Introduction

Hackers have become some sort of an enigma in the world of psychology and sociology. Understanding their development and motivations has become a one of the areas of interest. However, up to this day, there has been a dearth of studies and some exploratory studies on them.

There seems to be a dual standards when analysing hackers.

To companies whose network they victimize, and those adversely affected by their "intellectual endeavors", they have become a menace.

To most of the computing world, especially for programmers, there is a certain awe and fascination for hackers. Hackers are regarded with a certain degree of respect, not because of their acts of violations but because of their intellectual prowess.

This presentation will try to report a number of exploratory studies about hacker development and motivations.

By understanding their development and motivations, it is hoped that elements leading to the development and building of motivations of hackers would be checked and controlled.

Definition

hacker/n./[source: The Jargon File]

[originally, someone who makes furniture with an axe]1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming. 4. A person who is good at programming quickly. 5. An expert at a particular program, or one who frequently does work using it or on it; as in 'a Unix hacker'. (Definitions 1 through 5 are correlated, and people who fit them congregate.)

Generation

First Generation

• circa 1950s-1960s
• talented students; programmers, and computer scientists
• academics or professionals interested in the codes and sets of instructions
  being processed
• often pioneers in their field (Chandler, 1996; Levy, 1985; Sterling, 1992)
• motivation: intellectual challenge(Levy, 1985)

Second Generation

• circa 1970s
• tended to be technological radicals who recognized potential of PCs
• with disregard to concept of private or commercial code
• minor criminal activity was not uncommon
• motivation: intellectual challenge and breaking traditional boundaries

Third Generation

• circa 1980s
• young people who embraced the PCs
• recognized the potential entertainment value of the PC
• began developing games
• motivated to breaking copyright codes because of desire
  to access games for free
• criminal activity was minor in nature (Chandler, 1996; Duff & Gardiner, 1996)

Fourth Generation

• late 1990s and early 2000
• embraced criminal activity much like a sport
• claimed motivation: curiosity, hunger for knowledge
• actual motivation: greed, power, revenge or some malicious intent
  (Anonymous, 1997; Goodell, 1996; Parker, 1998; Power, 1998).

Categories

Newbie/tool kit (NT)

• with limited programming skills; relies on already written scripts or tool kits
• which are available in the Internet

Cyber-punks (different from William Gibson's sci fi work)

• have computer skills and programming knowledge;
• have a knowledge in programming software although not an expert
• have a better understanding of the system they are attacking
• have intention to engage in malicious acts (e.g. defacing web pages and spamming)
• have been known to engage in credit card number theft and telecom fraud.

Internals (IT)

• usually disgruntled employees or ex-employees
• computer literate and have been involved in technology related jobs
• carry out their attacks not usually through computer programming expertise but through privileges accorded to them at the time of their employment
  *accounts for nearly 70% of all computer related criminal activity (Power, 1997)
  

Coders (CD) - Old Guards (OG)

• no criminal intent
• without respect for personal property
• embraces ideology of the first generation hackers - interested in intellectual endeavors

Professional Criminals (PC) -Cyber-terrorists (CT)

• most dangerous
• professional criminals and ex-intelligence operatives who are guns for hire.
• specialize in corporate espionage
• extremely well trained and have access to state of the art equipment

The majority of research and media attention has been focused on cyber-punks. There have been little or no research on other categories (Rogers, 1999).

These categories are seen as comprising a continuum from lowest technical ability (NT) to highest (OG-CT)

The Flow

How does a newbie develop into a cyber punk instead of an old guard ?
- A conceptual framework

Flow

• sense of effortless action felt when being highly involved in an activity ot the degree that attention becomes ordered, fully invested and time is obscured by the involvement in the activity (Csikszentmihalyi, 1997)
• occurs when activity challenges the individual enough to encourage playful, exploratory behaviours, without the activity being beyond the individuals reach - if too demanding: produce anxiety, too easy-boredom

Four dimensions

1. user perceives control over computer interaction and playful exploratory behavior is encouraged.
   
   
2. user perceived that his/her attention is focused on the interaction - computer users have reported being mesmerized during computer interactions.
   
   
3. user's curiosity is aroused during the interaction - internet provides websites or hyperlinks that provide options that encourage exploration.
   
   
4. user finds the interaction intrinsically interesting - that is they are involved in the activity for its own pleasure and enjoyment rather than for some utilitarian purpose.

