 Thanks for waiting, everyone. We got our final speech here with Pongo. She's a system analyst and a web developer from Seattle, Washington, and she's a champion strategist and team organizer for the augmented reality game of Ingress. Her theme is swarm intelligence and augmented reality gaming. Pongo. How's it going, everybody? Games have been part of our culture for millennia. The thing I love about games is that they provide unique opportunities to recreate systems that may or may not exist in the real world, and we can actually use them to solve problems that do. So in this world, IRL, the world you and I are currently interacting in, my name's Nancy Eckert. I am a systems analyst, that is to say I build and occasionally break systems for fun and profit. I'm also a big fan of intelligent systems, artificial and natural. I love machine learning. I also love to play games. So the game that I'm going to talk about today is an augmented reality game. It's called Ingress, where I'm known as Agent Pongolin, or just Pongo for short. Anybody else play games? Everybody plays games. Anybody play ARGs? All right. Any Ingress players? Awesome. Enlightened. Resistance? Would you tell me if you were? All right. Cool. This is going to be good. Okay. So in this game, I'm a strategist and raid leader. In non-game terms, you might call me a community organizer. I have an area of influence that covers roughly the Northwestern United States from British Columbia down to Northern California, Montana, Idaho, Washington, Oregon. And this comprises, depending on who you ask, somewhere between a few hundred to over a thousand active players. My team wins a lot. Our global winning streak dates back about two and a half years. So just a quick warning, I'm going to briefly describe the game and its history, and then I'm going to return to our broader point in a moment. So stay with me. Ingress was created a little over five years ago by a company called Niantic, the same company that would later go on to create the immensely popular Pokemon Go. Ingress players like to refer to it as that other game. So Ingress differs from Pokemon Go in one very important aspect, and that is its player versus player. Actually, it's team-based player versus player. It's adversarial, and additionally, it has a surveillance component. It allows you to track certain player actions on a map of the real world. So it has a very cyberpunk flavor that tends to attract a lot of hackers and tech early adopters, which is more or less by design. So Ingress is both a collaborative and a competitive game. We can think of it as a lot like Capture the Flag. It's played a lot the same. There are two teams. There's a green team and a blue team, the Enlightened and the Resistance. The rules of the game stay one account per player, and it's fairly rare for people to ever change sides. The object of the game is to capture these portals, which are basically sites of interest, generally civic art or public gathering places. When you see the game happening in physical space, it usually looks a lot like this picture on the right. A bunch of nerds standing on a corner, staring at their phones. So in the game, the way you score points is by first capturing and then connecting these three portals of your color to make a triangular field as we have on the left. The bigger the field, the more points. But here's the catch. You can only make a field if there are no crossing links of either color obstructing them. To take down links, you have to successfully capture one of the linked portals. And additionally, friendly links, ones made by your own team, require a special item. So here's an example of what the game board looks like in Las Vegas a couple days ago. You can see a lot of these fields on the map. Most of these fields are put up by solo players or very small teams just in the course of daily play. Sometimes they're playing on their commute, sometimes they're playing on their lunch hour, sometimes they're playing on the job. The point is, though, this game is played in physical space. This is the augmented reality component. Small operations can be done solo. Scoring big points, on the other hand, require teamwork and organization, just like raids in any other game. So these operations, which are sometimes called mega fields, they require anywhere from 20 to 100 people to put up. And that's basically players in the field clearing these links, as well as operators who watch the map and relay information to players in the field. This field on the right covered the city of Seattle. And one thing to remember, one thing to keep in mind is that there is another team that is actively trying to undo your efforts at all times. And as you've probably already guessed, if you happen to know about your enemy's plan, it becomes much easier and in some cases trivial to block it. So I'm going to ask you to keep this in mind as we move ahead. Here's what we can say about the operation. It's difficult. That means, well, it has a chance of failure. It might be adversarial. It requires strategic movement in physical space. It also requires cooperation, precision and secrecy. One more thing. A lot of these portals are actually pretty difficult to access. There are portals on islands, on top of mountains, inside secure facilities. There are some inside military bases. And additionally, there are portals that exist where there is weak or even no cell signal. Sometimes you have to bring your own cell signal. We have a lot of operations where people totes satellite modems back and forth. Sometimes you have to social engineer your access to a place. And again, all of these things are done in real time, in meat space, competitively. So this field on the left connects a marine research facility in Baja to a volcanic crater currently under lava in Hawaii to the most remote location in the lower 48 states, the thoroughfare ranger station. This actually required a four person team to hike for two days through Yellowstone with a satellite modem. The operation probably took about 200 people to run. And yes, there were grizzly bears. Not in Hawaii. So fields of this size require a lot of people power, in addition to a very diverse skill set to pull off. They demand that every player in the region act in perfect cooperation, precision and secrecy. Which means