When hackers target a conference code of conduct

NEW YORK—Can hackers effectively mitigate a hack of their own subculture? Confrontations between Circle of HOPE conference speakers and a small group of male attendees wearing “Make America Great Again” hats and shirts leave the question wide open.

The conflict began Friday afternoon, the first day of the three-day conference, during cryptography expert Matt Blaze’s roundtable discussion on hacking and securing voting machines and systems. A man wearing a white MAGA hat, using language sources say was coarse and combative, accused Blaze of wanting to be assaulted by John “Captain Crunch” Draper when he was a teenager.

Draper was banned from multiple hacker conferences last year, following numerous public reports on his decades-long attacks against young men and boys in the hacker scene.

The man continued to harass Blaze, who has spoken at almost all of the 12 HOPE conferences held since 1994 and is involved in the conference’s presentation selection process. Blaze said via Twitter that the man “cornered” and “browbeat” him. Attendees told The Parallax that they overheard the man later saying that during the Unite the Right neo-Nazi rally in Charlottesville, Va., he had marched with neo-Nazis.

READ MORE ON TRENDS IN HACKER CULTURE

At Chaos, a chaotic response to assault allegations
How the myth of meritocracy stymies women in cybersecurity
New sexual-assault allegations against ‘phone phreaker’ John Draper
Facebook, EFF security experts sound off on protecting the vulnerable
Is doxing ever appropriate?

Blaze complained to conference organizers about the man’s behavior on Saturday, The Parallax has learned. And in an email seen by The Parallax between conference organizers about Blaze’s complaint, one organizer expressed more concern about “trolls” from the “radical left” than the right, along with unease about what might happen, were the conference were to ban a “guy with a hat.”

Later Saturday, the man in the white hat showed up at Gillian “Gus” Andrews’ talk, which criticized abuses within hacker culture. An attendee of the talk confirmed to The Parallax public reports that the man “demanded the evidence” on Draper, and referred to himself as “a proud nationalist.”

Following the Q&A session, an unidentified conference attendee swiped the white MAGA hat off his head. Although the man soon had the hat back in his possession, he left the conference visibly angry. When he returned, he was accompanied by a New York City Police Department officer.

While it appears that the NYPD took no action, there were more altercations to come.

Following an onstage interview between hacker Yan Zhu, chief security officer for the Brave Browser, and Chelsea Manning, an activist and whistleblower who spent six years in military prison after turning 750,000 government documents over to WikiLeaks, a similarly taunting line appeared to prompt conference organizers to cut a question-and-answer session short.

Steve Rambam, a regular HOPE speaker who this year was given a three-hour block for his presentation, asked Manning if she had “on purpose or by accident [given] the U.S. government the means indict [WikiLeaks publisher Julian] Assange,” implying that she had traded information on Assange for her commutation, an unfounded theory first suggested by Assange.

Later that day, Rambam was seen drinking with men wearing MAGA gear at a Hooter’s restaurant across the street, including one—wearing a white MAGA hat—who had been in the audience at Manning’s talk.

Rambam denies that the people he was with at Hooters were Trump supporters.

As the audience began to leave Manning’s Q&A session, the man wearing the white hat rushed the stage. He was stopped by an audience member as event staff escorted Manning out of the room.

Multiple sources tell The Parallax that they reported the stage-rushing incident to conference security team leaders, who in turn declined to take action until much later in the day. One organizer, Edward Cummings, also known as Bernie S., via email denied to The Parallax that the Q&A was cut short. He also said that in response to complaints from attendees, he had questioned whether some of alleged code of conduct violations were “merely examples of people expressing views or slogans that complainants legitimately disagree with.”

“Although I repeatedly asked these individuals what conduct they believe these MAGA hat-wearing men engaged in that violated the code of conduct published on HOPE.net, the only answer I could get was that this small number of men in hats was ‘menacing,’” he wrote. “Someone who may have said they’d been to Charlottesville and who may have been wearing a MAGA hat doesn’t, in my opinion, rise to the level of a violation of the published HOPE code of conduct, because it’s more about behavior that happens at HOPE.”

HOPE has, in fact, banned at least two well-known hackers—Draper and Jacob Applebaum—for alleged code of conduct violations outside the conference, including rape, sexual assault, and harassment. Bernie S. did not mention whether the alleged treatment of Blaze and Manning constituted violations, though he did acknowledge ejections.

“The number of actual harassment incidents that I’m personally aware of at The Circle of HOPE can be counted on the fingers of one hand, and resulted in ejections of multiple attendees,” he wrote.

“Some will say that these bad actors hacked the code of conduct. But they were targeting, cornering, and harassing speakers since Friday night. That’s a clear code of conduct violation. I’d argue that if they hacked anything, it was the security team, [which] was, in many situations, the first line of defense for CoC implementation”—Elissa Shevinsky, former HOPE press contact

The Parallax and others witnessed three men wearing MAGA gear and other slogans or symbols appropriated by neo-Nazi Trump supporters speaking jovially with conference security leaders Saturday. Several other attendees say they heard a HOPE security officer say, “I don’t care if they’re carrying a Nazi flag.” And conference attendee William Gillis, an organizer at the antigovernment group Center for a Stateless Society, says he saw three men sporting confrontational messages “physically intimidating” conference attendees.

The man wearing the white hat was later asked to leave the conference. Minutes later, attendees spotted him attempting to sneak back into the conference with what appeared to be a concealed gun. Conference security officers stopped him from re-entering.

HOPE’s code of conduct states that the conference is “a space for tolerance and respect” that is “dedicated to a harassment-free conference experience for everyone.”

