Hacking collective as a laboratory
Zarod, Marcin (Ezechiel)
Talk presents findings from sociological investigation on hacking collectives. I will try to answer the question whether hacking collectives are laboratories, as seen by sociology of science. I will also show some peculiar traits of hacking collective, beneficial both for sciences and societies. Perhaps academia needs hackers more than it’s willing to admit?
 Welcome everybody to the next talk, Hacking Collective as a Laboratory. Our speaker is Martin Zarod, he's from Poland. This talk is about sociology and the talk will offer you an insight on the sociological research that has been done on hacker spaces and hacking collectives. And now I ask you for a warm round of applause to greet Martin. I have a lot of fun. Hi, my name is Martin Zarod, I'm a member of the Warsaw Hacker Space. I'm also a PhD candidate at the University of Warsaw. Before I start, I ask you, please imagine a computer bug. It could be a software bug, it could be an exploit, it could be a hardware bug, it could be the bug that started your hacking career, it could be the bug that you are struggling currently. Please imagine any kind of computer bug. You do not have to be a hacker if you are just interested, it could be a bug that you just read about in a popular press. I do not care. Please imagine, let's, 10 seconds, any kind of computer bug. So I guess that some of you, when imagine a computer bug, also thought about how it works. Some of you thought how to stop it working. Some of you thought how to exploit it, how to make money of it, or how to make this bug for a good cause, or any kind of cause. Some of you also perhaps thought how to make it visible, or how to make it invisible, or what machines, instruments would it take to make it to change the degrees of visibility? Would it need an oscilloscope, would it need a server, or any kind of software? Perhaps some of you thought about systematic bugs, bugs that are inherent to particular designs. Some of you might have thought about situational bugs that are exceptional, connected with particular sets of constraints that do not happen every time. Obviously, some of those questions are technological questions. Some of those questions might be connected with science or medicine, because the question about knowledge is inherently connected with different kinds of scientific, technological, medical reasoning. But there are kind of questions that we, when we start asking them, we come closer to economical issues or sociological issues or philosophical issues. The sociology of science is about what is common for the people who are shared by the same thinking or similar thinking about particular categories of knowledge. So when we start asking questions, who may see that particular kind of bug? Or when we start the questions, what does it take to see that particular kind of bug in a sense of situational setting or sociological setting? Then we are starting to ask philosophical questions or sociological questions. The difference is when a philosopher asks about knowledge, he or she thinks about the individual. And when sociologist starts asking similar questions, he or she thinks about the group. So some of you might have thought about the particular kind of men in the middle attacks, for example, as described at the Claude Flair blog. It's okay. Some of you might have thought about syphilis, or maybe not, because this is a different kind of bug and it doesn't, and it's not that closely connected with computers, or is it? So when we think about the bugs or knowledge in terms of sociological knowledge, we start to understand that learning to see a bug is also about belonging to a particular group. When we start to see different kinds of bugs, when we learn how to manipulate them, how to exploit them in a different kind of way, we are also being closer and closer to particular knowledge or particular expert sub-societies or sub-social groups. And obviously, the bug is connected with particular setting. It might be situational, but more often than not, it also needs an extra work to make it visible. It doesn't mean that this bug is artificial or natural. It just means that it's not obvious, or it requires a special knowledge or a special social setting in order to make it visible. This is one thing that is shared between syphilis and men in the middle attack. They are not visible at the first glance. They need some kind of expert setting in order to become visible. And the sociology of science is about that kind of expert settings. So to see or not to see a particular bug is also to belong or not to belong to a particular knowledge group. And sociology of science has different strains. One strain is proposed by Merton, and it works that science was a source of certified knowledge for the rest of society. The science was the only source of knowledge. The other types of knowledge was not certified. The Merton would go crazy if he thought about hackers, but fortunately, he didn't have to. Other kinds of sociological thoughts were proposed by Bruno Latour, and he proposed that technology is society made durable. And it means that particular design decisions that were made or particular design decisions that seemed to be random, accidental, eventually became more and more stable, more and more constrained, and more and more embedded in the fabric of society. For example, if we decide where do we put our bridges, if we decide what measures of our networks are enough to ensure privacy or security, we are making long-term decisions that will shape the societies that will come after us. Those approaches are good, and many people are working within them with rather interesting results. But I wish to talk about approach proposed by Ludwig Fleck, Polish sociologist, Polish philosopher, Polish microbiologist, and he proposed the notion of thought collective. It was in the 1930s, he published in German, so perhaps not all of you might have read about him. So he proposed that thought collective is a group of people who share the similar epistemological approaches. What do I mean if I say epistemological approaches? For example, if certain group of people agree, more or less, that something counts as a good evidence, or something counts as truth, or some methods of achieving truths are better or more reliable than other, then perhaps this group of people might be a thought collective. What is more advanced sign of thought collective? It would be the ability to recognize some patterns that would be invisible to other. That kind of pattern might be a syphilis bacteria at the microscope. That type of pattern might be many in the middle attack in the code. But it's about seeing the pattern that other group of people would not see. And learning to see that pattern is also starting to belonging to that particular group. And we, the sociologists of science, we are somewhat different than our friends from the psychology department or our friends in the cognitive science department, because we think that thinking is a collective endeavor. We do not really believe that people think on their own. We believe that when a particular individual starts thinking, he or she is thinking with his or hers books, experiences, histories, biographies, and so on and so on. And many more advanced projects, for example, open source software or architecture software or Wasserman test to detect syphilis, was collective endeavor. And we also think that thinking involves minds, but also involves hands and eyes. Sometimes we do not have the idea of solution in our mind. Sometimes we just come upon it with tinkering, with seeing things in microscopes or in code. So how does it work in practice? I spent some years watching and talking and observing my friends from different hackerspaces in Poland and in some neighboring countries. I gathered the data. I got privilege and access to many parts of their private or hacking lives. They talked with me. Then I gathered this data. I analyzed it. The first stage of analysis is called first stage coding, and this is looking for basic patterns, basic biographical patterns, basic situational patterns, basic, for example, group rituals, rather simple stuff. Then based on that, I devised some kind of models. I test them, and eventually I publish papers. So this is the classical sociological route of work, but some of you might not know it. So what about the laboratory? Sociologists of science, since Merton, spent an awful lot of time in laboratories because laboratory for a modern society is a special place. This is the place where not only science is made, but this is also a place where future society is kind of shaped up. Not because in the laboratory we could devise