if you're trying to organize one of these things, you need to figure out how to get 200 people to behave in a very specific way. And that is ultimately an exercise of social engineering at scale. So I want to talk about a very basic problem observed in gaming, which is how do you get people to act as a team? Any gamer who has ever played a multiplayer game is familiar with the Leroy Jenkins problem. Maybe some of us are Leroy Jenkins. It's not surprising that this problem happens in the real world as well, because of course it does. I mean, how many people here really truly enjoy group projects? If you don't, chances are it's because of that one person who can't cooperate. Or in some cases, it's all of them. In games, though, as in life, the best rewards tend to happen when people cooperate. And difficult tasks require cooperation. Sometimes they need organization. DefCon is a great example. Large scale product, much infrastructure, run by volunteers. So how do we do this? Generally in a game, when you start getting to this scale, you start seeing enter the cat herders or the organizers or executors, as we sometimes call them, the people who get stuff done. If you're here today, chances are you're probably one of them. And you're facing a pretty hard problem, which is how do you get intelligent, free willed people to cooperate? So they get things done, people. This is usually the first system they try to build. It's a pyramid. This is a very intuitive structure. You have your your founders at the top calling the shots. You have your middle management in the middle. And in the game, these are usually the veteran players. They serve as gatekeepers for the people above them and mentors for the people below them. They assume sort of some of the management duties that the executors don't have the bandwidth to address themselves. They delegate, but mostly still maintain their authority. And at the bottom of this pyramid, we have the so called rank and file. In gaming, these are a lot of times new players. Sometimes they're casual players. In non game terms, they could be entry level employees, volunteers. But if you're thinking of the people at the top as the strategist figuring out what needs to be done, the people on the bottom tend to be the people who actually get the work done. And information flows from the top down. Additionally, there is sort of a sense that if you're at the bottom of this pyramid, you actually want to be at the top. So when you're doing this operation, there is a sense that you are devoting a certain amount of your energy to rising up in the pyramid. So this approach has some strengths. It's very easy to understand. And in certain ad hoc situations, particularly emergency situations is incredibly useful for us to know who's in charge. Let's take a moment to think about this model from a security perspective, though. Since most of us are hackers, and we're used to approaching things from unorthodox points of view. One of the things that I like to do here is inject a little bit of metaphorical systems thinking, that is to say, when we're thinking about attack vectors, and we're thinking about how a system might be compromised. This is one of the things that an attacker might do to approach the situation. Totally work. There we go. So we haven't actually changed anything here about the system. We're just flipping our perspective. And here we can see that the entire structure rents on a single point of failure. Furthermore, it also lacks flexibility. It lacks the ability to adapt to changing needs. When a model like this encounters challenges outside its wheelhouse, it breaks. And this problem tends to get more pronounced at scale. Systems analysts refer to this kind of system as a brittle system. And what we know about brittle systems is that they are vulnerable to attack. So let's carry this metaphor a little bit further. In fact, let's just make it explicit. So yeah, an attacker might actually see this system with a giant target painted on it that says attack here, and the whole system comes crashing down. So if you happen to be attacking, if you happen to be a pen test or, you know, red team, or if you're just trying to bring down the system, someone on offense, this is just great. It's very convenient. Bring the whole system down, attack the choke point. This is a basic gaming strategy that we have been using for, well, millennia. And again, there are many, many social engineering strategies that are built around this concept. Spear fishing, where one part of the system is directly targeted. Now, if you happen to be tasked with defending this system, whether you're playing a game or not, this is a real concern. It forces us to think a little bit more creatively about how we organize things. So what if we could do something like this? So this is a group of starlings, they're exhibiting flocking behaviors. This is a swarm. At first glance, this looks like an unintelligent mob. But in actuality, there's some crazy teamwork going on here. This is swarm intelligence. And this is not a new concept. It's used widely in programming. And it's based on the natural world. This is not accidental as well. Just as artificial neural networks are patterned on our understanding of how the brain works in the natural world, artificial swarm intelligence in computing is patterned on observed behaviors in the natural world as well. And it's not just birds either. Fish and insects do it as well. But what exactly are they doing? So to use a programming and analogy, they're following a set of very simple instructions. And they are processing information from their nearest neighbors. So from a security standpoint, this is pretty interesting because attacking one part of the system doesn't really do a whole lot. Since a swarm doesn't really need information or instructions from the leader or the entire swarm, removing any one node here merely establishes a new nearest neighbor. It's practically self healing. All right. So what is swarm intelligence? Swarm intelligence is defined as the collective behavior of individuals operating autonomously. So there are still leaders in this dynamic structure and organization as well. However, it tends to look a lot different from that traditional pyramid we just saw a moment ago. It is a decentralized approach, which means it