It further reads:

“HOPE seeks to ensure no attendee is harassed. This includes, but is not limited to: deliberate intimidation, stalking, following, harassing photography or recording, disruption of talks or other events, inappropriate physical contact, or unwelcome sexual attention.

The conference staff reserves the right to eject anyone from the conference at any time. If you are being harassed, notice that someone else is being harassed, or have related concerns, we encourage you to contact a member of conference staff immediately.”

Elissa Shevinsky, who managed HOPE’s press and on-site registration and revealed her resignation to The Parallax in part because of her perceived mishandling of the harassment incidents, says HOPE organizers need to get better at enforcing its code of conduct, including rapidly responding to alleged violations such as harassment or physical intimidation, and making sure that all staff are informed of the guidelines in advance of the conference.

“Some will say that these bad actors hacked the code of conduct. But they were targeting, cornering, and harassing speakers since Friday night. That’s a clear code of conduct violation. I’d argue that if they hacked anything, it was the security team, [which] was, in many situations, the first line of defense for CoC implementation,” she wrote in an email.

In responding to the alleged violations, Shevinsky says the conference failed to protect its attendees and speakers in a timely manner. As press lead, she says, she saw “requests for an official statement from HOPE. There are a number of wonderful, active volunteers with strong opinions, but I’m personally waiting to see a written statement from Emmanuel or the core [leadership] team.”

At the time of publication, HOPE officials have not yet released an official statement on the alleged harassment. HOPE co-founder and de facto leader Emmanuel Goldstein, who helms the phone-phreaking magazine 2600, said at the end of the conference that he planned to incorporate community feedback before making changes next year.

“We will do a better job,” he said. Goldstein did not respond to a request for further comment.

“We’ve allowed, in hacker culture, a lot of toxic, manipulative, harmful people because they ‘do good work.’ But we need to aggressively root them out and confront the problem head on.”—Cooper Quintin, security researcher and staff technologist, Electronic Frontier Foundation

Numerous high-profile conference attendees and organizations, including Manning, The Tor Project, and Riseup.net, on Saturday issued a public complaint about the conference’s lack of decisive action against the openly “fascist” attendees. Their “declaration of no confidence in HOPE’s code of conduct mechanism” starkly contrasted with an official HOPE tweet asserting that attendees should consider MAGA hats “a form of tracking device to monitor potential troublemakers.”

The clash at HOPE, separately reported by Motherboard, bears semblance to a situation in December involving alleged assault between attendees at Chaos Communication Congress, Europe’s largest hacker conference, that led to accusations of lax enforcement of the conference’s code of conduct.

Both incidents underscore an ongoing struggle by conference organizers to enforce official conference codes of conduct, especially when they disagree on what constitutes a violation. And they don’t bode well for DefCon, the largest conference in the world, which kicks off in Las Vegas in two weeks. DefCon has faced its own share of internal controversy, struggling to remove attendees who have allegedly violated its code of conduct.

Defenders of behavior emblematic of Trump supporters at HOPE say it should be protected as free speech. But Cooper Quintin, a security researcher and staff technologist at the Electronic Frontier Foundation who spoke at HOPE and was involved in the ad hoc effort to protect Manning, says the behavior is reflective of a rise in hate crimes across the United States, the United Kingdom, and Europe.

“Anybody wearing a MAGA hat is dog-whistling an allegiance to white-nationalist ideologies. It’s clear intimidation,” he says, adding that hackers should stand up for one another, not giving in to abusive situations.

“Even if the accused is ‘simply’ trolling, trolling can be as disruptive, if not more, than similar behaviors,”—Gabriella Coleman, cultural anthropologist, McGill University

“The heads of security were very dismissive of the situation, although individual members [of the HOPE security team] were helpful and understanding,” says Quintin. Both he and Shevinsky signed the protest letter. “We’ve allowed, in hacker culture, a lot of toxic, manipulative, harmful people because they ‘do good work.’ But we need to aggressively root them out and confront the problem head on.”

Hackers’ efforts to encourage and protect diversity while protecting one another from physical or digital harm, if successful, could comprise a road map for other American subcultures and even society at large, says Gabriella Coleman, a cultural anthropologist specializing in hacker culture who holds the Wolfe Chair in Scientific and Technological Literacy at McGill University.

“Speakers are being threatened, and some people can’t see that because there’s this long-standing current of ‘sticks and stones may break my bones’: Some people can’t see how speech of a certain sort can be incredibly violent, incredibly threatening,” she says, adding that conferences can’t just pay lip service to having a code of conduct.

Without a clear plan for how to handle complicated situations, Coleman says, hacker organizations will become more contentious.

“Even if the accused is ‘simply’ trolling, trolling can be as disruptive, if not more, than similar behaviors,” she says. In this case, HOPE’s organizers “were wholly unequipped to enforce the code of conduct.”

Coleman says having “a plan of action, or a committee tasked with judging these cases as they happen, is essential for actualizing the code of conduct.”

HOPE is one of the oldest, most venerated hacker conferences—a place where hackers vie for limited speaking slots to debut their latest research. Organizers of conferences in the hacking community—and well beyond it—should do more than take note of its struggle to manage threats to speakers and attendees.

Update, Aug 7 at 1:30 p.m. PST: Added denial from Steve Rambam. Update, July 25 at 11:25 a.m. PST: Added further comment from Edward Cummings, and clarified the timeline of events.

Update, July 24 at 2:55 p.m. PST: Clarified that the man who harassed and cornered Blaze did so after his panel, which did not have a Q&A session.