I'm a Hacker!

Every year we get grades 9s who waft into our high school believing they are god's gift to computing.  In the vast majority of cases I discover that they've learned how to do one or two things, but the moment you move them out of their area of 'expertise' (which is usually so small you couldn't really call it an area so much as a corner), things fall apart.

We have such a genius in this year's grade 9 cohort.  When the class was given CyberPatriot's Unity OS security simulation to play, he didn't know how to open a zipped file and get the game running.  When I queried him about it, the conversation went something like this:

"You told me you're this great hacker, but you can't open a zipped archive?"

"Well, this isn't what I usually do."

"You told me you're this great hockey player who can score goals from anywhere on the ice, but when I ask you to show me how you skate, stick handle and shoot you can't do any of it, which makes me wonder what it is you think you're good at."

Taking a script that you found online and running it doesn't make you a hacker, it makes you an idiot.

The student in question has proudly boasted of swatting people, which I'd describe less as hacking and more as criminal harassment that wastes limited emergency services.  This clarifies the difference between a hacker and a criminal in simple terms anyone can understand.  One is focused on complex skills development, the other is focused on finding shortcuts.

hacker noun

hack·​er | \ ˈha-kər

1: one that hacks
2: a person who is inexperienced or unskilled at a particular activity; a tennis hacker
3: an expert at programming and solving problems with a computer
4: a person who illegally gains access to and sometimes tampers with information in a computer system

#2 comes very close to what this guy is in terms of being a hacker, though he'd be popular with actual criminals if he's thick enough to run scripts that he doesn't understand; he'd be the perfect trigger man.  If we're applying the term in computer studies, a hacker is generally someone who is expert at solving problems with a computer or getting into systems.  In either case this skillset has traditionally required years of complex skills development including a challenging apprenticeship of trial and error learning on the wilds of the internet.  Criminals seldom have the kind of patience and intelligence to develop these skills; it's part of what makes them criminals.

Malware is being sold as a service: the
'hackers' running it are plain old criminals

What has happened recently is that cybercriminal activity has become professionalized.  Many of the people doing the 'hacking' now have no idea what they're doing (like this grade 9).  They buy malware as a service software from professional criminal organizations (many of whom have ties to state cyber-warfare actors) and then run a dashboard that provides them with ready-made hacking tools that do the thinking for them.  Some of these MaaS systems even provide IT support!  No genuine hacker would ever want nor need IT support, they'd provide it themselves.

I'm currently re-reading Matt Crawford's The World Beyond Your Head in which he makes a strong philosophical argument for developing complex skills rooted in real world experience.  Crawford goes to great length to describe how these hard-earned skills often develop a corresponding moral character in the majority of practitioners; reality is a consistent and demanding teacher and it demands rigour and focus.

I have students who have developed deep, complex digital skillsets in the course of our four year program and I would proudly acknowledge that they are hackers in the correct sense of the word, but what most would-be hackers are is really script kiddies who run other people's code simply to perform malicious acts.

Script kiddies exist in the first place because we go out of our way not to teach digital literacy and cyberfluency in our schools.  In the absence of any direction, some of the blunter tools wander into this kind of self-identification.  Students have to take 8 years of geography and history in elementary and then have mandatory geography and history courses in high school too, but there are no mandatory digital fluency courses in any Ontario high school - even after we've forced everyone into a remote learning stance due to COVID.  Many of the problems that have arisen during emergency remote learning are a result of the terrible digital skills many educators and students possess.  Script kiddies are just another symptom of our digitally illiterate education system - a system that depends increasingly on digital tools and networked information to operate.

This grade 9 may well sort himself out and become a hacker in the real sense, though I find the most boastful ones tend not to have the wherewithal to develop complex skillsets such as those required by a genuine hacker.

At the CyberTitan nationals in 2018, one of our team members (then valedictorian then University of Waterloo Computer Science student), became intrigued with the idea of pentesting as a career.  Penetration testing is something that has evolved quickly as networked cybersecurity best practices have evolved.  The thinking is basically this:  if you want to understand how best to respond to the rapid evolution of cyberattacks, have a skilled pentester come in and probe your network for weaknesses and then assist your defensive team in sealing up any gaps in your system.  Now THAT is a hacker!

