 Welcome everybody to the next talk, Hacking Collective as a Laboratory. Our speaker is Martin Zarot, he's from Poland. This talk is about sociology and the talk will offer you an insight on the sociological research that has been done on hacker spaces and hacking collectives. And now I ask you for a warm round of applause to greet Martin. I have a lot of fun. Hi, my name is Martin Zarot. I'm a member of the Warsaw Hacker Space. I'm also a PhD candidate at the Institute of Sociology at the University of Warsaw. Before I start, I ask you, please imagine a computer bug. It could be a software bug. It could be an exploit. It could be a hardware bug. It could be the bug that started your hacking career. It could be the bug that you are struggling currently. Please imagine any kind of computer bug. You do not have to be a hacker if you are just interested. It could be a bug that you just read about in a popular press. I do not care. Please imagine, let's 10 seconds, any kind of computer bug. So I guess that some of you, when imagine a computer bug, also thought about how it works. Some of you thought how to stop it working. Some of you thought how to exploit it, how to make money of it or how to make this bug for a good cause or any kind of cause. Some of you also perhaps thought how to make it visible or how to make it invisible or what machines, instruments would it take to make it to change the degrees of visibility? Would it need an oscilloscope? Would it need a server or any kind of software? Perhaps some of you thought about systematic bugs, bugs that are inherent to particular designs. Some of you might have thought about situational bugs that are exceptional, connected with particular sets of constraints that do not happen every time. Obviously, some of those questions are technological questions. Some of those questions might be connected with science or medicine because the question about knowledge is inherently connected with different kinds of scientific, technological, medical reasoning. But there are kind of questions that we, when we start asking them, we come closer to economical issues or sociological issues or philosophical issues. And sociology of science is about what is common for the people who are shared by the same thinking or similar thinking about particular categories of knowledge. So when we start asking questions, who may see that particular kind of bug? Or when we start the questions, what does it take to see that particular kind of bug in a sense of situational setting or sociological setting? Then we are starting to ask philosophical questions or sociological questions. The difference is when a philosopher asks about knowledge, he or she thinks about the individual. And when sociologist starts asking similar questions, he or she thinks about the group. So some of you might have thought about the particular kind of men in the middle attacks, for example, as described at Claude Fuller blog. It's okay. Some of you might have thought about syphilis or maybe not because this is different kind of bug and it doesn't, and it's not that closely connected with computers or is it? So when we think about the bugs or knowledge in terms of sociology of knowledge, we start to understand that learning to see a bug is also about belonging to a particular group. When we start to see different kind of bugs, when we learn how to manipulate them, how to exploit them in a different kind of way, we are also being closer and closer to particular knowledge or particular expert sub-societies or sub-social groups. And obviously the bug is connected with particular setting. It might be situational, but more often than not, it also needs an extra work to make it visible. It doesn't mean that this bug is artificial or natural. It just means that it's not obvious or it requires a special knowledge or a special social setting in order to make it visible. This is one thing that is shared between syphilis and men in the middle attack. They are not visible at the first glance. They need some kind of expert setting in order to become visible. And the sociology of science is about that kind of expert settings. So to see or not to see a particular bug is also to belong or not to belong to a particular knowledge group. And sociology of science has different strains. One strain is proposed by Merton and it works that science was a source of certified knowledge for the rest of society. The science was the only source of knowledge. The other types of knowledge was not certified. The Merton would go crazy if he thought about hackers, but fortunately he didn't have to. Other kinds of sociological thoughts would be proposed, was proposed for example by Bruno Latour and he proposed that technology is society made durable and it means that particular design decisions that were made or particular design decisions that seemed to be random accidental eventually became more and more stable, more and more constrained and more and more embedded into the fabric of society. For example, if we decide where do we put our bridges? If we decide what measures of our networks are enough to ensure privacy or security, we are making long-term decisions that will shape the societies that will come after us. Those approaches are good and many people are working within them with rather interesting results, but I wish to talk about approach proposed by Ludwig