It’s a familiar American success story of a college dropout learning computers, launching a career in tech, and earning millions in the process. But unlike the tech billionaires, these whiz kids instead use computers to hack into corporate computer servers to steal and resell credit card numbers. What’s going on in the mind of the hackers? They are textbook cases of criminal sociopaths who’ve discovered software as a way to satisfy their pathological desire for recognition, mastery, and, of course, wealth. The same sociopathic and psychopathic behaviors, unfortunately, can thrive in corporate environments as well.
◊
I was first introduced to the hacker’s mirror universe as a blogger for a data security company. We were helping customers protect their data; the black-hat hackers were doing just the opposite: busily probing defenses and applying their dark talents to steal credit card numbers. Some of them did live up to the mystique that surrounds this group – equal parts brilliant technicians and James Bond, along with a little gangster energy. Interestingly, before hacking took on more criminal overtones, the term super-hacker was a compliment given to nerds who could magically charm software to do amazing things. At this point, though, the dark side has completely appropriated it, and it’s now a badge of honor among cybercriminals.
Consider super-hacker Albert Gonzalez. Gonzalez, like a lot of nerds, wasn't fitting into school. He was the son of Cuban immigrants, and his only interests seemed to be computers and chatrooms. His mom was worried enough to tell him he should see a psychologist. Gonzalez refused. In a way, his focus on computers and learning about networks helped him break out of his loneliness and expand his world. He was not, however, destined to become the next Steve Jobs.
Between their hacking triumphs, Gonzalez and his cohort had the Miami club scene at their disposal. As substitutes for their hacking high, they binged on ecstasy, ketamine, and cocaine. None of this would come as a surprise to psychologists, who’ve long noted the connection between sociopaths and drug and alcohol abuse.
After dropping out of a Miami community college in the late 1990s, Gonzalez persuaded like-minded friends to join him in his criminal plans. By his early 20s, he was digitally breaking into big-box retailers and putting together an international organization with help from Russia cyber gangs. He was living large on his high-profit operation, flying up to Manhattan to throw himself a wild 25th birthday party and filling an expensive penthouse condo with his buddies.
Miami was a perfect playground for Albert Gonzalez. (Image Credit: jessica45 / Pixabay)
When federal agents finally arrested Gonzalez and his associates in May 2008, he was wanted for, among other crimes, hacking into the retail conglomerate TJ Maxx and stealing tens of millions of credit card numbers, which at the time was the largest data breach in U.S. history. He ultimately forfeited millions of dollars in real-estate, cash, and cars, and is currently serving a 20-year sentence in federal prison.
Albert Gonzales and his gang would likely be classified as sociopaths, or at least having sociopathic traits. Sociopaths are impulsive, grandiose in their plans, and always on the lookout for the next criminal thrill. Think of Gonzalez as a tech version of an old-school safe cracker, listening to the digital tumblers over his Internet connections and living the high life off of the loot.
Small-time criminals are known for their overly optimistic decision-making process, and Gonzalez again fits the pattern. Before he embarked on his data-stealing spree, he was producing fake credit cards from stolen numbers and cashing out at ATMs. He was quickly caught by the U.S. Secret Service and became their informant.
For non-sociopaths, that might have been the end of their careers, but, counter-intuitively, it emboldened Gonzalez to take on even riskier ventures. Amazingly, he believed that somehow he was protected by the Secret Service – they were his pals? – and continued on his crime spree, launching a project that he called “Operation Get Rich or Die Tryin’.”
Along with Gonzalez, many others cybercriminals match the sociopathic pattern. As we’ll soon see, though, there are a few digital thieves who act like classic con artists – smooth, convincing, slippery, and completely without scruples – and are more closely aligned with non-violent psychopaths.
Watch "Tracking Russian Hackers" now on MagellanTV!
