Brendan I. Koerner

Biafra’s star turn at H2K was a bombastic symbol of the computer underground’s growing zeal for political agitation — whether it be greeting would-be visitors to a hijacked Nike.com with “Global Justice is coming — prepare now!” while redirecting them to an Australian labor rights site, or disabling the Chinese government’s censorware. Already adroit at rallying around their persecuted peers, many hackers are now awakening to the world beyond Internet Relay Chat. Ideological kin to the coalition of anarchists, Teamsters and Earth Firsters who spearhead the anti-globalization movement, these self-styled “hacktivists” dream of furthering social justice while comfortably ensconced behind their Linux workstations.

Just last weekend — as about 100 hackers gathered for a “Cyber Civil Disobedience” discussion at H2K — a group calling itself “Gforce Pakistan” defaced 11 pages belonging to the National Oceanic Atmospheric Administration. The usual weather-related pabulum was replaced with pleas for Kashmiri independence. “When the people of Kashmir want to be independent, why not let them?” the protesters wrote. “US, take some steps.”

But even as the ranks of techno-pranksters on political missions swell, a number of veteran hackers categorize such “protests” as sloppy and counter-productive. “Ninety-five percent of it is bullshit,” says Andy Mueller-Maguhn, an associate of Germany’s Chaos Computer Club. “[The message] will be there for about five minutes. Then we’ve got a police investigation. Then we’ve got that Kevin Mitnick shit.” In other words, more ammunition for anti-hacker hysterics to demand get-tough measures, with little to show for the sacrifice.

Critics of the strategy also question whether the defacers are truly committed to fighting the good fight, or are more interested in showing off their technical chops. “A lot of these kids, they’re like, ‘Cool, I just hacked a Web page and got my little political message up,’” says “Izaac,” a cohost of “Off the Hook,” a weekly radio show produced by 2600, the hacker quarterly. “Then you ask them what their message is, and they’re like, ‘Huh?’” The majority of Web page vandals, he points out, prefer to get their messages across with bawdy “yo’ momma” jokes rather than well-argued dissertations on Nike’s labor policies.

The truth is that while the hacktivist slogan, “The revolution will be digitized!” is certainly catchy, most techno-protestors have yet to prove themselves anything more than pests. Disorganized and occasionally reckless, many are content to deface Web pages with “Break the Bank!” graffiti; they are not engaging in powerful acts that might set the mandarins of globalization aquake in their boots. And right now, with the underground so fractured, and the hacktivist agenda so hazily defined, it’s hard to imagine these techno-activists having any appreciable impact on global politics.

Though the word was recently coined, hacktivism can trace its roots to the prankster counterculture of the 1960s. The hacker ethos originated in the “Steal This Book!” culture-jamming hijinks of the radical Youth International Party and Abbie Hoffman, who pulled proto-hacking stunts by crafting payphone slugs. And the early “phreakers,” who used their technical acumen to pilfer phone service, espoused the same anti-corporate beliefs as the pepper-sprayed protesters of Seattle.

Greg Newby, a professor of information science at the University of North Carolina, argues that many hacktivists also have a bred-in-the-bone inclination toward social justice. Filled with folks who wear the “misfit” label with not-so-subtle pride, the underground is a come-as-you-are club. “Hackers have always been blind to things like color and race and accent,” he says. “There might be some prejudice against people who don’t type fast, or have a slow connection, but we’re blind to what is very important to the other people in the world.”

Yet the bulk of hacker activism has been narrowly focused on pet causes. The “Free Kevin” movement, for example, which prevented über-hacker Kevin Mitnick from forever vanishing into the bowels of the federal penal system, was the community’s political high-water mark. The latest geek-chic cause is Eric Corley, aka Emmanuel Goldstein, editor of 2600, who is being sued by eight movie studios for posting the source code to software that defeats DVD encryption.

At H2K, attendees showed their support for Corley/Goldstein by slapping “Coding is not a crime” bumper stickers on doorknobs and distributing leaflets publicizing a pro-2600 rally at Manhattan’s federal courthouse. Sustaining that kind of enthusiasm for less “in your face” issues is tricky. It’s far easier to rally support for an incarcerated colleague than for anonymous sweatshop laborers in Kuala Lumpur, particularly when so many members of the target audience are high schoolers who’ve yet to develop multitrack minds; if the rhetoric doesn’t involve port scans, VBS scripts or Echelon, their eyes might glaze over.

“The problem with the hacker community … is that it takes a hacker-related issue to get them out on the streets, like the Kevin Mitnick thing,” says Reid Fleming of the Cult of the Dead Cow (cDc), the planet’s most famous hacker collective.

Complicating matters is the culture’s anarchic nature, which eschews centralized authority. There is no hacker brain trust, no fiery leader to organize the rank-and-file into a disciplined hacktivist cadre. Contrary to media portrayals, the underground is dizzyingly diverse, to the point of Balkanization. Old-schoolers who cut their teeth writing BASIC programs on Commodore 64s despise most newcomers as scenesters living out “Matrix” fantasies, wannabes lacking the smarts to push technology forward.

Surveying the scene at H2K, veterans grimaced at the teens who loudly boasted of how many servers they “owned.” “Out of all the kids here, the hundreds of kids, there’s probably two or three that will turn into real hackers,” grumbled “Izaac.” A lot of the youngsters, meanwhile, dismiss the old-timers as … well, old-timers, unhip and crotchety to the extreme.

To foster harmony among the culture’s squabbling factions, and hopefully pave the way for hacktivist organization, Newby is supervising the creation of a “Hacker’s Code.” The code, in part inspired by the Hippocratic Oath and Isaac Asimov’s Laws of Robotics, features such statements as “Hackers share and are willing to teach their knowledge” and “Hackers often disagree with authority” — hard-to-argue generalities designed to forge common ground between young and old, greenhorn and expert.

“If computers are the key to the future, then hackers control the key,” says Newby, who has been programming for nearly two decades. “So we’re potentially a great force for making change. But we’re not going to do well if we can’t get a little organized.”

Goldstein is similarly intent on awakening hackers to the need for unity. As principal organizer of H2K, he designed the convention to resemble a campus political meeting rather than a hobbyist powwow. In addition to the requisite workshops on open-source security and shortwave radio, H2Kers were encouraged to attend such politically tinged panel discussions as “Secrets of the DNC/RNC,” (Democratic National Convention and Republican National Convention) at which a street-level activist named “ShapeShifter” offered lessons on how to chain oneself to a bus axle. Step 1: invest in a Kryptonite bicycle lock.

This was almost certainly the first-ever hacker conference to feature an Ivy League researcher lecturing on the teachings of Henry David Thoreau — about as low tech a figure as American history can offer. In the “Cyber Civil Disobedience” discussion, Dan Orr, from the Annenburg School at the University of Pennsylvania, argued that the roots of hacktivism run back through history, to Martin Luther King Jr. and Ghandi, and to Walden Pond, where Thoreau coined the term civil disobedience.

“That’s what I wanted the focus to be on, on kids applying themselves to realizing there’s a world beyond their computers,” says Corley. The kids seemed intrigued by the philosophical chatter, but one vital question went unanswered at H2K: What, exactly, should hacktivists be doing?

A vanguard of older, more professional hacktivists have pulled off some high-visibility stunts, which would argue for more high-profile Web site monkey-wrenching. The trailblazer is the Electronic Disturbance Theater (EDT), a pro-Zapatista group that took to cyberspace in 1994 when, according to co-founder Ricardo Dominguez, they “realized the streets were dead.” The EDT became famous in 1998, when it organized a well-publicized “virtual sit-in” on the Web site of then-President Ernesto Zedillo. Flooded with access requests from over 18,000 protesters, the site buckled and crashed. EDT’s success has inspired similar efforts by the likes of Great Britain’s electrohippies, the group responsible for disabling the WTO’s Web site last December.

But the Cult of the Dead Cow, another hacktivism pioneer, decries such actions as egregious violations of free speech. After the electrohippies’ WTO virtual sit-in, cDc member “Oxblood Ruffin” published an impassioned critique of such attacks. “No rationale, even in the service of the highest ideals, makes them anything other than what they are — illegal, unethical, and uncivil,” he wrote. “One does not make a better point in a public forum by shouting down one’s opponent.”

At cDc’s riotous H2K presentation — a crowd-pleasing mixture of lip-synced rapping and tasteless riffs on anal eroticism — Oxblood announced a fall launch date for a project to be called “Hacktivismo.” The specifics are still secret, but the group will reportedly write applications to defeat government content filters in totalitarian countries. Two hacker superstars have already signed up for Hacktivismo: “Bronc Buster,” notorious for removing content filters from Chinese ISPs, and “Mixter,” a German programmer known for coding a denial-of-service tool called Tribal Flood Network.

But until the nascent hacktivists — from the kiddie lone wolfs to the skilled crews — can unite behind a coherent game plan, they’ll have little shot at effectively heeding Biafra’s anti-globalization, anti-corporate, anti-authoritarian refrain. Though they still have yet to walk the walk, hackers are, at the very least, learning the radical shtick. At one H2K panel, when ShapeShifter announced, “If we got rid of things like capitalism, the Internet would be great!” there was a moment’s silence. Then a wave of nervous laughter. And, finally, thunderous applause and a peal of “right ons!”

Bruce Schneier, master cryptographer and idol of the computer underground, targets those short-attention-spanners in his latest book, “Secrets and Lies: Digital Security in a Networked World.” Aiming straight for the vaunted “general audience,” he peppers the 400-plus pages with Yogi Berra quotes, analogies drawn from “Star Wars” and trivia tidbits from Greek mythology. But the folksy wit doesn’t obscure a core message as frighteningly entertaining as Dr. Lecter’s flesh-eating antics: In cyberspace, you’re dead meat on a stick.

“Computer insecurity is inevitable,” he warns. “Networks will be hacked. Fraud will be committed. Money will be lost. People will die.” Indeed, the bulk of “Secrets and Lies” is a harrowing rundown of the myriad pitfalls that plague even the simplest systems. And that nifty new security software your company just bought for a jillion dollars isn’t going to help — if some teenage miscreant really, really wants to deface your Web page with Limp Bizkit lyrics, he’s going to get his way.

As Schneier sees it, the wired universe is plagued with hard-to-fix vulnerabilities. One notable example is buffer overflow bugs, which permit attackers to overwrite memories with their own instructions. Even the planet’s smartest, most diligent coder would be hard-pressed to completely cleanse a program of such holes. “With any piece of modern, large, complex code, there are just too many places where buffer overflows are possible,” Schneier laments. “The larger and more complex the code, the more likely the attack.” As a result, buffer overflows were the most popular attack of the 1990s, the tactic of choice for lightly skilled “script kiddies” bent on easy-to-execute mischief.

“Secrets and Lies” is a mea culpa of sorts. Schneier’s best-known book, “Applied Cryptography,” a geek bible of the ’90s, trumpeted strong encryption as the key to perfect online security — “a mathematical utopia.” Better cryptography, the book claimed, would spell the end of hackable networks and protect even the measliest Hotmail communiquis. “It is insufficient to protect ourselves with laws,” he wrote in that book’s second edition. “We must protect ourselves with mathematics.”

Schneier looks back on his optimistic pronouncements with more than a hint of embarrassment. “I talked about cryptography as if it were The Answer,” he confesses in the preface to “Secrets and Lies.” “I was pretty naive … Readers believed that cryptography was a kind of magic security dust that they could sprinkle over their software and make it secure.”

Stupid idea, Schneier now admits. Computer networks, he has come to believe, are so dauntingly complex that loopholes will always remain. Just as brush clearance teams will never rid the world of wildfires — how could they possibly find every last dried twig? — security professionals can’t head off every attack, no matter how pricey their toys. World-class cryptography is pretty useless, Schneier notes, if the administrator’s password is set to “password.”

Blame human beings, error-prone by definition. Though programmers are often regarded as akin to sorcerers, they are as bungling as any non-gearhead. There are an average of five to 15 bugs in every thousand lines of code, which means that Windows 98 is riddled with somewhere between 90,000 and 270,000 oopsies. Since software vendors cannot be held liable for faulty code, thanks to those licenses they make users agree to, they have zero incentive to create better products — much to the delight of computer criminals, who revel in exploiting bug-ridden programs.

The truly savvy cracker needn’t bother with sophisticated tools if he can trick a corporate lackey into revealing network secrets, a tact known as “social engineering.” By posing as a help-desk employee and sending out forged e-mails, for example, a brazen attacker can cull dozens of passwords in a matter of minutes. People are basically pretty helpful, and they’ll rarely think twice about cheerfully responding to a well-written request.

People are also woefully lazy. Most users instinctively click the “OK” boxes on their PC screens, seemingly indifferent to security hazards. That’s how the love bug made the rounds, causing an estimated $10 billion worth of damage. “If J. Random Websurfer clicks on a button that promises dancing pigs on his computer monitor, and instead gets a hortatory message describing the potential dangers of the applet,” Schneier writes, “he’s going to choose the dancing pigs over computer security any day.”

Humans can be excused for their foibles. The book’s real spleen is reserved for the various snake oils that are passed off as anti-hacker panaceas. Schneier ably debunks the magic-bullet claims of every class of product. Firewalls? Too easy to fool with forged requests for access. Intrusion detection systems? Too many false alarms. Digital watermarks? Taiwanese software pirates will simply figure out how to delete them. Biometrics? Please — a clever attacker need only steal a digital file containing thumbprint data, and they’ve got instant access to the nation’s goriest secrets.

The outlook offered by “Secrets and Lies” is so grim that readers might be inclined to join an abacus-using Luddite clan in Micronesia, far from anything as elementary as an ATM or Ms. Pac-Man machine. Schneier sympathizes; he admits that depression forced him to cease working on the manuscript for over a year. “I got two-thirds of the way through the book without giving the reader any hope at all,” he writes. “It was about then I realized that I didn’t have the hope to give.”

Fortunately for the reader’s mental health, “Secrets and Lies” does contain a few strains of optimism. Given the inevitability of attacks, “prevention” can no longer be the security buzzword. Just as even the finest hockey goalies must regularly suffer the humiliation of allowing a goal, companies must learn to live with penetrations. Prepare for the worst, Schneier urges. Make sure networks are designed to “fail safe.” Have a recovery plan in place. Track down attackers by collecting and analyzing forensic data. Assess the risks and purchase some insurance.

The solutions are a nice, moderately upbeat touch, but the horror stories are the real draw — “Secrets and Lies” is more thriller than primer. Schneier crafts scary tales that deftly avoid a Chicken Little tone. No, the Internet will not be felled by malicious kiddies and laptop-toting members of Osama bin Laden’s crew. But there are some bad seeds prowling the world’s systems, and they’ve got the upper hand. It’s almost enough to convince you to stop choosing the dancing pigs.