Development of a hacker-a proposed conceptual framework by John Van Beveren

When newbies start their hacking or computer criminal activies. tools kits and info gathered must be successful to provide positive feedback to the hacker. Being able to gather tools and information that makes them successful in their early endeavours will encourage Newbies to continue what she is doing until they develop their skills and confidence to pursue more computer criminal activities.

The development of new skills to meet new challenges is dependent on the available tools and challenges within the online environment.

When the newbie develops the skills and acquire the matching tools to meet new challenges, flow will occur.

A newbie becomes a cyber-punk or an old guard through the development of sufficient skills

Flow rapidly increases motivation to develop skills and find more challenges.

Criminal tendicies present in the individual would draw a Newbie hacker toward CP

Stereotypes

I believe there are a number of social hacker stereotypes

The first stereotype:

• an underdog
• unrecognized genius
• naive
• nerd
• shy or socially inept
• part of a larger group of unrecognized geniuses
• pursues hacking for the intellectual challenge it brings
• inherently good
• undermines and defeats authority through hacking

think of the movie Revenge of the Nerds

The second stereotype

• sociopath or psychopath out to rule the world
  by hacking critical network systems (think james bond movies)
• still a genius but not naive
• inherently bad

The third stereotype is a cross between the first and the second.

• a naive, unrecognized genius
• used by others for their own ends, may it be for the good or destruction of status quo
  

Psych Teory

"Psychological theories of crime postulate that because a hacker sub-culture or sub-class exists, and the activity is being reinforced (i.e. media attention, high paying jobs, movies), criminal hacking will not disappear on its own but will continue to flourish if left unchecked (Gattiker & Kelly, 1997) "

Reinforcement is at the heart of Psychology's Social Learning Theory which has evolved as an important tool in understanding traditional criminal behavior. Both psychology and criminology have played a major role in the development of social learning theory.

Social Learning Theory

• behavior could be learned at the cognitive level through observing
  other people's actions
• people are capable of imagining themselves in similar situations of
  incurring the same outcomes
• learned behavior may be reinforced or punished

  3 aspects of Motivations

  • external reinforcement
  • vicarious reinforcement
  • self reinforcement

Differential Asso.

Differential association

• criminal behavior was learned through a process of interactions with others. The interactions usually occured in primary groups where person is presented both criminal and anti-criminal patterns of behavior, techniques, motivations and definitions favorable or unfavorable toward crime.
  
  
• imbalance between favorable and unfavorable definitions toward crime, with more weight on the favorable, would result in criminal behavior being exhibited (Burgess & Akers, 1966; Sutherland, 1947).

Four dimensions: frequency, duration, priority and intensity

Differential Reinforcement

• criminal behavior continues or is directly maintained by the consequences of the act
  
  
• that there will be a high probability of a criminal act occurring in an environment where the individual in the past has been reinforced in behaving in such a manner, and the negative consequences of
  the behavior has been minor (Akers et. al, 1979; Hollin, 1989)
  
  
• since behavior is subject to differing schedules of reinforcement and punishment, it becomes complex and hard to extinguish
  

Definitions

Definitions

• orientations, rationalizations, definitions of the situation and other attitudes that label the commission of an act as right or wrong, good or bad, desirable or undesirable, justified or unjustified
  
  likelihood of engaging in specific acts is a function of the attitudes that the individual holds about the act. (Akers, 1998)
  
  Positive definition

  • occur less frequently than neutralizing definitions
  • based on beliefs or attitudes that make the behavior desirable or "wholly permissible" (e.g. political rhetorics)
    
    

  Neutralizing definitions

  • do not make acts desirable but gives an excuse or attempts to justify the act making it reasonable to commit the act
    (e.g. killing in the line of duty, or self -defense)

  • learning of criminal behavior involves learning of techniques to commit the crimes, learning of motives, drives and rationalizations, and attitudes.