sort of breaks down that triangle in favor of a more dynamic structure. So I just want to be clear here. I'm not actually declaring triangles obsolete. This is a strategy. It is not the only strategy and it can be applied to several different scenarios. In fact, it integrates quite well with more traditional hierarchies. Its key quality is adaptability, flexibility. And as it happens, it offers solutions for many of the vulnerabilities we just talked about. It's flexible. It's robust. And when it's done, well, it's incredibly efficient. There are examples in the real world as well. Maybe the simplest example is a flash mob, such as the pillow fight that we see in the background here. A lot of these flash mobs appear very spontaneous and disorganized when in actuality they're following some very specific rules that allow these individuals to function as a sort of a hive mind. Other examples. The Swedish pirate party founded by Rick Falkvinge describes itself as a swarm. Video games have successful examples of swarms as well. And if anybody is familiar with the game Eve Online, there was a group called the Goom Swarm, which is a famous, some say infamous, for steamrolling their opposition with essentially an army of noobs. There's also the group or anti-group anonymous. Specifically, its quality of undefinability shares many qualities with a swarm as well. So these systems all leverage swarms and they all have one thing in common. They tend to crush their competition through numbers and enthusiasm. Many successful social media campaigns have been driven by swarms as well. So let's reiterate the qualities of a swarm here and why we'd want to use one. Well, flexible. Flexible in that it reduces reaction time by eliminating bureaucratic overhead. Information doesn't have to travel up and down the pyramid. It's much faster. It's robust. It reduces service area for potential attacks. It enables self repair. It overwhelms competition with greater resources, whether that's time, money, or interest. It's efficient. It leverages the skill set of the entire swarm, not just the people at the top. So I want to go back to the game for a moment for an example of this decentralized advantage. So this image is from a global tournament, an Ingress tournament in 2017 in Portland, Oregon. There were several hundred players on each team, probably a few hundred portals in downtown Portland. The object of this particular game was to create as many small fields in downtown Portland as possible. So here's a snapshot of what the game board looked like a few minutes before the score was taken. My team, which is the green team, used a swarming strategy for this particular game. And that's what it looked like 90 seconds later. So using swarm intelligence, we were able to steamroll the competition in record time. We ended up replicating this several times at other tournaments and they all ended up this way. So now you're probably wondering how do we do it? So the strategy I want to share with you today was developed in the game, but you'll probably recognize elements of social engineering, game theory and plain old project management as well. It may seem very obvious to a lot of you once we broken it down. The first thing you need to do is establish your wing condition. This is sometimes called a vision or a purpose. This is basically the reason your swarm exists. When we did this in Portland, our wing condition was make small triangles. The second thing you need to do is break it down. So you have to break your skills down as far as possible to first principles that can be mastered and this is important autonomously. You don't want to be wasting time telling your swarm what to do. They need to be able to do it autonomously. So this particular game is not a hard game. It more or less amounts to showing up on time and pressing buttons on your phone. So what we did here was we basically broke it down to easily digestible portions instructions which says if the portal is blue make it green. If the portal is green make it linkable. If the portal is linkable link it move on. So the third thing you need to do is establish communication with the nearest neighbors in the swarm. So again it's not enough to make sure you get them all of the information you need or they need. If you're the leader or the manager you have to get people speaking to each other and this is where the real efficiency of the swarm comes in. It's fairly common to have instructions for this events like this relayed by an operator or dispatcher. Here in the tournament we remove that entirely. That's how we did it in 90 seconds. So by the time the tournament day rolled around we had instilled three things in our swarm. Purpose, mastery and communication. This is what we said. Our operators and dispatchers aren't going to be micromanaging you here. You already know what to do. So this is the swarm a hypothesis here. Make it even more universal. To catalyze swarm intelligence in a game setting. When a swarm has strong purpose mastery and communication with its neighbors collective intelligent behaviors will emerge. And in fact we can break it down even further into a sort of general equation. It goes like this. Play the game talk to each other. So again play the game break skills down as far as possible to principles that can be mastered autonomously. Unconscious competence is sort of the minimum condition necessary to unlock swarm intelligence. To talk to each other. Communication needs to be fast and efficient and it needs to support the team. It's not enough to tell the swarm everything. You have to get them talking to each other. Now this doesn't mean that we can't or don't have leadership or shouldn't have leadership. However the role of leadership in a swarm is pretty clear. Leadership reinforces win conditions. Maintains the vision. Leadership also motivates skills mastery. Basically teaching people how to play the game whether that's Ingress or some other game. And the last thing is that a leadership should be removing obstacles and to communication and facilitating it as much as possible. And this basically just goes back to talk to each other. Not just you talking to them. Get them talking to each other. So the thing is if you're striving to be successful at these things what are you really doing? You're building trust. And