The room beyond is large, cluttered, with a low ceiling, and, in most ways, looks like a university engineering workshop. But there’s one extraordinary feature: an enormous chest-high table that runs the entire length of the room. On this table are sweeping hills, a lumber farm, a town with shops and offices, and a papier-mâché mountain. And winding through all of this, chicaning past a church and finally ending at a depot, are tracks. Lots and lots of train tracks. This is the Tech Model Railroad Club of the Massachusetts Institute of Technology.

The student society started as just the Model Railroad Club. But then in the late Fifties, down the hall came wheeling two huge, fragile, ridiculously expensive and towering machines: the TX-0 and the PDP-1. And it was from this club — with what you can only imagine was startled wonder — that the first undergraduates in the world got direct, face-to-face access with computers.

Up until this point, computers had only ever been housed in the starched, controlled world of military laboratories. Access to computers was tightly limited and normally possible only via specialist technicians. You could never actually touch the computer yourself: you would hand a stack of punch cards to the technicians who, some hundreds of hours later, would give you the result of your program. But the members of the TMRC didn’t have to worry about such bureaucratic control. ‘‘There was no such thing as a computer club,” John McNamara, who joined the TMRC in the early Sixties, told me when I paid a physical visit to the club some years ago. “Step out of here and step to your right. That’s one of the birthplaces of American computing.” As humans and computers began to interact, something incredibly important began.

Some TMRC members approached computing with a kind of monastic devotion. Scruffy, disheveled, and almost exclusively male, they would stay awake through the night for the chance to get in front of the computer and get down to programming. They were also, at times, smelly: body odor was measured in “miliblatts”, named after one of the TMRC’s most legendary hackers, Richard Greenblatt. This was a new culture, with its own language, and in-jokes. To “munge” something was to “Mash Until No Good”. To “gronk” an item was to destroy it. “Losing” code was ugly and inefficient. “Winning” code was the opposite. But one word has lived on more spectacularly than any other: to hack.

Today, hacking is often considered to be synonymous with illegality. Think of the cliché of the hacker: a man, wearing a black hoodie, coding ones and zeros, for some reason green, into a computer. His face is probably covered by the shadows of a darkened room. But that image is far from what the word “to hack” actually means. In the TMRC, “hacks” were computing achievements that combined technical mastery with a sense of creativity, fun, even whimsy. The first computer game, Spacewar!, would have been considered a hack by the people who wrote it. The early hackers created a program that would instantly convert Arabic numbers to Roman numerals. Why? Simply because it was difficult to do. They also computerized the timetable of the the Tech Model Railroad itself; surely the first railroad in the world to join the digital age. This was the birth of the hacker mindset that thrilled in making computers do things no one had done before. Hacking was not necessarily illegal, but it wasn’t necessarily rule-following either. “Lock hacking” was developed so TMRC members could break into the computer at night. The old world of inefficient bureaucracies, clunking hierarchies, and — yes — formal rules didn’t understand computers, and so was to be largely discarded.

As charted in Stephen Levy’s definitive account Hackers: Heroes of the Computer Revolution, the hacker mindset that began in that dusty model railway club has stretched and evolved over time. By the 1980s, hacking’s center of gravity had shifted coast to San Francisco and the Bay Area, with groups like the Homebrew Computer Club hosting hackers not just writing code but tinkering with personal computers and electronics. Things became bigger, more commercial and some hackers shed some of the counter-culture of previous years, and thence, hacking created the richest men and largest companies in the world. Before it was renamed, Facebook’s address was 1 Hacker Way.

Nowhere is it clearer what hacking now is, what it has become and how it has grown since the days of the TMRC, than on one summer weekend in the Nevada desert. Once a year, hackers descend on Las Vegas in their tens of thousands to attend Defcon, the largest gathering of hackers in the world. There you’ll spot a cluster of bright blue mohawks, plenty of blockchain tattoos, and code jokes printed across black T-shirts. While less nerdy and introverted than the TMRC, today’s hackers are effectively doing the same thing: lock-hacking, sharing code, and delighting in the art and mastery of the best hacks.

