that way, and just kept building as technology moved on. [08:38.400 --> 08:39.260] I've morphed. [08:39.900 --> 08:41.040] I'm an old phone freak. [08:41.580 --> 08:45.060] And back in the day, the phone was the thing you could play with. [08:45.520 --> 08:50.700] It was a network you could crawl through and find things out in ways that the phone company never wanted you to know. [08:52.180 --> 08:58.180] It was, um, I first identified with the term probably in the late 90s. [08:58.320 --> 08:58.400] Okay. [08:58.920 --> 09:03.800] Um, I think I've been one for a long time. [09:04.240 --> 09:04.340] Mm-hmm. [09:04.480 --> 09:16.120] You know, even in terms of when I was three years old, I got my parents thrown out of a department store because I, you know, my, some kids carry around stuffed dolls. [09:16.280 --> 09:20.260] I carried around a set of screwdrivers, and I started taking, and I took things apart. [09:22.000 --> 09:24.340] The experience of hacking, like, is, is the wonder rod thing. [09:24.540 --> 09:25.220] It's, it's a rush. [09:25.420 --> 09:27.420] I got this thing to do with this. [09:27.600 --> 09:28.240] Look at this. [09:28.320 --> 09:28.920] It's cool. [09:29.340 --> 09:30.440] I, look, look, look, look. [09:30.560 --> 09:35.680] I broke it open, and there's this cool chip in there, and I can make it do things that nobody else can do. [09:36.260 --> 09:39.600] Even the old, the man that designed this, didn't know what to do with this shit. [09:39.600 --> 09:40.920] This is awesome. [09:42.760 --> 09:46.740] So as you can see, every hacker we spoke to had their own unique story. [09:46.940 --> 09:49.340] However, there were some common threads that ran through this. [09:50.160 --> 09:55.780] Many of the hackers we spoke to felt that they had been hackers for a long time, from a young age, perhaps even from birth. [09:56.640 --> 09:59.580] And secondly, there was a theme of empowerment. [09:59.580 --> 10:04.420] A lot of people felt empowered by being hackers and being able to take back technology for themselves. [10:06.180 --> 10:10.020] So that kind of concludes our hacker narrative, but we wanted to go a step further. [10:10.140 --> 10:13.700] We wanted to look at these media myths that Aunshul mentioned earlier. [10:14.100 --> 10:22.040] So I'm going to walk you through each myth, how the media is portraying hackers, and then we're going to listen to what the hacking community had to say about each of these media myths. [10:24.140 --> 10:30.060] So the first myth, that cyberspace is portrayed as pathologically unsafe and criminogenic. [10:30.420 --> 10:36.260] The media is showing cyberspace as having some property that makes people more likely to commit crimes. [10:36.860 --> 10:40.700] So let's listen to what the hackers at The Last HOPE had to say about this myth. [10:41.220 --> 10:42.320] It's just inevitable. [10:42.680 --> 10:49.660] Like anything that you can do to undermine the system, anything you can do to support the system, will happen. [10:49.660 --> 10:54.600] It doesn't matter what medium it is, it's just going to happen. [10:56.640 --> 10:59.860] I think that most systems will decay and corrupt over time. [10:59.980 --> 11:01.940] It's just the nature of human systems. [11:03.000 --> 11:03.780] It's just a pipe. [11:04.000 --> 11:04.940] Yeah, it is. [11:04.940 --> 11:07.100] A network is just a pipe for information to flow through. [11:07.580 --> 11:14.240] Just like a telephone line, which then becomes a data line, which then goes into packet networks and there's your network again. [11:14.600 --> 11:15.620] It's just a pipe. [11:17.840 --> 11:20.480] So we had a bit of a mixed response to this media myth. [11:20.640 --> 11:25.520] We had some of the people we spoke to who felt that cyberspace is criminogenic in some way. [11:25.820 --> 11:31.260] Just in the nature of a human system and they felt that any human system will decay and corrupt over time. [11:32.280 --> 11:38.880] On the other hand, we had some hackers say that a network is just a pipe for information to flow through with no criminogenic properties. [11:41.400 --> 11:44.940] The next media myth is one of the biggest ones, the omnipotent super hacker. [11:45.380 --> 11:51.560] In the media, hackers are portrayed as very powerful, able to hack into any system in a couple of seconds. [11:52.320 --> 11:54.520] So let's see what was said about this myth. [11:58.260 --> 12:08.800] This idea that somebody is just breaking into a system in under a couple of seconds and writing a shit ton of code is just this utterly retarded idea. [12:08.960 --> 12:09.820] It's a hilarious notion. [12:10.080 --> 12:17.380] And so much of this, maybe 98% of what happens in these films is completely wrong. [12:18.980 --> 12:22.680] It is almost impossible to know everything there is to know. [12:22.840 --> 12:25.080] Everyone has their little niches of what they know. [12:25.240 --> 12:27.800] You got the people that find vulnerabilities, you got the people that program. [12:28.380 --> 12:29.180] There's niches. [12:29.380 --> 12:32.080] There's not one person that I've ever had that knows everything. [12:32.240 --> 12:33.000] It's just too much information. [12:33.040 --> 12:36.300] If that person existed, they'd probably be on net with