In the past it's not been my practice to read the business section of the newspaper but lately I've been paying more attention to it. Sunday, the Philadelphia Inquirer's business section featured an article I just couldn't resist: Hacker Camp: Computer programmers get to play attacker in order to learn how to do security better.
Early in the article we learn that all the "campers" are men. This is discouraging. I don't know how attendees were recruited or selected but I'm guessing there wasn't a lot of outreach to women. This is the part of the article that really woke me up, however:
The campers adopt a vaguely disturbing semisexual lingo.
There's "violation" and "penetration." When these guys form buddy teams, one "has to volunteer to take it first," Evans, the counselor, said - meaning one is the hacker, the other the cracker.
It brought to mind Carol Cohn's classic essay, "Sex and Death in the Rational World of Defense Intellectuals". (in Signs vol. 12, no. 4, Within and Without: Women, Gender, and Theory, [Summer, 1987], pp. 687-718. DOI: 10.1086/494362) Cohn's paper is witty and jargon-free; it is a delightful read and I highly recommend it. I went back to it to help me think about sexual metaphors at hacker camp.
Cohn studied what she called "technostrategic" language among defense intellectuals. One of her insights was that technostrategic language shaped how it was possible for one to think about nuclear weapons; it also made it impossible to think and talk about certain concepts, such as peace.
Technostrategic language was vividly laced with sexual metaphors, and Cohn offered some cautions in thinking about this. It was too simplistic to just talk about men's obsession with phallic imagery. It wouldn't do to read individual motivations into language such as that quoted above from the newspaper article. That is, what is of interest, or importance, is not why those individual men are motivated to use such language. The language comes out of the broader culture and is available to the individuals. What is of interest is how does the language function? What purpose does it serve? Cohn notes that sexual imagery has long been a part of the discourse of warfare, and a warfare mentality is certainly present in the hacker camp. It is, in a sense, a war between those who want to crack computers and those who would defend against them.
Cohn notes:
Both the military and arms manufacturers are constantly exploiting the phallic imagery and promise of sexual domination that their weapons so conveniently suggest.
"Penetrate" is a word that appears with some frequency. Cohn asks, "how does [this imagery] function in their construction of a work world that feels tenable?" Her conclusion is that it offers a sense of control in a situation that is wildly beyond the individual's control.
It's possible that the sexual imagery at hacker camp functions in much the same way. Computer security requires eternal vigilance and never-ending creativity to keep up with the bad guys. It is a situation that can potentially feel out of control.
It's not like the sexual imagery is required to describe what's going on. There are other forms of imagery available: medical imagery (infections, viruses, immunity) or, as the Inquirer reporter noted, a game of chess. One could just break in to someone's computer - is it really necessary to say that you penetrated it? But that imagery of sexual domination gives one such a nice feeling of being in control.
Cohn's paper is a fascinating case study of the function and purpose of workplace language in one very unique workplace, but her insights and conclusions can help us understand language functions in other settings.
- Log in to post comments
Gah, please don't urge them to use chess imagery. Chess metaphors are the most badly abused language constructions I've ever seen - nobody gets them right, and nobody gets even close. If you're not a chess player, don't compare things to chess because you're only going to look like a tool to anyone who *is* a chess player.
On a more practical note, I think that you're doing a bit of a disservice to the hacking / security community. I spent a little time in the black hat world during my wasted youth, and the cultural aspects of the language have broad and deep roots which stretch back to the early days of computing in the '50s and '60s; the sexual imagery you're talking about is a small (and amusingly cherry-picked) element of a well-developed jargon. In fact, browse the Jargon file for about 10 minutes and you'll see what I mean. Also, to many hackers (especially the ethical hacking community), cracking system security is not a war but a game, a puzzle to be solved. It's that sense of puzzle-solving that brings many people into hacking in the first place.
Admittedly the sexual uses of 'violate' are contemporaneous with other uses, but the use of 'penetration' to refer to the sexual act postdates other uses (including the military sense) by quite a few hundred years.
Additionally, both terms are commonly used in the language of medicine: 'violation' gets some 3,500 hits on PubMed (after excluding terms such as 'sex', 'intercourse', 'penis', and other likely indicators of sexual context) while 'penetration' gets ten times as many (similar context).
The faculty and students for college and university programs in this area are also predominantly male, apparently. This is from a Linux news article on a recent collegiate cyber defense competition:
Baltimore County Community College, the only team with a female competitor, and Mount San Antonio Community College in Los Angeles, proved that network security skills are not the exclusive domain of larger, better-known institutions. Their presence at this national competition is roughly the equivalent of a community college basketball team making it to the NCAA's Final Four, and both schools and students
deserve kudos for going head to head against teams from much larger schools, especially since those schools may include two graduate students on their team.
Reminds me of my electronics days with all the male and female connectors and the mnemonic for the resistor color code: "Bad Boys Rape Our Young Girls, But Violet Gives Willingly for Silver or Gold". Sometimes people would say "black boys..." for the double whammy.
Zuska, I think you are pretty far off base here. From what I know of you (just by being a long term reader), this is probably just because of misinformed article in the papers, and that you aren't much in the computer field, no less in the systems or security subfields. I'm in this field, and like to think I have a pretty good idea of what is going on. (I'm also male, btw.)