The hacks on display at Defcon are astonishing. I have seen laptops hacked with light. I have seen hackers peer into secret instructions that have been written inside processing chips. Someone once explained how they could cause wind turbines to explode. Another showed a crowd how to make elevators go up to unadvertised floors. And then, I’m embarrassed to say, I’ve been hacked myself. In what I can only describe as 10 seconds of crushing naiveté, I pulled my credit cards out of a protective pouch to buy a bottle of water in the oppressive heat — only to come home to see a dozen Uber Eats orders had been placed.

The convention floor is always a curious place. Intermittent cheers can be heard against a constant techno soundtrack. This year, one burly, tattooed hacker bellowed “hack the world” from the stage. He later told me he worked in the Supreme Allied Shenanigans Division. The room, lit up by neon signs, is littered with dozens upon dozens of competitions. In the Beverage Cooling Contraption Contest, teams compete to chill a drink in a red cup as quickly as possible. Then there’s a fiendishly difficult contest which involves cryptographic puzzles scattered online and physically across the room. An anonymous team of furries collected their prize wearing animal masks — they’ve won that competition every year. Running around the convention floor are those who organize Defcon. They wear only red and go by the name “goons” — the origin of the word, like many things at Defcon, is the product of some long-ago in-joke.

The only rule is to absolutely not film the crowd. Otherwise, almost anything goes. Most attendees turn up with $500 and nothing else: no name or registration needed. Some wear masks the whole weekend. But there are also police lurking on the convention floor. One person tells me to look out for people wearing Pikachu hats because they’re from an intelligence agency. Another flashes me his military police badge.

More from this author

Will chatbots become cult leaders?

By Carl Miller

What binds hackers across social divides, political chasms, and even both sides of the law itself is a particular mindset. Hackers fundamentally believe in computers — in access to them, the power of them, and their capacity to improve our lives. They mistrust authority and hierarchies, but also do not trust locked doors, black boxes, hidden code or anything else that might be used to control them — they will go to extraordinary lengths to break them open. Above all, they revel in the art of the hack: they have come to see technical mastery as a very human act of self-expression and creativity.

Hacking, though, isn’t just fun and games. Scientists sometimes perform “biohacking”, where they apply the same hacker ethos to questions of human implants, sensory augmentation and smart drugs. It has also become intertwined with geopolitics. “Making Putin mad since 2014,” said Ukrainian hacker Alex Holden at this year’s Defcon. Holden has been locked in a digital duel against a Russian cyber-criminal group called Killnet that sometimes works on behalf of the Russian state. For years, Holden and Killnet have tried to track, infiltrate and expose each other. Holden finally managed to identify its leader as the former drug dealer Nikolay Serafimov, hack a Russian drug market central to Killnet’s operations, and finally cause the group to disband.

But even among hackers — people whose very identity is wrapped up in technology — the shadow of AI automation is looming. Some of the competitions this year anxiously explored the increasing capabilities of AI agents. In fact, the first thing I saw at Defcon this year was a team of college-age hackers picking up a giant $4 million check for a competition to train AI to identify vulnerabilities in code. The organizers of the contest — the US federal agency Darpa, inventors of the precursor to the Internet in the late Sixties — deliberately introduced the defects for the AI to find with no human intervention. The results were staggering: not only were the models brilliant at finding the introduced vulnerabilities, but they also found real ones in code that millions of people use every day, and that no one had ever noticed. “The world changes today,” said a man standing on a huge stage, facing thousands of people staring back at him.

Matters such as cyber-security and online privacy will ultimately be determined by dueling mathematical models. AI, used by both attackers and defenders, will race across millions of lines of code, in desperate search for vulnerabilities to either plug or exploit. This isn’t necessarily bad news, by the way; it may well be that AIs dramatically benefit defenders over attackers. But it will make these sorts of conflicts more inscrutable and shadowy to all of us who don’t spend our lives thinking about them.