that, but it's impossible. [12:38.220 --> 12:45.820] That we are almost superhuman and supernatural. [12:46.460 --> 12:48.160] We are... [12:50.380 --> 12:54.140] We almost exceed the rules of physics. [12:57.480 --> 13:03.040] And if it is theoretically possible, we do it on a regular basis. [13:06.340 --> 13:08.760] So many of the people we spoke to saw this in the media. [13:08.880 --> 13:13.660] They saw the media as portraying hackers as being these kind of superhero, all-powerful beings. [13:14.580 --> 13:18.600] When in actuality, they felt that there's no way anyone has all that knowledge. [13:18.800 --> 13:21.760] Everyone has their own specializations, their own little niches. [13:23.040 --> 13:31.960] When they talked about why this might be the case, why the media is portraying them in this way, one individual said that perhaps it's because normal people just aren't as exciting to box up. [13:31.960 --> 13:37.020] So that might be why the media is kind of packing hackers into this all-powerful being kind of stereotype. [13:40.060 --> 13:41.140] So the next myth. [13:41.260 --> 13:44.480] That cybercrime is dramatic, dystopic, and futuristic. [13:45.360 --> 13:52.120] We didn't really have any clear audio for these clips for this myth, unfortunately, but I'm going to walk you through a few of the things that were said. [13:53.420 --> 13:58.040] This one individual pointed out that hacking happens under a couple of seconds in the media. [13:58.580 --> 14:05.120] That kind of plays to the whole dramatic aspect of this myth, where the media is kind of sensationalizing and making this much more dramatic. [14:06.180 --> 14:15.100] We have this individual who spoke about the novel Neuromancer, and it's a very negative look at the future regarding data, which really goes to that whole dystopic notion. [14:15.880 --> 14:20.140] And finally, this person speaking about the 1995 film Hackers. [14:20.560 --> 14:27.740] How it had all these flashy pictures and cookie monster icons and futuristic names like Zero Cool and Acid Burn. [14:28.060 --> 14:30.740] So we did see this myth throughout our interviews. [14:33.400 --> 14:34.460] The next myth. [14:34.560 --> 14:37.000] That hackers have become a part of organized crime. [14:37.460 --> 14:42.920] That the media is depicting the hacking community as having a growing organized crime movement. [14:44.660 --> 14:57.900] Well, there are tales of those hackers that have gone to jail and met organized crime people, who then pretty much forced them into helping them with their endeavors. [14:58.600 --> 15:03.080] It was not their attention, but, quote, the system made them do it, close quote. [15:04.980 --> 15:05.940] That is true. [15:06.800 --> 15:08.140] Organized crime took over. [15:09.080 --> 15:15.520] And, you know, like the ransomware cryptolock we talked about, most of that is funded now, where the money runs back to organized crime. [15:17.100 --> 15:34.760] You know, hackers, it seems like in the news nowadays, are portrayed as foreign people working, like, for their government or profit, or, you know, in Eastern Europe or China or wherever, like, somewhere far away. [15:37.560 --> 15:41.040] We also have a couple other quotes that we didn't have clear audio for. [15:41.260 --> 15:46.720] One individual stated that the media has kind of made a sort of underground movement within the hacking community. [15:47.300 --> 15:55.500] And another who talked about Stuxnet, which is an instance of state-sponsored hacking, which was, uh, likely done by several world governments. [15:56.040 --> 16:05.120] Uh, this myth is particularly interesting to us, because a lot of the hackers we spoke to, uh, actually did perceive a growth of organized crime in the hacking community. [16:05.600 --> 16:09.520] So we really have to question, is there actually a growth of organized crime? [16:09.740 --> 16:15.880] Or perhaps the media is making the hackers that we spoke to perceive this kind of growth, when it might not actually exist. [16:18.020 --> 16:22.160] The next myth, uh, cybercriminals are anonymous and cannot be tracked. [16:22.660 --> 16:30.520] Uh, so basically the media is portraying people as, if this crime happens over the Internet, there's no way to, uh, hunt down these criminals, correct? [16:30.940 --> 16:33.720] Uh, so let's see what the hackers had to say about this myth. [16:35.140 --> 16:37.380] How many ways can we tag you on the Internet? [16:38.800 --> 16:40.140] Everybody uses handles. [16:40.500 --> 16:40.700] Yep. [16:41.580 --> 16:45.080] But at some point or another, you can kind of drew a single IP address somewhere. [16:45.660 --> 16:49.140] It can be difficult sometimes, with everybody losing trace. [16:51.160 --> 16:53.660] And we have another quote without clear audio. [16:53.880 --> 16:58.780] Uh, this individual said that the only way to not get caught is to not do anything worth getting caught over. [16:59.040 --> 17:02.660] And if you're going to do something, do 99% of it offline. [17:03.400 --> 17:07.660] Uh, so the hackers we spoke to really called BS on this media myth. [17:07.880 --> 17:11.060] Uh, they stated, there's always a way to catch a cyber criminal. [17:11.060 --> 17:18.420] Anyone who does sort of hacking leaves a trace, as long as