Where Have All the Hackers Gone?

Recently a high school in Pennsylvania shocked the nation when it became the subject of a lawsuit alleging that webcams in school-issued laptop computers were being remotely activated by school staff, used to snap photos of students in their homes. As a computer security professional I dug into the story with the help of my colleagues, and together we found that the networked webcam capability built into these computers by the school district was absolutely real. Our findings were greeted with surprise and dismay; they have caused a nationwide outcry. The truth is, this shouldn't have been a surprise. America has been on this road for years.

Nearly every wired school district in America uses some form of remote administration software. This software varies in the degree of control that it exerts over student computers. The trend started with web filtering and progressed to allow remote use of student's desktops by teachers. Some advanced schools now allow surreptitious eavesdropping of student's desktops while they are working. Today on the cutting edge of this trend is Harriton High, with thousands of taxpayer purchased laptops issued to children, and school staff armed with the ability to take remote webcam pictures of the students at will. This isn't a revolution, it's just a bump on the ride.

Historian James Bradley writes in FlyBoys about a nation of young men growing up in pre-WWII America tinkering, modifying, and optimizing a new wave of internal combustion powered machines. Bradley talks about the inherent advantage that this generation of tinkers gave America in the coming aerial conflict, where pushing new technology to its limits was the key to a new form of warfare: aerial combat. When it comes to information technology, it's time we ask ourselves: where will we find our next generation of computing tinkers? This problem is only now becoming apparent at a national level. The US Air Force is currently holding Cyber Defense competitions at the high school level, nationwide. The Defense Advanced Research Projects Agency (DARPA) recently released a paper stating that the United States will be “hampered” by its projected dearth of expertise in Internet technologies and information security: “we are steadily losing the engineering talent to project these systems .” As our government begins to identify a critical shortage that has been evident in my industry for years as a national security threat, I believe it is time we asked ourselves: “Where have all the hackers gone?”

The answer is that we've stopped making them. Before building Apple Computer, Jobs & Wozniak hacked the phone system. I grew up hacking the computer they built, the Apple ][. Critical events in my personal and professional development were dependent on my ability to access the core of how computers worked in order to understand them, re-purpose them, and harness them to my will. The Greatest Generation supercharged their Chevys; my generation peeked and poked at the internal memory of our Apple computers. Today's generation is growing up in a new era of “jailed” devices, devices like the laptops at Harriton, which were jailed against any student use except approved applications. To tinker with these computers, students were first required to “jailbreak”, a technical feat which would have given students the freedom to understand their computers and to determine who was remotely activating their webcams. Not surprisingly, jailbreaking carried the threat of stringent penalties from the school. A student locked inside a digital jail of this type could never start down the road of digital proficiency necessary to reach the finish line DARPA is asking for.

Digital jails are not solely the realm of education. Devices like the Amazon Kindle and Apple iPhone are jailed against any unauthorized consumer use, guarded by strict but unproven new federal laws against jailbreaking them. Jailed devices are controlled by a networked authority, be it a company like Apple, a school district, an employer, or a government. Jailed devices teach a different kind of lesson to the people who use them: your camera may be monitored, your books may be deleted, your work process may be watched. And most importantly, your attempts to delve into the mysteries of how the device functions will be punished.

We've reached a fork in the road at Harriton High. As the nation watches, we're pondering the consequences of transforming computing devices from machines that we control into machines which exert control over us. As we give away our freedom to tinker, we give away the chance to raise a generation which will lead the information age. It is now time to decide as consumers, as parents, and as a nation which road we will take into the future. I believe that students cannot learn to protect themselves against Internet threats unless they are taught that the power of the Internet comes with a price tag to be paid in responsibility. The responsibility to learn, understand, and master digital self defense. The responsibility to peer inside the machine in order to master it. In order to take on this responsibility, we need to loosen our grip on the reigns and let our children show us the way.

-stryde.hax