White hat hackers used to do this as a kindness, though most recently it has also become a bounty hunting situation, and now a lucrative profession.  Top pentesters are in high demand and make good money.  What they don't do is download and run scripts they don't understand and then not know how to perform even simple tasks on a computer - that would be a good way to lose any credibility with their employer.

I'm in the awkward position of seeing this happen in another class.  Were it me, I'd be leaning on this student hard to see what it is they actually think they know.  Being at arm's length in this scenario, my biggest worry is that this student will use our technology to hurt someone else (I fear this has already happened).  If we had a student come into the school who had been convicted of vehicular manslaughter, I doubt we'd put them in an automotive technology class, yet we don't think twice about taking a potentially digitally dangerous student and dropping them into computer technology?

This is a tricky situation to navigate.  I'm actually hoping this student has genuine potential and we can get him engaged with doing more than running scripts he has no understanding of.  In learning the rigours of operating in cyberspace, he will also most probably become less of a braggart as he aligns himself with the reality of the situation.

Why You Shouldn't Base Your Classroom On Hacker Mythology

Like many social trends, hacking came into education late. Decades after the concept reached world wide understanding in technology, education took it up as a great leap forward and a way to catch up with the times, except everyone else has moved on, again.  WIRED recently published an article that demonstrates technology's evolving relationship with the hacker ethos.  In questioning the value of hacking as a moral and useful way of thinking, this article raises some interesting questions about the many teachers who want to hack the classroom, or teach children the magic of hacking.

Honesty, ethics and scientific method?  Surely it's much
better to be a cool hacker in a classroom, right?

If, as Joi Ito suggests in that article, "the hacker archetype had found its highest articulation in one Donald Trump", then perhaps it's time for educators to rethink their hacking fandom.  At its roots hacking is an act of hubris designed to beat a system at all costs.  It is driven by pride and arrogance and the results always justify the means.  A successful hack is a forced, rushed, short-term result that only has value to its user.  Hackers don't build things, they break things, twisting the intentions of designers and diverting shared resources for their own needs; hacking is an inherently self serving and destructive act.

...but I can hack a fix that will save us in this moment
but will take weeks afterwards to undo or everything
will fall apart - hacks have nothing to do with sustainable
engineering.

In certain circumstances (say, Scotty on the Enterprise jury-rigging together some dilithium crystals to make the warp drive work and save everyone's lives), a hack might be just what you need, but to base your personal knowledge on hacks, or worse, teach it to many people as curriculum, is madness.  Whenever someone hacks together a solution in a complex system, it weakens the system.  You might get what you want out of it in the short term, but capable people will need to come in afterwards and repair what you've done or else the system will eventually fail.

It might seem romantic and exciting to call hands on learning hacking, but it's also very inaccurate, to the point of being damaging to the students learning it because it doesn't teach them effective engineering.  It is akin to teaching accounting by showing students how to cook the books, or teaching a sport by showing students how to cheat to win it.  As they mention in the WIRED article, the Russian team's hacking of the last Olympics shows a staggering lack of understanding; the point isn't winning at all costs.

As a former IT technician and now technology teacher I've always wondered why I find the whole hacker thing so eye-rollingly tedious, but in retrospect it was because I was the one who had built the thing they broke, and then had to fix their 'ingenious hack' so that the whole thing would work again.  It's difficult to see a hacker as some kind of genius when you build and service a complex hardware and software network that serves hundreds of people well only to watch it get broken to serve one selfish person.  Yet many educators hold up hacking as this magical process that lets you beat technology.  Perhaps that's what's at the bottom of this, an opportunity to attack the technology that so many people feel is enabling them to belittle themselves.

“There is a trend in software development away from the ‘hacker’ jury-­rigging into a mature field, where things are ‘proven’,”

Virgil Griffith

You don't have to advocate for technological terrorism
to get into teaching science & technology, you just
need to spend some time understanding it.  It
isn't magic, it's knowable and teachable.

That mature field is called engineering.  It doesn't have the gung-ho and catchy mythology of hacking, but it's what builds space shuttles, Internets and makes the rest of modern society possible.  It is a creative and powerful expression of human thought made tangible and something that everyone should have at least a passing experience in otherwise they are ignorant of how the Twenty-First Century works.