this is of course what social engineering is all about isn't it? Building trust whether that's to persuade people to act for or against their own self interests. So there are many good resources for how to establish this trust. I'm going to show you a framework that has been used by tribal structures for centuries. That's right if you want to lead a swarm you have to be a party cat. The lifeblood of a swarm is recruiting and retention. And the best way to do that is to deliver a worthwhile experience to everyone. This is where the party metaphor comes in. And again party is a metaphor. All it is it could be a literal party or it could be some other kind of worthwhile experience. How you deliver that will be different with every swarm. And part of the social engineering challenge is becoming fluent in your swarms goals and definitions of a good time. That is to say you have to do research. You have to do recon if you want to establish trust. So your goals are basically to build trust and identify the reward. This is the fuel for the party machine. And you have to keep the party machine rolling. So when we're chasing trust and reward there are two main chemicals in the brain we're seeking to activate. The first one is oxytocin which is fundamental to trust and bonding. This is where the party comes in. The other is dopamine which controls our reward centers and defines what we think of as worthwhile experiences. So as human beings we've discovered a few very effective very reliable ways to activate dopamine reward centers in the brain. So can anybody guess what the most reliable one is? It's not sex. It's not money either. Booze is a good guess but it's not booze. It's actually gaming. So games have a built-in win condition. That's what games are. Games remove obstacles for communication by providing opportunities to take risks and show vulnerabilities. Anybody out here play hack their badges this weekend? Did you have to talk to somebody to do it? Did that maybe bring you a little bit out of your comfort zone? Exactly. You did it for a game. So games have been shown in many maybe most cases to be more reliable than money or sex to get people to act for or against their own self-interest. So when we create games that promote mastery of these skills we're also reinforcing the swarms win conditions and we're promoting communication by establishing meaningful connections between people. We're having that teaching them to take small risks and in doing so we're building trust. So when we're successful at doing these in group situations what we're actually doing is building tribe. So what makes a good game? Remember what we said at the beginning? There's a chance of failure. It might be adversarial. It requires strategic movement in physical space. I mean we're hackers, we live on the internet, but physical proximity is what makes us human. And again it requires cooperation, precision and secrecy. So we often refer to tournament play as planning a wedding as well as a war. That is you have to take care of the strategy, that's the war. But your first job in that is to make sure your army shows up. That's the wedding. So in Congress tournaments are largely run by the players. They don't get paid, mostly they do it because they want to win. There's a very valuable lesson here about crowd sourcing. So hotels, after parties, emergent gameplay, this is all organization done for the purpose of getting people to the place to do the thing. So here's where we start to see how we can use games in a way not just to teach skills mastery, but to cultivate and validate trust. We can start small with small projects and small numbers. As we deliver worthwhile experiences and we keep that party machine rolling, we gain trust. And that trust can kind of become a form of social capital that we can then reinvest into larger ventures. As you continue reinforcing your win conditions, building skills mastery, and helping people create meaningful connections with each other, this is how you turn a swarm into a tribe. So by now you may already be thinking about how to apply swarm intelligence to your own projects. Any sort of team-based venture can be thought of as a game with a win condition, skills to be mastered, and methods of communication throughout among the team. Does anybody have any questions? It's a really good question. So the question was people swapping accounts, maybe changing teams, is that what you're referring to? Oh, I'd have to say that culture still exists within the game and it's very strong. There are definitely still people who do multi-accounts, but one thing that both teams have developed is sort of a face-to-face verification system. In local communities a lot of times you won't be allowed into any sort of secure chats until somebody has met you face-to-face. I don't know that necessarily meeting somebody face-to-face makes somebody less inclined to switch teams, however it makes it more difficult for them to infiltrate another team if their face is known to others. This is a really good question. So how do we combat the Leroy Jenkins problem? If you have a Leroy Jenkins on your team, how do you how do you minimize the harm that they can do? The swarm intelligence model is basically seeks to eliminate Leroy Jenkins from happening by building trust within the swarm. In general, Leroy Jenkins types will make themselves known very early on. Sometimes they sometimes you can align your goals with theirs or vice versa and sort of bring them on on board to the team. You know sometimes you you can't. Yes. Oh yes. Who is Leroy Jenkins? This is an internet trope that predates Ingress by several years. Leroy Jenkins was a infamous example contrived, but an infamous example in an MMO of a player that went off the rails basically. There was a gigantic raid where everybody was trying to do do something very carefully in an accorded manner and Leroy Jenkins was not paying attention and wiped the whole raid. Screaming his name in the process, Leroy. Yes. How do you design a good win condition that is easy to understand? Yes. Actually, Falka Vinga, the Swedish pirate party, talks a little bit about this in one of his books. It needs to be specific. It needs to be easy to understand and it needs to be achievable. Beyond that it doesn't really need to be too detailed. Very much, Pongo.