Expert Analysis

11:21 AM
50%
50%

One Secret That Stops Hackers: Girlfriends

The majority of hackers "age out" of hacking as they get older and find girlfriends, families, and other responsibilities. Why not invest in educating young hackers sooner, instead of locking them up later?

Want to put a stop to hacking? The solution is simple: Get hackers girlfriends.

To be sure, that prescription is tongue-in-cheek, but it speaks to a hacking truth: Based on arrests of alleged Anonymous, LulzSec, TeamPoison, and other hacktivist group participants--not to mention many cyber-crime gangs--it's the rare participant who's over the age of 25--or even 19.

Clearly, the early 20s are an inflection point in most hackers' lives, when they transition from engaging in criminal activity to becoming law-abiding citizens. Accordingly, might outreach programs, perhaps involving older ex-hackers, help keep them out of jail? They might even steer would-be hackers into lucrative professions that put their skills to better use, such as penetration testing.

[ Megaupload founder says he'll come to the U.S. in exchange for a fair trial and access to his assets. Read more at Megaupload's Kim Dotcom Offers To Extradite Himself. ]

The question of whether outreach programs would be effective requires working backwards, starting with the reason hackers--who are overwhelmingly male--stop hacking. That's typically because they get girlfriends, jobs, children, or other responsibilities. "We see a lot of adolescent hackers just 'aging out,' and there are relatively few who remain life-course persistent," says cyberpsychology expert Grainne Kirwan, a lecturer in psychology at Ireland's Dun Laoghaire Institute of Art, Design and Technology, in a phone interview.

While conducting research for her criminology Ph.D., Kirwan interviewed about 20 hackers and found that the majority stopped hacking due to their changing life circumstances. "The chances are by the time they turn 18 or 19 they'll age out, and if they haven't stopped then, by the time they get married, settle down, and have kids, they won't have time to do this type of behavior anyway," she explains. "As they get older, their moral development gets better, and they don't have the ability to commit crimes anyway."

Kirwan said the aging-out phenomenon isn't limited to young hackers. "What we know from general criminology research is that offenders age out, and that they tend to age out when they start to settle down, find a significant other, and [other] factors that will reduce the likelihood of their wanting to offend," she says.

The prevalence of minors who hack hasn't gone unnoticed in law enforcement circles. Speaking earlier this year at the RSA conference in San Francisco, Eric Strom, unit chief for the Cyber Initiative and Resource Fusion Unit Cyber Division at the FBI, said the bureau believes that in general, hacktivist groups are run by a small number of people who combine "technical knowhow and the ability to impress upon younger people" the desire to launch certain types of attacks. But, he said, "the challenges of going after the larger group [of participants] is that most of them are minors."

How should law enforcement address that, especially when those kids' parents likely think their son is upstairs doing his homework, not launching a low orbit ion cannon distributed denial-of-service (DDos) attack?

To answer that question, it helps to know why hackers hack. In fact, most hackers--who are older minors or young adults--"are desperately trying to assert their own independence, and believe they can make a change in the world that their parents can't," says Kirwan. "They kind of forget that it's their parents' generation who invented hacking."

Many kids involved in hacking view their activities as a benign form of protest, when the laws--as currently written--can criminalize some types of related behavior. "They are sitting at their computer and saying, 'I'm not committing a crime,' because it doesn't feel like committing a crime," explains Kirwan.

The FBI's Strom said the bureau tries to draw a clear line between online protests and online attacks. "Certainly if they're just complaining about something, they have every right to do that--and we don't have any problem with that," said Strom. But if they hack into a system or go after someone in law enforcement and their family, that's a different story.

Also, there can be seeming inconsistencies between what's legal in the real world as opposed to online. "In the western world, we generally… encourage political activism, even when it might have a negative effect on business," said Grady Summers, vice president of Mandiant, speaking at this year's RSA conference. For example, workers can picket their place of business over poor working conditions, and people can protest in front of foreign embassies or set up Occupy Wall Street camps that may impact local businesses. But by comparison, "the digital equivalent of that--a DDoS attack that takes a site offline for a few hours--is clearly criminal," he said.

Should the laws pertaining to DDoS attacks, when launched for protest purposes, be changed? Regardless of wrong or right, in today's "must-be-seen-as-tough-on-crime" political arena, it's unlikely that related laws or jail times would ever be curtailed. Furthermore, do we really have a full enough understanding of exactly why people hack?

