Sim-Cyberpunk: Serious Play, Hackers and Capture the Flag Competitions
What is a Capture the Flag Competition?
Capture the flag (CTF) is a competitive game in which players mimic the experience of discovering and exploiting vulnerabilities in information systems, hacking into simulated software and/or networks to retrieve data known as a ‘flag.’ CTF participants, often drawn from the information security and IT industries utilize these games as a means of training to develop/apply offensive security knowledge in a legal way, so that they can better defend the software/systems they are entrusted with. Lily Irani has described similar kinds of participation as the “entrepreneurial citizenship” of present-day high-tech labour (Irani, 2015, p.801), the activities that workers perform extrinsic to their workplace to make themselves more desirable/productive employees.
The organization and play of CTFs relies extensively on a shared corpus of information security knowledge and skills shared openly by the information security and hacker community. For many competitors and organizers the knowledge work and skill required to play in a CTF directly parallels the work that they do in their careers as information security and information technology professionals. My study will consider how participation in these competitions transforms the act of play “into psychological, social and material resources for the workers of a new, supremely fluid world of post-industrial information work”; (Turner, 2009, p.86); as CTF players hone skills, develop their knowledge and build the social networks required to safeguard and strengthen the information systems that serve as the infrastructure of digital capitalism. Specifically, this research will examine the use and impact of the manifold forms of open-access knowledge that CTF play and infosec work depends on, through whitepapers, CTF challenge write-ups, common vulnerability and exposure identifiers (CVE-IDs), wikis, manuals and other forms of documentation.
About the Project:
The rearticulation of information security work in CTFs should not proceed un-interrogated. Despite cultural and often politicized perceptions of antagonism between hacker culture and the information systems that undergird digital capital, hacker culture is deeply inculcated in in a liberal mode of production. As other scholars have observed, one of the most salient traits of hacker culture is a strong desire to produce technology, but also to produce knowledge about these technologies (Irani, 2015; Coleman & Golub, 2013). Accordingly, my research will consider how hacker culture, often imagined as disruptive or antagonistic towards systems of capital should be understood in continuity with the productive impulses of a liberal ideology. It will explore, dialectically, how hacker culture has been increasingly subsumed as a key part of the information security industry. The analysis will include both the contexts under which CTFs are organized and also the mode through which their play reproduces hacker culture.
Utilizing a feminist-ethnographic methodological framework, the research produced is both an ethnography of play, but also a quasi-instutional ethnography of the way in which these games are inculcated in workplace cultures. Two key insights into CTF competitions already g
Methods:
This research project utilizes three methods, or stages, for data collection. The first will be semi-structured interviews with CTF designers (roughly 10-20 designers). The second will be participant observation of 4-5 teams of CTF competitors (or about 12-50 players) as they compete or qualify for a CTF during or prior to a hacker convention. The third will be follow-up interviews with competitors immediately following (or soon after) the CTF event. Since a majority of CTF competitions are undertaken by teams at conventions, it makes sense to study this cluster of participants as a unit while they compete in the context of the convention to understand the procedural and environmental factors that contribute to CTF play. As Pink et al. observe, studying events allows ethnographers begin “re-theorizing” the impact of digital media on “production, consumption and dissemination… temporally and spatially through the processual theory of place-as-event” (Pink et al., p.184, 2016). Establishing the context and procedure of CTF play as it is supported through and occurs within digital technologies is important as scholars of ethnography have increasingly argued that “interviews are unlikely to be productive by themselves”, and that “multiple methods should be used in any investigation” where ethnographic research is applied (Walford, p.118, 2009).
Research Timeline:
Publication and Defense: Projected Fall of 2020 Fieldwork: Underway - projected completion date of November, 2019 Amended Ethics Proposal: Approved by the University of Toronto’s IRB in June, 2019 Ethics Proposal: Approved by the University of Toronto’s IRB January, 2019 Research Proposal: - Defended