Fleck, Polish sociologist, Polish philosopher, Polish microbiologist and he proposed the notion of thought collective. It was in the 1930s, he published in German, so perhaps not all of you might have read about him. So he proposed that thought collective is a group of people who share the similar epistemological approaches. What do I mean if I say epistemological approaches? For example, if certain group of people agree more or less that something counts as a good evidence or something counts as truth or some methods of achieving truths are better or more reliable than other, then perhaps this group of people might be a thought collective. What is more advanced sign of thought collective? It would be the ability to recognize some patterns that would be invisible to other. That kind of pattern might be a syphilis bacteria at the microscope. That type of pattern might be many in the middle attack in the code but it's about seeing the pattern that other group of people would not see and learning to see that pattern is also starting to belonging to that particular group. And we, the sociologists of science, we are somewhat different than our friends from psychology department or our friends in cognitive science department because we think that thinking is a collective endeavor. We do not really believe that people think on their own. We believe that when particular individual starts thinking, he or she is thinking with his or hers books, experiences, histories, biographies and so on and so on. And many more advanced project, for example, open source software or architecture software or Wasserman test to detect syphilis was collective endeavor. And we also think that thinking involves minds but also involves hands and eyes. Sometimes we do not have the idea of solution in our mind. Sometimes we just come upon it with tinkering, with seeing things in microscopes or in code. So how does it work in practice? I spent some years watching and talking and observing my friends from different hackerspaces in Poland and in some neighboring countries. I gathered the data. I got privilege and access to many parts of their private or hacking lives. They talked with me. Then I gathered this data, I analyzed it. The first stage of analyze is called first stage coding. And this is looking for basic patterns, basic biographical patterns, basic situational patterns, basing, for example, group rituals, rather simple stuff. Then, basing on that, I devised some kind of models, I test them, and eventually I publish papers. So this is the classical sociological route of work but some of you might not know it. So what about the laboratory? So sociologists of science since Merton spent an awful lot of time in laboratories because laboratory for a modern society is a special place. This is the place where not only science is made, but this is also a place where future society is kind of shaped up. Not because in the laboratory we could devise any kind of knowledge or not because any kind of truth could be socially constructed no matter whatever, but because many of the decisions made in laboratories have significant political consequences. I'm not only talking about decisions made in programming communities, but it also dates back, for example, to program Manhattan or the Wasserman test for Syphilis. So what is the laboratory? Or what makes the Huckaspace a special kind of laboratory? As a rule of thumb, laboratory is a kind of separated space when you could make mistakes freely. The mistakes made in the open society cost more than mistakes made in the laboratory. And laboratory enables you to kind of limit the space or time or causes in order to manipulate them. Things in laboratory might happen faster, might happen slower, might happen on different scales, for example, in the scale of microscope, in the scale of macro sociological models, and you could, for example, limit some causes. And in the sociology of science, sometimes we say that in the laboratory the first relations are reverted. It means that in the outside world, the bacteria are stronger because they are harder to spot, they are harder to catch, but in the laboratory we could limit them. We could catch them in our networks, in our instruments. What is particular for the Huckaspace or any other kind of informatical technology laboratory that in the case of IT laboratory and Huckaspace in silico is the same as in vivo? It means that there is very thin line between theoretical model and practical application. For example, in physics, in chemistry, in biology, computer model is very much separated than the wet work, the bench work, the real work, whatever you call it. But in the information security, theoretical model could be more or less tested, but in many cases could be tested as fast as you may. There are exceptions, I know about the supercomputers, I know that not all theoretical informatics could be tested on the spot, but as a general principle, it works more or less. The particular laboratory, as we know from FLAC, is often linked with particular thought collective. Thought collective is a group of people that share, as I said, similar epistemological patterns, and in the case of Huckaspace, that kind of hacking thought collective could be recognized, for example, with accepting this principle, is to tinker with something, is to understand with something. It doesn't mean we would go