Permanent Record (6 page)

For all of this cooperative, collectivist free-culture ethos, I’m not going to pretend that the competition wasn’t merciless, or that the population—almost uniformly male, heterosexual, and hormonally charged—didn’t occasionally erupt into cruel and petty squabbles. But in the absence of real names, the people who claimed to hate you weren’t real people. They didn’t know anything about you beyond what you argued, and how you argued it. If, or rather when, one of your arguments incurred some online wrath, you could simply drop that screen name and assume another mask, under the cover of which you could even join in the mimetic pile-on, beating up on your disowned avatar as if it were a stranger. I can’t tell you what sweet relief that sometimes was.

In the 1990s, the Internet had yet to fall victim to the greatest iniquity in digital history: the move by both government and businesses to link, as intimately as possible, users’ online personas to
their offline legal identity. Kids used to be able to go online and say the dumbest things one day without having to be held accountable for them the next. This might not strike you as the healthiest environment in which to grow up, and yet it is precisely the only environment in which you
can
grow up—by which I mean that the early Internet’s dissociative opportunities actually encouraged me and those of my generation to change our most deeply held opinions, instead of just digging in and defending them when challenged. This ability to reinvent ourselves meant that we never had to close our minds by picking sides, or close ranks out of fear of doing irreparable harm to our reputations. Mistakes that were swiftly punished but swiftly rectified allowed both the community and the “offender” to move on. To me, and to many, this felt like freedom.

Imagine, if you will, that you could wake up every morning and pick a new name and a new face by which to be known to the world. Imagine that you could choose a new voice and new words to speak in it, as if the “Internet button” were actually a reset button for your life. In the new millennium, Internet technology would be turned to very different ends: enforcing fidelity to memory, identarian consistency, and so ideological conformity. But back then, for a while at least, it protected us by forgetting our transgressions and forgiving our sins.

My most significant early encounters with online self-presentation happened not on BBSes, however, but in a more fantastical realm: the pseudo-feudal lands and dungeons of role-playing games, MMORPGs (massively multiplayer online role-playing games) in particular. In order to play
Ultima Online
, which was my favorite MMORPG, I had to create and assume an alternative identity, or “alt.” I could choose, for example, to be a wizard or warrior, a tinkerer or thief, and I could toggle between these alts with a freedom that was unavailable to me in off-line life, whose institutions tend to regard all mutability as suspicious.

I’d roam the
Ultima
gamescape as one of my alts, interacting with the alts of others. As I got to know these other alts, by col
laborating with them on certain quests, I’d sometimes come to realize that I’d met their users before, just under different identities, while they, in turn, might realize the same about me. They’d read my messages and figure out, through a characteristic phrase I’d used, or a particular quest that I’d suggest, that I—who was currently, say, a knight who called herself Shrike—was also, or had also been, a bard who called himself Corwin, and a smith who called himself Belgarion. Sometimes I just enjoyed these interactions as opportunities for banter, but more often than not I treated them competitively, measuring my success by whether I was able to identify more of another user’s alts than they were able to identify of mine. These contests to determine whether I could unmask others without being unmasked myself required me to be careful not to fall into any messaging patterns that might expose me, while simultaneously engaging others and remaining alert to the ways in which they might inadvertently reveal their true identities.

While the alts of
Ultima
were multifarious in name, they were essentially stabilized by the nature of their roles, which were well defined, even archetypal, and so enmeshed within the game’s established social order as to make playing them sometimes feel like discharging a civic duty. After a day at school or at a job that might seem purposeless and unrewarding, it could feel as if you were performing a useful service by spending the evening as a healer or shepherd, a helpful alchemist or mage. The relative stability of the
Ultima
universe—its continued development according to defined laws and codes of conduct—ensured that each alt had their role-specific tasks, and would be judged according to their ability, or willingness, to complete them and fulfill the societal expectations of their function.

I loved these games and the alternative lives they let me live, though love wasn’t quite as liberating for the other members of my family. Games, especially of the massively multiplayer variety, are notoriously time-consuming, and I was spending so many hours playing
Ultima
that our phone bills were becoming exorbitant and no calls were getting through. The line was always busy.
My sister, now deep into her teen years, became furious when she found out that my online life had caused her to miss some crucial high-school gossip. However, it didn’t take her long to figure out that all she had to do to get her revenge was pick up the phone, which would break the Internet connection. The modem’s hiss would stop, and before she’d even received a normal dial tone, I’d be screaming my head off downstairs.