"What do we really know about hackers engaged in bad stuff? Do we have a proper, accurate, working taxonomy of people involved in cyber-criminal activity, cyber espionage, cyber warfare, and so on?" said Darkmarket author Misha Glenny, speaking at this year's RSA conference. "Who are the masterminds behind the attacks? Are they suave social engineers, are they highly skilled hackers, or are they psychopathic characters who combine both attacks?"

Another question concerns whether many hackers might also have Asperger's syndrome, a form of autism characterized by having difficulties with social interaction, and often also an affinity for obsessive or repetitive routines. Kirwan says a connection between hacking and Asperger's has been noted anecdotally because "it's a facet of some of the most publicized cases." For example, both the lawyers for NASA hacker Gary McKinnon and accused LulzSec member Ryan Cleary have said their clients have the disorder.

The Asperger's theory would handily explain why many kids hack, as well as why they're so good at it. "People who have Asperger's syndrome are less likely to find full-time employment or to settle down with a family," says Kirwan. "Another trait for people with Asperger's is they will find out everything they know about something they like." But she cautions against trying to reduce the cause of hacking to just a developmental disorder. "I certainly don't want to do a tarring with one brush," she says.

Keeping the potential Asperger's connection in mind, if most hackers do simply age out, could prevention programs be put in place to help deter minors before that happens? For example, why not turn to older, more mature ex-hackers to educate younger hackers about the risks, or to try and help them put their talents to a legal—and, given the state of the information security job market, likely quite remunerative--use? "Putting the two together seems like it would reduce the crime, but the next step is to test that and see if that's what really happens," says Kirwan.

Unfortunately--at least where Kirwan's hacking studies are concerned--hacking interviews and research conducted for her Ph.D. have given way to the responsibilities of a full teaching load. "It would be fantastic if I could buy out a bunch of my time and work on a project like this," she says. "But we'd need the funding to do that, and at the moment, that funding doesn't seem to be around."

So here's to a show of hands from businesses and government agencies that don't want to get taken down by hacktivists: Rather than locking up hackers after the fact, who wants to fund better hacking research and practical hacking-prevention campaigns?

Editor's note: corrected spelling of low-orbit ion cannon.

Black Hat USA Las Vegas, the premiere conference on information security, features four days of deep technical training followed by two days of presentations from speakers discussing their latest research around a broad range of security topics. At Caesars Palace in Las Vegas, July 21-26. Register today.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sumdood
50%
50%
Sumdood,
User Rank: Apprentice
7/27/2012 | 6:34:53 PM
re: One Secret That Stops Hackers: Girlfriends
Most of those adolescent hackers just need to get laid for the first time
Scott Wallask
50%
50%
Scott Wallask,
User Rank: Apprentice
7/23/2012 | 1:26:54 PM
re: One Secret That Stops Hackers: Girlfriends
While it makes for a funny headline to say "get hackers laid and they'll stop hacking," we all know that's not true. KoE's comments are the dose of reality here. If you're good at what you do and don't get caught, you will keep doing it. The Asperger's argument is always a weird one to me -- sounds like social profiling, and it's no better than the police pulling over African-Americans because they're black. If the "aging out" theory has any merit, than the Asperger's theory must then be invalidated, because you don't age out of Asperger's.
KoE
50%
50%
KoE,
User Rank: Apprentice
7/19/2012 | 11:12:36 AM
re: One Secret That Stops Hackers: Girlfriends
I didn't make it to the end of this article. I was laughing so hard I almost had a heart attack.

Seriosuly though, what makes you think all hackers are:
1 - Young.
2 - Not in a relationship.
3 - Have no responsibilities.
4 - Not security professionals by day.

Let's not forget that "Anonymous" are new kids on the proverbial block. They just caught the public eye as the group revolves and grows on media attention.

Real hackers go undetected.
I'm 29. I'm a hacker. I have a job. I have a relationship. I have children. I just stand up for what's right, not just what makes money.

records.viu.ca/~soules/media11...
[snip]
"This is our world now... the world of the electron and the switch, the
beauty of the baud. We make use of a service already existing without paying
for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
you call us criminals. We explore... and you call us criminals. We seek
after knowledge... and you call us criminals. We exist without skin color,
without nationality, without religious bias... and you call us criminals.
You build atomic bombs, you wage wars, you murder, cheat, and lie to us
and try to make us believe it's for our own good, yet we're the criminals.

Yes, I am a criminal. My crime is that of curiosity. My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
for.