with that after, so don't worry, but it comes with kind of cost because in the observed hacking communities, they are often brilliant engineers, they are often brilliant programmers or tinkerers, I couldn't pay more respect to them, but more often than not, they have some problems with stabilizing the knowledge. Often the manuals or tutorials or documentation provided by Huckas is limited or in the best case scenario, is often linked to the direct project. Huckers do not have much patience or do not put much attention to general principles. This is the difference from many natural scientists. Many natural scientists are looking for general rules, generalizations, whereas Huckers would go for application. For scientists, something is true if we could make a general predictable model and for Hucker, something is true if it works. Obviously, some engineers would do differently, some natural scientists also would do differently, but we would go with it in a moment. But if the Huckers have problems with stability of the products of the Huckers space, what is the most stable product of the Huckers space? I think that the most stable product of the Huckers space are the Huckers themselves. Not many products of the Huckers space have the similar amount of documentation or similar amount of autonomy as the Huckers. You do not need much to operate a Hucker, but you need much to operate the Hucking products. And they are much, how to say it, from the sociological point of view, the Huckers are much easier to handle than Hucking products. But to more comparison with natural scientists, if I compare the data on the Huckers spaces collected by me in several Huckers spaces in the period of three years and so on and so on, with the data on CERN and Max Planck Institute collected by Karin Knosetina, and we have some similarities. For example, compared with physics, Huckers, more often than not, would agree that the knowledge belongs to the whole community. Knowledge would be more distributed, one. And this is not very surprising because we know that open source models or open hardware has some similar roots with physics community in CERN. So the historical argument stands. But also what is less obvious is that Huckers, as well as particular physicists, also like to gossip, to talk about machines. We know that many physical instruments operate more or less or are calibrated more or less and they have good days and bad days. We do not always write about it in scientific papers, but if you remember about the issues of detection of Higgs boson and many false claims or problems with CERN announcement and their own limitations, you would see the trace of us of it. But comparing Huckers with physics is rather obvious. We know that there is a Huckers space near CERN and many of the electronic people or physics people from CERN are members of that Huckers space. It's really nothing new. But what is more interesting is comparing Huckers with biologists from Max Planck Institute is, for example, some biologists agree with the classical Hucking stance that to understand something is to produce that. You do not have to devise a general model, you just need to devise the tools. If you are able to manipulate it, then you understand it. Other thing would be the recognition of authorship in important chunks and the third thing would be the more attention to quick trial and error cycle. In this particular biological setting in the observed period, it was, I'm open to discussion, many of the biologists doing the wet work, doing the bench work, doing the laboratory work, relied on quick trial and error cycle without doing much formal calculations, without resolving much to formal models, just unlike the physicists. Physicists, you know, you need a lot of simulations before you put on your atlas. But this is rather interesting, classical sociological stuff, but let's do something crazy. Let's reverse the thinking. We were looking at the hackers as they were scientists. We have some differences, we have some similarities, but let's look at the hackers as some sort of social syphilis. I'm really sorry for that. We know that syphilis in the time of Fleck shown something about the society. For example, shown that many of respected middle-aged men were not as faithful as they claim to be. It's shown something about the need of public healthcare. It also shown something about who knows, who really knows something about small, tiny bugs invisible to other people. And up to some extent, and this is metaphor, you know, I do not claim that hackers are bacteria. I also think that hackers is a kind of... But... Ha, ha, ha, ha, ha, ha, ha. Might act as a bacteria in a certain settings in a scale of society. Because they reveal some things that otherwise would be hidden. And what is also a similarity is that hackers do not need a knowledge about the whole system. They do not need to understand the whole setting. Physicists need all the data. Biologists need all the data. But syphilis and hackers need only one access point, one entry point. This is obviously a classical knowledge or asymmetry between attacker and defender. And here I'm treating some hackers as attackers. But for the sake of metaphor, let it be. What if... If some kind of hacking history or history of hackers or sociology of hackers resemble, up to some extent, history of syphilis and biologists, maybe we