any kind of knowledge, or not because any kind of truth could be socially constructed no matter whatever, but because many of the decisions made in laboratories have significant political consequences. I'm not only talking about decisions made in programming communities, but it also dates back to, for example, the program Manhattan or the Wasserman test for CIVILIS. So what is the laboratory? Or what makes the Huckerspace a special kind of laboratory? As a rule of thumb, laboratory is a kind of separated space when you could make mistakes freely. And mistakes made in the open society cost more than mistakes made in the laboratory. And laboratory enables you to kind of limit the space or time or causes in order to manipulate them. Things in the laboratory might happen faster, might happen slower, might happen on different scales, for example, in the scale of microscope, in the scale of macro sociological models, you could, for example, limit some causes. And in the sociology of science, sometimes we say that in the laboratory the first relations are reverted. It means that in the outside world, the bacteria are stronger because they are harder to spot, they are harder to catch. But in the laboratory, we could limit them. We could catch them in our networks, in our instruments. What is particular for the Huckerspace or any other kind of informatical technology laboratory that in the case of IT laboratory and Huckerspace in silico is the same as in vivo? It means that there is very thin line between theoretical model and practical application. For example, in physics, in chemistry, in biology, computer model is very much separated from the wet work, the bench work, the real work, whatever you call it. But in the information security, theoretical model could be more or less tested, or in many cases could be tested as fast as you may. There are exceptions. I know about the supercomputers. I know that not all theoretical informatics could be tested on the spot, but as a general principle, it works more or less. The particular laboratory, as we know from FLAC, is often linked with particular thought collective. Thought collective is a group of people that share, as I said, similar epistemological patterns. And in the case of Huckerspace, that kind of hacking thought collective could be recognized, for example, with accepting this principle is to tinker with something, is to understand with something. It doesn't mean we would go with that after, so don't worry. But it comes with kind of cost, because in the observed hacking communities, they are often brilliant engineers. They are often brilliant programmers or tinkerers. I couldn't pay more respect to them. But more often than not, they have some problems with stabilizing the knowledge. Often the manuals or tutorials or documentation provided by Huckers is limited, or in the best case scenario, is often linked to the direct project. Huckers do not have much patience or do not put much attention to general principles. This is the difference from many natural scientists. Many natural scientists are looking for general rules, generalizations, whereas Huckers would go for application. For scientists, something is true if we could make a general predictable model. And for Hucker, something is true if it works. Obviously, some engineers would do differently. Some natural scientists would do differently, but we would go with it in a moment. But if the Huckers have problems with stability of the products of the Hucker space, what is the most stable product of the Hucker space? I think that the most stable product of the Hucker space are the Huckers themselves. Not many products of the Hucker space have the similar amount of documentation or similar amount of autonomy as the Huckers. You do not need much to operate a Hucker, but you need much to operate the Hucking products. And they are much, how to say it, from the social point of view, the Huckers are much easier to handle than Hucking products. But to more comparison with natural scientists, if I compare the data on the Hucker spaces collected by me in several Hucker spaces in the period of three years and so on, we have the data on CERN and Max Planck Institute, collected by Karin Knosetina, and we have some similarities. For example, compared with physics, Huckers, more often than not, would agree that the knowledge belongs to the whole community. The knowledge would be more distributed one. And this is not very surprising because we know that open source models or open hardware has some similar roots with physics community in CERN. So the historical argument stands. But also what is less obvious is that Huckers, as well as particular physicists, also like to gossip, to talk about machines. We know that many physical instruments operate more or less or are calibrated more or less and they have good days and bad days. We do not always write about it in scientific papers, but if you remember about the issues of detection of Hicks boson and many false claims or problems with CERN announcement and their own limitations, you would see the trace of it. But comparing Huckers with physics is rather obvious. We know that there is a Huckers space near CERN and many of the electronic people or physics people from CERN are members of that Huckers space. It's really nothing new. But what is more interesting is comparing Huckers with biologists from Max Planck Institute is, for example, some biologists agree with the classical Hucking stance that to understand something is to produce that. You do not have to devise a general model, you just need to devise the tools. If you are able to manipulate it, then you understand it. Other things would be the recognition of authorship in important chunks and the third thing would be the more attention to quick trial and error cycle. In this particular biological setting in the observed period, it was, I'm open to discussion, many of the biologists doing the wet work, doing the bench work, doing the laboratory work relied on quick trial and error cycle without doing much formal calculations, without resolving much to formal models, just unlike the physicists. Physicists, you know, you need a lot of simulations before you put on your atlas. But this is rather interesting, classical, social, political stuff, but let's do something crazy. Let's reverse the thinking. We were looking at the Huckers as they were scientists. We have some differences, we have some similarities. But let's look at the Huckers as some sort of social syphilis. I'm really sorry. But we know that syphilis in the time of Fleck, shown something about the society. For example, shown that many of respected middle-aged men were not as faithful as they claim to be. It's shown something about the need of public healthcare. It also shows something about who really knows something about small, tiny bugs invisible to other people. And up to some extent, and this is metaphor, I do not claim that Huckers are bacteria. I also think that Huckers is a kind of... Right-act as a bacteria in a certain settings, in a scale of society. Because they reveal some things that otherwise would be hidden. And what is also a similarity is that Huckers do not need a knowledge about the whole system. They do not need to understand the whole setting. Physicists need all the data, biologists need all the data, but syphilis and Huckers need only one access point, one entry point. This is obviously a classical knowledge or asymmetry between attacker and defender. And here I'm treating some Huckers as attackers, but for the sake of metaphor, let it be. What if some kind of Hucking history or history of Huckers or sociology of Huckers resemble up to some extent history of syphilis and biologists, maybe we could also think or maybe we would see that some kind of genetics, genetics of exploits or genetics of Huckers spaces. And this is made because people working on security are working on different generations of bugs and evolutions of bugs. And people working on Huckers spaces talk about generation of Huckers spaces. For example, Maxigas. But also we know that many of the natural sciences, for example chemistry or medical data, moved to automation discovery systems based on machine learning. I would be very much amazed if some parties weren't breeding machine learning systems on exploit and patches. We have automatic discovery systems on biology. We have automatic discovery systems in chemistry, in medical data. I'm almost sure that there is a beast in the Google or in the NSA that it's feeding on exploits, that it's feeding on blog posts, and that it's feeding on this presentation at this moment. But here comes the thing or interesting part. I said that Huckers sometimes