Software and Sociopaths
There are eerie parallels between the hacker and the defender mindsets, and they run deeper than most of us might at first think. As I’ve discovered from working in the software world, computer programming seems to attract a disturbing personality type obsessed by technical details, lacking in emotional depth, and driven by the reward of quick riches. The same desires to master obscure technical problems seem to motivate both the good and the bad nerds. Is there something about computers themselves that appeals to these “antisocial personalities”?
Some of the connections between personality type and computer technology were first noted by MIT computer scientist and early AI critic Joseph Weizenbaum. (He’s perhaps better known for developing Eliza, the first chatbot and automated psychologist.) In the late 1960s, Weizenbaum wrote Computer Power and Human Reason to argue against computer intelligence, as well as to demystify computer techniques. He also had a lot to say about the people who were attracted to software technology. A paragraph from his book nicely summarizes his observations on what we today would call computer nerds:
[Programming] appeals most to precisely those who do not yet have a sufficient maturity to tolerate long delays between an effort to achieve something and the appearance of concrete evidence of success. Immature students are therefore easily misled into believing that they have truly learned a craft of immense power when in fact they have learned its rudiments. . . . A student’s quick climb from a state of complete ignorance about computers may leave him with a euphoric sense of achievement and a conviction that he has discovered his true calling.
As I learned more about Albert Gonzalez, I realized he fits Weizenbaum’s description of the immature student who attains a “euphoric sense of achievement” after learning how a gadget works. We know from newspaper accounts that Gonzalez enjoyed the challenge of analyzing computer networks, and his siblings commented on his obsession with computers and how it fueled his ego and sense of superiority.
The Akhter Brothers: Shapeshifting Hackers
The case of the cleaner-living Akhter twins, Muneeb and Sohaib, shows the blurring of lines between legitimate and criminal computer activities, and how the sociopathic personality is at home in both. The Akhters were computer and robotic whizzes, both graduating from Virginia’s George Mason University at the age of 19 – the youngest to do so in the college’s history. Armed with computer science degrees, they then took straight jobs with . . . the government.
In 2014, Muneeb scored a data security assignment with General Dynamics, which was a subcontractor to the Department of Homeland Security (DHS). And Sohaib gained work as an IT contractor to the U.S. Department of State.
Sohaib Akhter: You gotta case the joint. You gotta figure out exactly what’s happening here . . . and have an elaborate scheme built out that you’ll never leave a trace.
Muneeb Akhter: Yeah, you first climb the ladder before you . . . Know your shit. Need to know who’s watching, what they’re watching, and luckily I’m one of the people watching.
—Conversation between the Akhters, USA vs. Sohaib Akhter, Department of Justice
After Muneeb boasted to a DHS coworker – sociopaths crave attention to their own detriment – about hacking into websites to steal credit card numbers, he was paid a visit by investigators. Eventually, the government discovered the brothers had indeed gone to the dark side, breaking into the website of a cosmetics company owned by a friend’s mom to steal credit card numbers. They then charged plane tickets and hotel reservations and embarked on their idea of a dream vacation – a week in southern California. They accomplished all of that before they even took their government jobs. And yes, the government failed to conduct a better background check on the Akhters.
Image Credit: Michael Treu / Pixabay
Further investigation revealed that the two were planning to steal and resell passport information stored on the State Department’s servers. In 2015, they pled guilty in federal court and received relatively light sentences of fewer than three years. Interestingly, DHS under then-head Janet Napolitano was looking to bring on 600 “hackers for good”! She said “they would have a bunch of different skill sets” to offer the country. Indeed.
Napolitano was referring to white-hat hackers as opposed to black-hat hackers, such as the Akhters, who use their skills to take advantage of others. It’s an interesting distinction, and one that you don’t hear being applied to, say, doctors or accountants – “I’m not one of those black-hat accountants, I’m completely above board.” However, in the data security industry, with its porous separation between good and bad hackers, sociopathic personalities can thrive, so this distinction has to be made.
