When someone invites me to speak at a conference or quotes me, they often write that I’m an “ethical hacker.” I used to put that in my bio myself, so it keeps getting copied around. In this blog post, I’ll explain why I no longer consider myself an ethical hacker.
I’ve been hacking since I was a kid. At first, I didn’t even know it was called hacking. I had an 8-bit computer and I was just exploring what it could do. Then came PCs, BBSes, the internet, Linux, open-source, and web services.
In the early days of the internet, hacking was great fun. Everyone was just excited that the internet worked at all—so much so that it didn’t even occur to anyone to upgrade anything. If it ain’t broke, don’t fix it. These were the days I call the “open house” era of the internet, and this lasted for several years.
As money came to the internet through e-commerce, and people started handling “more important” things than debates about life itself, security began to commercialize on both sides of the fence. Attackers, spammers, and “black hat” hackers on one side; admins, security architects, penetration testers (“ethical” hackers, to distinguish themselves from the “bad” hackers), and auditors on the other. Great methodologies emerged for pentesting and risk assessment (though I had serious problems with risk assessment in particular—it was basically security theater).
Later, the state started sticking its nose into security and privacy and began “solving” it—cookie banners constantly ruining the entire internet, privacy policy consents that nobody reads, mandatory penetration tests where clients want “twenty sheets of security”—meaning papers in a drawer to keep the regulator off their backs.
My Relationship with IT Security
Hacking used to be fun. Finding vulnerabilities, glory in hacker magazines, competing to see who was better. Amazing hacker events—both at home and abroad, with tons of inspiring people.
I founded several security companies—I built servers and server farms to be secure, I did penetration testing, and I ran a bug bounty platform.
Lately, it’s become less fun. Increasingly, it’s not about finding a vulnerability and helping fix it, but about meeting some formal requirements. Clients demanding risk assessments based on methodologies that make no sense. And working more and more often with clients who don’t actually care about security—and frankly, in many cases, they shouldn’t have to. For many businesses, a hack just isn’t that big of a deal. They’d be better off investing in something else—marketing, improving their product, increasing quality. Instead, a tire shop has to pentest its tire change booking form because, god forbid, customer phone numbers might leak. Sure, ideally they wouldn’t collect personal data at all—but in many cases, the state forces companies to do so.
When I buy an e-book, the only reason I have to fill in my name, address, and phone number is because the state requires the seller to issue a proper invoice (phone numbers are good to collect because it’s one of the pieces of evidence you need to store as proof of correct VAT assessment; IP addresses are stored for the same reason—more in this regulation, articles 24b and 24f). So on one hand, the state harasses entrepreneurs by saying they can’t track users with cookies, and then forces them to track users by logging sensitive personal data that they don’t actually need to deliver the service—if I’m providing someone with an e-book, I really don’t care where exactly they live, I don’t want to know, it’s data I have to protect unnecessarily.
The result is a growing disillusionment as I realized that my work wasn’t something the client actually needed to be better. Or at least, this was increasingly the case—of course, plenty of clients genuinely needed it—security in the financial sector, working with truly sensitive personal data, and so on.
But technical hacking remains. I’ve written several pieces of pentesting software, denial-of-service protection, and similar tools. I’ve audited cryptocurrency projects. All of this was fun. Until this activity became a monotonous task following methodologies. There’s still plenty of good and fun work to be found in this area.
I still enjoy going to hacker conferences, sitting down and listening to someone talk about how they hacked a satellite in orbit that had stopped working.
When it comes to work, though, I’m missing the positive feedback. Friends found security vulnerabilities in government systems and the state attacked them for it. Instead of gratitude and an opportunity to improve, the reaction was as if the hackers were to blame for the bugs in the system.
And that brings me to my final realization. Hacking isn’t as creative as it was when I started. I realize the fault lies with me—I’ve stopped improving. I can still appreciate others’ creativity, but I’ve returned to creating things that have a longer-lasting effect—programming, writing, and similar pursuits. I want to leave something behind, something that will be used for longer than a patch and five minutes of fame from your own CVE.
The machines took over (from Tamers of Entropy)
The following is a chapter from Tamers of Entropy, where I tackle this topic:
He packed his gear with the usual hacker messiness – his backpack was just a volume to be filled with cables, connectors, and devices. Outside the tent, Lisa sat watching the stars, her back against a crate of empty Club-Mate bottles someone had stacked into a bench, or at least she thought that was the purpose of this installation. The sky was absurd, dense and unfiltered, the kind that cities had abolished. She could still feel the residue of the coherence session somewhere behind her sternum, a warmth that hadn’t been there before, oscillating at a strange frequency.
He emerged and saw her there. Asked if he could join her. She nodded, and he set his backpack down and pulled out a jacket, spreading it on the ground for them to sit on. The earth was releasing the day’s heat into the cooling air, and the chill was starting to reach through denim.
“I’m switching tracks,” Lisa said. It came out clean and certain, like something her subconscious had been certain of, but she’d feared saying it out loud before. “I’ve been too deep in security. It’s lost its charm for me.”
The camp hummed around them. A distant bass pulse from the main stage, laughter from the Italian village where someone had resurrected the disco for the third time, the subsonic vibration of generators powering this temporary civilization.
“It’s creative,” she continued. “But the creation doesn’t last. You find a bug, then it’s fixed. What’s new in the world is an absence, a vulnerability that no longer exists. Which improves things, sure. But there are always more bugs. It never ends.”
“You’re in security as well…?” Lisa asked, and caught herself as the words left her mouth. Nobody here talked about their jobs. They talked about their creations, their obsessions, the things that kept them awake. Occupation was a label from the other world.
