Hacking as an act of faith

The Baltimore Sun

It was 2003, it was Vegas, and Johnny Long was a rock star.

He slung the blue speaker badge around his neck - careful to make sure everyone could see it - and strutted through the DEF CON hacker convention with his nose in the air and his ears set to whisper mode, listening for the buzz.

Too cool to make eye contact, the 32-year-old cut a path through the crowd, which was mostly made up of men wearing some variation of a black T-shirt, the unofficial uniform for the three-day conference.

Johnny, the Maryland kid who once networked computers in his backyard for fun, had grown up to become a professional hacker, joining an elite team of cyber superheroes - called "StrikeForce" - that was paid to break into computer systems.

And that, along with his knack for using Google to help break into cyber security systems, had just won him a coveted speaking slot at the world's biggest underground hacker convention.

The platform at the conference was easily the highlight of his career, the big payoff for all those late nights staring into a computer screen, the missed time with his wife and kids, and even the high school years when the popular kids ignored him.

Johnny (or j0hnny, as he was known online) had arrived.

And yet, in the wake of this much-anticipated triumph, he was surprised to realize that the only thing he felt was emptiness.

It wasn't that he didn't kill during his talk (he did), and it wasn't that the August conference was a dud (it wasn't). It was just that after it was all over, Johnny felt nothing. He was hollow.

How could that be?

He had fantasized about reaching this point for years, sacrificed most everything for it. Now that it was here, where was the euphoria? Where was the high? After all this time, all this effort, he couldn't help feeling - there was no other way of putting it - cheated.

And just like that, Johnny Long - to all the world, a man on a rocket ship bound for the top of his field - found himself smack in the middle of a midlife crisis, years before midlife.

He returned to his home outside Baltimore where he stewed for a couple of months, envying all those others who had what he didn't: a purpose in life, a meaning to day-to-day existence and pursuits.

He decided he had to shake things up.

And so, as the summer gave way to the fall, he sat before his computer one day, and let his fingers tap out the most explosive thing he could think of to say about himself on his Web site. Under the heading, "Who is this johnny guy?" he typed out this description: "a hacker and a follower of Jesus."

And with that, Johnny was sure he'd officially stuck his neck out, and all but asked for someone to hack away at it.

Little did he suspect that the months of uncertainty and doubt would soon lead him to a dusty and desperate Ugandan village and a spiritual renewal unlike anything he'd ever experienced.

On the outside

Hackers are a mixed lot.

There are good guys (a k a "white hats") who use their tech talents to expose security flaws so that they can be fixed. There are bad guys ("black hats") who expose security flaws so they can be exploited. And there are the other guys, who just like showing off.

But there's one thing that's true of most of them: They're all pretty much outsiders. Outside establishment, outside mainstream, outside average. Oh, and their egos are overactive.

"The overwhelming tendency is to have a very idealistic and libertarian outlook and to be anti-government," said Avi Rubin, the technical director of the Johns Hopkins Information Security Institute. He's never met Johnny, though he's heard of him and bets Long fits the mold.

"Sounds right," Johnny later agrees, "except for the idealistic part."

He can talk for days about himself and isn't at all shy about recounting his fame. He likes to dye his hair to stand out at conferences, and he wears a thumb ring because he thinks it's cool (something he picked up from a former colleague).

For the record, he's also funny, self-effacing and a hands-on dad to his three kids. He takes in stray cats, houses a Korean exchange student, mentors dozens and wants to be a ninja (he has a brown belt in Bujinkan Budo Taijutsu).

His mother, Sharon Long, fills out the profile of the hacker as a youth. "He was a terrible student; he was bored in school," she recalls. "But he would test through the ceiling."

When Johnny was about 10, he got his first computer, a Texas Instruments 99/4A that Bill Cosby was hawking on television.

Initially, it was tough to see the hacker in the boy, whose first interactions with the machine included cutting out construction paper shapes and taping them to its television-screen monitor in an unsuccessful attempt to create a video game.

But soon, something in him switched on. He began checking out library books and - being a kid - taught himself the code to repeat the words "You suck" indefinitely on a monitor. When he graduated to more complex programming than his computer could handle, he tested his creations on high-powered Commodore 64s on display at Kmart and RadioShack.

Holed up in his bedroom, his face lit by the screen's glow, Johnny felt like a magician, in control of everything he touched.

