SlideShare a Scribd company logo
hackers as a high-risk
    population

       @violetblue
Harm reduction methodology

      Ways to use it

      Hackers at risk
Harm reduction

Harm reduction typically refers to a range of controversial
public health policy strategies designed to reduce harmful
consequences associated with human behaviors,
specifically risky or illegal behaviors.

Conventional criticism of harm reduction is that any
tolerance of illegal or risky behavior is a demonstration to
society that the risky and illegal behaviors are acceptable.

                        And possibly even fun.
SFSI.org

SFSI.org is a nonprofit that provides confidential and
anonymous sex crisis counseling, as well as training for
medical professionals, clinic workers and caregivers.

* Instances include physical trauma and accidents, birth
control counseling, gender and orientation crises after sex
acts, sexual risk events, taboo or illegal sex acts.

* SFSI methodology applies harm reduction by suspending
judgment, and communicating facts and available choices.
Complex Humanitarian Emergency
            Training

UCSF's Global Health Master's Program, emergency and
crisis trial training for NGO workers, specifically field nurses
and doctors.
Live-action simulation of field confrontation in situations
such as wilderness training, media training, Geneva
Convention training risk assessment situations.
Homeless youth outreach

As a former homeless teen I was asked by a group of
neighborhood business associations to moderate forums
between neighborhood residents and the homeless youth
of Haight (San Francisco), and explain the harm reduction
approaches taken by neighborhood homeless youth
outreach organizations.

The work: facilitating discussions between neighborhood
residents and homeless youth, harm reduction outreach
organizations (Larkin Street Youth).
Hackers are the embodiment of
disobeying the security regime.



You are uniquely suited to be at-risk to yourselves.
Ilya Zhitomirskiy

"Those putting their reputations on the line, investing so
much heart, soul, time, energy and money in these
ventures are engaging in high stakes behavior.

It makes sense to me that there is great potential to fall to
very low places after investing so much and believing so
much in something."

                                  --Dr. Keely Kolmes, Psy.D.
Hackers and Harm Reduction /  29c3 / CCC
"Are hackers cognitively different?"


Female and Male Hacker Conferences Attendees: Their
Autism-Spectrum Quotient (AQ) Scores (2011; pub 2012)
-Bernadette H. Schell, Ph. D. / June Melnychuk, Ph. D.

Teams distributed eight-page surveys at Black Hat and
Defcon (2005, 2006, 2007), HOPE 2006, the 2005
Executive Women's Forum for IT Security, and the 2006
IBM CASCON conference.

It is the first psychological study to be performed on non-
incarcerated hackers.
The results were middle-ground, with no push
toward one extreme of Asperger's prevalence
one way or the other.

According to the study, new research suggests that those labeled as
Asperger's syndrome individuals may not be "unfeeling geeks" or emotionally
and socially deficient.

The Intense World Theory sees the core issue in autism-spectrum disorders as
not being a lack of empathy or feeling -- but instead these individuals are
having a hypersensitivity-to-affective-experience issue.

Meaning, they feel "too much" in a room full of people and the information
comes in too fast than can be comfortably processed. This person would
combat social anxiety by focusing on details and switching attention, pulling
back in a way that appears to be callous or disengaged but is actually a coping
mechanism for overwhelming feelings, and choosing to hide their own.
Hacking is a complicated gift.
* Legal risks.
* Fighting common misperceptions between information sharing and advocacy.
* Lack of support system.
* Can't ask for help.
* Outcasts to society and companies.
* Fighting indifferent institutions.
* Limited communications.
* Hackers are culturally diverse; may not be working in same language of
targets, unknowns, or allies.
* Some hackers are more at risk than others (exceptional talent, access).
* High stakes: the high profileness of the info that you have to contain adds a
different level of pressure.
* Inner risks: solitary nature of hacking - isolation, depression, impostor
syndrome.
* Hackers do things that affect hundreds, thousands of people (often more).
* A moral universe where you're either a player or you get played; you're
owning or getting owned.
The long term effects of being secret keepers.
Actions and acts of hacking put the hacker at risk.

Actions and acts of hacking put the hacker's communities
                         at risk.

      Actions and acts of hacking put external people
(individuals, communities, vulnerable populations) at risk.
lessons from the streets
The code of the streets is a protective mechanism that
serves to protect gangsters from arrest as they violate legal
codes, but operates in a dual purpose to protect the
gangsters and those they care about.

A 'code' puts the focus on individuality as opposed to
societally imposed labels.