have problems with stability. Reports produced by Huckers spaces are less standardized than inscriptions or reports or scientific papers presented by the formal laboratories. It means that knowledge from the formal physics laboratory is much more easier to chunk into machine learning system. It means that it's easier to standardize knowledge. And on the other hand, as my friend put to me, we're still feeding the computers knowledge about the computers. So the translation part is easier. So it goes both ways. But nevertheless, the issue of standardization in this kind, in this part, it's no longer a bug, it's a feature, or it's an issue. Less standardized knowledge, the whole set of blog posts, tutorials, YouTube, Gossips, CTF reports, whatever, they do not resemble scientific papers, but maybe this is good. Maybe this is what we need. So I know that people have found some cures for syphilis. It's good. But I really hope that, and when they found that cure for syphilis, many of the thought collectives collaborated. They merged, they changed. They were forced to collaborate. They need to understand and translate from one mode of thinking, one mode of knowledge production to another. They learned to talk to each other and they created something bigger. I really hope that some hackers would start or will continue translating to other types of knowledge production. For example, knowledge production by journalists. We know that it is occurring, the knowledge production by the academic people. We know that it's occurring and so on and so on. And the last thing, I really hope that unlike the syphilis and unlike the history of Fleck, I really hope that hacking would not be cured because we do not need the syphilis, but we need the hackers. And I really wish at this point, I really wish to express my sincere gratitude to all the participants of my study. For the three years I observed you and you granted me the privilege to be observed. Agree to give interviews and I'm really grateful for that. Thank you very much. Thank you very much, Marcin, for your talk and all your insights. We luckily have five minutes left for questions and answers. So if you have any questions, please move to the microphones that we have throughout the room. Please, your first question. Please move close to the microphone. Is this working? Yeah, it is. Okay. So in your experience doing this research, did you ever find hackers in a research lab? And if you found any positive effect of this and if not, and you ran a simulation in your head, what do you think would be a positive outcome of having hackers in a research lab? I've run into several accounts. For example, during this Congress, when people have two affiliations, they were affiliated in particular hacking collective and at the same time they were active in the academic field. We know that people exist. I haven't met many of them, but I met several scientists turned hackers or hackers learning some things from science. And I think this is beneficial. If you are more interested in that, please look into my papers about hacking collective as a trading zone. I have a special part of research done on this translation intergroup issues. Thank you very much. Second question. You said that hackers are like syphilis to the society. And I'm sorry, but I didn't understand in which way they are syphilis. Can you repeat it? Yeah, of course. This is a metaphor. I really... The hackers sometimes in some sense act as a syphilis because first of all, they reveal some things about society that otherwise would be hidden. Second, in order to see the actions of the hackers, you need a different thought collective. And what is peculiar, I haven't talked much about it, but this is the moment. In some cases, the same people that are acting would be the same thought collective that would be the cause. And this is characteristic for hackers because some actions done by the hackers could only be understood within the hacking community. So that is the extent of metaphor. This is not about causing harm or any kind of negative stereotypes connected with hackers. Thank you. Do we have any other questions? We still have some time left. So if you have a question or a comment, feel free to move to one of the microphones. It seems to me that this is not the case. So please give another warm round of applause to Martin. Thank you very much for your talk. Thank you.
 Welcome everybody to the next talk, Hacking Collective as a Laboratory.  Our speaker is Martin Zarod, he's from Poland.  This talk is about sociology and the talk will offer you an insight on the sociological  research that has been done on hacker spaces and hacking collectives.  And now I ask you for a warm round of applause to greet Martin.  I have a lot of fun.  Hi, my name is Martin Zarod, I'm a member of the Warsaw Hacker Space.  I'm also a PhD candidate at the University of Warsaw.  Before I start, I ask you, please imagine a computer bug.  It could be a software bug, it could be an exploit, it could be a hardware bug, it could  be the bug that started your hacking career, it could be the bug that you are struggling  currently.  Please imagine any kind of computer bug.  You do not have to be a hacker if you are just interested, it could be a bug that you  just read about in a popular press.  I do not care.  Please imagine, let's, 10 seconds, any kind of computer bug.  So I guess that some of you, when imagine a computer bug, also thought about how it works.  Some of you thought how to stop it working.  Some of you thought how to exploit it, how to make money of it, or how to make this bug  for a good cause, or any kind of cause.  Some of you also perhaps thought how to make it visible, or how to make it invisible, or  what machines, instruments would it take to make it to change the degrees of visibility?  Would it need an oscilloscope, would it need a server, or any kind of software?  Perhaps some of you thought about systematic bugs, bugs that are inherent to particular  designs.  Some of you might have thought about situational bugs that are exceptional, connected with  particular sets of constraints that do not happen every time.  Obviously, some of those questions are technological questions.  Some of those questions might be connected with science or medicine, because the question  about knowledge is inherently connected with different kinds of scientific, technological,  medical reasoning.  But there are kind of questions that we, when we start asking them, we come closer to economical  issues or sociological issues or philosophical issues.  The sociology of science is about what is common for the people who are shared by the  same thinking or similar thinking about particular categories of knowledge.  So when we start asking questions, who may see that particular kind of bug?  Or when we start the questions, what does it take to see that particular kind of bug  in a sense of situational setting or sociological setting?  Then we are starting to ask philosophical questions or sociological questions.  The difference is when a philosopher asks about knowledge, he or she thinks about the  individual.  And when sociologist starts asking similar questions, he or she thinks about the group.  So some of you might have thought about the particular kind of men in the middle attacks,  for example, as described at the Claude Flair blog.  It's okay.  Some of you might have thought about syphilis, or maybe not, because this is a different kind  of bug and it doesn't, and it's not that closely connected with computers, or is it?  So when we think about the bugs or knowledge in terms of sociological knowledge, we start  to understand that learning to see a bug is also about belonging to a particular group.  When we start to see different kinds of bugs, when we learn how to manipulate them, how  to exploit them in a different kind of way, we are also being closer and closer to particular  knowledge or particular expert sub-societies or sub-social groups.  And obviously, the bug is connected with particular setting.  It might be situational, but more often than not, it also needs an extra work to make it  visible.  It doesn't mean that this bug is artificial or natural.  It just means that it's not obvious, or it requires a special knowledge or a special  social setting in order to make it visible.  This is one thing that is shared between syphilis and men in the middle attack.  They are not visible at the first glance.  They need some kind of expert setting in order to become visible.  And the sociology of science is about that kind of expert settings.  So to see or not to see a particular bug is also to belong or not to belong to a particular  knowledge group.  