If you’re interrupted in the middle of, say, reading the news online, you can always go back and pick up wherever you left off. But if you’re interrupted while playing a game that you can’t pause or save—because a hundred thousand others are playing it at the same time—you’re ruined. You could be on top of the world, some legendary dragon-slayer with your own castle and an army, but after just thirty seconds of
CONNECTION LOST
you’d find yourself reconnecting to a bone-gray screen that bore a cruel epitaph:
YOU ARE DEAD
.

I’m a bit embarrassed nowadays at how seriously I took all of this, but I can’t avoid the fact that I felt, at the time, as if my sister was intent on destroying my life—particularly on those occasions when she’d make sure to catch my eye from across the room and smile before picking up the downstairs receiver, not because she wanted to make a phone call but purely because she wanted to remind me who was boss. Our parents got so fed up with our shouting matches that they did something uncharacteristically indulgent. They switched our Internet billing plan from pay-by-the-minute to flat-fee unlimited access, and installed a second phone line.

Peace smiled upon our abode.

All teenagers are hackers. They have to be, if only because their life circumstances are untenable. They think they’re adults, but the adults think they’re kids.

Remember, if you can, your own teen years. You were a hacker, too, willing to do anything to evade parental supervision. Basically, you were fed up with being treated like a child.

Recall how it felt when anyone older and bigger than you sought to control you, as if age and size were identical with authority. At one time or another, your parents, teachers, coaches, scoutmasters, and clergy would all take advantage of their position to invade your private life, impose their expectations on your future, and enforce your conformity to past standards. Whenever these adults substituted their hopes, dreams, and desires for your own, they were doing so, by their account, “for your own good” or “with your best interests at heart.” And while sometimes this was true, we all remember those other times when it wasn’t—when “because I said so” wasn’t enough and “you’ll thank me one day” rang hollow. If you’ve ever been an adolescent, you’ve surely
been on the receiving end of one of these clichés, and so on the losing end of an imbalance of power.

To grow up is to realize the extent to which your existence has been governed by systems of rules, vague guidelines, and increasingly unsupportable norms that have been imposed on you without your consent and are subject to change at a moment’s notice. There were even some rules that you’d only find out about after you’d violated them.

If you were anything like me, you were scandalized.

If you were anything like me, you were nearsighted, scrawny, and, age-wise, barely entering the double digits when you first started to wonder about politics.

In school, you were told that in the system of American politics, citizens give consent through the franchise to be governed by their equals. This is democracy. But democracy certainly wasn’t in place in my US history class, where, if my classmates and I had the vote, Mr. Martin would have been out of a job. Instead, Mr. Martin made the rules for US history, Ms. Evans made the rules for English, Mr. Sweeney made the rules for science, Mr. Stockton made the rules for math, and all of those teachers constantly changed those rules to benefit themselves and maximize their power. If a teacher didn’t want you to go to the bathroom, you’d better hold it in. If a teacher promised a field trip to the Smithsonian Institution but then canceled it for an imaginary infraction, they’d offer no explanation beyond citing their broad authority and the maintenance of proper order. Even back then, I realized that any opposition to this system would be difficult, not least because getting its rules changed to serve the interests of the majority would involve persuading the rule makers to put themselves at a purposeful disadvantage. That, ultimately, is the critical flaw or design defect intentionally integrated into every system, in both politics and computing: the people who create the rules have no incentive to act against themselves.

What convinced me that school, at least, was an illegitimate system was that it wouldn’t recognize any legitimate dissent. I
could plead my case until I lost my voice, or I could just accept the fact that I’d never had a voice to begin with.

However, the benevolent tyranny of school, like all tyrannies, has a limited shelf life. At a certain point, the denial of agency becomes a license to resist, though it’s characteristic of adolescence to confuse resistance with escapism or even violence. The most common outlets for a rebellious teen were useless to me, because I was too cool for vandalism and not cool enough for drugs. (To this day, I’ve never even gotten drunk on liquor or smoked a cigarette.) Instead, I started hacking—which remains the sanest, healthiest, and most educational way I know for kids to assert autonomy and address adults on equal terms.