So will hacking itself be swallowed by AI? Well, it is no accident that the TMRC hackers, as really the first computer club in the United States, became the core of the first group devoted to studying and building artificial intelligence. Naturally, they saw, before anyone else, that computers were more than expensive number crunchers. Lurking in the machine was, the hackers probably felt as much as knew, the potential for machine intelligence. And there is something fitting how, 60 years later, the descendants of these early computers aren’t just getting hacked; they’ve become hackers too.

There’s no point sugar-coating it: a computer is a portal to a very dangerous world. You can’t see cyber-crime. It happens on screens behind closed doors. Most victims don’t report it to the police. Many are embarrassed to even tell relatives.

But crime has completely transformed over the last decade. A touch under half of the crimes that people in the UK fall victim to are committed over the internet. Online fraud is now the most common crime in the country. Your social media accounts are as likely to be burgled as your house. You are more likely to be hit by a computer virus than all forms of violent crime put together.

Crime on the internet – like anything on the internet – traverses borders effortlessly. But law enforcement doesn’t. You’re more likely to be victimised by someone on the other side of the world than across the street, and your local police force will struggle to get that person into a courtroom – assuming they can find the perp in the first place.

Suggested reading

The truth about the 'techlash'

By Carl Miller

Any hacker worth their salt knows all this. And they know that there is only one person  responsible for their online safety. Not the tech giants, not police forces, not their banks. They can rely only on themselves – and there’s a phrase they use when they think about keeping safe. The phrase is ‘OPSEC’ – or operations security.

OPSEC isn’t rocket science. You don’t need to be a computer genius; you don’t need to know how to code. It’s a mentality that acknowledges there are bad actors out there. It sees every action that you take online as having implications for your security, it urges you to think systematically about them, and tells you to use countermeasures.

OPSEC is your online footprint – it reaches from the furthest corners of the internet to the devices that you use and takes into account the things that you do every day. This is your ‘attack surface’; this is where you are vulnerable. You must do hostile reconnaissance on it to discover what you have left for others to exploit.

So step one is to see if any information has already been leaked, hacked or dumped about you over the years that you’ve been online. Visit the website www.haveibeenpwned.comwhich allows you to type in your email or account information to check if you’ve been caught up in any of the umpteen data breaches that have happened over the last few decades, often without companies either telling you about them or even knowing about it themselves.

Suggested reading

Who commands the internet?

By Carl Miller

Then, try to put all the open source information that exists about you into a single picture. Visit pipl.com and type your own name in. There you will find all the information about you that’s freely available in the public records. Carry out targeted Google searches for your bank account number, telephone number, specific address, national insurance number. All of these can be put together to begin to take your identity away from you. Check your social media to see if there any password unlock clues there – your eye colour, a pet’s name, your mother’s maiden name. Compile a dossier. If you didn’t find a lot – great. If you did, visit each source to see what you can remove.

Then visit Clearscore by Equifax and check who’s looking at your credit history. Someone you don’t recognise? It might be that they’re scanning identities to see who’s alive. It’s not proof you’re being targeted, but they are like small calling cards, indications that a threat might exist.

Check your devices and networks. Anything connected to your home network can be compromised. What in your house is connected to the internet? Do these devices (Alexa; telly; heating system and so on) have default passwords? If so, change them.

Suggested reading

The dangerous power of the clickbait king

By Carl Miller

Do you use a router? Update its firmware. If you don’t use a firewall on your computer, get one or enable it. If you don’t use a VPN to connect to the Internet, look it up and buy one today.

If you don’t use two-factor-authentication for your accounts, then you are asking for trouble. Check and install it. New flaws are found all the time in all the software that you use. Keeping them all updated and patched is absolutely vital.

The most important part of OPSEC, however, is behaviour – what you actually do with your computer. And your riskiest behaviour will be how you handle your passwords. If it’s a recognisable word, why are you even bothering. If you use the same password across a number of different platforms, change it. If you have passwords stored in browsers, they can be got at. If you are trying to remember all your passwords, you won’t be able to.

This brings me to a general rule of OPSEC: the most convenient option is never going to be the safest. So you, like many hackers, need to take your most private parts of your life out of the digital realm. The most important piece of technology to keep your passwords secure? The humble notebook. Write each of your passwords in the notebook, and use a cypher so if it is stolen, it is useless.

