Techno-Crimes (Hacking): Managing deviant online behavior, Part 5

By John Suler, Ph.D.

(Page 53 of 53)

All online deviant behavior requires some degree of technical skill because it is being expressed via a computer. What I'll call "techno-crimes", on the other hand, require a bit more knowledge and skill than the ordinary user possesses. In some cases, it may be a rather simple trick that the trouble-maker learned from a colleague or discovered on his own. In other cases, it may be a very sophisticated hack requiring considerable expertise. Basically, a techno-crime involves exploiting the software for purposes other than intended by the programmers. Mild versions would include mischievous pranks designed to impress or, at worst, confuse other users. For example, a user writes a script that makes closed doors look like they are open, or a vicarious lurker manages to alter the room occupancy number so everyone thinks there is an invisible user among them. Sometimes the hack may not be deviance at all but a creative contribution to Palace culture.

True techno-crimes are clearly anti-social and abusive. Directly or indirectly, someone pays a price. The most common types are flooding, crashing, and hacking for passwords and registration keys.

Flooding

Flooding is a good example of an unsophisticated techno-crime. A naive user may repeatedly change avatars, play sounds, or run a script (like opening and closing a door), not realizing that this swamps the server and slows down the conversation in the room - what users call "lag." A true techno-snert understands this effect and floods deliberately in order to gain attention ("see what I can do!") or to disrupt the socializing in the room, probably as a result of feeling alienated and jealous. More insidious and slightly more clever snerts will target a specific person with repeated whispers packed full of abusive or nonsense text, which cripples the victim with lag. Gangs have been known to "gang-whisper" victims by pounding them over and over again with such voluminous text balloons. All deliberate flooders are driven by a need to feel powerful. Having to disrupt other people's ability to communicate probably reflects their own inabilities and insecurities about relating to others.

Possible Interventions - The server can be programmed to disconnect certain types of flooders. Bounce too often on the bed in one of the private rooms (which is a script), and the server automatically will oust you from the site while politely informing you of your faux pas. Wizards also can turn all scripts off in a room where snerts are deliberately using them to flood the server, and then turn them back on when the hyperactive pranksters have calmed down or left (clever snerts might realize they can move to another room and try again). Depending on the particular method of flooding, wizards may also warn, pin, gag, propgag, or, if necessary, kill. One difficulty is that wizards too may be lagged by the snert, which makes intervening more difficult. The intervention may need to be swift in order to remedy the situation as quickly as possible.

Crashing

Crashing other users, or the entire server, is a much more sophisticated techno-crime. On one occasion, snerts figured out a way to use scripts to crash the PC users in the room, forcing them to reboot. The "screechers" used scripts to create a horrible high pitched shrill on the speakers of Mac users (technically, not a true crash... but it sure sounded like one). Wizards intervene quickly with these antics, usually with a kill - lest they become the victim of the crash too. But then comes the more challenging question. How did the snert do it? In some cases, it took the wizards and TPI officials a while to figure out these tricks. Crashing is a good example of the sometimes highly sophisticated technical battle of wits that get played out between the Forces of Good and the Forces of Evil. Looking at the half full glass, some wizards and TPI/EC officials see crashers as an opportunity to fix loopholes in the software.

Password and Registration Key Hacking

A hardcore netter once defined a "true hacker" to me as someone who illegitimately breaks into a system in order to access restricted privileges or databases. If this an accurate definition, then Palace has had its share of hackers. Usually they try to crack the password safeguards to gain wizard powers (impersonating a wizard in order to persuade another wizard to reveal the password is another tactic, but not really hacking). Others try to crack or bypass the registration key system in order to gain membership abilities without paying. Safeguards built into the Palace program eliminate some of the less sophisticated hacks. Anyone who persists in trying to figure out the wizard password will be automatically disconnected from the site after a few failed tries. The more sophisticated hacks are much less frequent. Similar to flooding, it becomes a cat and mouse game where the Palace technical team detects the hack and fixes the loophole. Sun Tzu, the famous Chinese warrior and strategist, stated that you must embrace the enemy's attempts to detect your weaknesses. With this knowledge, your defenses can be fortified.... Or, as Nietzsche once said, "that which doesn't kill me, makes me stronger."

Inside the Hacker

What motivates the hacker? Some are captivated by the challenge and excitement of venturing into forbidden territories. They derive a sense of accomplishment, mastery, and power from doing what others can't. Impressing other users, especially one's fellow hackers, is a source of self-esteem. Some are motivated by a rebellious nature. Cracking the system of the "institution" reflects a defiant attitude towards authority figures. Psychoanalytic theory would predict an underlying Oedipal striving to challenge and prove oneself better than the father. In extreme cases, a hacker - and especially hacker wannabes - feel pressured to demonstrate that they are better and smarter than anyone. The cat-and-mouse drama of beating the system becomes a tireless, relentless quest to prove oneself. "I will prevail" becomes the battle cry. Defeat creates feelings of powerlessness and humiliation that fuel the fires. Driven by inner insecurities, they brag about their accomplishments and supposed powers (like being able to kill). When other users (and undercover wizards) ask them to display these powers, they make excuses. Such false bravado and desperate needs to prove oneself may be more common in the hacker wannabe than in the truly skilled hacker.