could also think, or maybe we would see, that some kind of genetics. Genetics of exploits or genetics of hacker spaces. And this is made because people working on security are working on different generations of bugs and evolutions of bugs. And people working on hacker spaces talk about generation of hacker spaces. For example, MaxiGas. But also we know that many of the natural sciences, for example, chemistry or medical data, moved to automation discovery systems based on machine learning. I would be very much amazed if some parties weren't breeding machine learning systems on exploits and patches. We have automatic discovery systems on biology. We have automatic discovery systems in chemistry, in medical data. I'm almost sure that there is a beast in the Google or in the NSA that it's feeding on exploits, that it's feeding on blog posts, and that it's feeding on this presentation at this moment. But here comes the thing or interesting part. I said that hackers sometimes have problems with stability. Reports produced by hacker spaces are less standardized than inscriptions or reports or scientific papers presented by the formal laboratories. It means that knowledge from the formal physics laboratory is much more easier to chunk into machine learning system. It means that it's easier to standardize knowledge and it's me, but on the other hand, as my friend put to me, we're still feeding the computers knowledge about the computers. So it's the translation part is easier. So it goes both ways. But nevertheless, the issue of standardization in this kind, in this part, it's no longer a bug, it's a feature, or it's an issue. Less standardized knowledge, the whole set of blog posts, tutorials, YouTubes, Gossips, CTF reports, whatever, they do not resemble scientific papers, but maybe this is good, maybe this is what we need. So I know that people have found some cures for syphilis. It's good. But I really hope that, and when they found that cure for syphilis, many of the thought collectives collaborated, they merged, they changed, they were forced to collaborate. They need to understand and translate from one mode of thinking, one mode of knowledge production to another. They learned to talk to each other and they created something bigger. I really hope that some hackers would start, or will continue translating to other types of knowledge production. For example, knowledge production by journalists, we know that it is occurring, the knowledge production by the academic people, we know that it's occurring and so on and so on. And the last thing I really hope that unlike the syphilis and unlike the history of Fleck, I really hope that hacking would not be cured because we do not need the syphilis, but we need the hackers. And I really wish on this point, I really wish to express my sincere gratitude to all the participants of my study. For the three years I observed you and you granted me the privilege to be observed. You agreed to give interviews and I'm really grateful for that. Thank you very much. Thank you very much, Marcin, for your talk and all your insights. We luckily have five minutes left for questions and answers. So if you have any questions, please move to the microphones that we have throughout the room. Please, your first question. Please move close to the microphone. Is this working? Yeah, it is. Okay, so in your experience doing this research, did you ever find hackers in a research lab? And if you found any positive effect of this and if not and you ran a simulation in your head, what do you think would be a positive outcome of having hackers in a research lab? I've run into several accounts, for example, during this Congress when people have two affiliations, they were affiliated in particular hacking collective and then at the same time they were active in the academic field. We know that people exist. I haven't met many of them but I met several scientists turned hackers or hackers learning some things from science and I think this is beneficial. If you are more interested in that, please look into my papers about hacking collective as a trading zone. I have a special part of research done on this translation intergroup issues. Thank you very much. Second question. You said that hackers are like syphilis to the society and I'm sorry but I didn't understand in which way they are syphilis. Can you repeat it? Yeah, of course. This is a metaphor. I really... The hackers sometime in some sense act as a syphilis because first of all, they reveal some things about society that otherwise would be hidden. Second, in order to see the actions of the hackers, you need a different thought collective. And what is peculiar? I haven't talked much about it but this is the moment. In some cases, the same people that are acting would be the same thought collective that would be the cause. And this is characteristic for hackers because some actions done by the hackers could only be understood within the hacking community. So that is the extent of metaphor. This is not about causing harm or any kind of negative stereotypes connected with hacker. Thank you. Do we have any other questions? We still have some time left. So if you have a question or a comment, feel free to move to one of the microphones. It seems to me that this is not the case so please give another warm round of applause to Marcin. Thank you very much for your talk.