Suggested reading

The dangers of a digital life

By Carl Miller

Meanwhile, stay vigilant. A lot of hacking is what is known as ‘social engineering’. This isn’t about fooling your device, it’s about fooling you. An email from your ‘boss’ that gets you to click a link. A mailed USB stick that you plug into your computer. A telephone call from your ‘bank’ that causes you to reveal account information.

OPSEC begins with a simple ABC: Assume Nothing. Believe No-one. Check everything. It’s a way of turning the deep, lurking, unknown dangers of the digital world into ones which are understood, measured and mitigated against. There is, remember, no such thing as being completely safe. Nothing and no one is completely un-hackable. But you really can make yourself a more difficult target.

With all the debate now erupting about government regulation, about the role of the tech giants, fines for harmful content and likely new laws to criminalise certain activity, don’t rely on the big institutions that surround you to keep you safe. Remember that you, yourself, remain the best layer of defence against the threats of the digital world. All it takes is a bit of healthy paranoia.

The early internet was a pretty innocent undertaking. Its architects were similarly-minded, collegial academics scattered across a range of elite universities and defence science laboratories. They knew that computers needed a common language, a common series of rules, if they were ever going to be able to talk to each other. There were a number of competing visions, but one protocol eventually won. It emerged to define the internet: called TCP/IP.

Transfer Control Protocol/ Internet Protocol. Even its name is unimaginably boring. Hardly anyone knows how the protocol works, and the vast majority of people who rely on it every day don’t know that it exists. But this tangle of code is undoubtedly more important than any law, any charter or covenant, for enshrining the rights, at least online, that you enjoy today. Just a series of rules, TCP/IP was written into the way the internet worked, and it reflected that innocent time.

Suggested reading

Who commands the internet?

By Carl Miller

The internet, TCP/IP says, must be free to use. It is a network that any computer, anywhere can join. All the data that passes through the internet, it says, must be treated equally, and computers are entirely disinterested about what that data is. And because of the way that it works, the internet would have no reigning authority or centre. No-one would be – really could be – in charge of it. It was a vision for a free-wheeling, open, democratic network of networks.

As the decades have passed, however, the internet has grown beyond the wildest, most unguarded imaginations of the people who first built it. From an innocent network of researchers, it is now more likely to be seen as a playground for hate criminals, information warfare officers and organised cybercriminals.

And yet TCP/IP has maintained its innocent outlook, still letting anyone join, still treating all data as equal still, essentially, trusting people to be who they say they are. Its architects might have imagined the internet as an escape from the tawdry geo-political struggles that blighted offline life, but it is now a key battleground where those very conflicts are being fought.

As the internet has fallen from its state of innocence, protocols – those powerful, forgotten, mysterious things – are now part of that struggle. There is now a competitor to TCP/IP, a very different kind of protocol, that has been rising in popularity. 

Suggested reading

Analogue dictators are no match for digital detectives

By Ian Birrell

It is called Digital Object Architecture, or, another acronym, DOA. Created in the 1990s, by one of the original inventors of the internet, Bob Kahn, DOA has another way of managing information. Unlike TCP/IP, data isn’t anonymous. Everything on the internet gets its own, unchanging digital fingerprint, whether a device, document or a person. Everything gets an identity number that doesn’t change.

DOA has been used to manage libraries and online academic repositories. But it is now being proposed to make the internet more secure. Forged identity is one of the main reasons crime is so easy to commit on the internet, and DOA would likely help change that. A hacker would struggle to impersonate you, because they wouldn’t have your unique identifier. Likewise, a fraudster would struggle to pretend to be your bank. Your financial records, your medical data, your social media profile – everything could be tagged to ensure that only certain people could look at it. It would weave identity and security into the fundamental way that the internet works.

