I’m walking with Nico through the hallways of the convention area of the Riviera Hotel in Las Vegas. There is a distinct old school feeling at the Riviera that reminds one of the days when Las Vegas was run by the family. Walking swiftly Nico tells me that we might see security expert Chris Paget get arrested during his presentation.

“Arrested?”

As we get closer to the hall where Paget is presenting, I hear someone yelling, “if you have a GSM cell phone, your call may be intercepted. If you do not want this to happen, then turn off your cell phone.” The vociferous warning is supported by the flyers I see haphazardly taped to the walls.

Using a laptop, a transmitter broadcasting over a ham-radio frequency and two antennas, Paget has created a GSM base station which all the mobile phones in the near vicinity have been duped into thinking is a legitimate AT&T cell tower. “When the phone is looking for a signal, it looks for the strongest tower. This [his setup] offers the best signal,” he explains. On the laptop screen he shows a list of phones, mine included, that are connected to his fake network. The threat of arrest comes from the FCC. Should Paget intercept a voice or data transmission from one of the phones connected to his $1500 dollars worth of equipment and open-source software, he will be in violation of the law. I honestly can’t decide if I want to see that happen or not. The sensationalistic side of me would love to see the drama, but the rational side of me is taken with Paget’s enthusiasm and blazing intelligence. More importantly, he has revealed an inherent security weakness with 2G technology. A weakness that can be fixed by moving mobile networks to 3G or encrypting 2G connections.

This is an example of what happens every year at the DefCon hacker conference in Las Vegas. Passionate hackers present their knowledge and capabilities, often times skirting the very fringes of legality. However, if you think that this is a convention for geek criminals, then you’ve been watching too much NBC.

Have you ever locked yourself out of your home and had to try to break in? There is sense of accomplishment in succeeding. Then there’s the slightly disturbing revelation that if you can break into your place as an amateur, a professional could do it five times faster – so you look at your exploit and fix the breach. DefCon is like that.

The activities and experiments that take place at DefCon, along with the information reported here has an enormous impact on our daily lives. These are the people that look with significant scrutiny at all manner of security systems that are found everywhere from the internet, to mobile communications to household door locks. And then they try to hack them. After attending three years in a row I can tell you that very few people here hack with a nefarious intent, but rather they do it for the challenge, and the thrill that comes from circumvention. From these efforts shortcomings are revealed and changes are made by the targeted industry to plug the security holes.

A poignant example of this is when I attend a presentation on electronic door locks. The presenters reveal significant weaknesses in several brands of electro-mechanical locks. When I say weaknesses, I’m talking about things like a household version of a bio-lock that uses a fingerprint scan for entry being defeated, easily, by a paper clip. The presenters alerted all the manufacturers of all the locks they hacked to allow them the opportunity to fix the problems. Not all responded. Ironically one of the most secure locks they demonstrated was a 4000 year old Egyptian tumbler lock.

DefCon is a vast mix of cultures as well as being a culture unto itself. The DefCon staff who are responsible for security and general order are called “goons”. The DefCon badges are electronic, hackable and showcase an anti-establishment, almost cyber punk aesthetic. If designer Alexander McQueen were still alive, he would find much inspiration here.

Walking around the halls are people in dark clothes, ripped jeans and mohawks talking to people in golf shirts and khakis. It is a welcome antidote from the Hollywood environ where I live. Social status here is based on knowledge and accomplishment and not on clothing labels or car marques.

That is not to say you shouldn’t watch your back here. There are unwritten rules like; don’t ask anyone where they work, and don’t use any ATMs within a two block radius of the Riviera hotel. There are government agents here, as well as white collar criminals. If you are press, you are asked to be obvious in displaying your credential, and to ask permission before shooting pictures of anyone. A rule that NBC Date Line undercover reporter Michelle Madigan ignored in a legendary incident at DefCon 15 in 2007 where she was publicly outed and escorted from the conference. Madigan refused four different offers from DefCon for legitimate press credentials and then proceeded to register as a regular attendee. She brought a pinhole camera into the conference to allegedly portray DefCon in a sensationalistic, scaremongering way to shock the NBC viewers.

There were a number factors that led to her discovery, but the most egregious from a DefCon perspective was panning her pinhole camera across the Capture the Flag room, a room where it is absolutely forbidden to have any sort of visual recording device. DefCon has a responsibility to protect the identities and methods of the people in the Capture the Flag competition so they can attract the brightest hackers to compete.