Like most of my classmates, I didn’t like the rules but was afraid of breaking them. I knew how the system worked: you corrected a teacher’s mistake, you got a warning; you confronted the teacher when they didn’t admit the mistake, you got detention; someone cheated off your exam, and though you didn’t expressly let them cheat, you got detention and the cheater got suspended. This is the origin of all hacking: the awareness of a systemic linkage between input and output, between cause and effect. Because hacking isn’t just native to computing—it exists wherever rules do. To hack a system requires getting to know its rules better than the people who created it or are running it, and exploiting all the vulnerable distance between how those people had intended the system to work and how it actually works, or could be made to work. In capitalizing on these unintentional uses, hackers aren’t breaking the rules as much as debunking them.

Humans are hardwired to recognize patterns. All the choices we make are informed by a cache of assumptions, both empirical and logical, unconsciously derived and consciously developed. We use these assumptions to assess the potential consequences of each choice, and we describe the ability to do all of this, quickly and accurately, as intelligence. But even the smartest among us rely on assumptions that we’ve never put to the test—and because we do, the choices we make are often flawed. Anyone who knows better,
or thinks more quickly and more accurately than we do, can take advantage of those flaws to create consequences that we never expected. It’s this egalitarian nature of hacking—which doesn’t care who you are, just how you reason—that makes it such a reliable method of dealing with the type of authority figures so convinced of their system’s righteousness that it never occurred to them to test it.

I didn’t learn any of this at school, of course. I learned it online. The Internet gave me the chance to pursue all the topics I was interested in, and all the links between them, unconstrained by the pace of my classmates and my teachers. The more time I spent online, however, the more my schoolwork felt extracurricular.

The summer I turned thirteen, I resolved never to return, or at least to seriously reduce my classroom commitments. I wasn’t quite sure how I’d swing that, though. All the plans I came up with were likely to backfire. If I was caught skipping class, my parents would revoke my computer privileges; if I decided to drop out, they’d bury my body deep in the woods and tell the neighbors I’d run away. I had to come up with a hack—and then, on the first day of the new school year, I found one. Indeed, it was basically handed to me.

At the start of each class, the teachers passed out their syllabi, detailing the material to be covered, the required reading, and the schedule of tests and quizzes and assignments. Along with these, they gave us their grading policies, which were essentially explanations of how As, Bs, Cs, and Ds were calculated. I’d never encountered information like this. Their numbers and letters were like a strange equation that suggested a solution to my problem.

After school that day, I sat down with the syllabi and did the math to figure out which aspects of each class I could simply ignore and still expect to receive a passing grade. Take my US history class, for example. According to the syllabus, quizzes were worth 25 percent, tests were worth 35 percent, term papers were worth 15 percent, homework was worth 15 percent, and class participation—that most subjective of categories, in every subject—was
worth 10 percent. Because I usually did well on my quizzes and tests without having to do too much studying, I could count on them for a reliable pool of time-efficient points. Term papers and homework, however, were the major time-sucks: low-value, high-cost impositions on Me Time.

What all of those numbers told me was that if I didn’t do any homework but aced everything else, I’d wind up with a cumulative grade of 85, a B. If I didn’t do any homework or write any term papers but aced everything else, I’d wind up with a cumulative grade of 70, a C-minus. The 10 percent that was class participation would be my buffer. Even if the teacher gave me a zero in that—if they interpreted my participation as disruption—I could still manage a 65, a D-minus. I’d still pass.

My teachers’ systems were terminally flawed. Their instructions for how to achieve the highest grade could be used as instructions for how to achieve the highest freedom—a key to how to avoid doing what I didn’t like to do and still slide by.

The moment I figured that out, I stopped doing homework completely. Every day was bliss, the kind of bliss forbidden to anybody old enough to work and pay taxes, until Mr. Stockton asked me in front of the entire class why I hadn’t handed in the past half-dozen or so homework assignments. Untouched as I was by the guile of age—and forgetting for a moment that by giving away my hack, I was depriving myself of an advantage—I cheerfully offered my equation to the math teacher. My classmates’ laughter lasted just a moment before they set about scribbling, calculating whether they, too, could afford to adopt a post-homework life.

“Pretty clever, Eddie,” Mr. Stockton said, moving on to the next lesson with a smile.

I was the smartest kid in school—until about twenty-four hours later, when Mr. Stockton passed out the new syllabus. This stated that any student who failed to turn in more than six homeworks by the end of the semester would get an automatic F.

Pretty clever, Mr. Stockton.