More on Intervention Strategies

In this section I'd like to expand on some of the intervention strategies discussed earlier. I'll discuss them here in a more general context rather than related to a specific type of deviant behavior. All intervention strategies can be categorized according to three dimensions:

- Preventative versus Remedial: Does the intervention create conditions that attempt to prevent the deviance from ever occurring, as in creating restricted areas and controlling traffic flow. Or does it attempt to fix the problem after it appears, as in pins and kills? Preventative measures shape the culture at the congenital level, while remedial measures correct aberrations in the culture's evolution. "Secondary" prevention detects a problem in its very earliest stages (before it's yet a problem) and averts its development; "primary" prevention keeps a problem from ever occurring at all. As the saying goes, an ounce of prevention...

- Interpersonal versus Technical: Does the intervention primarily rely on a psychological or social process, usually a wizard personally assessing the situation and persuading the offender to behave, which requires social skills? Or does it rely on a software tool like pin, gag, kill, or even fully automated server actions like killer bots? Many strategies combine the interpersonal and technical approaches in various mixtures. Without the human touch, technical tools like pin and kill will only be marginally effective. For this reason, with few exceptions, TPI/EC officials discourage wizards from taking action (pin, gag, kill, etc.) "across rooms" - without actually being there in person with the offender. Fully automated server actions surely save time and energy, but online "community" means people interacting with people, not with programs.

- User or Superuser: In the case of technical tools, is the feature available to all users (e.g., "mute") or just superusers/wizards (e.g., gag, pin, kill)? The overarching issue is power - and who has it. Presumably, the basic interpersonal interventions are available to everyone, although not everyone will be skilled at those interventions.

Big Brother is Watching (Presence)

Establishing a presence - a mostly psychological intervention - can achieve a lot in preventing mischief before it starts. If wizards are nearby, snerts will tend to behave. For this reason, TPI strongly encouraged wizards to wear their badges (unless they were off-duty). Of course, even if wizards are present, snerts can always slip off to another room to pursue their antics. Following them might then be perceived as harassment. Using scripts, wizards could monitor activity in another room (e.g., detecting foul language) and then when necessary inject a warning from across rooms, but this constitutes eavesdropping. It's a delicate balance between establishing a healthy "presence" and slipping into the role of an intrusive Big Brother. By strolling through the site (patrolling) and sending global messages across all rooms, wizards can let all users know that they are there, somewhere.

Nazis and Bleeding Hearts

Wizards have jokingly drawn a distinction between their colleagues that seem like "Nazis" and those who act like "Bleeding Hearts." Of course, these terms are parodies. Neither extreme makes for a good intervention philosophy. Wizards who discipline users out of a need to control, feel powerful, or forge some imagined "perfect" society need retraining and an honest look at their own motives. So too for overly sympathetic wizards who fear confrontation, anger (including their own), and being disliked.

Taken down several notches, the Nazi/Bleeding Heart distinction does point to two very different, equally viable methods for handling deviance. The distinction reminds me of the psychological research on parenting styles which demonstrated that strict and permissive approaches both can work well in raising children - as long as the parent is not acting cold, distant, or cruel. Being firm and decisive, but also fair, may be just the right medicine for certain types of misbehaving users (the "tough love" tactic). Other problematic users may respond better to a more sympathetic, tolerant approach. Some wizards may be better at one method and not the other, which means that one wizard may call on another to handle a situation because "your style works better with this type of person." Some interpersonally talented wizards will be effective at both styles and can switch accordingly.

Entire online communities may endorse either a strict or permissive philosophy. Those determined to make their home a friendly and peaceful place may quickly dispense with trouble-makers. Those with a more open and permissive ideology (and those run by a business that needs paid registrations) may be more tolerant. The composition of wizards - strict, permissive or a mix - will be determined by the site's philosophy and will reciprocally shape the site's philosophy.

The various intervention strategies discussed throughout this article fall at different points along the strict/permissive continuum, with a leaning towards the permissive end.

About the Author

John Suler, Ph.D. is Professor of Psychology at Rider University. This article comes from his online hypertext book The Psychology of Cyberspace which describes his ongoing research on how individuals and groups behave in cyberspace. His work has been reported by national and international media, including The New York Times, The Washington Post, the BBC, and CNN. www.rider.edu/~suler/psycyber/