“They’re just seven freshmen on one floor of one dorm of one college in one state in one country on our one and only planet.
For all their exceptional talent, there must be tens of thousands more, and they will be running the show.
Google the words “David Dworken” and you’ll find a picture of a teenager in an oversize gray suit shaking hands with former secretary of defense Ash Carter, along with a headline that reads: “Meet David Dworken, the Teenager Who Hacked the Pentagon.” Which is pure clickbait.
Last spring, the Pentagon sponsored a “bug bounty,” inviting computer security enthusiasts to dig into , DoDLive, and a few of its other public-facing websites. Dworken, then newly 18 and among the youngest of the 1,410 participants, found six vulnerabilities, ranging from cross-site scripting (where malicious code can wreak havoc on a victim’s web browser) to insecure direct object reference (alert: potential data breach). He wasn’t the only one to find errors—250 bug hunters had found similar weaknesses—but he was the one who made headlines. He was just a high school senior, after all, and ours is a culture fascinated, and terrified, by teenagers who know computers better than most of us will ever know anything.
Dworken had been moonlighting as a whitehat hacker since he was 16, helping to uncover website vulnerabilities for massive companies like Netflix, General Motors, and AT&T. He found a remote-code-execution glitch on a United website, earning 1 million air miles for his trouble. The lack of rate-limiting on get.uber.com? That was him (and he earned $3,000 for identifying it). At the time of the Pentagon event he was a computer whiz on his way to Northeastern University with a merit scholarship. In other online articles about the hack, he talked about hacking as a public service, a way to help protect the world’s digital infrastructure. He hoped to someday have a career in cybersecurity. He seemed like a good kid, the anti–Mr. Robot. And as part of the first generation of Americans who came of age after WikiLeaks and Snowden, and after concepts like privacy, security, and online identity blew up in our collective face, this smiling kid with a Supercut looked like nothing so much as the future.
But to really find out—to study that potential future in all its complexity, to learn how the next generation is grappling with the Big Issues keeping the rest of us awake at night, you can’t just trust the internet. You have to go to a very cramped room in Boston.
When i arrive at Stetson West, the computer science dorm in the northeast corner of Northeastern’s leafy campus, it is early December, and David greets me wearing a T-shirt that says “Respect the Research.” Looming at a lanky 6′ 4″, he smiles often, with round dimpled cheeks and deep laugh lines; along with his unprominent chin and pointy canines, he gives off an amiable Chip ’n’ Dale vibe.
In his tiny dorm room, six guys are crowded together, lounging in desk chairs, slouched on the loft beds, or standing; everyone’s either holding or looking at a computer. They’re all part of a self-started hacker group called Sthacks, short for Stetson Hacks, and David’s room is their informal HQ. The floor is covered with throw rugs and grubby bath mats, and on the wall is a vanity license plate that reads M3MES. David’s Corsair keyboard glows red in front of his curved LG monitor; my geek pride inflates when I notice we own the same mouse, a Razer DeathAdder Chroma. I search for a bookshelf, but I can find only one physical book, Essentials of Programming Languages. I have them count the number of internet-enabled devices in the room; David has 13, his roommate has 11, and the others carry two apiece, for a total of 34.
Shortly after I arrive, the Sthacks members wander out, giving David and me the room. In an unhurried drawl, he tells me he was born to nontechie parents in 1998; he tended sheep, goats, and pigs at his small middle school outside Washington, DC. Out of curiosity, he taught himself to program on his TI-84 Plus graphing calculator in seventh grade and got into finding bugs in high school, when he discovered an XSS vulnerability on his school’s website. From there he branched out into corporate bug bounties, starting with AT&T (where the nature of his work was confidential under Section 5 of AT&T’s terms and conditions), and attended some hacker events, where he skewed on the young side—last summer his father had to chaperone him to Def Con in Las Vegas, because the hotel was 21-and-over. He says he loved high school, which trips my red flag, because what kind of freak loves high school? So I ask him what he hates. “I don’t hate anything,” he says.
