Beyond the Lulz: Black Hat Trolling, White Hat Trolling, and Hacking the Attention Landscape

Ma Goerzen & Jeanna Mahews Media Manipulaon Iniave | Data & Society www.datasociety.net INTRO August 1, 1998 @ DEF CON August 12, 2017 @THE

First: Mode of governing other users on

Later: users raiding for “lulz” Hackvists drawing media aenon to acvist causes Networked harassment and (oen w/ polical intent) Using controversy to sow chaos and amplify disinformaon Baing journalists into reporng false informaon Manipulang popular opinion To Discuss & Differenate… With You

1. Media (, social) as Security Systems 2. A range of Techniques 3. Possible Goals and Outcomes 4. Various Targets 5. Potenal Vulnerabilies 6. Black Hat, Gray Hat, and White Hat disposions 7. Ethics & Threat Models 8. Trolling: A Bug or a Feature? 9. The Role of the Troll? 40+ CASE STUDIES

• Trolling is to socio-technical systems what hacking is to technical systems

• “Aenon hacking” to set the media agenda, direcng journalists, users and others to informaon that serves their interest

• New media = new vulnerabilies

• Adversement & “If it bleeds it leads” = unpatched vulnerabilies • Source Hacking / Journobaing • Controlled Opposion

• Aenonal Honeypots • Driving a Wedge / Divide & Conquer

• Keyword Squang • Concern Trolling

• Capturing the Narrave • Brigading / Dogpiling

• Cognive Denial of Service • Sockpuppetry

• Brute Force Harassment • Jiu Jitsu / Self-Vicmizaon

• Ironical Bait & Switch •

• Gaming Databases / Algorithmic Control • Context Distoron

• Memec Trojan Horses • Deep Fakes / Photoshops • Troll

• Bait

• Target

• Third-party Interpreter

• Intended outcome • Lulz • Polics • Polical Maneuvering • Incitement

• Chaos / Scorched Earth • Response seeking

• Percepon Management • Community building

• Denial of Service • Community governance

• Lulz / Drama • Demoralizaon / Outrage

• Agenda Seng / Priming • Profit??? • Draw aenon to ignored issues (“agenda seng”)

• Waste aenon and distract from issues

• Direct aenon to pressure enes (“security economics”)

• Draw a telling response (transparency and accountability)

• Deny a response

• Diminish an opponent’s resources or morale – perhaps to exhauson • Peers

• Journalists (and their readers…)

• Social Media Users (potenal allies)

• Social Media Users (perceived threats)

• Policians & Regulators

• Companies and vendors • Clickbait / ”Bleeding Leads” / Breaking News

• Network curaon

• Asymmetric cost to debunk

• Automated amplificaon (bots)

• Adtech

• Context collapse / Poe’s Law / Anonymity

• Push private agenda

• Counter to target’s interest

• Non-prescribed engagement • Non-prescribed engagement

• Sense of public interest

• Demonstrate aack surface (proof of concept)

• Increase pressure on gatekeepers

• Troll to Reveal? • Reveal vulnerabilies selecvely to plaorms

• Disable possibility of non-prescribed engagement through research and educaon

• Reduce aack surface

• Align system with intent

• Blue team plaorms… for profit? • Is “I did it for the lulz” sufficient?

• Is “an-” enough?

• Who judges?

• Does it look different from different perspecves? • Where do we locate the public good?

• What are the threat models?

• Right to free speech with your one mouth?

• Right to amplificaon of that speech?

• Monopolizaon of aenon = DOS of other’s free speech? • Finite lifeme problem

• Can’t verify/invesgate every claim

• Inflammatory lies sckier and more profitable • Gatekeeping under counts • No gatekeeping over counts

• Do-it-yourself gatekeeping tends to tribalism? • Old gatekeeping wasn’t working. Rules for sharing our aenon landscape? Long-term goals? Short-term changes?

• Gatekeeping but not too much? Cracks are where the light gets through!

• Plaorm re-design

• Media Literacy

• Trust and Verificaon

• Disrupng Economic Incenves

• Banning Accounts

• Regulatory Approaches

• Don’t Feed the Trolls / Strategic Silence • Doxing “bad actor” trolls

• “Vulnerability” disclosure

• Shaming or trolling plaorms and newsrooms to change

• P2P moderaon • White lists • Call outs • “Countermemes” or “discursive patches” like Godwin’s Law or “Don’t feed…” • Redirecon / board sliding • Inform intervenons by: • “Security research” / “Penetraon tesng”

• Informing media companies / plaorms of vulnerabilies? • Idenfying bad actors and their incenves?

• Intervening directly by: • Pung pressure on media companies to change?

• Demonstrang aack vectors as “proofs of concept”? • Trolling trolls?