By the time he was a teen, he was a regular on virtual gaming bulletin boards, which started out free but eventually began to charge. That's when a hacker was born. Soon enough, young Johnny began plugging in various user names and passwords until he cracked the codes and gained entry, slipping past the virtual cashier directly onto the boards.

It was his first taste of the exhilaration that comes from beating a system. And one of the few ways he ever did it illegally. He may have had an outlaw streak in him, he realized early, but he wasn't an outlaw.

"We were cut from the same rock of ethics, so to speak," said Chris Cooper, Johnny's best bud in middle school. "We were decent kids; we didn't get into a whole lot of trouble.

"The bond for John and I wasn't so much computers. The bond for John and I was the type of people we were."

And that type was Christian.

Turning away

Johnny's family bounced around the Baltimore area, living in Eldersburg, Glen Burnie, Arbutus and Randallstown. An only child, his constants were church and doting parents, who - he'll readily tell you - spoiled him just shy of rotten.

He was raised Baptist, with a smattering of Presbyterian. He was taught to be God-fearing, to honor the church and to emulate its leaders, according to his parents.

And he was OK with most of it, except this: Churchgoers, to youthful Johnny, just weren't cool. And if there's one thing he wanted to be, it was cool. They didn't dress right, they separated themselves from the mainstream, and they talked about faith as casually as the weather.

Try that in high school, and your lot will get 10 times worse, thought Johnny. He was far more interested in crafting an image as a fringe skater kid, with red light bulbs in his bedroom, big hair and a thing for Depeche Mode.

So, in typical teenager fashion, he got snide and judgmental, dismissing Christians as "culturally and socially inept."

Nevertheless, his parents insisted on his continued presence in church; what they couldn't do is keep his mind from wandering to less spiritual pursuits, namely parties, cars and girls.

Despite lackluster grades, Johnny made it out of high school with his diploma in 1989. He got a job as a computer operator at Catonsville Community College, took a few classes, got bored and dropped out.

He took an IT job with a health insurance company and spent three unfulfilling years there until a friend took him to a career fair in 1996. There, Johnny landed an engineering position at Computer Sciences Corp., or CSC, a long-established technology giant with offices around the world and headquarters in California.

Within months, he and a select few at CSC banded together to create StrikeForce, their version of good-guy hacker heaven.

'Adrenaline rush'

You've seen their ilk in the movies: a secretive team of tech-savvy super sleuths who use their skills to sneak into off-limit areas and snatch some kind of treasure, usually cash or state secrets. But StrikeForce only sneaked into places to prove it could be done.

Not that its agents don't use stealth and subterfuge.

"You have to go in and convince somebody you belong there, then talk the talk and walk the walk and bypass the controls," said Jason T. Arnold, one of five StrikeForce founders.

The group was among the first real-world crews of cyber-security experts. They were paid to physically break into offices, through cunning rather than force, and crack computer systems to show where the weaknesses were and how to fix them. Their clients included federal agencies and private organizations, for whom StrikeForce helped secure systems and prevent data leaks. The group also developed CSC's first software product - an automated attack tool.

Generally, to be a member of StrikeForce was to feel superior and pretty cool on a daily basis.

Arnold's focus was on network protocols and security. Another guy was good at applications and a third the software expert. Johnny was into the "attack and penetration part," Arnold said. "He was the one most passionate about that."

They used to watch movies, Sneakers and The Matrix and the like, to get pumped for jobs. Then they'd go in, using fake badges and phony identities to fool guards and receptionists and bypass computer firewalls and other so-called safety measures.

For Johnny, it was a meteoric high.

"There was such an incredible adrenaline rush, any criminal will tell you. It was just phenomenal, the rush of breaking into a place, the rush of beating their firewalls," he says.

This is what Johnny does best - hunt for weaknesses. He scans people for clues about their lives, computers for access codes taped to their keyboards, employee badges for work details and the TV sets in hotel rooms for ways to unlock restricted channels (which eventually led to his viewing customer bills, e-mails and movies through the television).

He's obsessed with vulnerabilities. He's worked so hard to avoid them in his own life - even giving up alcohol to remain in control - that he's now hardwired to find them elsewhere. And he'll use whatever tools he can to seek them out. Even Google.