Poverty, racism, war? What about global warming? “I’m concerned, it’s an issue, and it needs to be dealt with,” he says. David always says issue instead of problem, and the most negative word he’ll use is annoying. Not only does he hate nothing, but he claims he has no regrets, worries, insecurities, or recurring bad thoughts. The most personal thing he’ll tell me is that he’s allergic to the orange part of muenster cheese. He won’t even take a public stance on Edward Snowden’s NSA disclosures, except to say, “I object to massive spying programs.”
Maybe it’s not surprising that a security obsessive would be an uncrackable cipher of niceness. But is he just a naturally private person, like he claims? Does it only seem natural because he has grown up in an era when secrecy is a healthy norm? Or is he posing as a do-gooder for the lulz? Should I be reassured or terrified that he isn’t worried about anything? Maybe he’s just young. Or I’m old.
Before I can probe further, the Sthacks guys reenter with laptops in hand. Lest you picture some Revenge of the Nerds tableau, they wear the archetype lightly—no snort-laughs or Comic-Con merch; only one pair of glasses, tapeless. They’re dressed in T-shirts and cargo shorts. Some have girlfriends, all make eye contact. These NU freshmen are what you might call Nu-Nerd—confident, articulate, nonneurotic, and sharp as katanas. They’re all, in their own ways, just as whizzy as David: There’s Sam, a chatty former competitive League of Legends player; he argues constantly with Peter, a pugnacious arch capitalist who pulls in five figures a year with a web design business. Jacob is a deadpan wiseacre; the soft-spoken Taha is considering pursuing three minors and two majors (he dropped a third, mechanical engineering, because he figures he can pick it up on his own). David’s roommate, Alec, knows three languages, plays three instruments, and has a penchant for tie-dye and sweatpants. And Matt, a baby-faced Ping-Pong enthusiast with an 11-o’clock shadow, is the only one whose pants fit properly.
Like Midnight’s Children or the X-Men, they have talents that seem to have emerged spontaneously and in isolation, from everywhere and for no reason, united here through the sheer chance of dorm assignments and the lingua franca of tech. One mentions he attended the best-funded school in the US, another the worst-funded school in New Jersey. There are Hillary voters and more than zero Trump voters. They’re all guys, perhaps due to the gender imbalance in STEM fields, but at least partly because the dorm floors here are gender-segregated. Where it seems like race, sexuality, gender, and class dominate collegiate discussions right now, the young men of Sthacks simply identify as hackers, though they hate how the term has been twisted to mean trespassing. Hacking, as they’ll tell you, means quick-and-dirty programming and problem-solving, taking things apart and putting them back together.
And that’s what they do. Nonstop.
They do it for school; outside of school, they do it for work; outside of work, they do it for fun. Unlike every other gathering of male undergrads I’ve ever seen, there’s no horseplay or grab-ass, no profanity or pop references. Instead there is a bewildering flurry of shoptalk: “It’s a fuzzer that inspects the code as it runs to make sure it hits every single possible branch, and when you compile it with their compiler, it’s all open source, and it adds its own instrumentation …”
“Fully automated fuzzer?”
“Fully automated, and it hits every branch. That’s the crazy part. Everything from, like, Firefox, Internet Explorer, SQLite, GnuPG, NTPD, FFmpeg—”
“So it needs to generate a whole—like, a whole control flow tree?”
“Yeah, it hooks into the compiler. I don’t completely get it …”
Anyway, to focus on what they’re doing obscures what they’re not doing. Most people under late capitalism identify, at least in part, by what they consume: their media preferences, possessions, fashion. But David doesn’t listen to music. Nobody’s huge on Silicon Valley or Mr. Robot, but they’re cultists for Westworld (which happens to be about whitehat and blackhat cowboys in a futuristic simulation of the Wild West). Nobody smokes dabs or vapes or snorts study drugs. The only thing I see them consume, in medically unsound amounts, is candy—David’s trash can is stuffed with Kit Kat and Twix wrappers, and Alec is on his second 5-pound sack of gummy bears this semester.