“Passingly.” He pulled a blade of grass from beside the jacket and rolled it between his fingers. “I started a few IT security companies, but I got tired of it too. I don’t last with anything very long, though. I always need a new challenge. Or even a category of challenges, if you know what I mean.” He studied the grass blade as if it contained information. “There’s a gap until I reach total mastery in hacking. But also, hacking is a state of mind. It’s bigger than any single discipline. Cracking encryption of DVDs is nice, but once a year at a conference is just about the right dose for me right now.”
Lisa nodded. The synthesizer arpeggios from a nearby tent had resolved into a sustained chord, a pad that hung in the air like mist. She continued, like a monologue overheard by someone: “You know how Barlow said, in the Declaration of Independence of Cyberspace… something about it being a new space for the mind. I don’t like the word cyberspace, but anyway, it’s an infinite space where the mind can expand. What we experienced tonight is showing me that it can be that in an almost literal sense. Our minds explored a whole new territory together. Maybe I’ll play with that.”
“It’s a beautiful thing to explore. Do you think it can lead somewhere, or is it just a ‘cyberdelic’ experience?”
Lisa hadn’t heard the term before. Maybe nobody had. Maybe he’d just coined it, assembled it from available parts. But it worked.
“Perhaps. I don’t know yet.” She watched a distant drone trace its navigation lights across the airfield, red and green drawing a diagonal through the dark. “But also, you can’t just declare independence of cyberspace. You need to build it. Or help build it. It’s quite mature already, but it’s still sort of a blank canvas.”
His phone chimed. He glanced at it and slipped it back into his pocket. “Sorry, I don’t want to break your chain of thought. Let’s talk while walking. If you have more time to spend with me, I have a perfect thing to finish the evening.” A beat. “We’ll need to take a shower first, though.”
“Sure,” she said, standing, brushing grass from her jeans. “You’ve got me curious.”
They walked along the edge of the old taxiway, where the cracked concrete still held traces of the day’s heat. Someone had chalked equations across one slab, probably related to the rocket assembly a few villages over. The camp’s light pollution was contained and careful, but it still ate the lowest stars; the higher ones burned harder by contrast.
“So what sort of things do you think need to be built?” He made air quotes around the next words. “For ‘cyberspace.’ I don’t like the term either”. The walking helped. Ideas moved differently when the body was in motion, looser, less rehearsed. “Well, first we need to encrypt the internet. The whole thing. It’s completely surveilled in ways that most people haven’t begun to realize. By governments, by private entities. Whoever could gain something from listening is listening, and it’s going to get worse. Much worse. Unless we encrypt everything.”
He was quiet for a few steps. In any other context, what she’d just said might have sounded like the preamble to a conspiracy theory. Or a privacy buff who didn’t fully understand how things worked and saw spooks behind every router. There were plenty of both types here, people with theories, people with suspicions, some of them half-right and half-paranoid. But there were also people like Bill Binney, who’d spent decades inside the apparatus and walked out with receipts. And perhaps because their brainwaves were still a little bit in phase, something in her tone told him she was neither theorist nor buff. She wasn’t speculating.
“You know something about this, don’t you?”
“A bit.” She nodded. “But it’s not as interesting as people think. The bureaucracies are like machines. Dumb machines, but enormous, and they thrive on data. People fear what would happen if machines take over, but they don’t understand they took over a long time ago.” She stepped over a painted line on the tarmac, some remnant of the airfield’s former life, guiding aircraft that no longer existed to gates that had been dismantled. “A computer used to be a person. Someone doing calculations on paper. And those calculations are the machines. The algorithm written in royal decrees, in laws and regulations. It happened decades ago, centuries ago, probably. Perhaps when they first started enforcing the use of surnames, so their tax agents could track who owed them what. They’ve just upgraded from paper to silicon. I’ve seen the probes. An old version of them.”
She surprised herself with the openness. She couldn’t really talk to anyone about this. Kevin, yes. And maybe James, although they hadn’t really talked, they’d only shared the same knowledge, passed in silence, if he’d understood the USB key she gave him. The thought touched something in her chest and moved on, like a bird landing on a wire and taking off again.
She felt the gravity constant decrease. As if she weighed half her weight and her body wanted to float, to lift off the tarmac the way Orville the cat-drone had lifted off that morning, ungraceful but triumphant, rising on borrowed physics.
“Showers.” He pointed to the portable shower pavilion ahead. There was no queue at this hour. Light steam rose from the drainage channels, and Lisa figured there was even some warm water left, a small miracle of diesel and plumbing.
“Meet you here in a bit,” he said, and turned left toward the men’s side.
Lisa did not know why he’d insisted on the shower. But when the water hit her shoulders and ran down her spine, she understood it in her body before her mind caught up. The heat dissolved something. The spray carried a weight she hadn’t realized she was holding, not away exactly, but through, streaming off her skin and spiraling into the drain, joining the runoff of five thousand other people who had come to this field. She felt lighter with each second. Unburdened.
She turned off the tap. The silence was sudden, but in it she could hear the camp breathing around her, generators and music and voices and footsteps, all part of a single organism, temporary and alive. T.A.Z.
She was going to do something very different from now on. Maybe she’d help build the new space for the mind.
Conclusion
I’m rooting for all hackers out there, and I’m grateful for the work they do. But I moved on to other things long ago. I’m applying hacker techniques elsewhere now (to life, biohacking, travel…). And best of all, when no regulator is forcing you to do it. Even hacking should be voluntary—only then is it beautiful.
Hack the planet!