you put the time, effort, and resources into that, uh, sort of investigation. [17:19.500 --> 17:23.460] Uh, the other myth is similar, but important in a couple key ways. [17:23.840 --> 17:26.740] That cyber criminals go unpunished and get away with crime. [17:27.200 --> 17:36.460] So, whereas the last myth stated that cyber criminals don't get caught at all, uh, this myth regards the media portraying cyber criminals as getting away with their crimes when they are caught. [17:37.240 --> 17:45.880] I think that law enforcement is trying to, you know, make examples, find, find people in our community to make examples out of. [17:46.280 --> 17:54.960] Um, it's, you know, made me realize, or given me the feeling that you have to be careful about what you type into a terminal. [17:55.740 --> 17:59.140] Um, you know, any time, anything that you're typing is a written document. [17:59.480 --> 18:04.540] And assume that it will be hauled out and used against you in the worst possible light at some time. [18:04.540 --> 18:25.020] Um, the, the portrayal of us being supernatural and malevolent means that when we're prosecuted, we get, we get harsher treatment than violent criminals. [18:26.380 --> 18:39.760] More often than not, we're put in ad-seg, um, we're given much more restrictive, even post-release, may not touch the computer. [18:40.160 --> 18:42.580] Have to, have to do this, have to do that. [18:42.820 --> 18:45.760] And it's out of proportion to the damage done. [18:46.780 --> 18:50.840] Uh, they commend pretty hard on people who they, um, think to be a hacker. [18:51.000 --> 18:56.860] Like, the Computer Crime and Fraud and Abuse Act is a really terrible law and it's massively abused. [18:57.020 --> 19:09.080] I mean, you can look at what happened to Aaron Schwartz and, um, his suicide, which is probably partially related to the, um, very overzealous prosecution by, um, I guess the U.S. government. [19:11.240 --> 19:16.380] Uh, so basically everyone we spoke to massively disagreed with this media myth as well. [19:17.000 --> 19:21.380] Uh, they felt that the law enforcement community kind of tries to make an example out of the hacking community. [19:21.720 --> 19:31.740] Uh, that they get harsher treatment when they do go to court and given much more restrictive, uh, sort of post-release things than someone who might commit a similar crime of a not-cyber nature. [19:31.740 --> 19:39.660] And, uh, we had multiple people point out the Computer Fraud and Abuse Act as a specific piece of legislation that they felt was very problematic in that regard. [19:41.540 --> 19:47.940] So, our final media myth is the idea that users are depicted as weak and not really able to protect themselves. [19:48.780 --> 19:56.860] Because when we talk about ransomware or all the viruses cut loose by evil hackers, quote-unquote, um, it's the victims that need to pay attention to, right? [19:57.060 --> 19:59.020] It's, it's everyone who needs to secure their systems. [19:59.480 --> 20:04.300] So, what they've done, the consequences of that, I think really are the appropriate place to look at that. [20:04.500 --> 20:06.540] For example, like the Target hack. [20:06.760 --> 20:07.000] Oh, yeah. [20:07.020 --> 20:15.940] And they were focusing on the hack and the security of the company as opposed to, like, the 22 million or however many, where there were people that were like, uh, all this stuff's now floating around on the Internet. [20:19.800 --> 20:25.680] I think people are less scared, as computers are, like, either good as part of our lives, people are less scared of them. [20:27.800 --> 20:41.880] So, we didn't have a ton of the people we spoke to who talked specifically about this myth, but we did have some point out that the media tends to focus on these hacks or breaches or events, rather than the many, many victims who have to now deal with their information being out on the Internet. [20:42.560 --> 20:49.900] And, uh, a few people also mentioned that they think that people are becoming less scared of technology, as it becomes more ingrained in our everyday lives. [20:51.640 --> 20:55.020] So, that concludes our kind of academic media myth analysis. [20:55.520 --> 20:58.280] Uh, up on the screen, we have a summary, kind of, of our findings. [20:58.840 --> 21:05.040] Uh, the two left columns, labeled interview, show where, in our interview process, we found people speaking about the myths. [21:05.380 --> 21:08.820] Uh, the orange ones are where they saw those myths in the media. [21:08.820 --> 21:14.300] And the blue boxes are where they might have, uh, perceived that in their actual experiences. [21:15.080 --> 21:23.720] Uh, the two columns labeled media go back to our media analysis, where we saw this happening in the media, or perhaps where we saw something going against this myth. [21:25.480 --> 21:27.260] Uh, so just to walk through it. [21:27.340 --> 21:33.820] Firstly, the myths that cybercrime is futuristic, dystopic, and dramatic, and also the omnipotent superhacker myth. [21:33.820 --> 21:36.480] We did see a lot of this in our media analysis. [21:36.920 --> 21:40.740] And, uh, that really corroborated with what the hackers that we spoke to saw as well. [21:41.540 --> 21:46.040] Uh, for the myth that cybercrimin- or hackers