Most surprisingly, none of them use social media, except for occasional event invites. To them, putting information online for no practical purpose is senseless and boring. “I get depressed when I look at Facebook,” Alec says. “It makes you compare the highlights of everyone else’s lives to your unedited reel.” The Sthacks members have a group chat channel on Discord, but other than that they meet in person, usually in this room in Stetson West. This is their network. And when I leave for the night, they finally take a break from hacking to watch a YouTube video of John McAfee snorting bath salts through a crazy straw. It’s 3 am, and they are wide awake.
The next evening, I follow David and the other Sthackers to a meeting of NU Hacks, the college’s official hacking club, whose website describes it as “a community of artists, programmers, makers, breakers, and rump shakers,” and tonight, in a midsize lecture hall, they are voting for next semester’s leadership positions.
“Whoa, the population of women just went up in here by a hundred percent,” says Niousha, the club’s president, as she enters the room. To be precise, it’s 14 men to two women in the room tonight, and aside from a few Asian faces (including Niousha’s), the room is dominated by reedy white guys, which is a more or less accurate reflection of what’s happening in computer science at most colleges right now. The club’s got an open door, and of the dozen or so members I speak to, all of them say they wish more types of people would walk through it. In the meantime:
“Yo, I have ducks! Does anyone want ducks?” Niousha asks. She starts tossing out rubber ducks, a reference to “rubber-duck debugging,” where you work through a problem by talking to a rubber duck. Then the election begins.
By now I’ve learned that hackers will always look for exploitable loopholes; they follow rules but also test them. Sure enough, with every office open and so many candidates running unopposed, someone says: “Wait, what if we just did ‘No Confidence’ for everybody?”
Others join in. “Let’s elect Bernie.”
“I’m raising money for a recount.”
“Wi-Fi causes autism.”
The meme catches on as the speeches begin; each candidate is now running against No Confidence. Danielle, the lone presidential candidate, is a regular NU Hacks attendee. “I always feel guilty if I don’t go” to the meetings, she tells me later; she’s big on inclusion and worried that potential new members would see a room of dudes and assume they didn’t care about including women. “I feel like my presence there helps against people who might say those things.” She’s had to put up with some sexism in the CS world, like enduring flirting from a male classmate just so he’d teach her about C pointers. Rather than trying to blend in, she plays up her gender: “I wear pink all the time, skirts, everything. I’m here to be the beacon of: It’s OK to be feminine here, and it’s OK to be a woman.”
She stands on a desk to make her pitch. “I’m just really glad that we breathed new life into this place. And I knew there had to be a place where CS people could gather and do social things together. What’s happening? Why are you all snickering?” The audience heckles and squeaks their ducks at her. She concludes: “So yeah, vote for not–No Confidence, and we will, uh, strive to make this the place … for you to do the thing.”
“Do the thing!” the audience calls back, applauding.
Next up is Milo for VP. He climbs onto a swivel chair, flailing and torquing around. “I promise a new era of violent dictatorship where all dissent is suppressed, using violence and other nefarious tactics. I promise that you shall fear for your safety should you speak out against the regime,” he says, to more heckling. “This I vow, to all of you, on my honor. Thank you, and please don’t vote for No Confidence. That would really suck.”
“That speech is a lot less funny given the president-elect right now,” someone says.
One of the candidates for treasurer gives his speech, calling NU Hacks a cross between an authoritarian dictatorship and an anarchist collective, and meanwhile everyone’s whispering; No Confidence is gaining momentum. Obviously they’re just clowning around, but I do start wondering how much the joke extends to real life—whether, at a time when hackers and email leaks influence elections, theirs is a politics of No Confidence, disengaged and distracted by fuzzers and messing with strangers’ baby monitors. Sure, college is a time for indecision, for gathering knowledge without immediately forming an agenda. Then again, they’re also voting age.