And sociology of science has different strains.  One strain is proposed by Merton, and it works that science was a source of certified knowledge  for the rest of society.  The science was the only source of knowledge.  The other types of knowledge was not certified.  The Merton would go crazy if he thought about hackers, but fortunately, he didn't have to.  Other kinds of sociological thoughts were proposed by Bruno Latour, and he proposed that technology  is society made durable.  And it means that particular design decisions that were made or particular design decisions  that seemed to be random, accidental, eventually became more and more stable, more and more  constrained, and more and more embedded in the fabric of society.  For example, if we decide where do we put our bridges, if we decide what measures of  our networks are enough to ensure privacy or security, we are making long-term decisions  that will shape the societies that will come after us.  Those approaches are good, and many people are working within them with rather interesting  results.  But I wish to talk about approach proposed by Ludwig Fleck, Polish sociologist, Polish  philosopher, Polish microbiologist, and he proposed the notion of thought collective.  It was in the 1930s, he published in German, so perhaps not all of you might have read  about him.  So he proposed that thought collective is a group of people who share the similar epistemological  approaches.  What do I mean if I say epistemological approaches?  For example, if certain group of people agree, more or less, that something counts as a good  evidence, or something counts as truth, or some methods of achieving truths are better  or more reliable than other, then perhaps this group of people might be a thought collective.  What is more advanced sign of thought collective?  It would be the ability to recognize some patterns that would be invisible to other.  That kind of pattern might be a syphilis bacteria at the microscope.  That type of pattern might be many in the middle attack in the code.  But it's about seeing the pattern that other group of people would not see.  And learning to see that pattern is also starting to belonging to that particular group.  And we, the sociologists of science, we are somewhat different than our friends from the  psychology department or our friends in the cognitive science department, because we think  that thinking is a collective endeavor.  We do not really believe that people think on their own.  We believe that when a particular individual starts thinking, he or she is thinking with  his or hers books, experiences, histories, biographies, and so on and so on.  And many more advanced projects, for example, open source software or architecture software  or Wasserman test to detect syphilis, was collective endeavor.  And we also think that thinking involves minds, but also involves hands and eyes.  Sometimes we do not have the idea of solution in our mind.  Sometimes we just come upon it with tinkering, with seeing things in microscopes or in code.  So how does it work in practice?  I spent some years watching and talking and observing my friends from different hackerspaces  in Poland and in some neighboring countries.  I gathered the data.  I got privilege and access to many parts of their private or hacking lives.  They talked with me.  Then I gathered this data.  I analyzed it.  The first stage of analysis is called first stage coding, and this is looking for basic  patterns, basic biographical patterns, basic situational patterns, basic, for example,  group rituals, rather simple stuff.  Then based on that, I devised some kind of models.  I test them, and eventually I publish papers.  So this is the classical sociological route of work, but some of you might not know it.  So what about the laboratory?  Sociologists of science, since Merton, spent an awful lot of time in laboratories because  laboratory for a modern society is a special place.  This is the place where not only science is made, but this is also a place where future  society is kind of shaped up.  Not because in the laboratory we could devise any kind of knowledge, or not because any  kind of truth could be socially constructed no matter whatever, but because many of the  decisions made in laboratories have significant political consequences.  I'm not only talking about decisions made in programming communities, but it also dates  back to, for example, the program Manhattan or the Wasserman test for CIVILIS.  So what is the laboratory?  Or what makes the Huckerspace a special kind of laboratory?  As a rule of thumb, laboratory is a kind of separated space when you could make mistakes  freely.  And mistakes made in the open society cost more than mistakes made in the laboratory.  And laboratory enables you to kind of limit the space or time or causes in order to manipulate  them.  Things in the laboratory might happen faster, might happen slower, might happen on different  scales, for example, in the scale of microscope, in the scale of macro sociological models,  you could, for example, limit some causes.  And in the sociology of science, sometimes we say that in the laboratory the first relations  are reverted.  It means that in the outside world, the bacteria are stronger because they are harder to spot,  they are harder to catch.  But in the laboratory, we could limit them.  We could catch them in our networks, in our instruments.  What is particular for the Huckerspace or any other kind of informatical technology laboratory  that in the case of IT laboratory and Huckerspace in silico is the same as in vivo?  It means that there is very thin line between theoretical model and practical application.  For example, in physics, in chemistry, in biology, computer model is very much separated  from the wet work, the bench work, the real work, whatever you call it.  But in the information security, theoretical model could be more or less tested, or in  many cases could be tested as fast as you may.  There are exceptions.  I know about the supercomputers.  I know that not all theoretical informatics could be tested on the spot, but as a general  principle, it works more or less.  The particular laboratory, as we know from FLAC, is often linked with particular thought  collective.  Thought collective is a group of people that share, as I said, similar epistemological patterns.  And in the case of Huckerspace, that kind of hacking thought collective could be recognized,  for example, with accepting this principle is to tinker with something, is to understand  with something.  It doesn't mean we would go with that after, so don't worry.  But it comes with kind of cost, because in the observed hacking communities, they are  often brilliant engineers.  They are often brilliant programmers or tinkerers.  I couldn't pay more respect to them.  But more often than not, they have some problems with stabilizing the knowledge.  Often the manuals or tutorials or documentation provided by Huckers is limited, or in the best  case scenario, is often linked to the direct project.  Huckers do not have much patience or do not put much attention to general principles.  This is the difference from many natural scientists.  Many natural scientists are looking for general rules, generalizations, whereas Huckers would  go for application.  For scientists, something is true if we could make a general predictable model.  And for Hucker, something is true if it works.  Obviously, some engineers would do differently.  Some natural scientists would do differently, but we would go with it in a moment.  But if the Huckers have problems with stability of the products of the Hucker space, what  is the most stable product of the Hucker space?  I think that the most stable product of the Hucker space are the Huckers themselves.  Not many products of the Hucker space have the similar amount of documentation or similar  amount of autonomy as the Huckers.  You do not need much to operate a Hucker, but you need much to operate the Hucking products.  And they are much, how to say it, from the social point of view, the Huckers are much  easier to handle than Hucking products.  But to more comparison with natural scientists, if I compare the data on the Hucker spaces  collected by me in several Hucker spaces in the period of three years and so on, we have  the data on CERN and Max Planck Institute, collected by Karin Knosetina, and we have  some similarities.  For example, compared with physics, Huckers, more often than not, would agree that the  knowledge belongs to the whole community.  The knowledge would be more distributed one.  And this is not very surprising because we know that open source models or open hardware  has some similar roots with physics community in CERN.  