I am a hacker, and this is my manifesto. You may stop this individual,
but you can't stop us all... after all, we're all alike."
AutumnL78
50%
50%
AutumnL78,
User Rank: Apprentice
7/18/2012 | 4:39:25 PM
re: One Secret That Stops Hackers: Girlfriends
'Getting hackers girlfriends" to get them to stop hacking is from my experience not true. The use of these mini hackers in the military and other needed areas would drastically improve our chances at winning the cyber war. But instead of focusing on and writing about ways trying to bring these kids to the good side (we have cookies too ya know) the focus seems to be on discouraging them and their natural skills, and attempting to stop them from developing their skills in a controlled and educated way.. And how you say do we stop these mini hackers from hacking?? By throwing girls at them. Yeah. No. This will NOT stop them. How do I know this??? Eight years ago I MARRIED the guy who got busted for hacking the schools dial up system from home in middle school, who would take leave to go to hacker cons, and owned a small library of 2600 magazines. I encouraged this hacker to change rates in the Navy so that he could use his interest in hacking and all the skills he had for good. I supported his desire to get not one, but TWO masters in internet security. I have gone to many "hacker-cons" just to learn and understand what my husband is passionate about. My wonderful husband instead of being distracted from his interest in hacking has been encouraged since he was a kid to learn about the things that interest him. In my opinion this encouragement is what makes this man the BEST in his field in the Navy. I know this not through biased but through fact, experience, observation, and discussions with his supervising officers and civilians who work with him, as well as discussions with people we have met at cons who have interacted with him. I have learned enough from cons, editing masters papers, and dinners with his friends that I can carry on a rather informed discussion with his friends, coworkers and the people in his job field. And even though he is a hacker, the man can be incredibly social, funny, and fun to be around. Has he always been like this? Honestly, no, he had to learn to interact with certain groups that weren't in his normal social circles, but in reality we ALL have to do that when walking into a new social group or situation. To flip the coin on this "hackers being socially challenged" idea, can I a non-hacker intermingle perfectly with his hacker friends, or any social group you put me in? To be honest not always, but at the same time sometimes there are just people you don't mesh with. Am I an expert in hacking/internet security because of the cons/talks I have attended/sat through with my husband? No, but I can sit and give a WONDERFUL response about my thoughts on cloud computing, secured networks and the need to better educate people on net security.
I won't deny that I have sat at MANY a hacker con/event and while people watching said/ thought on several occasions "wow these are NOT the most social people on earth". But I will admit that I sat and thought same thing with other "genre" obsess-ors, as I am sure you will admit to as well. I mean really have you BEEN to a Comic/Star Wars/Star Trek/Woman's Fashion event/ or some other type of gathering not in your realm of "normal thing to attend" and not thought the same thing at least one? Everyone has their obsessions in life and this is what makes us unique and let's us learn from each other. Everyone ends up with their own quirks and social challenges. It tends to be a generally accepted idea that when someone is exceptionally smart something tends to be missing on the social side, not because of a Autism diagnosis or assumption, but because they are just so dominantly left brained the social norms part of the right brain gets overridden/forgotten.
At the end of this though, outside of hackers and social issues is something I think that was barely gleamed on and really should have been the focus of this article.The KEY issue is not discouraging, but encouraging in a positive and educated way. Instead of trying to STOP kids from hacking, we need to be focusing on what can be done to encourage them to become ETHICAL hackers. Kids and teens TEST boundaries and borders, it's WHAT they do. I am in that 28-35 age bracket that I am sure you are in as well. When we were kids we had a totally different set of rules, expectations, and norms to test and push the limits of. As you know when we were growing up the internet wasn't so easily assessable and the concept of having a laptop that weighed under 5 pounds and wasn't so slow a calculator could challenge it in a speed test, we didn't have a smart phone that fit in our front jeans pocket. Cell phones to us were those big bricks and the thought of a cell phone that could make calls on unlimited plans, send typed/text messages, take photos, and play music, movies and video games was a dream. As we ALL know the tech is now more easily assessable to everyone, not just adults and in general most of the tech we dreamed of having is something kids now are expected to own and know how to use. Because of these advancements in tech and as well as the general acceptance of it in daily mainstream use the boundaries we pushed as kids are now no longer a challenge to kids today and because of this, kids today will continue to find their own boundaries to push and test. These kids that are getting caught hacking need to be educated instead of getting punished in a way that makes them resent the system and then lash out and commit the same offense but this time on an escalated level. They need to be put in classes that encourage their skills and natural interest and teach them the ethics and legalities of hacking and how their skills can be used for good and shown the effects that their current uneducated and destructive style of hacking can have. Encourage these kids to become the next "10th Fleet" of the Navy and other military cyber defense groups. Let these pint sized hackers become our nations cyber defense group vs the young "kids" coming into the field now who have NO concept of what hacking is, nor do they have an interest in hacking. All they know is what they've seen in movies, and that the recruiter is telling them it's the new hotness rate/job in the military. Imagine if we were to foster these kids we are trying to stop. We would have a group in national cyber defense that not only knows from day one what a network is, what cyber defense is, and what penetration test is, but that LOVES what they do and works to excel at their job. Most of the current military cyber defense group has a limited concept of these things outside of what the military opts to teach them, and has no interest in learning MORE about these things to improve their skills on their own time, meaning we are in general handing our nations cyber defense off to a group that just wants a pay check.
Lord Layabout
50%
50%
Lord Layabout,
User Rank: Apprentice
7/17/2012 | 11:30:40 PM
re: One Secret That Stops Hackers: Girlfriends
Thats easy then - give every hacker a girlfriend. While we are at it, let's solve world hunger by growing more crops, and solve poverty by giving everyone more money.