have become a part of organized crime. [21:46.380 --> 21:48.560] We did see this throughout our media analysis. [21:49.000 --> 21:55.620] Um, but as I mentioned earlier, that was interesting to us because a lot of the hackers actually did perceive a sort of growth of organized crime. [21:57.020 --> 22:02.800] For the myth that cybercriminals are anonymous and cannot be tracked, uh, that didn't really match up with our media analysis. [22:03.100 --> 22:05.480] A lot of the hackers that we saw in the media did get caught. [22:05.940 --> 22:09.480] And that kind of lined up with what the hacking community saw as well. [22:11.020 --> 22:18.640] Uh, for the myth that cyberspace is criminogenic, uh, we didn't really see anything either- either direction in our media analysis. [22:18.640 --> 22:21.720] Uh, and the hackers we spoke to had opinions in both directions. [22:22.160 --> 22:24.580] So we can't really draw any conclusions there. [22:26.260 --> 22:29.900] Uh, for the myth that cybercriminals go unpunished and get away with crime. [22:30.440 --> 22:33.260] Uh, we just saw it in both directions in our media analysis. [22:33.640 --> 22:36.560] Uh, but the hackers we spoke to felt that that was not the case. [22:36.760 --> 22:40.580] And that hackers receive much harsher treatment when they are, uh, tried. [22:41.760 --> 22:44.520] And finally, that users are weak and need to be protected. [22:45.140 --> 22:47.540] Uh, we did see this throughout their media analysis. [22:47.740 --> 22:51.520] A lot of the users in these movies and films we looked at were not able to protect themselves. [22:51.860 --> 22:54.500] Uh, which lined up with what the hackers saw in the media. [22:54.920 --> 23:02.840] But as I stated, some hackers felt that the users are getting better at protecting themselves as computers become more, uh, used in everyday life. [23:04.640 --> 23:07.480] So that concludes our sort of academic media myths. [23:07.480 --> 23:13.380] Uh, however, we had a lot of, uh, information come up that didn't really fit into this academic framework. [23:13.840 --> 23:20.380] So we pulled out some common themes that we saw and kind of wanted to talk about, which we're going to go through now in this third objective. [23:22.740 --> 23:28.660] First of all, with the media use of the word hacker, uh, a lot of the people we spoke to took issue with this. [23:30.040 --> 23:31.540] Um, oh gosh. [23:31.720 --> 23:34.520] Uh, I think it's, uh, I think it's someone that disrupts technology. [23:34.520 --> 23:43.080] Uh, uses technology to, in a way that it wasn't intended to be used, um, either, like, for creativity, or for destruction, or for both. [23:43.280 --> 23:43.540] Okay. [23:44.440 --> 23:48.580] Um, I guess it means to me, um, it means a couple things. [23:48.800 --> 24:01.740] I mean, first it means kind of being a part of the political culture here, where it's very activism-oriented, and you have strong opinions about government, and it's often related to having a lot of issues with the current way capitalism's run. [24:02.000 --> 24:09.920] Um, and it also just describes the general desire to, like, tinker with things, and understand the world around you, and understand your tools, and how to build it. [24:10.900 --> 24:19.200] I'm a big fan of the hacker dictionary, which would define a hacker as someone who performs hacks upon systems. [24:20.100 --> 24:30.160] It's one of those ambiguous words that doesn't really have any canonical meaning, but, um, the media's definitely leveraged it however they've wanted. [24:31.560 --> 24:39.660] I think it describes more, like, uh, like maybe, yeah, like a mindset now, instead of any specific, like, activity. [24:39.660 --> 24:48.240] So, it's, like, a skater, like a, I don't know, doesn't even need to escape, you know, like, maybe just wears the clothes. [24:49.480 --> 24:52.960] A hacker is someone who is curious. [24:53.220 --> 24:57.840] They like to play with things and see how they work, and maybe make them do something unexpected. [24:59.140 --> 25:01.160] Five words that describe hacking. [25:02.480 --> 25:08.380] Intelligent, crazy, ADHD, rainbows, and unicorns. [25:10.400 --> 25:16.700] So, as you can see, we had almost as many different definitions for hackers as we did, uh, have people we spoke to. [25:17.260 --> 25:22.160] Uh, we had some say that it's anyone who disrupts technology or uses it in creative ways. [25:22.500 --> 25:24.600] Others who pointed to a certain political culture. [25:25.260 --> 25:28.600] Uh, whereas others stated there wasn't any specific canonical meaning. [25:29.160 --> 25:36.660] Uh, however, basically everyone agreed that the media use of the term referred to a cyber criminal who, uh, hacks for profit. [25:36.660 --> 25:39.300] Uh, which they really did not agree with. [25:41.040 --> 25:47.940] Uh, next, looking specifically at gender and the female portrayals, uh, in the hacking community and media. [25:48.260 --> 25:54.300] I think in general in the tech and computer world, uh, the female gender tends to be pretty underrepresented. [25:54.720 --> 25:59.500] So, um, it's true in the hacker world as well, I guess, by extension. [26:00.040 --> 26:08.260] Um, I think hackers... most hackers tend to be a little bit more liberal about