So the historical argument stands.  But also what is less obvious is that Huckers, as well as particular physicists, also like  to gossip, to talk about machines.  We know that many physical instruments operate more or less or are calibrated more or less  and they have good days and bad days.  We do not always write about it in scientific papers, but if you remember about the issues  of detection of Hicks boson and many false claims or problems with CERN announcement  and their own limitations, you would see the trace of it.  But comparing Huckers with physics is rather obvious.  We know that there is a Huckers space near CERN and many of the electronic people or  physics people from CERN are members of that Huckers space.  It's really nothing new.  But what is more interesting is comparing Huckers with biologists from Max Planck Institute  is, for example, some biologists agree with the classical Hucking stance that to understand  something is to produce that.  You do not have to devise a general model, you just need to devise the tools.  If you are able to manipulate it, then you understand it.  Other things would be the recognition of authorship in important chunks and the third thing would  be the more attention to quick trial and error cycle.  In this particular biological setting in the observed period, it was, I'm open to discussion,  many of the biologists doing the wet work, doing the bench work, doing the laboratory  work relied on quick trial and error cycle without doing much formal calculations, without  resolving much to formal models, just unlike the physicists.  Physicists, you know, you need a lot of simulations before you put on your atlas.  But this is rather interesting, classical, social, political stuff, but let's do something  crazy.  Let's reverse the thinking.  We were looking at the Huckers as they were scientists.  We have some differences, we have some similarities.  But let's look at the Huckers as some sort of social syphilis.  I'm really sorry.  But we know that syphilis in the time of Fleck, shown something about the society.  For example, shown that many of respected middle-aged men were not as faithful as they  claim to be.  It's shown something about the need of public healthcare.  It also shows something about who really knows something about small, tiny bugs invisible  to other people.  And up to some extent, and this is metaphor, I do not claim that Huckers are bacteria.  I also think that Huckers is a kind of...  Right-act as a bacteria in a certain settings, in a scale of society.  Because they reveal some things that otherwise would be hidden.  And what is also a similarity is that Huckers do not need a knowledge about the whole system.  They do not need to understand the whole setting.  Physicists need all the data, biologists need all the data, but syphilis and Huckers need  only one access point, one entry point.  This is obviously a classical knowledge or asymmetry between attacker and defender.  And here I'm treating some Huckers as attackers, but for the sake of metaphor, let it be.  What if some kind of Hucking history or history of Huckers or sociology of Huckers resemble  up to some extent history of syphilis and biologists, maybe we could also think or maybe  we would see that some kind of genetics, genetics of exploits or genetics of Huckers spaces.  And this is made because people working on security are working on different generations  of bugs and evolutions of bugs.  And people working on Huckers spaces talk about generation of Huckers spaces.  For example, Maxigas.  But also we know that many of the natural sciences, for example chemistry or medical  data, moved to automation discovery systems based on machine learning.  I would be very much amazed if some parties weren't breeding machine learning systems  on exploit and patches.  We have automatic discovery systems on biology.  We have automatic discovery systems in chemistry, in medical data.  I'm almost sure that there is a beast in the Google or in the NSA that it's feeding on  exploits, that it's feeding on blog posts, and that it's feeding on this presentation  at this moment.  But here comes the thing or interesting part.  I said that Huckers sometimes have problems with stability.  Reports produced by Huckers spaces are less standardized than inscriptions or reports or  scientific papers presented by the formal laboratories.  It means that knowledge from the formal physics laboratory is much more easier to chunk into  machine learning system.  It means that it's easier to standardize knowledge.  And on the other hand, as my friend put to me, we're still feeding the computers knowledge  about the computers.  So the translation part is easier.  So it goes both ways.  But nevertheless, the issue of standardization in this kind, in this part, it's no longer  a bug, it's a feature, or it's an issue.  Less standardized knowledge, the whole set of blog posts, tutorials, YouTube, Gossips,  CTF reports, whatever, they do not resemble scientific papers, but maybe this is good.  Maybe this is what we need.  So I know that people have found some cures for syphilis.  It's good.  But I really hope that, and when they found that cure for syphilis, many of the thought  collectives collaborated.  They merged, they changed.  They were forced to collaborate.  They need to understand and translate from one mode of thinking, one mode of knowledge  production to another.  They learned to talk to each other and they created something bigger.  I really hope that some hackers would start or will continue translating to other types  of knowledge production.  For example, knowledge production by journalists.  We know that it is occurring, the knowledge production by the academic people.  We know that it's occurring and so on and so on.  And the last thing, I really hope that unlike the syphilis and unlike the history of Fleck,  I really hope that hacking would not be cured because we do not need the syphilis, but we  need the hackers.  And I really wish at this point, I really wish to express my sincere gratitude to all  the participants of my study.  For the three years I observed you and you granted me the privilege to be observed.  Agree to give interviews and I'm really grateful for that.  Thank you very much.  Thank you very much, Marcin, for your talk and all your insights.  We luckily have five minutes left for questions and answers.  So if you have any questions, please move to the microphones that we have throughout  the room.  Please, your first question.  Please move close to the microphone.  Is this working?  Yeah, it is.  Okay.  So in your experience doing this research, did you ever find hackers in a research lab?  And if you found any positive effect of this and if not, and you ran a simulation in your  head, what do you think would be a positive outcome of having hackers in a research lab?  I've run into several accounts.  For example, during this Congress, when people have two affiliations, they were affiliated  in particular hacking collective and at the same time they were active in the academic  field.  We know that people exist.  I haven't met many of them, but I met several scientists turned hackers or hackers learning  some things from science.  And I think this is beneficial.  If you are more interested in that, please look into my papers about hacking collective  as a trading zone.  I have a special part of research done on this translation intergroup issues.  Thank you very much.  Second question.  You said that hackers are like syphilis to the society.  And I'm sorry, but I didn't understand in which way they are syphilis.  Can you repeat it?  Yeah, of course.  This is a metaphor.  I really...  The hackers sometimes in some sense act as a syphilis because first of all, they reveal  some things about society that otherwise would be hidden.  Second, in order to see the actions of the hackers, you need a different thought collective.  And what is peculiar, I haven't talked much about it, but this is the moment.  In some cases, the same people that are acting would be the same thought collective that  would be the cause.  And this is characteristic for hackers because some actions done by the hackers could only  be understood within the hacking community.  So that is the extent of metaphor.  This is not about causing harm or any kind of negative stereotypes connected with hackers.  Thank you.  Do we have any other questions?  We still have some time left.  So if you have a question or a comment, feel free to move to one of the microphones.  It seems to me that this is not the case.  So please give another warm round of applause to Martin.  Thank you very much for your talk.  Thank you.