           The most simplified street code is this:

                      Make paper.
                      Stay fresh.
                      Don't snitch.
The most detailed explanation of street code was in the
portrayal of notorious real-life gangster Donnie Andrews, as
depicted through the character Omar Little in HBO’s The
Wire.

The underlying theme of the show was Omar's belief that "a
man's gotta have a code." This contrasted perceptions of a
character who was seen on the outside as a sawed-off
shotgun toting terror, and a double-crossing mastermind
who outsmarted both the biggest drug dealers and police
time and time again.
* Omar is careful to distinguish between players and citizens.
* He never robs or murders people who are not involved in the drug trade.
* His code is not to hurt anyone who is not already in the game.
* Sunday is off limits for killing and robbing.
* Bad people deserve to be punished.
* Truth can’t be subverted to punish bad people.
* No talking on phones about business.
* No loose talk.
* Defend yourself whenever necessary.
* Look out for your own.
* Recon is required: he will scout out a location, sometimes for days, making
sure he knows everything about it before he will make his strike.
* Stay sharp: he talks often about how one must do difficult jobs, so as to keep
their senses sharpened, their wits too.
* You live by the gun, accept you'll die by the gun.
* Never get high on your own supply.
* Don't snitch.
Instances

●   Anonymity policies: perfect example of failure to reduce harm.

●   Transparency/disclosure No one listens to hackers.
    RainForestPuppy: good example of harm reduction.

●   Hacker "gentleman's agreements" another good example:
    reduces risk of a bigger threat to both entities, to limit behavior that is bad
    for business.

●   Hacktivism; the use of communication tools by activists
    and countermovements - “Telling activists not to use centralized
    email and social media platforms is about as useful as telling teenagers not
    to use drugs.” See also: OpSec for Hackers by grugq.
slideshare.net/grugq/opsec-for-hackers
hackers as a high-risk
    population

       @violetblue

More Related Content

PPT
SociologyExchange.co.uk Shared Resource
PPTX
Sy3 understanding power and control
PPT
Chapter 6 deviance and crime
PPTX
Crime and deviance complete revision
PPT
SociologyExchange.co.uk Shared Resource
DOC
SociologyExchange.co.uk Shared Resource
DOC
SociologyExchange.co.uk Shared Resource
DOCX
SociologyExchange.co.uk Shared Resource
SociologyExchange.co.uk Shared Resource
Sy3 understanding power and control
Chapter 6 deviance and crime
Crime and deviance complete revision
SociologyExchange.co.uk Shared Resource
SociologyExchange.co.uk Shared Resource
SociologyExchange.co.uk Shared Resource
SociologyExchange.co.uk Shared Resource

Viewers also liked (17)

PDF
Privacy is Personal Security, Digital Privacy is Digital Self Defense 11-18-2015
PDF
Teenage Girls: Who are they?
PDF
What teenage girls are to follow
PPT
The parable of the ten teenage girls
PPT
Hackers The Anarchists Of Our Time
PDF
The Teenage Girl as Consumer and Communicator
PPTX
Online Security for Kids
PPTX
Peer to Peer Teen Dating Violence Prevention Training
PDF
Privacy and Security in Online Social Media : Intro to course
PDF
Privacy and Security in Online Social Media : Policing and Social Media - Part 2
PDF
Are You a Hacker's Target?
PPTX
Hack the Hackers 2012: Client Side Hacking – Targeting the User
PDF
hackers
PDF
4G LTE Security - What hackers know?
PDF
Online Security
PDF
Hackers and Hacking a brief overview 5-26-2016
PDF
Internet privacy ethics and online security
Privacy is Personal Security, Digital Privacy is Digital Self Defense 11-18-2015
Teenage Girls: Who are they?
What teenage girls are to follow
The parable of the ten teenage girls
Hackers The Anarchists Of Our Time
The Teenage Girl as Consumer and Communicator
Online Security for Kids
Peer to Peer Teen Dating Violence Prevention Training
Privacy and Security in Online Social Media : Intro to course
Privacy and Security in Online Social Media : Policing and Social Media - Part 2
Are You a Hacker's Target?
Hack the Hackers 2012: Client Side Hacking – Targeting the User
hackers
4G LTE Security - What hackers know?
Online Security
Hackers and Hacking a brief overview 5-26-2016
Internet privacy ethics and online security

Similar to Hackers and Harm Reduction / 29c3 / CCC (20)