If you want to have Maker Spaces and encourage hands-on learning I'll be the first to applaud the effort, but you don't need to dirty the name of technical creation with hacking, because it has nothing to do with it.  You're encouraging a cheating-to-a-solution-at-all-costs mentality when you use the term hacking.  Engineering is a collaborative act of creation with a result that is beneficial to many people.  The reason hacking isn't is because it has little to do with creation and is usually motivated entirely by selfish need, that's why it's usually a solo effort.  Is that really what you want for your students?  Ruthless, deterministic and selfishly motivated hands-on learning?

As educators I think we can do a bit better than that.

Gaming Everything

Via NBCnews: the glory of the hardcore video gamer.  Not
 the kind of thing that's ever going to challenge the Olympics
for public attention I think.

I've had a lot of trouble playing video games lately.  My problem seems to be around that idea of scripted experience.  If I'm playing a video game I'm working through a narrative someone else created.  I enjoy narratives but what irks me about video games is they pretend to have an element of choice in them when in fact they don't.  They suggest that they are the next evolution in entertainment but the interactivity they offer is so limited that it's really just a hidden script that you follow under the illusion of choice.  Gamification in general seeks to use this illusion to hook people into otherwise tedious situations.

The first step away from video gaming occurred when I found I couldn't get into single player games anymore.  Even the good ones with epic narratives felt banal.  I went to multi-player games for several years hoping that the human element would create choice, but I find that these too are scripted, and worse, they force players into scripted responses to the point where you can't tell the players from the bots.  When a game is so restrictive that it makes the people in it act like machines it's not a game I care to play.

There is a particular situation in which we're happy to turn people into bots if the illusion of engagement is preserved.  That situation also happens to be seen as quite tedious by many of its participants.  Education is eager to digitize if it ensures engagement, even if that engagement mimics the dimensionless engagement found in online activity.  Standardized testing feeds this thinking, producing learning outcomes that are easily quantifiable as data even as they fail to demonstrate learning.  Deep contextual human activities (like learning) are lost in simplistic digital data.

Doubt is cast on an individual teachers' ability to teach a subject.  Consistency is demanded in modern education as a result of this doubt and the slippery nature of digital information encourages this by eroding the space between classrooms and lessons.  This is shown as some kind of great step forward in terms of fairness, but what it really does is reduce teaching (as it has done with many other human activities) to a vapid exchange of information, incidentally, what digital machines do best. 

We fill in templates, teach centralized material and are encouraged to sync how we teach it.  Proof of success is found in standardized test scores.  There is little interest in assessing teaching or learning in any other way.

This digital infection also carries the parasitic idea of gamification, usually championed by video game evangelists who believe that the structure of gaming can overcome every obstacle.  Teachers are encouraged to design student success through scripted outcomes, pretty much like a video game does.  If the game you're playing is designed to have you eventually win, it isn't much of a challenge, and certainly isn't something you can be proud of, but then modern learning isn't about challenge, it's about engagement.  The idea of gamification makes me uneasy for this very reason.  When we gamify situations that aren't games I'm afraid that we pollute complex situations with the implied success found in most gaming outcomes.  If education is supposed to prepare students for the world beyond school, this isn't going to do it.

When you're gaming everything, you've lost the ability to
immerse yourself in anything.

If you offer open ended, 'real' experience many digital natives shy away from a situation where the rules can't be gamed for advantage.  The hacking mindset implies that the system is more important than the content.  Perhaps that is why I can't play video games anymore.  It's hard to get lost in a narrative when you're constantly looking at ways to subvert the delivery method.

Wilful suspension of disbelief is lost in the digital age.  This is the root of the pessimism and disengagement you see in many students.  When education becomes another process you hack to guaranty your own success, it becomes increasingly impossible to do anything useful with it.

This grew out of Scripted Lives which itself grew out of Unscripted Moments.  I'm pulling at a lot of threads here.  I've been a fan of RPGs since I got into D&D when I was 10.  I love sports and would describe myself as a serious gamer.  I've spent most of my life learning digital technology, so I'd hardly call myself a tech-hater either, but watching digital technology and gamification aiming for society wide acceptance has made me very uneasy.