33c3-8263-hacking_collective_as_a_laboratory_0_1499.png 33c3-8263-hacking_collective_as_a_laboratory_1500_2291.png 33c3-8263-hacking_collective_as_a_laboratory_2292_2363.png 33c3-8263-hacking_collective_as_a_laboratory_2364_3791.png 33c3-8263-hacking_collective_as_a_laboratory_3792_4307.png 33c3-8263-hacking_collective_as_a_laboratory_4308_4583.png 33c3-8263-hacking_collective_as_a_laboratory_4584_11123.png 33c3-8263-hacking_collective_as_a_laboratory_11124_11183.png 33c3-8263-hacking_collective_as_a_laboratory_11184_11483.png 33c3-8263-hacking_collective_as_a_laboratory_11484_11651.png 33c3-8263-hacking_collective_as_a_laboratory_11652_15803.png 33c3-8263-hacking_collective_as_a_laboratory_15804_16175.png 33c3-8263-hacking_collective_as_a_laboratory_16176_16307.png 33c3-8263-hacking_collective_as_a_laboratory_16308_17639.png 33c3-8263-hacking_collective_as_a_laboratory_17640_20663.png 33c3-8263-hacking_collective_as_a_laboratory_20664_23351.png 33c3-8263-hacking_collective_as_a_laboratory_23352_23591.png 33c3-8263-hacking_collective_as_a_laboratory_23592_24395.png 33c3-8263-hacking_collective_as_a_laboratory_24396_24503.png 33c3-8263-hacking_collective_as_a_laboratory_24504_24731.png 33c3-8263-hacking_collective_as_a_laboratory_24732_26819.png 33c3-8263-hacking_collective_as_a_laboratory_26820_29063.png 33c3-8263-hacking_collective_as_a_laboratory_29064_31967.png 33c3-8263-hacking_collective_as_a_laboratory_31968_32015.png 33c3-8263-hacking_collective_as_a_laboratory_32016_33239.png 33c3-8263-hacking_collective_as_a_laboratory_33240_35243.png 33c3-8263-hacking_collective_as_a_laboratory_35244_36275.png 33c3-8263-hacking_collective_as_a_laboratory_36276_38699.png 33c3-8263-hacking_collective_as_a_laboratory_38700_39179.png 33c3-8263-hacking_collective_as_a_laboratory_39180_43583.png 33c3-8263-hacking_collective_as_a_laboratory_43584_43898.png
Welcome everybody to the next talk, Hacking Collective as a Laboratory. Our speaker is Martin Zarod, he's from Poland. This talk is about sociology and the talk will offer you an insight on the sociological research that has been done on hacker spaces and hacking collectives. And now I ask you for a warm round of applause to greet Martin. I have a lot of fun. Hi, my name is Martin Zarod, I'm a member of the Warsaw Hacker Space. I'm also a PhD candidate at the University of Warsaw. Before I start, I ask you, please imagine a computer bug. It could be a software bug, it could be an exploit, it could be a hardware bug, it could be the bug that started your hacking career, it could be the bug that you are struggling currently. Please imagine any kind of computer bug. You do not have to be a hacker if you are just interested, it could be a bug that you just read about in a popular press. I do not care. Please imagine, let's, 10 seconds, any kind of computer bug. So I guess that some of you, when imagine a computer bug, also thought about how it works. Some of you thought how to stop it working. Some of you thought how to exploit it, how to make money of it, or how to make this bug for a good cause, or any kind of cause. Some of you also perhaps thought how to make it visible, or how to make it invisible, or what machines, instruments would it take to make it to change the degrees of visibility? Would it need an oscilloscope, would it need a server, or any kind of software? Perhaps some of you thought about systematic bugs, bugs that are inherent to particular designs. Some of you might have thought about situational bugs that are exceptional, connected with particular sets of constraints that do not happen every time. Obviously, some of those questions are technological questions. Some of those questions might be connected with science or medicine, because the question about knowledge is inherently connected with different kinds of scientific, technological, medical reasoning. But there are kind of questions that we, when we start asking them, we come closer to economical issues or sociological issues or philosophical issues. The sociology of science is about what is common for the people who are shared by the same thinking or similar thinking about particular categories of knowledge. So when we start asking questions, who may see that particular kind of bug? Or when we start the questions, what does it take to see that particular kind of bug in a sense of situational setting or sociological setting? Then we are starting to ask philosophical questions or sociological questions. The difference is when a philosopher asks about knowledge, he or she thinks about the individual. And when sociologist starts asking similar questions, he or she thinks about the group. So some of you might have thought about the particular kind of men in the middle attacks, for example, as described at the Claude Flair blog. It's okay. Some of you might have thought about syphilis, or maybe not, because this is a different kind of bug and it doesn't, and it's not that closely connected with computers, or is it? So when we think about the bugs or knowledge in terms of sociological knowledge, we start to understand that learning to see a bug is also about belonging to a particular group. When we start to see different kinds of bugs, when we learn how to manipulate them, how to exploit them in a different kind of way, we are also being closer and closer to particular knowledge or particular expert sub-societies or sub-social groups. And obviously, the bug is connected with particular setting. It might be situational, but more often than not, it also needs an extra work to make it visible. It doesn't mean that this bug is artificial or natural. It just means that it's not obvious, or it requires a special knowledge or a special social setting in order to make it visible. This is one thing that is shared between syphilis and men in the middle attack. They are not visible at the first glance. They need some kind of expert setting in order to become visible. And the sociology of science is about that kind of expert settings. So to see or not to see a particular bug is also to belong or not to belong to a particular knowledge group. And sociology of science has different strains. One strain is proposed by Merton, and it works that science was a source of certified knowledge for the rest of society. The science was the only source of knowledge. The other types of knowledge was not certified. The Merton would go crazy if he thought about hackers, but fortunately, he didn't have to. Other kinds of sociological thoughts were proposed by Bruno Latour, and he proposed that technology is society made durable. And it means that particular design decisions that were made or particular design decisions that seemed to be random, accidental, eventually became more and more stable, more and more constrained, and more and more embedded in the fabric of society. For example, if we decide where do we put our bridges, if we decide what measures of our networks are enough to ensure privacy or security, we are making long-term decisions that will shape the societies that will come after us. Those approaches are good, and many people are working within them with rather interesting results. But I wish to talk about approach proposed by Ludwig Fleck, Polish sociologist, Polish philosopher, Polish microbiologist, and he proposed the notion of thought collective. It was in the 1930s, he published in German, so perhaps not all of you might have read about him. So he proposed that thought collective is a group of people who share the similar epistemological approaches. What do I mean if I say epistemological approaches? For example, if certain group of people agree, more or less, that something counts as a good evidence, or something counts as truth, or some methods of achieving truths are better or more reliable than other, then perhaps this group of people might be a thought collective. What is more advanced sign of thought