Capture the Flag pits elite hackers against elite hackers in a cyber game of network attack and defense that goes on 24 hours a day. CTF takes place in a large hotel conference hall. The hall is lit by down lights, huge video projections on all of the walls, and clouds of monitor glow which emanates from above groups of tables that are spaced about twenty feet from each other. Each group of tables is a CTF team. Up on the walls are projected videos ranging from movie snippets to material from YouTube. Also projected is each team’s status in the contest. In the center of the room is an elevated command and control platform overseeing the contest and providing the visuals.

Pizza boxes and various caffeinated beverages are strewn between rows of laptops in each team section. The room is mesmerizing. I was given limited and supervised photographic access to the room, provided I asked everyone who had the potential to be in my frame their permission before clicking the shutter. Also I was strictly forbidden from revealing any of the details on the computer screens.

Elsewhere at DefCon there are hacking villages; small rooms with lots of hands on demonstration tables and brilliant people manning them where you can learn a myriad of things from how to pick locks, to electronically hacking the firmware of your hackable DefCon badge.

Along with the DefCon badges, which everyone who attends receives, a limited number of Ninja badges were handed out by Ninja Networks, a hacker group based in the Pacific Northwest. The badges are part video game and part electronic invitation to the exclusive Ninja Networks party. These extraordinary pieces of innovation, that were underwritten by Lookout Mobile Security, are the product of Amanda Wozniak, who created the hardware, and Brandon Creighton who wrote the firmware. The character on the screen of the Ninja badge starts to battle other Ninja characters of other badges when the badges are in proximity to each other. In order to get to the top level of the badge there are different tasks that have to be accomplished that include an electronic scavenger hunt, cryptographic puzzle solving and a donation to the Electronic Frontier Foundation, a non-profit organization devoted to protecting digital rights.

I caught up with Miss Wozniak at the Ninja party. “Passionate” is inadequate in describing the alacrity she assigns to her craft. As I interviewed her she excitedly took apart my badge and showed me how it worked. She also pointed out that the electronic piece was completely modular and ready to be repurposed for experimentation or a new creation. It is inspired forward thinking and functionality.

Back at the conference I’m walking through the halls where there is seemingly no end to cool hacking events. A contest entitled Gringo Warrior is described as:

Participants in Gringo Warrior will have five minutes to free themselves from handcuffs, escape from their “cell”, get past a guard, retrieve their passport from a locked filing cabinet, leave through another locked door, and make their escape to freedom. The course will offer a variety of locks representing a range of difficulty, allowing participation by people of all skill levels. Points will be awarded based on the time of completion as well as the difficulty of locks attempted. The best warrior of all wins the grand prize!

It’s a series of locks that the contestant has to pick starting with hand cuffs at one end of the stage, and ending with a door lock on a stand at the other.

Not far away is an impromptu salon dishing out only one kind of hairdo. A mohawk. For a fifteen dollar donation that goes to the Electronic Frontier Foundation, you can walk a way with a new look, or as is the case that I’m seeing over and over, a cleaned up version of your original hawk. There is a rumor circulating that the Guinness Book awarded the tallest mohawk to a DefCon attendee this week. The disclaimer stating that the people performing the hair artistry are not professionals doesn’t seem to intimidate anyone. Every time I walk past the salon, business is brisk.

If you’re one who dismisses the DefCon attendees as group of misfits and social pariahs then you probably have the same password for ninety percent of your online existence. Which means you are doomed. Because as clever as you think you’re being by using your dog’s birthday backwards as a secure key, you’re no match for the people that I’ve met. There is no more greater ignorance online than that of an average internet user who believes what the mainstream media says about hackers and internet security. There is much more going on in this constantly changing and evolving technological world than those predictable stereotypes.

The attendees at DefCon are pioneers on a myriad of levels. Socially they challenge convention on every strata. Fashion-wise there are no boundaries and norms, just personal styles that clothe intelligent minds. In the realm of the internet, communications and other security genres, there is no equal.

You may argue that these hackers have a proclivity to criminal behavior which is why they do what they do. I’ll tell you are wrong. Yes there are criminal intentions to be found at DefCon, but so are there to be found in your office. Every niche of society has a dark element. But that’s not the majority of what you see in society, or here at DefCon. The sense of community and public education is overwhelming, as is the need to share, albeit anonymously, successful hacks that reveal weaknesses in the various security infrastructures that affect all of our lives.

Recently in the news there have been a number of stories telling of various governments, including our own, that are lobbying to try and get more access to the data of our personal online habits. This is an unconscionable thought to me and to probably many of you reading this. Sadly we have very few tools to protest such agendas should they be advanced. But I know a group of people who are passionate about online freedom and have the means to make a stand against insurgencies into your private online life. Many of them can be found at DefCon.

This story orginally appeared in National Geographic Assignment.

•••