KEY
Carrot stick-consequences-app secdc-2010
DOCX
Course ObjectiveAnalyze key psychological and sociological issues .docx
PDF
Social Networks And Phishing
PPT
Learn Hacking
PDF
An Underground education
PDF
Tracking trollers
PPT
Presentatie professor Hartel Dialogues House, 28 mrt 2012
PPT
WCCC Faculty Presentation
PPTX
Cyber Security Resilience from Metro Louisville Govt.
PPTX
C3 and digital citizenship
PPT
An Underground education
PPTX
Risk Communication
PPTX
4 b. thomas whipp presentation
 
PPT
Ethichack 2012
PPTX
Bad Advice Unintended Consequences and Broken Paradigms - Think && Act Differ...
PPTX
Cyber Civil Defense - Risk Masters - Allan Cytryn
PPTX
Policies and Stragegies for Digital ImpactSinit IAD keynotex.pptx
PDF
Puna 2015
PDF
Infosec & failures
PPTX
Cyber Safety and Digital Empowerment.pptx
Carrot stick-consequences-app secdc-2010
Course ObjectiveAnalyze key psychological and sociological issues .docx
Social Networks And Phishing
Learn Hacking
An Underground education
Tracking trollers
Presentatie professor Hartel Dialogues House, 28 mrt 2012
WCCC Faculty Presentation
Cyber Security Resilience from Metro Louisville Govt.
C3 and digital citizenship
An Underground education
Risk Communication
4 b. thomas whipp presentation
 
Ethichack 2012
Bad Advice Unintended Consequences and Broken Paradigms - Think && Act Differ...
Cyber Civil Defense - Risk Masters - Allan Cytryn
Policies and Stragegies for Digital ImpactSinit IAD keynotex.pptx
Puna 2015
Infosec & failures
Cyber Safety and Digital Empowerment.pptx

Recently uploaded (20)

PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
PDF
Network Security Unit 5.pdf for BCA BBA.
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
PDF
Electronic commerce courselecture one. Pdf
PDF
Encapsulation_ Review paper, used for researhc scholars
PDF
Spectral efficient network and resource selection model in 5G networks
PDF
Unlocking AI with Model Context Protocol (MCP)
DOCX
The AUB Centre for AI in Media Proposal.docx
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
PDF
Encapsulation theory and applications.pdf
PDF
Review of recent advances in non-invasive hemoglobin estimation
PPTX
Big Data Technologies - Introduction.pptx
PPT
Teaching material agriculture food technology
Digital-Transformation-Roadmap-for-Companies.pptx
Advanced methodologies resolving dimensionality complications for autism neur...
Network Security Unit 5.pdf for BCA BBA.
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
Mobile App Security Testing_ A Comprehensive Guide.pdf
Electronic commerce courselecture one. Pdf
Encapsulation_ Review paper, used for researhc scholars
Spectral efficient network and resource selection model in 5G networks
Unlocking AI with Model Context Protocol (MCP)
The AUB Centre for AI in Media Proposal.docx
CIFDAQ's Market Insight: SEC Turns Pro Crypto
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
Agricultural_Statistics_at_a_Glance_2022_0.pdf
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
Encapsulation theory and applications.pdf
Review of recent advances in non-invasive hemoglobin estimation
Big Data Technologies - Introduction.pptx
Teaching material agriculture food technology