For its backers, however, DOA may solve an even bigger problem than cybercrime. The internet, as it stands, has always been very difficult for states to control. In order to work, huge databases may have to be built, where every digital object is uniquely tagged, and where information is added, tracked and queried. Whomever controls the DOA registry becomes the centralised gatekeeper to all the information, resources and devices on the internet. It would create an unprecedented concentration of power to control and manage online life. And who would probably own the DOA registries? Governments. 

Suggested reading

How technology sidelines the citizen

By Carl Miller

There are reports – confirmed and unconfirmed – that DOA has begun to be rolled out. China may have been first in 2014. In May 2016, the Russian Minister of Communications Nikolay Nikiforov, said “Russia is interested in designing alternative ways of addressing on the internet, such as the DONA [an authority to implement DOA]”. On 16 October 2016 South Africa signed an agreement to use DOA. It’s not clear who else is using it, and that, of course, is part of the problem.

Human rights always exist in tension with one another, and these protocols that run the internet are at the very centre of one of the most important of these tensions. It’s a lot harder for any State to control an internet governed by TCP/IP, but it’s also easier for criminals to flourish. DOA would likely make cybercrime more difficult, but the price would be that governments would have a level of control over digital life that at the moment they simply do not have.

More from this author

The man holding Putin to account

By Carl Miller

This is a big deal. Different governments will take different views on the right protocols for the future. Western governments will probably give DOA a wide berth, whilst others have already adopted it. If that’s the case, we might be heading towards the ‘splinternet’ – a fracturing in the basic way that the internet works across geo-political divides. Some countries will use one protocol, and others another.

But underlying any kind of geo-political fracture in the internet is, for me, a more fundamental concern. Historically, human rights need to be protected by more than governments. They need high public visibility and the aggressive, vocal advocacy of civic society.

Internet protocols may become one of the most important battlegrounds where we fight for our online rights, freedoms and responsibilities. But surrounded by an alphabet soup of international agencies, legalese and impenetrable technical verbiage, they are difficult to explain, to understand, to raise any kind of awareness about. For all but a small handful, they are simply too impenetrable and boring to feel angry about. And that is a huge, huge danger.

It was the deadliest mass shooting in the US for years, yet neither Farook nor Malik had criminal records, and neither were on any terrorist watch list. In the months that followed, the FBI began to grapple with what they saw to be a troubling new phenomenon: online self-radicalisation. Painstakingly building a portrait of Farook and Malik’s life, they tried to learn why both had decided to die for a terrorist group neither had actually met. And to do that, Farook’s Apple iPhone became central to the search. The FBI asked Apple to unlock it, and Apple refused. A court order compelled Apple to open the phone, but again they said they’d legally fight it.

There was nothing unusual about this conflict. The FBI’s overwhelming mandate was to learn as much as they could about Farook to protect public safety. Apple’s, especially in the wake of the Snowden disclosures, was to assure their users that their data was secure – even those who turned out to be terrorists. And both sides saw the argument as far bigger than this single case. Both knew that it would set a new precedent for how security should be balanced against privacy; and both knew that the world was watching, with almost exactly half of the public supporting each position.

The debate was old; what was new was the way it was resolved. Just months before the attack, Apple had released an operating system that meant that Apple itself could not decrypt the device. Technology, in other words, that deliberately made its maker unable to comply with the court order they now faced, or any of the others they anticipated would emerge in the years ahead. The court then ruled that Apple had to write new software to crack the phone, but as Apple prepared to fight that case too, the FBI promptly withdrew the claim. Before the legal process could be concluded or enforced, the FBI had paid professional hackers to find an undisclosed flaw in the software, and broken it open themselves.

More from this author

The dangerous power of the clickbait king

By Carl Miller

For both Apple and the FBI, the battle in the courts had been a sideshow. That delicate, constantly changing trade-off of between privacy and security wasn’t decided by the finer principles of law, courtly argument and judicial interpretation. The decider was the technology itself. Apple had built technology to make the court order impossible. And the FBI had bought technology to mean they didn’t need Apple to carry it out.

The dispute was about something bigger than this single case. It showed that how the tensions, trade-offs and conflicts that we’ve always had are being resolved in an entirely new way.