genders and sexuality. [26:08.460 --> 26:11.940] I think in most cases, which is a good thing, but that only goes so far. [26:13.200 --> 26:15.400] There's a, there's a wave of women in that. [26:15.640 --> 26:21.280] They're not presented as hackers because hackers has a negative connotation and women in tech are to be encouraged. [26:21.500 --> 26:21.640] Right. [26:21.880 --> 26:26.120] So, there's not as many women being presented as hackers. [26:26.460 --> 26:26.540] Right. [26:26.700 --> 26:31.240] Uh, though, culturally, I think they're, uh, embracing it. [26:32.160 --> 26:40.540] Yeah, I think that, like, I mean, like, women are portrayed badly by the media and, frankly, treated really badly by the security industry. [26:41.880 --> 26:51.180] Um, there's also kind of this denial of, of there being women in the hacker community before, which is bullshit, because nobody knows who you are online. [26:53.440 --> 27:01.060] Uh, we have one final quote that we didn't really have clear audio for, uh, but it was someone pointing to how women in the media are kind of objectified. [27:01.060 --> 27:05.460] And that they're often kind of this token sexualized female hacker in the movies. [27:06.040 --> 27:14.020] Uh, so there wasn't really great representation or portrayals of female hackers, at least as far as the people we spoke to were concerned. [27:14.980 --> 27:24.060] Uh, this one individual who stated that there are women who are becoming hackers, but not necessarily identifying with the term due to these negative kind of portrayals. [27:24.820 --> 27:29.360] Um, so moving on, race in the hacking community. [27:29.360 --> 27:32.920] I mean, it's just clearly out there in the open. [27:33.260 --> 27:33.420] Right. [27:33.820 --> 27:39.060] They're portrayed as Caucasian males that look like nerds or like geeks or whatever. [27:39.980 --> 27:44.800] Um, I mean, they're, they're just smeared all over the place. [27:44.960 --> 27:51.800] It's like, I mean, there's all types of races that obviously are hackers. [27:52.620 --> 27:59.660] Uh, I think the, I think the typical, the stereotypical hacker is, um, you know, a boring white guy. [28:00.620 --> 28:01.740] Hackers of color? [28:02.920 --> 28:16.160] I don't think I, I don't think I can think of any representations of hackers of color except as sort of a vague, formless threat. [28:16.160 --> 28:19.360] But, I know a handful of hackers of color. [28:19.640 --> 28:19.860] Right. [28:20.020 --> 28:23.860] And, uh, they look like the rest of us except they're darker skin. [28:24.380 --> 28:24.540] Right. [28:24.660 --> 28:25.800] They still look pasty. [28:26.160 --> 28:34.740] You know, because, you know, even if they're, even if you're a dark skin African American people, it's still like, they're still pasty because they're still doing what we're doing. [28:36.760 --> 28:43.180] So, yeah, so there was, uh, the people we spoke to saw basically no representation of hackers of color in the media. [28:43.560 --> 28:49.200] Uh, they didn't necessarily think that there weren't hackers of color, just that these media portrayals just weren't really there. [28:49.500 --> 28:58.640] With the sole exception of these kind of enemies of America being depicted as kind of a vague, formless threat, like you see happen with these Chinese hackers in the media. [29:00.860 --> 29:03.340] Uh, the next slide is hackering polarization. [29:03.340 --> 29:10.980] So, we had multiple issues that we saw a split, where there were either portrayals in one direction or the other, but nothing really in between. [29:11.320 --> 29:13.260] So, we have a few different ones we're going to talk about. [29:13.260 --> 29:35.560] I think the fact that media often presents hackers as dangerous and powerful or, uh, inversely as, as losers, but only those two extremes, often means that, uh, it's easy to see through the false binary. [29:36.680 --> 29:50.900] The media would just be, uh, the stereotype, and I guess the stereotype is the young boy living in the, in the, in the, in the basement or dead, or some superhero-style person that just hacks anything. [29:53.020 --> 30:04.600] So, our first point of polarization was this, uh, portrayal of the hacker individual in the media as being portrayed as either these dangerous, all-powerful beings, or perhaps as losers in mom's basement. [30:04.600 --> 30:06.680] Uh, but nowhere really in between. [30:07.180 --> 30:10.820] We have a couple other points as well that we didn't have clear audio for. [30:11.060 --> 30:21.880] Uh, but some spoke about, uh, uh, kind of polarization between the general public and the hacking community, where some, or many individuals are scared of technology, and perhaps even scared to turn on a computer. [30:22.480 --> 30:35.620] Uh, and finally, with portrayals of females in the media, where they're always portrayed as either these sexualized characters, like Angelina Jolie in Hackers, or as these kind of goth characters, the first of which that comes to mind is Abby from NCIS. [30:37.040 --> 30:39.440] Uh, the next slide. [30:39.540 --> 30:40.780] Hack versus Hackers. [30:40.780 --> 30:45.940] So, when we were asked, talking to these hackers, we asked, what is shown more in the media? [30:46.160 --> 30:49.380] Is it the hack, the