collective? It would be the ability to recognize some patterns that would be invisible to other. That kind of pattern might be a syphilis bacteria at the microscope. That type of pattern might be many in the middle attack in the code. But it's about seeing the pattern that other group of people would not see. And learning to see that pattern is also starting to belonging to that particular group. And we, the sociologists of science, we are somewhat different than our friends from the psychology department or our friends in the cognitive science department, because we think that thinking is a collective endeavor. We do not really believe that people think on their own. We believe that when a particular individual starts thinking, he or she is thinking with his or hers books, experiences, histories, biographies, and so on and so on. And many more advanced projects, for example, open source software or architecture software or Wasserman test to detect syphilis, was collective endeavor. And we also think that thinking involves minds, but also involves hands and eyes. Sometimes we do not have the idea of solution in our mind. Sometimes we just come upon it with tinkering, with seeing things in microscopes or in code. So how does it work in practice? I spent some years watching and talking and observing my friends from different hackerspaces in Poland and in some neighboring countries. I gathered the data. I got privilege and access to many parts of their private or hacking lives. They talked with me. Then I gathered this data. I analyzed it. The first stage of analysis is called first stage coding, and this is looking for basic patterns, basic biographical patterns, basic situational patterns, basic, for example, group rituals, rather simple stuff. Then based on that, I devised some kind of models. I test them, and eventually I publish papers. So this is the classical sociological route of work, but some of you might not know it. So what about the laboratory? Sociologists of science, since Merton, spent an awful lot of time in laboratories because laboratory for a modern society is a special place. This is the place where not only science is made, but this is also a place where future society is kind of shaped up. Not because in the laboratory we could devise any kind of knowledge, or not because any kind of truth could be socially constructed no matter whatever, but because many of the decisions made in laboratories have significant political consequences. I'm not only talking about decisions made in programming communities, but it also dates back to, for example, the program Manhattan or the Wasserman test for CIVILIS. So what is the laboratory? Or what makes the Huckerspace a special kind of laboratory? As a rule of thumb, laboratory is a kind of separated space when you could make mistakes freely. And mistakes made in the open society cost more than mistakes made in the laboratory. And laboratory enables you to kind of limit the space or time or causes in order to manipulate them. Things in the laboratory might happen faster, might happen slower, might happen on different scales, for example, in the scale of microscope, in the scale of macro sociological models, you could, for example, limit some causes. And in the sociology of science, sometimes we say that in the laboratory the first relations are reverted. It means that in the outside world, the bacteria are stronger because they are harder to spot, they are harder to catch. But in the laboratory, we could limit them. We could catch them in our networks, in our instruments. What is particular for the Huckerspace or any other kind of informatical technology laboratory that in the case of IT laboratory and Huckerspace in silico is the same as in vivo? It means that there is very thin line between theoretical model and practical application. For example, in physics, in chemistry, in biology, computer model is very much separated from the wet work, the bench work, the real work, whatever you call it. But in the information security, theoretical model could be more or less tested, or in many cases could be tested as fast as you may. There are exceptions. I know about the supercomputers. I know that not all theoretical informatics could be tested on the spot, but as a general principle, it works more or less. The particular laboratory, as we know from FLAC, is often linked with particular thought collective. Thought collective is a group of people that share, as I said, similar epistemological patterns. And in the case of Huckerspace, that kind of hacking thought collective could be recognized, for example, with accepting this principle is to tinker with something, is to understand with something. It doesn't mean we would go with that after, so don't worry. But it comes with kind of cost, because in the observed hacking communities, they are often brilliant engineers. They are often brilliant programmers or tinkerers. I couldn't pay more respect to them. But more often than not, they have some problems with stabilizing the knowledge. Often the manuals or tutorials or documentation provided by Huckers is limited, or in the best case scenario, is often linked to the direct project. Huckers do not have much patience or do not put much attention to general principles. This is the difference from many natural scientists. Many natural scientists are looking for general rules, generalizations, whereas Huckers would go for application. For scientists, something is true if we could make a general predictable model. And for Hucker, something is true if it works. Obviously, some engineers would do differently. Some natural scientists would do differently, but we would go with it in a moment. But if the Huckers have problems with stability of the products of the Hucker space, what is the most stable product of the Hucker space? I think that the most stable product of the Hucker space are the Huckers themselves. Not many products of the Hucker space have the similar amount of documentation or similar amount of autonomy as the Huckers. You do not need much to operate a Hucker, but you need much to operate the Hucking products. And they are much, how to say it, from the social point of view, the Huckers are much easier to handle than Hucking products. But to more comparison with natural scientists, if I compare the data on the Hucker spaces collected by me in several Hucker spaces in the period of three years and so on, we have the data on CERN and Max Planck Institute, collected by Karin Knosetina, and we have some similarities. For example, compared with physics, Huckers, more often than not, would agree that the knowledge belongs to the whole community. The knowledge would be more distributed one. And this is not very surprising because we know that open source models or open hardware has some similar roots with physics community in CERN. So the historical argument stands. But also what is less obvious is that Huckers, as well as particular physicists, also like to gossip, to talk about machines. We know that many physical instruments operate more or less or are calibrated more or less and they have good days and bad days. We do not always write about it in scientific papers, but if you remember about the issues of detection of Hicks boson and many false claims or problems with CERN announcement and their own limitations, you would see the trace of it. But comparing Huckers with physics is rather obvious. We know that there is a Huckers space near CERN and many of the electronic people or physics people from CERN are members of that Huckers space. It's really nothing new. But what is more interesting is comparing Huckers with biologists from Max Planck Institute is, for example, some biologists agree with the classical Hucking stance that to understand something is to produce that. You do not have to devise a general model, you just need to devise the tools. If