Perhaps the Akhters will learn to at least curb their worst tendencies, becoming “hackers for good” and finding a niche for themselves after their prison sentences. It’s possible.
Kevin Mitnick and the Art of Deception
And that brings us to Kevin Mitnick, perhaps the most famous of all the hackers. In the early 1990s, he made the front page of The New York Times as the nation’s most-wanted cybercriminal for successfully eluding a nationwide FBI manhunt. By the time of the article, his hacking activities, which started as a teenager, had already resulted in several arrests and even a short prison stint. His own attorney described him as “addicted to computers.”
According to Mitnick, his computer addiction was harmless. And that’s partially true. But if you're the CEO of Motorola, Fujitsu, Nokia, or another company from which he was downloading proprietary software, you might feel differently. For the record, it is a crime to steal corporate intellectual property, regardless of whether you then sell it. The FBI finally caught up with him in 1995, and Mitnick was sentenced to five years in prison.
Why was he hacking? Mitnick claims it was for “the pursuit of knowledge and adventure.” Well, maybe. But, as we’ve pointed out about sociopaths and psychopaths, they have incredible craving to be acknowledged for their cleverness. And what more effective way to get recognition than to be wanted by the FBI?
Mitnick, though, differed significantly from Gonzalez and the Akhters in using his personality, not just his technical skills, to gain access to computer systems. He was facile at pretending to be someone else – what’s known as pretexting – and then smooth-talking his way into convincing an operator or technician to give him a password, or a phone number to old-style dial-in modems. Mitnick even noted that his father’s side of the family had been “in sales for generations.”
One of the traits of psychopaths is their ability to coolly take on different personas for the purpose of manipulation. While Mitnick was not technically a practitioner of con artistry – in which money is involved – he seemed to get endless pleasure controlling others. He was very much a calculating loner, but, unlike Gonzalez, his addiction to hacking did not extend to drug use.
Perhaps not surprisingly, Mitnick is now the CEO of his own data security consulting business. He has written many books (including The Art of Deception), and for a fee will speak at trade shows and conferences. His career at this point involves giving defensive advice to the very same corporate community he was formerly attacking. And if there was any doubt about Mitnick’s abilities, you can examine his web page, where he refers to himself as “a genius and one of the most famous hackers of all time.” It appears he’s found a more positive way to focus his addiction.
Sociopathic black-hat hackers can share similar personality traits with the best programmers.
(Image credit: Tima Miroschnichenko / Pexels)
The Sociopathic Organization
Mitnick may provide a possible career path for the Akhters, or perhaps inspire borderline black hats to become “hackers for good.” A more disturbing possibility is that budding sociopaths or psychopaths may not have to change much at all to thrive in their jobs.
In recent years, there’s been a growing awareness that a psychopath’s charm, coolness, ego, and apparent decisiveness makes him or her excellent C-suite material. Many business publications, including the Harvard Business Review, have been sounding alarms on this subject. Of course, a CEO has all those preceding qualities, but psychopaths are also pathological liars, and completely without conscience. That should be disqualifying in non-dysfunctional organizations, but it’s still likely there are a few thriving in any large company.
It has also been pointed out that a modern corporation actually rewards sociopathic behavior. Ex-corporate attorney Jamie Gamble has said that a company’s maniacal focus on profits means that corporate executives “are legally obligated to act like sociopaths.” And when you apply the corporate profit-seeking model to software ventures with their anything-goes work culture, the results have made the news. To name just two more prominent examples: Travis Kalanick, the CEO from Uber, resigning over the toxic work environment he encouraged, and Google executives recently fired for sexual harassment.
It's not that some of these traits on their own, and in less potent forms, are necessarily bad for business. But a more important question remains: How much sociopathic or psychopathic behavior are we willing to accept as normal in the workplace? Based on my own experiences, it’s still far too much.
Ω
Title Image credit: Pixabay