actual event of these breaches that occur? [30:49.700 --> 30:53.620] Or is it, does the media focus on these personalities, the actual hackers? [30:54.380 --> 31:07.100] They need a face and a physical body to point at, so it's very hard to talk about a hack, or about the movement, or about...so they need us to point at some moments. [31:08.020 --> 31:12.200] Uh, I mean, I guess it depends on, on, on the story. [31:12.500 --> 31:18.700] Like, a target hack is all about the hack, or at least what I, you know, read or saw about it. [31:19.980 --> 31:32.180] So, usually in the news, the first thing that will come out is the news about a particular, uh, breach, or leak, or, I don't know, Adobe using passwords, any particular breach. [31:33.640 --> 31:36.620] Personalities that get famous, they're rare. [31:37.840 --> 31:39.720] I think it's the hack itself. [31:40.220 --> 31:57.980] Uh, because the, uh, I don't know, the event, or, the type of hack, can be twisted to say whatever the public relations or whatever is put out in the media. [31:58.260 --> 32:01.960] Like, I mean, they, they focus, a lot of them focus on the hack, and they don't focus on the hacker. [32:02.180 --> 32:04.460] And, okay, what was the hacker's intent? [32:04.720 --> 32:06.020] Why was he doing this? [32:06.620 --> 32:11.500] Uh, they don't really use any, any kind of expression in regards to that. [32:13.520 --> 32:15.820] So we had mixed responses to this question. [32:16.120 --> 32:18.260] Uh, we had some that said it was easier for the media. [32:18.260 --> 32:19.960] If they had a face they could point at. [32:20.440 --> 32:27.360] Uh, whereas others said that it was easier for the media to twist a specific event into whatever their, uh, current agenda is. [32:28.080 --> 32:32.500] Um, so, leading into issues with news. [32:32.740 --> 32:39.360] Taking a break from the movies and the television shows, what specific issues did the hacking community have with the mainstream news? [32:45.620 --> 32:46.840] What can we do better? [32:47.320 --> 32:56.740] Um, I think that, like, I mean, there needs to be more good journalism. [32:57.400 --> 33:02.450] This takes snippets and then they twist that to whatever, whatever they want it to appear to be. [33:02.650 --> 33:08.280] But then if you read the full story of, like, like you said, the dockets or whatever, you get the real story. [33:08.430 --> 33:14.480] You're like, okay, this is actually what happened, not someone else's interpretation of how they read it or how they want people to understand that. [33:14.480 --> 33:14.580] Yeah. [33:15.430 --> 33:25.560] You have these, these, uh, major news outlets and media outlets that, they work in public relations. [33:25.820 --> 33:29.980] I mean, obviously, they're able to shape public opinion. [33:30.190 --> 33:40.580] I mean, cause, most of the stuff you're gonna see on TV anyways, it's gonna be some, something bad or something negative or something pessimistic or cynical. [33:41.430 --> 33:47.690] They don't really understand, like, the hacker mindset or the, uh, hacker manifesto. [33:49.690 --> 33:56.480] Uh, so the vast majority of people we spoke to felt that the mainstream news does not do a good job at portraying the hacking community. [33:56.780 --> 34:07.450] Uh, they said that the media often twists stories when if you actually do your own research, it might not be the full story that they're giving, and that they're shaping public opinion with these kind of negative portrayals. [34:08.620 --> 34:11.840] Um, on the other hand, what about issues with movies? [34:12.120 --> 34:16.060] Not the mainstream news, but just these television shows and fictional depictions of hackers. [34:17.220 --> 34:21.820] Maybe 98% of what happens in these films is completely wrong. [34:23.140 --> 34:23.640] What? [34:23.780 --> 34:26.060] First off, I have yet to see an accurate hacking movie. [34:26.300 --> 34:26.540] Yeah. [34:27.040 --> 34:28.360] I don't think it'll ever exist. [34:29.600 --> 34:31.500] You know, YouTube forgive Hollywood, though. [34:31.600 --> 34:36.380] They're not gonna make a movie about, like, people staring at, like, computer screens for, like, two hours, right? [34:37.580 --> 34:45.020] They suggest to me, like, oh, actually, this movie's kind of, like, it's kind of totally got computer technology wrong. [34:45.520 --> 34:47.820] I mean, like, oh, I don't really want to watch that. [34:49.540 --> 34:56.600] I think that movie doesn't pay tribute to, and, you know, the media definitely doesn't pay tribute to. [34:56.600 --> 34:58.940] Is the social engineering aspects of it. [34:59.780 --> 35:11.300] Um, I think, I think a pervasive one is that hackers are, like, usually male, uh, usually young teenagers, uh, like, sexually inexperienced, completely faced in their basement. [35:11.840 --> 35:11.980] Okay. [35:12.160 --> 35:16.980] And are sort of, like, taking out their, like, aggression and their impotence on the rest of the world. [35:18.980 --> 35:22.140] Uh, then we had a couple other quotes we didn't have clear audio for. [35:22.500 --> 35:28.160] Uh, this individual saying that a hacking movie would be boring as hell, staring at screens for hours in a row. [35:28.600 --> 35:31.720] Uh, and another pointing out, again, that they