David’s bug-bounty work confuses me a bit. Though they’ve existed since the 1990s, bug-bounty competitions have seen a boom over the past few years since big companies like Google and Facebook started hosting them. A handful of superstar whitehats can clear $250,000 in a good year, but aside from the air miles and some nominal fees from Uber, David’s been working mostly pro bono. To me this sounds suspiciously like a corporate ploy for cheap labor, but he says he considers it a public service: “They hold data on you, on millions of users, and so to help with their security is in the public interest.” He has a point—when we’ve collectively volunteered so much personal data to the private sector, the notions of public welfare and corporate security have fused. Secure in their future earning potential, not one of them expresses colossal ambitions of “changing the world.” Except for Peter, with his bottom-line business focus, they all seem indifferent to wealth, power, and the popularity that comes with both. So maybe they feel that politics, which is all about those things, doesn’t bear on them.
“Vote No Confidence,” David enthuses. “You can vote No Confidence. No Confidence!”
Niousha tallies the votes aloud. Someone wrote in “Milo for Dictator.” A pen comes twirling at Jacob: “There’s already been an assassination attempt!” The winners are announced to applause and calls for bloodshed. No Confidence does not prevail; humans do.
The next day, David and I attend Technology and Human Values, a class that fulfills the “ethical reasoning” requirement for CS majors. Almost everyone is using a laptop, and of the 40 or so students, three, including David, have their webcams covered with either masking tape or a sliding doodad.
“Good afternoon, everyone!” the professor calls out. “Good afternoon, John,” some 40 students reply in feigned boredom. This is John Basl, an engaging young bearded guy with Bee Gees hair; he plainly oozes Cool Teach. Jacob asks him what Westworld episode he’s on, and he replies, “One.” The lecture hall resounds with hair-whitening shrieks.
Today’s topic: Do we need to treat advanced AIs ethically? For the next 100 minutes, Basl breaks down the different types of moral status and patiency, and whether we should invent strong AIs at all. I wonder if learning about ontogeny nondiscrimination and substrate independence will help students when, for instance, an employer asks them to do something fishy. After all, the nature of a whitehat—and ethics generally—is context-dependent. A man some might consider the ultimate whitehat, Edward Snowden, stands officially condemned. (Or in programming notation: lawful != ethical.)
Later, Basl tells me that he’s not trying to focus on the pros and cons of specific issues, but instead offer tools for ethical thinking. “I want them to leave with a sense that ethical questions, questions about how we ought to act or what is valuable, are very different from empirical or descriptive questions, questions about the way the world is.” This is especially important with his students, whom he finds “extremely techno-optimistic; they believe that technology will inevitably develop, that technological possibilities will all be realized.”
After class, David and I head to a café, where he continues to stonewall me on everything: politics, religion, class, dating life. At a time when young people are accused of oversharing, I find his aversion to disclosure interesting. “I, by default, am going to keep things private and let it become public when there’s a sufficiently convincing reason for it to be public,” he says. Like when? “When it’s beneficial in terms of career prospects.” (One thing, more than any other, that he wants the world to know: “Bug-bounty programs are good.”) Someone like David, who deeply understands and values privacy, shares only what he wants. He’s out here fixing bugs to secure our privacy; all he asks for is some privacy of his own.
I propose we move out of his comfort zone, do something nonfactual: go to a fortune-teller, a club, a hookah bar. “I don’t have any interest in doing that, to be honest,” he says. “I’d rather go to my room and work on programming.” On our way out, he swerves to pick up a tiny discarded receipt off the ground, then wanders even farther off to drop it carefully into a recycling bin.
On Friday night around 10, freshmen are swearing loudly and sprinting around a hallway that smells of burnt microwave popcorn. Outside David’s room, a drunk dude in a suit staggers around with a huge patch of dirt on his sleeve. It’s the kind of old-fashioned monkeyshine that, under the menacing sousveillance of social media, now carries the whiff of oh shit. Even a momentary lapse of unseemliness or unsightliness can live on forever, like herpes.
Not that the Sthacks crew are in much danger of incrimination; as usual, they’re just hanging out in David’s room, hacking. It seems like a good time to ask them about security—more specifically, my security. Ever since Snowden, everyone I know has dwelled in a similar fatalistic confusion; we know that so much of our info is already out in the world—all our humiliating correspondences, our cash and coordinates, our nipples, wieners, and booties—that we shrug and do whatever’s convenient. Are we really at risk? And if so, can we do anything about it?