Imitation

• commiting behavior modeled on, and following the observation of similar behavior in others (Akers, 1998)
• actual imitation of modeled behavior reinforced vicariously
• important on the initial phases when acquiring behavior
• less important when maintaining and ending established behavioral patterns
• reinforcement agents: media, face-to-face, primary group interaction
  

Moral disengagement

• people tend to refrain from engaging in behavior that violates their own moral standards (Bandura, 1990a)
• moral standards play the role of regulating our behaviors

An individual can disengage self-sanctions by:

1) re-construing the conduct

-reprehensible conduct can be masked by euphemistic language
-sometimes language can make a conduct seem respectable
-by comparing the act to other more injurious behavior

2) obscuring personal causal agency

- displacing responsibility e.g. social pressure.."devil made me do it"

3) misrepresenting or disregarding the negative consequences of the action

- distord the detrimental consequences of the actions reduces feeling of guilt

4) vilifying the victims, and maltreating them by blaming and devaluing them

-by dehuminizing or blaming the victims, perpetrators become construed as defensive. (Bandura et. al, 1996)

Differential Asso. & Reinforcement

Differential association-reinforcement

• behavior was shaped and that reinforcement (negative and positive) and punishment determined the likelihood that the behavior, once exhibited, would continue (Burgess & Akers, 1966).
  

  Negative reinforcement: being ostracized by one's friends or group
  Positive reinforcement: acceptance by the group or elevation in status
  Punishment: being caught and incarcerated or fined

How the process works:
1. Differential association provides social environment, provides exposure to definitions and imitation of models
2. Definitions are learned through imitation and observational learning
3. Learned behavior is reinforced both internally and externally;
*form of reinforcement:
1) tangible (e.g. money)
2) social rewards (e.g. increase in peer status)

Overtime, imitation becomes less important and reinforcement or consequences of the actions determine the probability that the activity will continue (Akers, 1977; Akers et. al., 1979)

Hacker Findings

Skinner and Fream(1997)
Ability of social learning to explain etiology of computer crime:

• differentially associating with friends was the strongest predictor of the computer crime index
• age, education or marital status was not significantly different among general criminals and computer criminals
• general criminals received significantly longer sentences and more severe punishments than computer criminals in Canada
• 60% of all participants admitted to engaging in computer activities - prevalence may be due in part to the unique morality
  surrounding this type of criminal activity (e.g. ethical boundaries of technology)
• as perceived severity of the criminal activity increased, the frequency of these activities decreased.
• most frequent activity- software piracy and password guessing -considered harmless
• obtaining or possessing credit card numbers -least frequent
• observed severity trend may be influenced by moral disengagement
• computer criminal activity is more common among youths and young adult
• operating system preference: Windows/NT with majority considering themselves experts with computers,
• however, system preference and level of expertise are not significant factors
• individuals who self-report computer criminal behavior had significantly higher rates of differential association and differential reinforcement than participants who had never engaged in criminal activity.
• Studies have indicated that individuals involved in criminal computer behavior associate with other computer criminals through internet chat channels or news groups, sometimes physically through conventions and conferences
• mentoring is common in the hacking community
• individuals who self reported computer criminal behavior had significantly higher rates of moral disengagements than non-criminal participants
• individuals who had engaged in criminal computer activity would have a higher level of differential association and differential reinforcement than the individuals who had no criminal activity
• individuals who had engaged in criminal computer activity would have a higher rates of moral disengagement that
  individuals who had no criminal activity
• only differential association and moral disengagement were significant for predicting who engaged in criminal
  computer activity
• differential association was positively correlated with illegal computer acts and was strongest predictor of computer crime

"The more the individual defines the behavior as positive of justified, and associates with individuals holding
similar views, the higher the probability that he or she will engage in the behavior".

Criminal computer behavior may in fact be more dependent of differential association than general criminal behavior
not just for the social environment to shape their belief system, but also for the required technical acumen to
engage in the behavior.

Summary
Criminal computer behavior is influenced by differential association, differential reinforcement and moral disengagement.

A predictive model for criminal computer behavior should include moral disengagement and differential association.

References

References:

1 Van Beveren, John "A Conceptual Model of Hacker Development and Motivations" Journal of E.Business, Vol. 1, Issue 2, December 2001.
http://www.ecob.iup.edu/jeb/December2001-issue/Beveren%20article2.pdf.

2. Rogers, Marc "A New Hacker Taxonomy", Graduate Studies Department of Psychology, University of Manitoba. http://www.victoriapoint.com/hackertaxonomy.htm

3. Rogers, Marc "A Social Learning Theory and Moral Disengagement Analysis of Criminal Computer Behavior: An exploratory Study" a thesis submitted to the Faculty of Graduate Studies in partial fulfillment of requirements for a Doctorate in Philosophy at the University of Manitoba, Canada. http://www.mts.net/~mkr/

4. The Hacker Psychology (The Learning Channel)
http://tlc.discovery.com/convergence/hackers/articles/psych.html

5. The Psychology of Hacking
http://www.dvara.net/HK/webpresence.asp