Of course changing the lifestyle of someone will change what they do. Sounds like a truism to me.

But finding enough girlfriends for young men would be a much bigger problem to solve than hacking itself is. We live in an era when, in the West, vast numbers of women have turned their backs on men (either before or after having a child); and in the East it is suspected that many girl babies are strangled at birth (the disproportion in China is frightening) or the girls leave (eg as Thai brides) to become the second wives of middle aged men in the west.

Myself, I was 25 before I found a girl my own age who would even have a conversation with me, rather than saying "Get lost". Not for my lack of trying, and I was not even bad looking or hard-up.

If you see a note of bitterness here, then that is an insight of the problem.
Cryptodd
50%
50%
Cryptodd,
User Rank: Apprentice
7/17/2012 | 10:52:55 PM
re: One Secret That Stops Hackers: Girlfriends
The article is interesting and humorous. I sense a national Gǣanti hackingGǥ campaign formingGǪ Seriously though, it might be true that a girlfriend can rehabilitate a young hacker by refocusing his energy elsewhere and toward maturity, the problem with the Gǣaging outGǥ theory is that there is always a steady supply of younger hackers who take the helm G and build on the work of their predecessors. I agree with Paul that the time and energy would be better spent on protecting the data within the database. If data is encrypted and protected well, hacker satisfaction decreases to zero.
Bubbatron
50%
50%
Bubbatron,
User Rank: Apprentice
7/17/2012 | 8:01:45 PM
re: One Secret That Stops Hackers: Girlfriends
Mr Schwartz writes: "To be sure, that prescription is tongue-in-cheek"
If you have to point out that it's tongue-in-cheek, you're not doing it right.

And then we read the following: "Another question concerns whether many hackers might also have Asperger's syndrome"
This is the reason why the presented plan won't work. The only people who can stand aspies enough to be their girlfriends are other aspies. Given that most aspie girls are rather butch, they won't float said aspie hackers' boats, dooming this plan from the start.
Danielle Kogan
50%
50%
Danielle Kogan,
User Rank: Apprentice
7/16/2012 | 9:33:39 PM
re: One Secret That Stops Hackers: Girlfriends
Very interesting article- check out this post about hiring a hacker http://www.intechnic.com/blog/...
PJS880
50%
50%
PJS880,
User Rank: Apprentice
7/16/2012 | 5:11:05 PM
re: One Secret That Stops Hackers: Girlfriends
That is a very interesting article and a bit comical. They put an awfully lot into researching why people hack, and in my opinion the money could be better spent on preventative measures rather than profiling possible hackers. Ultimately regardless of the reason or the individuals situations people are still hacking and will continue to hack as long as there are systems to hack. I would have quested the reasons people hack is to either prove there self-worth and skills on a computer, monetary gains, or for preventative purposes. I think that life changing events affect every person differently it is how individuals deal with them that makes the difference.
Paul Sprague
InformationWeek Contributor
Slideshows
Cartoon
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
Research: 2014 State of the Data Center
Research: 2014 State of the Data Center
Our latest survey shows growing demand, fixed budgets, and good reason why resellers and vendors must fight to remain relevant. One thing's for sure: The data center is poised for a wild ride, and no one wants to be left behind.
Video
Twitter Feed