#1. This is a subfield that has few women at all compared to computer science in general. And CS in general has got one of the lowest female participation rates of any discipline in engineering. And engineering... well anyway. I am not surprised there were no women there (most samples of less than a few hundred will have only a few women). That's a shame, and you are right that the event organizers probably did not reach out to women at all. Just like CS as a whole largely ignores and/or alienates women. I wouldn't put too much blame on this particular event, without some more information though -- it really seems to be CS undergraduate and graduate schools that need to get the ball rolling.
#2. Sexual imagery. In this case, the reporter has an overactive and selective imagination. This subfield does use medical imagery: virus, infection, anti-virus, immunity, etc. It uses warfare imagery: penetration, attack, defenses, perimeter, DMZ. Police imagery: probing, fingerprinting, etc. Silly kids imagery: knocking (as in a secret doornock), handshake, zombie. It uses a whole bunch of made up stuff too: firewall, botnet, honeypot. CS even has some really awful-sounding terms. E.g. master/slave used to be very common (and had very specific and very old technical meanings that, at least now, have little to do with race relations). This one has been pretty much phased out because they sound so awful (and just as well too -- primary/secondary or controller/peripheral serve roughly the same purpose).
What I don't see a lot of is sexual imagery, actually. The examples you mention aren't sexual, they are either medical or military. Penetration is what the bad guys do, not the good guys -- so the bit about people who want to be in "control" using this term is backwards. Violation is more a police word -- violating a rule, or a policy. You don't violate an object. I've never heard the "take it first" phrase before as a common phrase.
-kevin
Andrea -- yup, forgot about male/female connectors. This is pretty much standard across all mechanical/electrical/computer engineering as far as I know. I've never noticed this to be a particularly inappropriate usage, though, is it? It's not like the female connectors are seen as bad or something, or less strong as the male connector, or anything. They could have called it an outie and an innie by analogy to bellie buttons, I suppose.
I've never heard your resistor mnemonic before (I wasn't trained in EE formally, and the one I learned informally was innoccuous -- so much that I can't remember it any more), but that's pretty awful.
Kevin: I can remember a lot of awkward moments when discussing male/female connectors or "mounting" drives. It wasn't so much that the female connectors were "bad" or "less" as that they were female, and suddenly a (generalized) picture of my (female) anatomy flashed through the mind of everyone in the room, often followed by either long, awkward pauses (which only confirm/magnify the effect) or by ribald joking which wasn't always welcome. Either way, it was made painfully clear that I was a woman (and that they were not) and that my femaleness was weird and unusual. The wink-wink-nudge-nudge could be construed as sexual harassment in that "uncomfortable climate" kind of way. And it all certainly made me think twice about whether I "belonged" in that field, and about whether I wanted to spend the next 40 years of my working life dealing with it.
So I guess I see three aspects of the problem with sexual metaphors.
1. direct sexism if the metaphors of one gender are denigrated
2. that subtle kind of Otherness Magnification that is one reason women leak out of the pipeline
3. subtle sexual harassment
Surely "mounting" a drive derives from the days of magnetic tape reels (which I'm old enough to remember), which had to be physically placed (mounted) on the tape drive.
Honestly, I'm not too worried about the gender balance at what sounds like fantasy baseball camp for network admins.
@kevin re #1: I don't think that's correct in this case. What we're talking about here is security as a subset of system and network administration. I don't have numbers, but my gut feeling from working in the field is that there's better gender balance than there is in more academic computer science. Among security conscious or security specialist system administrators, I have never been the only woman in the room. Now, if you're talking about development of security applications or academic research into security within computer science departments, I'm inclined to believe that the gender balance is particularly bad -- when I worked on security products I saw plenty of women in roles outside of hands-on core technology work (program, product, and team management, UI, QA), none in it -- but that isn't the target market for this camp.
Arguably, security conscious system administrators are not even the target market for this camp. I'm within the demographics cited (aside from gender), but I'm pretty sure I and most people at my level professionally -- which really isn't all that high, all things considered -- would not need or even want a sleep-away camp to pass the CEH exam. Instead, if I'm going to spend my (or my employer's) dollars on a security-related junket I'm going to go to a conference where new work is being presented. (Never mind that if I wanted a certification of questionable practical value I'd go for the CISSP instead.)
That said, another reason I think the gender balance may be what it is in that camp is that I suspect by that age bracket women in tech are either well-specialized (quite possibly into less hands-on roles like program management, market analysis, education, etc.) or they've gotten out. Not too many mid-career women just now thinking they might want to see what this pentesting thing is all about, y'know?
WRT the vocabulary...it's never struck me as especially sexual. I have heard explicitly sexual metaphors used in technical settings and there's an obvious difference. I could just be totally desensitized by this point, though.
A bunch of guys on a hacker camp need to assure each other and themselves that they are straight. Film at 11.
" I've never noticed this to be a particularly inappropriate usage, though, is it?"
Well, as a 16 yr old physics geek who hadn't ever been kissed by or gone out on a date with a boy, but who did get to intern at a hospital with a proton accelerator for several months during the summer, to say it was creepy and off-putting would be an understatement.
Not nearly as creepy and off-putting as the sexist surgeons I met, but still, I wasn't interested in becomoming a doctor, and the doctors' behavior could be rationalized as belonging to them and not being normalized throughout an entire branch of science/technology.....
There are reasons why I never would have majored in physics if I hadn't gone to a small, women only, liberal arts college. Sexism is hardly the only reason, but sexist shit like this certainly made an impact.