Hackers and Harm Reduction / 29c3 / CCC

  • 1. hackers as a high-risk population @violetblue
  • 2. Harm reduction methodology Ways to use it Hackers at risk
  • 3. Harm reduction Harm reduction typically refers to a range of controversial public health policy strategies designed to reduce harmful consequences associated with human behaviors, specifically risky or illegal behaviors. Conventional criticism of harm reduction is that any tolerance of illegal or risky behavior is a demonstration to society that the risky and illegal behaviors are acceptable. And possibly even fun.
  • 4. SFSI.org SFSI.org is a nonprofit that provides confidential and anonymous sex crisis counseling, as well as training for medical professionals, clinic workers and caregivers. * Instances include physical trauma and accidents, birth control counseling, gender and orientation crises after sex acts, sexual risk events, taboo or illegal sex acts. * SFSI methodology applies harm reduction by suspending judgment, and communicating facts and available choices.
  • 5. Complex Humanitarian Emergency Training UCSF's Global Health Master's Program, emergency and crisis trial training for NGO workers, specifically field nurses and doctors. Live-action simulation of field confrontation in situations such as wilderness training, media training, Geneva Convention training risk assessment situations.
  • 6. Homeless youth outreach As a former homeless teen I was asked by a group of neighborhood business associations to moderate forums between neighborhood residents and the homeless youth of Haight (San Francisco), and explain the harm reduction approaches taken by neighborhood homeless youth outreach organizations. The work: facilitating discussions between neighborhood residents and homeless youth, harm reduction outreach organizations (Larkin Street Youth).
  • 7. Hackers are the embodiment of disobeying the security regime. You are uniquely suited to be at-risk to yourselves.
  • 8. Ilya Zhitomirskiy "Those putting their reputations on the line, investing so much heart, soul, time, energy and money in these ventures are engaging in high stakes behavior. It makes sense to me that there is great potential to fall to very low places after investing so much and believing so much in something." --Dr. Keely Kolmes, Psy.D.
  • 10. "Are hackers cognitively different?" Female and Male Hacker Conferences Attendees: Their Autism-Spectrum Quotient (AQ) Scores (2011; pub 2012) -Bernadette H. Schell, Ph. D. / June Melnychuk, Ph. D. Teams distributed eight-page surveys at Black Hat and Defcon (2005, 2006, 2007), HOPE 2006, the 2005 Executive Women's Forum for IT Security, and the 2006 IBM CASCON conference. It is the first psychological study to be performed on non- incarcerated hackers.
  • 11. The results were middle-ground, with no push toward one extreme of Asperger's prevalence one way or the other. According to the study, new research suggests that those labeled as Asperger's syndrome individuals may not be "unfeeling geeks" or emotionally and socially deficient. The Intense World Theory sees the core issue in autism-spectrum disorders as not being a lack of empathy or feeling -- but instead these individuals are having a hypersensitivity-to-affective-experience issue. Meaning, they feel "too much" in a room full of people and the information comes in too fast than can be comfortably processed. This person would combat social anxiety by focusing on details and switching attention, pulling back in a way that appears to be callous or disengaged but is actually a coping mechanism for overwhelming feelings, and choosing to hide their own.
  • 12. Hacking is a complicated gift.
  • 13. * Legal risks. * Fighting common misperceptions between information sharing and advocacy. * Lack of support system. * Can't ask for help. * Outcasts to society and companies. * Fighting indifferent institutions. * Limited communications. * Hackers are culturally diverse; may not be working in same language of targets, unknowns, or allies. * Some hackers are more at risk than others (exceptional talent, access). * High stakes: the high profileness of the info that you have to contain adds a different level of pressure. * Inner risks: solitary nature of hacking - isolation, depression, impostor syndrome. * Hackers do things that affect hundreds, thousands of people (often more). * A moral universe where you're either a player or you get played; you're owning or getting owned.
  • 14. The long term effects of being secret keepers.
  • 15. Actions and acts of hacking put the hacker at risk. Actions and acts of hacking put the hacker's communities at risk. Actions and acts of hacking put external people (individuals, communities, vulnerable populations) at risk.
  • 16. lessons from the streets The code of the streets is a protective mechanism that serves to protect gangsters from arrest as they violate legal codes, but operates in a dual purpose to protect the gangsters and those they care about. A 'code' puts the focus on individuality as opposed to societally imposed labels. The most simplified street code is this: Make paper. Stay fresh. Don't snitch.
  • 17. The most detailed explanation of street code was in the portrayal of notorious real-life gangster Donnie Andrews, as depicted through the character Omar Little in HBO’s The Wire. The underlying theme of the show was Omar's belief that "a man's gotta have a code." This contrasted perceptions of a character who was seen on the outside as a sawed-off shotgun toting terror, and a double-crossing mastermind who outsmarted both the biggest drug dealers and police time and time again.
  • 18. * Omar is careful to distinguish between players and citizens. * He never robs or murders people who are not involved in the drug trade. * His code is not to hurt anyone who is not already in the game. * Sunday is off limits for killing and robbing. * Bad people deserve to be punished. * Truth can’t be subverted to punish bad people. * No talking on phones about business. * No loose talk. * Defend yourself whenever necessary. * Look out for your own. * Recon is required: he will scout out a location, sometimes for days, making sure he knows everything about it before he will make his strike. * Stay sharp: he talks often about how one must do difficult jobs, so as to keep their senses sharpened, their wits too. * You live by the gun, accept you'll die by the gun. * Never get high on your own supply. * Don't snitch.
  • 19. Instances ● Anonymity policies: perfect example of failure to reduce harm. ● Transparency/disclosure No one listens to hackers. RainForestPuppy: good example of harm reduction. ● Hacker "gentleman's agreements" another good example: reduces risk of a bigger threat to both entities, to limit behavior that is bad for business. ● Hacktivism; the use of communication tools by activists and countermovements - “Telling activists not to use centralized email and social media platforms is about as useful as telling teenagers not to use drugs.” See also: OpSec for Hackers by grugq.
  • 21. hackers as a high-risk population @violetblue