Technologists have long known that the key questions of the digital age wouldn’t be decided at the ballot box or in the courts. Changing the world, they realised, didn’t mean winning the argument. It meant building new technology to decide the outcome. Technology, they knew, could make things possible or impossible, easy or difficult. You didn’t need to convince people to change, you simply needed to change the options that people had in the first place.

For the disputes that matter most, public debate and legal argument have, just like in San Bernardino, become something of an undercard billing. The main fight is over building technology to simply render the whole moral debate meaningless. In the red corner, technology is being built to usher in one kind of reality, and in the blue corner, technology is being built to stop them. Look almost anywhere today, and you can see the same thing happening. Technologies ‘duel’ with each other to decide what your life – and the world – is like.

Bitcoin is the most famous of this kind of political-technology. From the very beginning its aim was clear: to transform the status quo of corporations and states into one of decentralised networks. If you could build technology that created things like currencies without central banks, they reasoned, you simply make those central banks unnecessary.

Changing the structure of technology was really about changing the structure of society. Decentralised technology would create a similarly decentralised society, one without the concentrations of data, control and yes, power, that centralised systems inevitably produce. Bitcoin was only one of a whole universe of different technologies all trying to achieve this.

Decentralised money, decentralised social media platforms, decentralised email, decentralised shopping, all were aimed at undermining the states, hierarchies and corporations dominant, as they saw it, within the status quo. They saw the digital revolution as an opportunity to break apart old concentrations of power, not to create new ones. The old world pitted against the new. Old concentrations of power versus new ways of dispersing it.

Your privacy is also being decided by duelling technology, too. Apple announces new features on its browser to prevent Facebook and other data companies tracking its users across the web, while ad tech companies quietly build ingenuous, innovative ways of ‘finger-printing’ you as you travel around the web. These technologies duel generally out of sight – and it is largely them, not the body of cumbersome, slow moving privacy law, that decides in practice what your privacy online is.

Suggested reading

How the tech lords privatised the public square

By Jamie Bartlett

The most obvious arena for this technological combat is online security. Go to DEF CON, a huge gathering of hackers and computer security specialists, and you will witness the thousands of technological struggles happening every day, side-by-side, that determine your online safety. Hackers – largely with the same skills – work as offence and defence: inventing entirely new ways to take control of your digital life, and desperately trying to find ways to plug the gaps. What determines your safety online is the outcome of this struggle: what is technologically possible, not what is legal.

Worryingly, these struggles are usually entirely invisible to us. You don’t see how spammers, marketers and even states constantly build bots and fake accounts to avoid detection, and people within Facebook and Twitter build technology to try to catch them. Likewise you don’t see the struggle over who controls the information you consume – behind the scenes some technologists work to game and manipulate search engine results, while Google and others desperately try to stop them.

The grand moral questions of our age are not being decided by public debate, the law, norms, principles or the conventional tumble of politics. They are being decided by a new dynamic, something I’ll call ‘technological achievability’. A clunky phrase, granted, but I think an important one. Is it easier and cheaper for cyber-criminals to find vulnerabilities in your computer, or is it easier for cyber-security specialists to keep you safe? Is it easier for propagandists to build fake accounts, or for the tech giants to detect and remove them? Which outcome, in other words, is it easier, cheaper, or more convenient for technology to be built to achieve.

Of the many shifts in power I’ve spent years trying to understand, this is perhaps the most important. The technologists on the front-lines of these struggles now have enormous moral agency in their hands; those of us who are not blockchain engineers or cryptography specialists, are shut out. However imperfect, the messy web of public debate, norms, law and politics was at least something we could all be involved in. Now we are trapped in the crossfire of the technologies duelling around us. More like spectators than we ever were, as our lives are shaped and moulded in this new way. More disempowered, I think, than we have ever been in the decisions that really matter, that really decide what our lives will be like.

And so, in front of us, a new struggle lies ahead. In an age of blindingly fast technological progress, we need to make morals matter again. How to do that, I don’t know. But the first step is to realise how dreadfully absent they are from the world as it is today.

Carl Miller’s newly released The Death of the Gods: The New Global Power Grab is out now.