The newest hacker community in the United States is nowhere near Silicon Valley.
by Joe Pappalardo
A man named Tinker clutches an HDMI cable as he bumps through the crowd milling in front of the stage at Family Karaoke, a joint on Dallas’s east side. A former Marine, Tinker has a solid but not overly muscled frame. Less weight lifter than baseball infielder. He has a voice that belongs on a live-fire exercise. It booms, even over the thrump of the techno blasting from two speaker towers on the stage.
“Okay, what’s the first rule of this place?” he asks the crowd before answering his own question: “Don’t hack the venue!” This is the monthly meeting of the Dallas Hackers Association, the largest of the local groups—for there are many more than you would expect. A hacker named Wirefall started DHA in June 2013. A handful of people showed up back then. Tonight, under 1970s-chic red and purple neon, Family Karaoke is filled with enough attendees to worry a fire marshal. Nearly 150 hackers, and those who might be called hacking enthusiasts, sit on stools and around small tables. Security pros, hash crackers, fledgling programmers, and a few members of the curious public. None are here to sing. They’re here for this month’s firetalks—15-minute presentations of firsthand achievements in subverting, repurposing, reprogramming, or overriding modern technology.
North Texas has become an unexpected haven for hackers seeking not only camaraderie but paid work. There is an ecosystem here that can sustain them. The Dallas–Fort Worth area has the most available cybersecurity jobs in the nation. Community colleges and universities are building cybersecurity institutes. The area has a history—starting with Texas Instruments in 1951 and through today, when AT&T, Raytheon, and Facebook’s new data storage facilities are located nearby. All of those companies need smart programmers. And cybersecurity. They need hackers.
Tinker’s rule—don’t hack the venue—was instituted after organizers had to apologize to the hosts at their previous meet-up location after someone hacked the cashier system. It’s necessary instruction again here: “We have surveyed the cell towers in the area and there are two new ones tonight,” he says. The phony tower signals are set up to trick cellphones into connecting so that their data can be surreptitiously collected. “C’mon, guys,” Tinker says. “Do not shit where you eat!”
Another hacker, WhiskeyNeon, deejays from his laptop on stage. (Like fighter pilots, hackers have call signs that they prefer to use in public.) He turns down the hard-edge techno a little. Behind him, images flicker on a drop-down screen: “Support Your Local Hacking Community,” “Watch out: The Feds Have Eyes Everywhere,” and slides promoting DC214, Hack Fort Worth, OWASP, North Texas CyberSecurity Group, and other hacking associations in the area.
“WHERE ARE THE FBI AGENTS? THERE’S ONE,” TINKER SAYS.
Another driver of growth is how uncommonly accepting the city’s hackers are of new blood. “These people have been alone, or just virtually connected,” Wirefall says of the crowd. “Now they have found the place for people like us.” People like WhiskeyNeon. Like many in the crowd, he’s a transplant. He moved here from Louisiana in 2015 after hearing about opportunities from a group of trusted phone phreakers. “Every good thing that has happened to me in my life has come from DHA,” he says. He traces his entire circle of friends, income from consulting, startup business connections, and girlfriend directly to the group. “It pulled me out from a very dark place.”
Wirefall has helped a lot of people like Whiskey. Sometimes they call him the hacker nanny. Tonight he wears a T-shirt with a silhouette of Sherlock Holmes seated at a desktop computer. He has a gray beard and stout frame, a former weight lifter and Air Force radio repairman who channels Friar Tuck—a frontline monk who protects a band of idealist troublemakers from their own impulses.
Along with the centralized bar and restaurant, DHA has commandeered several karaoke rooms. In one, a dozen hackers sit on couches, laptops and tablets used for penetration testing (called “Pwn pads”) on their legs, competing to crack password cyphers. In another, a handful of people work slender tools to open handcuffs and padlocks under the long-lashed eyes of MoeBius.
MoeBius has a cool handle, but she’s not a hacker. Her boyfriend is a DHA organizer. Her lock-picking hobby quickly became a specialty and a draw, not just at DHA but at larger hacker conferences and local cybersecurity camps for kids that are run by local colleges and the Girl Scouts. Lock-picking has plenty in common with hacking. It combines skill with trial-and-error patience and using the right tools to manipulate a lock’s tumblers to get the correct configuration. Like pickers, a skilled hacker can either safeguard people’s belongings or gain unwanted access to something they shouldn’t. On the main stage, an anonymous hacker describes a recent exploit he discovered. It allows him to access corporate networks through the starfish-shaped polycom boxes that are ubiquitous in conference rooms. DHA prides itself on disclosing these vulnerabilities in public, without warning those who own the systems ahead of time. And they like to gloat. “We’re dropping zero day exploits like F-bombs,” Tinker says to the crowd.
Then he starts in on the undercover agents that he’s sure are in the room. “We have a sheriff’s deputy here, but he talks so it’s cool. The FBI guys just sit there and lurk.” He looks around a little more. “Where are the FBI agents? There’s one,” he says, pointing to a young, professionally dressed man. “They triangulate, so the other one will be somewhere over . . . there.”
This game of spot the fed is common at DHA meet-ups. Everyone has theories on who they could be. The agents often come in pairs but sit apart, they say. They tend to be younger, too, delegated to a task considered to be low on the totem pole. For its part, the Dallas FBI office says that the FBI doesn’t conduct any official outreach with groups like DHA. Which is interesting phrasing, considering the number of DHA hackers who say FBI agents have quietly approached them to either help with an investigation or to build a case on someone else. Tinker keeps an FBI agent’s business card in his wallet.
He’s wrong about the guy at the table. It turns out he and his colleagues are not looking to arrest hackers but hire them. Tech firms send recruiters, often attractive young women, to DHA to scout talent. They buy pitchers of beer for the hackers, enticing them into conversations about job opportunities.
“PARENTS WHO ACTUALLY WANT THEIR KIDS TO BECOME HACKERS? THAT’S AWESOME,” SAYS WIREFALL.
There are always recruiters at these meetups because there are always jobs to fill. Texas glows on a heat map of cybersecurity jobs. CyberSeek, an interactive tool funded through the National Institute of Standards and Technology, shows 21,000 open cybersecurity positions in Texas. Nearly 10,000 of them are in Dallas–Fort Worth. That’s nine percent more jobs than there are in San Francisco.
DHA’s internal oral history includes tales of irredeemable hackers who were offered jobs the very night they presented at the karaoke bar. Of hackers who slept in their cars when they arrived at DFW and are now gainfully—and legally—employed. Of self-taught hackers who scored jobs with major telecom companies through connections made at DHA. Tinker himself hires his freelance crews of penetration testers mainly from meet-up participants.
The stories get out. There’s now a new generation that will continue to grow Dallas’s hacker culture: “We’ve seen parents who come to learn about information security so they can get their kids into it,” Wirefall says. “Parents who actually want their kids to become hackers? That’s awesome.”
At the end of the night a small crowd lingers. New hackers corner experienced ones with hardware questions. One of the suspected federal agents tries his hand at a challenge in a side room. Everyone seems to have a vape. They make new connections and greet old friends. Swap stories of corporate clients gone bad and local hackers made good. They gripe about the hacking challenges at national infosec conventions and the teams from security software companies that dominate them.
It’s not a place for plotting. It’s too public for that. These are afternoon-in-the park conversations, albeit with a tech edge and under neon. The kind of exchanges that bind you together. That transform you into a community.