weren't very realistic. [35:32.400 --> 35:41.200] So, the hacking community also took issue with a lot of these movie portrayals, uh, but, um, not, on the news, they didn't really understand. [35:41.320 --> 35:44.180] But with the movies, they kind of understood more why this might be the case. [35:44.540 --> 35:49.360] Why Hollywood might want to speed things up a bit, uh, rather than just staring at these computer screens. [35:49.900 --> 35:54.200] Uh, which leads us into the 1995 film Hackers. [35:54.200 --> 35:58.880] Uh, we had so much of a response about this film that we gave it its own slide. [35:59.060 --> 36:02.160] So, we're gonna listen to what the hacking community had to say about this film. [36:05.150 --> 36:07.210] It's, it's almost a parody of real hacking. [36:07.950 --> 36:09.070] It's definitely Hollywood. [36:09.310 --> 36:12.010] I mean, you got the whole mad scientist big corporation thing. [36:12.730 --> 36:14.810] Hackers is just, yeah, that's great. [36:14.950 --> 36:16.310] Like, I can't even tell you why. [36:17.050 --> 36:18.370] It's very old and outdated. [36:18.730 --> 36:22.690] Like, they threw, like, they had some, like, the collective new book and all that. [36:22.930 --> 36:28.470] Like, even when they were using that stuff, it was, like, out of date when they were talking about it, which was kind of funny. [36:28.990 --> 36:33.470] I mean, Hackers is fun, but it's not, like, a very accurate or even good movie. [36:34.690 --> 36:37.150] It's just, like, laughably badly written in it. [36:38.470 --> 36:40.150] That movie, to me, is crap. [36:40.310 --> 36:44.430] It shows, like, it shows, like, the old school stuff, so to speak. [36:44.430 --> 36:49.090] It, it kind of stereotypes, like, what hackers are. [36:51.070 --> 36:58.850] So we just kind of wanted to pull out a separate slide for that, because basically everyone we spoke to, when we asked them for an example of a hacking movie, mentioned Hackers. [36:59.390 --> 37:03.590] Basically, everyone loved it, probably due to that whole, it's so bad, it's good mentality. [37:05.050 --> 37:06.770] But moving on, evolution. [37:06.890 --> 37:10.110] How have these media portrayals changed over time? [37:10.110 --> 37:14.590] In general, yeah, I think that it's shifted from, like, scary teenagers to scary Chinese. [37:15.690 --> 37:24.570] I guess that recently, yeah, it's also quite changing, because of all this cyber war pollution. [37:25.410 --> 37:38.370] We have gone from being... I'm thinking the 80s persona is fun-loving prankster, not, not deliberately dangerous. [37:38.830 --> 37:44.310] By the 90s, it morphs into weirdo who's soon to be rich. [37:44.530 --> 37:45.550] And that was the idea. [37:45.670 --> 37:47.330] Like, hey, I'm a hacker. [37:47.490 --> 37:50.570] I got blue hair and, you know, some weird tats. [37:50.570 --> 37:52.910] And I'm wearing really impractical clothing. [37:52.910 --> 37:56.830] In 2000s, it kind of drops off. [37:57.150 --> 38:04.810] And there's, after 2001, we get this, hackers are potential cyber warriors for America. [38:05.350 --> 38:07.530] And I watch a militarization. [38:09.230 --> 38:21.190] So the main kind of change over time that we saw was this movement from the media towards this kind of warfare, this cyber warfare, hacking being used as a tool in the military. [38:21.550 --> 38:24.570] So that was the main kind of change that we've seen in the media. [38:26.850 --> 38:31.770] On the other hand, how has the media impacted the hacking community, going in the reverse direction? [38:32.450 --> 38:38.890] I'm very careful using the word because I am sensitive to their impressions of the word hacker. [38:39.710 --> 38:44.710] I recently had a conversation with a cousin who I haven't talked to in 20 years. [38:45.410 --> 38:47.350] And she said, oh, you know, we're catching up. [38:47.490 --> 38:48.570] And, oh, so what do you do? [38:48.570 --> 38:53.310] And I said, well, I've put on some conferences. [38:53.990 --> 38:58.390] But when I say the word hacker, I'll explain it to my cousin. [38:59.550 --> 39:02.110] That might trigger certain things in your mind. [39:02.770 --> 39:09.170] And I want to make you aware up front that it's not necessarily what your impression is. [39:10.570 --> 39:23.850] But I think it's resilient enough that the hacking culture is resilient enough that that kind of bad influence does not really affect us in the long term. [39:25.230 --> 39:30.630] So many of the people we spoke to felt a strong personal impact because of these portrayals in the media. [39:30.890 --> 39:35.610] They felt uncomfortable describing themselves as a hacker to their friends or to the public. [39:36.970 --> 39:48.830] However, multiple people stated that they felt the hacking culture as a whole, despite these individual impacts, the hacking community was very resilient and not really strongly affected by these portrayals. [39:50.410 --> 39:52.690] So we wanted to end this on kind of a fun note. [39:53.270 --> 39:55.870] What would hackers do if they were making the movies? [39:56.190 --> 39:57.290] Who would they cast? [39:57.370 --> 39:58.910] What kind of plot would they have? [40:01.150 --> 40:03.350] It would be fun to just flip all those parodies. [40:03.490 --> 40:04.950] Cast