you are able to manipulate it, then you understand it. Other things would be the recognition of authorship in important chunks and the third thing would be the more attention to quick trial and error cycle. In this particular biological setting in the observed period, it was, I'm open to discussion, many of the biologists doing the wet work, doing the bench work, doing the laboratory work relied on quick trial and error cycle without doing much formal calculations, without resolving much to formal models, just unlike the physicists. Physicists, you know, you need a lot of simulations before you put on your atlas. But this is rather interesting, classical, social, political stuff, but let's do something crazy. Let's reverse the thinking. We were looking at the Huckers as they were scientists. We have some differences, we have some similarities. But let's look at the Huckers as some sort of social syphilis. I'm really sorry. But we know that syphilis in the time of Fleck, shown something about the society. For example, shown that many of respected middle-aged men were not as faithful as they claim to be. It's shown something about the need of public healthcare. It also shows something about who really knows something about small, tiny bugs invisible to other people. And up to some extent, and this is metaphor, I do not claim that Huckers are bacteria. I also think that Huckers is a kind of... Right-act as a bacteria in a certain settings, in a scale of society. Because they reveal some things that otherwise would be hidden. And what is also a similarity is that Huckers do not need a knowledge about the whole system. They do not need to understand the whole setting. Physicists need all the data, biologists need all the data, but syphilis and Huckers need only one access point, one entry point. This is obviously a classical knowledge or asymmetry between attacker and defender. And here I'm treating some Huckers as attackers, but for the sake of metaphor, let it be. What if some kind of Hucking history or history of Huckers or sociology of Huckers resemble up to some extent history of syphilis and biologists, maybe we could also think or maybe we would see that some kind of genetics, genetics of exploits or genetics of Huckers spaces. And this is made because people working on security are working on different generations of bugs and evolutions of bugs. And people working on Huckers spaces talk about generation of Huckers spaces. For example, Maxigas. But also we know that many of the natural sciences, for example chemistry or medical data, moved to automation discovery systems based on machine learning. I would be very much amazed if some parties weren't breeding machine learning systems on exploit and patches. We have automatic discovery systems on biology. We have automatic discovery systems in chemistry, in medical data. I'm almost sure that there is a beast in the Google or in the NSA that it's feeding on exploits, that it's feeding on blog posts, and that it's feeding on this presentation at this moment. But here comes the thing or interesting part. I said that Huckers sometimes have problems with stability. Reports produced by Huckers spaces are less standardized than inscriptions or reports or scientific papers presented by the formal laboratories. It means that knowledge from the formal physics laboratory is much more easier to chunk into machine learning system. It means that it's easier to standardize knowledge. And on the other hand, as my friend put to me, we're still feeding the computers knowledge about the computers. So the translation part is easier. So it goes both ways. But nevertheless, the issue of standardization in this kind, in this part, it's no longer a bug, it's a feature, or it's an issue. Less standardized knowledge, the whole set of blog posts, tutorials, YouTube, Gossips, CTF reports, whatever, they do not resemble scientific papers, but maybe this is good. Maybe this is what we need. So I know that people have found some cures for syphilis. It's good. But I really hope that, and when they found that cure for syphilis, many of the thought collectives collaborated. They merged, they changed. They were forced to collaborate. They need to understand and translate from one mode of thinking, one mode of knowledge production to another. They learned to talk to each other and they created something bigger. I really hope that some hackers would start or will continue translating to other types of knowledge production. For example, knowledge production by journalists. We know that it is occurring, the knowledge production by the academic people. We know that it's occurring and so on and so on. And the last thing, I really hope that unlike the syphilis and unlike the history of Fleck, I really hope that hacking would not be cured because we do not need the syphilis, but we need the hackers. And I really wish at this point, I really wish to express my sincere gratitude to all the participants of my study. For the three years I observed you and you granted me the privilege to be observed. Agree to give interviews and I'm really grateful for that. Thank you very much. Thank you very much, Marcin, for your talk and all your insights. We luckily have five minutes left for questions and answers. So if you have any questions, please move to the microphones that we have throughout the room. Please, your first question. Please move close to the microphone. Is this working? Yeah, it is. Okay. So in your experience doing this research, did you ever find hackers in a research lab? And if you found any positive effect of this and if not, and you ran a simulation in your head, what do you think would be a positive outcome of having hackers in a research lab? I've run into several accounts. For example, during this Congress, when people have two affiliations, they were affiliated in particular hacking collective and at the same time they were active in the academic field. We know that people exist. I haven't met many of them, but I met several scientists turned hackers or hackers learning some things from science. And I think this is beneficial. If you are more interested in that, please look into my papers about hacking collective as a trading zone. I have a special part of research done on this translation intergroup issues. Thank you very much. Second question. You said that hackers are like syphilis to the society. And I'm sorry, but I didn't understand in which way they are syphilis. Can you repeat it? Yeah, of course. This is a metaphor. I really... The hackers sometimes in some sense act as a syphilis because first of all, they reveal some things about society that otherwise would be hidden. Second, in order to see the actions of the hackers, you need a different thought collective. And what is peculiar, I haven't talked much about it, but this is the moment. In some cases, the same people that are acting would be the same thought collective that would be the cause. And this is characteristic for hackers because some actions done by the hackers could only be understood within the hacking community. So that is the extent of metaphor. This is not about causing harm or any kind of negative stereotypes connected with hackers. Thank you. Do we have any other questions? We still have some time left. So if you have a question or a comment, feel free to move to one of the microphones. It seems to me that this is not the case. So please give another warm round of applause to Martin. Thank you very much for your talk. Thank you.
on hacker spaces and hacking collectives. And now because the question about knowledge is more often than not, it also needs an extra work visible. And the sociology of science is about decisions that will shape the societies that will that it's easier to standardize knowledge. And on collective as a trading zone. I have a special characteristic for hackers because some actions