Johnny and his team found that if you tailored a search just right, Google gave up the goods not only on people, but also on computer networks. At home, he tested Google's limits looking for particular types of files or flubs that revealed way-too-detailed error messages, vulnerable servers and, yes, passwords. ("PASSWORDS, for the LOVE OF GOD!!! Google found PASSWORDS!" Johnny wrote on his Web site.)

He started posting some of his Google findings and, after a short while, drew a following of fans.

And before he knew it, Johnny was on his way to being famous - among those impressed by that kind of thing, anyway.

"He's made a name for himself in that arena," says Jeff Moss - a k a "The Dark Tangent" - who founded the DEF CON hacker convention in Vegas in 1993.

When the DEF CON committee selected speakers in 2003, Johnny's name was on the list. It's been there every year since.

"There's probably a handful of people that you know will fill a room, and Johnny's one of them," said The Dark Tangent, who's based in Seattle. "He's pretty much a rock star."

Celebrity status

Surprisingly, rock star proved not to be enough. Johnny figured that out after DEF CON.

So he outed himself as a Christian, and hoped by simply saying it publicly, it would actually take hold, even if it ruined his professional reputation.

For all her devotion, his mother, Sharon Long, wasn't sure it was the wisest professional course.

"I don't think we live in a culture that sometimes wants to hear about spiritual matters," she said. "Putting his faith out there ... was taking a risk."

In other words, he'd just dared fate to quash his career.

Instead, it took off.

Despite Johnny's worry, pretty much nobody noticed his post - or didn't much care if they did. Within a month, a publisher had called and asked Johnny to write a book (Volume 1 of Google Hacking for Penetration Testers was published in 2005, and Volume 2 hit the shelves last year). That led to a dozen more book projects.

He became a talking head on CNN, MSNBC and CNET. Within a year, there were more than 80,000 users registered on his site - johnny.ihackstuff.com - up from 500.

He was also spending more time with members of the nondenominational church he and his wife, Jen, the product of two missionary parents who has never been one to shy away from a charity case, joined a few years after marrying.

"I've seen him get more intentional about his faith, about the role he believes God plays in his life," said Mark Norman, senior pastor of Fulton's Grace Community Church. Norman got to know Johnny through a church Bible study group. "There was a deepening, a maturity."

On the convention circuit, Johnny invariably declared himself to be a Christian during presentations, with ever-growing conviction behind the words.

He'd also moved into a researcher role at CSC, making room for younger, more specialized security professionals to take his place on StrikeForce.

But he didn't yet have his purpose. He was still looking for something that would merge his commitments to computers and now Christianity. He was looking for a legacy, but coming up short.

So, he borrowed one from Jen.

Visiting Uganda

In 2006, while Johnny was at another conference in Vegas, Jen was in Uganda with members from Grace Community Church. They were there to help a charity working with children orphaned by AIDS.

The pictures she brought back and the stories she told of children living in dirt huts, surviving on one sparse meal per day, did a number on Johnny. The orphan's eyes, their frail frames, worked their way into his thoughts, and, eventually, his heart. He had to go to them, to offer his help.

And the hackers - that group he once thought would blackball him for mentioning his faith - paid his way there.

Though the speaking engagements and book deals definitely brought more money into the household, they didn't make the Longs rich. So Johnny wrote a letter about his desire to go to Uganda and last spring sent it to The Hacker Foundation, an organization that connects technology projects with the resources needed to get them off the ground.

His missive was immediately posted online and asked its readers to "forego that triple-venti white chocolate mocha, and send [Johnny and Jen] a few bucks instead." Roughly 24 hours later, $4,800 had been raised - $600 more than they needed for the trip.

And so, in May of this year, Johnny, Jen and a half dozen others from the church set out for the Jinja district of Uganda, a small country in East Africa bordered by Kenya and Sudan. A small country obliterated by AIDS.

Grace Community had sent several missions there already to work with Sam Tushabe, the African founder of an organization to treat and educate AIDS orphans. He had begun saving children one by one in his home district of Jinja when he was in his 20s, more than a decade earlier.

Tushabe's mother was among the first to die from the disease, in the 1980s, when it still had no name and locals thought witchcraft brought it on. By the mid-1990s, thousands had died, and their orphaned children wandered through the villages, looking for work on banana plantations or begging door to door.

Tushabe was a 25-year-old student then, when he was asked to take in his first orphaned child. Soon, he took in another, and another, and another, selling his handmade batiks to tourists along the Nile River to survive.