people you'd never consider. [40:10.110 --> 40:19.410] I mean, you know, it could be, I don't know, hackers wanting to expose the truth about, like, I don't know, climate change or people hoarding money or... [40:19.410 --> 40:26.590] And honestly, I would cast some of the guys around here, the whole 2600 crew, because they're, like, the originals. [40:27.710 --> 40:33.630] Obviously, to make it a Hollywood movie, it's got to be exciting. [40:33.890 --> 40:45.830] There has to be actual drama rather than lots of caffeine, obsession, and Arduino. [40:45.830 --> 40:52.190] You know, um, because most hacking is boring from the outside. [40:52.630 --> 40:57.330] Because I might try to insert more realistic stuff. [40:57.650 --> 41:02.810] To actually show someone, you know, running in my command line. [41:05.010 --> 41:12.310] So, leaving aside some of the fun casting decisions, a lot of the hackers we spoke to would like to see some more realism in the media. [41:13.110 --> 41:16.770] However, they kind of understood why Hollywood might do what they're doing. [41:17.330 --> 41:22.890] They understood that hacking was boring, and you couldn't just make a film entirely about hacking for the general public. [41:23.610 --> 41:27.830] So, that concludes our kind of analysis, so I'm going to turn the stage back over to Aunshul. [41:28.430 --> 41:29.330] Alright, thanks, Quinn. [41:29.930 --> 41:33.310] So, as you can see, this is a very complex topic. [41:33.490 --> 41:37.110] There's lots of rich detail, and we did struggle in certain areas. [41:37.430 --> 41:44.350] We would love to hear from you guys about how race, gender, and age are portrayed in the media. [41:44.490 --> 41:46.830] And has this changed over time, and if so, how? [41:47.710 --> 41:54.290] How have the hacking community and culture as a whole been impacted, and, you know, how are they managing any such impacts? [41:54.710 --> 41:59.370] And finally, did we capture all of the myths, or are there some that we missed? [42:01.070 --> 42:09.630] So, in academia, publish or perish is a big component of the job, and Quinn and I do plan to publish this soon. [42:10.090 --> 42:15.830] But before we do that, we're here to ask you, consider this a validation stage, if you will, of the research. [42:16.490 --> 42:17.610] What did we get right? [42:18.050 --> 42:19.210] What did we get wrong? [42:19.450 --> 42:20.930] And how can we improve our work? [42:21.610 --> 42:23.450] And so, we'd love to hear from you. [42:23.610 --> 42:27.430] As I stated earlier, we only had 20 folks that we spoke with. [42:27.670 --> 42:29.210] We'd love to get that number up. [42:29.910 --> 42:36.210] So, if you want to talk to us and have time, Quinn is available to do interviews here today. [42:36.410 --> 42:38.410] And Bernie, I don't know if you're here or not. [42:38.570 --> 42:40.030] I can't see in the dark. [42:40.030 --> 42:45.870] But thank you for getting us our second letter of support in time for this round. [42:46.910 --> 42:50.130] Or, if you don't have time to talk to us, I mean, we are at HOPE 11. [42:50.290 --> 42:51.490] There's lots of cool talks out there. [42:52.190 --> 42:55.950] If you could, please complete the survey that Quinn has created on Qualtrics. [42:56.070 --> 42:57.790] The QR code is on screen. [42:59.730 --> 43:04.990] Just to let you know, both in-person interviews and online surveys are completely anonymous. [43:05.230 --> 43:08.810] We don't record any names or identifiers, no IP addresses. [43:09.670 --> 43:14.210] Or, if you would like to speak with us at a later time, my email address is listed on the screen. [43:14.330 --> 43:16.390] So, please feel free to reach out to us. [43:16.550 --> 43:20.150] I want to take a quick few seconds to say that I'm very, very proud of Quinn. [43:20.910 --> 43:22.870] He's worked very hard on this project. [43:22.870 --> 43:28.110] So, thank you for working with me and I'm glad that we got to present this research at HOPE 11 together. [43:28.650 --> 43:32.530] So, thank you all for attending and for your time and attention. [43:32.910 --> 43:36.570] I think we can open it up for questions, discussions, comments. [43:37.410 --> 43:37.810] Thank you. [43:49.610 --> 43:54.610] If you have a question for Ann Scholler-Quinn, please come up to the front and use the microphone. [43:55.010 --> 43:55.610] Thank you. [43:56.010 --> 44:00.870] Are you keeping your research U.S.-based focused or is you also looking for international components? [44:00.870 --> 44:02.830] We'll take anything that we can get. [44:03.070 --> 44:12.810] It's good because we do have topics of race, gender, culture, things like that, which I think will show some differences. [44:13.190 --> 44:15.050] So, yes, we would love to open it up. [44:24.120 --> 44:26.300] We did have some index cards in the back of the room. [44:26.300 --> 44:32.960] So, if anybody has any questions or comments for us, please feel free to reach, to fill those out and we'll collect them at the end. [44:33.360 --> 44:34.180] Do you have a question? [44:34.460 --> 44:34.640] Yeah. [44:35.180 --> 44:35.700] All right. [44:35.880 --> 44:36.180] We're good. [44:36.660 --> 44:37.000] Good. [44:37.520 --> 44:37.940] I don't know. [44:38.680 --> 44:39.540] I think that's it.