Then, he took me aside after class and said, “You should be
using that brain of yours not to figure out how to avoid work, but how to do the best work you can. You have so much potential, Ed. But I don’t think you realize that the grades you get here will follow you for the rest of your life. You have to start thinking about your permanent record.”

U
NSHACKLED FROM HOMEWORK
, at least for a while, and so with more time to spare, I also did some more conventional—computer-based—hacking. As I did, my abilities improved. At the bookstore, I’d page through tiny, blurrily photocopied, stapled-together hacker zines with names like
2600
and
Phrack
, absorbing their techniques, and in the process absorbing their antiauthoritarian politics.

I was at the bottom of the technical totem pole, a script kiddie n00b working with tools I didn’t understand that functioned according to principles that were beyond me. People still ask me why, when I finally did gain some proficiency, I didn’t race out to empty bank accounts or steal credit card numbers. The honest answer is that I was too young and dumb to even know that this was an option, let alone to know what I’d do with the stolen loot. All I wanted, all I needed, I already had for free. Instead, I figured out simple ways to hack some games, giving myself extra lives and letting me do things like see through walls. Also, there wasn’t a lot of money on the Internet back then, at least not by today’s standards. The closest that anyone I knew or anything I read ever came to theft was “phreaking,” or making free phone calls.

If you asked some of the big-shot hackers of the day why, for example, they’d hacked into a major news site only to do nothing more meaningful than replace the headlines with a trippy GIF proclaiming the skills of Baron von Hackerface that would be taken down in less than half an hour, the reply would’ve been a version of the answer given by the mountaineer who was asked his reason for climbing Mount Everest: “Because it’s there.” Most hackers, particularly young ones, set out to search not for lucre or power,
but for the limits of their talent and any opportunity to prove the impossible possible.

I was young, and while my curiosity was pure, it was also, in retrospect, pretty psychologically revealing, in that some of my earliest hacking attempts were directed toward allaying my neuroses. The more I came to know about the fragility of computer security, the more I worried over the consequences of trusting the wrong machine. As a teenager, my first hack that ever courted trouble dealt with a fear that suddenly became all I could think about: the threat of a full-on, scorched-earth nuclear holocaust.

I’d been reading some article about the history of the American nuclear program, and before I knew it, with just a couple of clicks, I was at the website of the Los Alamos National Laboratory, the country’s nuclear research facility. That’s just the way the Internet works: you get curious, and your fingers do the thinking for you. But suddenly I was legitimately freaked out: the website of America’s largest and most significant scientific research and weapons development institution, I noticed, had a glaring security hole. Its vulnerability was basically the virtual version of an unlocked door: an open directory structure.

I’ll explain. Imagine I sent you a link to download a .pdf file that’s kept on its own page of a multipage website. The URL for this file would typically be something like website.com/files/pdfs/filename.pdf. Now, as the structure of a URL derives directly from directory structure, each part of this URL represents a distinct “branch” of the directory “tree.” In this instance, within the directory of website.com is a folder of files, within which is a subfolder of pdfs, within which is the specific filename.pdf that you’re seeking to download. Today, most websites will confine your visit to that specific file, keeping their directory structures closed and private. But back in those dinosaur days, even major websites were created and run by folks who were new to the technology, and they often left their directory structures wide open, which meant that if you truncated your file’s URL—if you simply changed it to something like website.com/files—you’d be able to access every
file on the site, pdf or otherwise, including those that weren’t necessarily meant for visitors. This was the case with the Los Alamos site.

In the hacking community, this is basically Baby’s First Hack—a totally rudimentary traversal procedure known as “dirwalking,” or “directory walking.” And that’s just what I did: I walked as fast as I could from file to subfolder to upper-level folder and back again, a teen let loose through the parent directories. Within a half hour of reading an article about the threat of nuclear weapons, I’d stumbled upon a trove of files meant only for the lab’s security-cleared workers.

To be sure, the documents I accessed weren’t exactly the classified plans for building a nuclear device in my garage. (And, anyway, it’s not as if those plans weren’t already available on about a dozen DIY websites.) Instead, what I got was more along the lines of confidential interoffice memoranda and other personal employee information. Still, as someone suddenly acutely worried about mushroom clouds on the horizon, and also—especially—as the child of military parents, I did what I figured I was supposed to: I told an adult. I sent an explanatory email to the laboratory’s webmaster about the vulnerability, and waited for a response that never came.