He wrote to friends for help, asking others to take in children. By 2000, he realized he needed more than a collection of individuals to make a difference. He needed a foundation and a system to give these kids more than shelter.

He organized the AIDS Orphans Education Trust, or AOET, to set up a school and offered families housing and work skills if they took children in.

He made a lot of progress in a few years. But this May, when the crew from Grace Community Church showed up, there was still much work to be done and only two weeks to do it.

The volunteers were a mix of ages and experiences, and they came with different expectations. Johnny had romantic notions of manual labor. He wanted to work side-by-side with his wife and feel the nightly satisfaction of aching muscles and a hard day's work.

Instead, he got stuck in an office, charged with making something out of piles of nothing: ancient computer parts and pieces covered in the village's red dust and dirt. He rarely saw Jen, didn't get to interact as much with the kids, and was generally annoyed - until others made him see the value of his work.

"It was miraculous," said Ginny Driscoll, one of the volunteers.

Johnny took the pieces, separated what was workable from what wasn't and built AOET a network.

"He was very, very skilled. When he talked, it was like he was drawing from a huge resource," Tushabe said on a recent visit to the U.S. "He saved us thousands of dollars. I mean thousands of dollars."

And for a while, that was enough for Johnny. He'd done something, he'd made a difference, he'd put his skills to work in a way he never had before. And he was feeling pretty good.

But then the trip was over, and down he went again. Back to the everyday. At home, he started pining, then thinking. How could he get that feeling back, but from here?

Then he struck on it: He would hack charities.

Hacking for good

First step: Set up a Web site: www.ihackcharities.org.

Second step: Acknowledge how ridiculous that sounds in the intro: "You WHAT? Picking on charities is just plain rude. Thankfully, that's not what we're about."

Third step: Explain what you're about: "We're about proving that hackers have amazing skills that can transform charitable organizations. We're about proving that those skills can be translated into careers, one keystroke and one resume bullet at a time."

The idea is to get hackers from around the world to volunteer their time and used gear to various charities that seriously need technical help, whether it's through securing their sites or finding ways to pair children with sponsors online, like Johnny is working on for AOET.

Ultimately, the work could save organizations thousands of dollars and, consequently, maybe even a life or two.

To attract talent, he offers volunteers personal recommendations and some actual project experience to put on their CVs. It's the kind of carrot that hackers, often just self-taught kids, covet. It's a ticket to a foot in the door at a company and incentive to keep on the straight and narrow.

And with that, Johnny had found a purpose.

"It started out with me trying to fill a hole, to make me feel better, but it's not about me anymore," Johnny said.

Well, not completely. He's still hyper-aware of how he's perceived and more than a little self- and image- conscious. (He compares himself to U2's Bono - a lot.) But those qualities are the same ones that drove him to look for more, then follow through once he found it.

So far, he's recruited about 120 hackers from around the world, though he's still doing about half the work himself, and the group's only target thus far is AOET. Johnny's not quite sure yet how to branch out, and AOET needs a lot of work.

He's streamlined its Web site, set up Gmail accounts and started a blog so the site that hadn't been touched for years can now be updated daily. And he's begun a side project he's calling "Swag for charity" - through which conference-goers donate all the free stuff, like thumb drives, they pick up and don't need.

This fall, he and Jen opened their home to Tushabe and an AOET musical group called Predestined, which raises money for the organization by giving free concerts and selling the crafts villagers made.

The group performed at Grace Community Church in September, with Jen manning the craft sales tables and Johnny running around manning a video camera. They raised thousands, and 77 kids got sponsors.

Now, Johnny is trying to get Predestined hooked up on iTunes and is working on drawing more recruits to the I Hack Charities effort.

He filed for nonprofit status at the beginning of the year, registered under the name Hackers for Charity. He's raised $2,000, and he just got his first corporate sponsor last month: Annapolis Junction's Proteus Technologies is ponying up 10 new customized laptops in exchange for a security lecture from Johnny. The company is talking with a partner about matching the donation.

He's still spending too much time on the computer. And he's got a thought in the back of his head that won't go away.

"I'd love to be doing it full time," he says.

It's likely an impossible dream, and he knows it. He's got a family to support after all - people to think about. People other than him. But as far as daydreams go, it's one he can live with.


Copyright © 2021, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad