Are hackers partially schizophrenic?

I think a significant portion of hackers lie somewhere in the schizophrenic spectrum. Oddly this is good for them, and bad news for us.

Over the course of evolution, genetic anomalies have emerged that walk a fine line between being productive and being dangerous. For instance, mild versions of cystic fibrosis can protect against cholera by preventing the dehydration of the lungs. People in certain regions defend against malaria with sickle-cell anemia, and its generally believed those with Tay-Sachs disease have a natural defense against tuberculosis.

These traits continue to be bred into successive generations because the mild versions carry an adaptive value and don't impact the lifespan or breading abilities of the carrier. The result however, is that a percentage of the descendants develop full blown versions of the disorders with all of the disastrous consequences. Mother nature it seems, is willing to take this risk.

Schizophrenia presents on a wide spectrum, with a less severe version known as schizotypal personality. Schizotypal personality (also known as Schizotypal disorder) is characterized by the need for social isolation, odd behavior and thinking, and often unconventional beliefs. Unlike those diagnosed with schizophrenia, people with schizotypal personality can lead very full and productive lives. The negative effects are so vague they are mostly undiagnosed and untreated. Moreover, like the other disorders mentioned there can be advantages to having a schizotypal personality.

In a lecture by Joel Sapolsky he explains that the family members of people with schizophrenia have a higher rate of schizotypal disorder. Normally this presents itself in their gravitation towards solo occupations (lighthouse keeper, movie projectionist, etc). In cases where the unconventional beliefs and perceptual experiences are the stronger trait he draws a connection to religious or spiritual leaders. He points out that some behaviors one could consider psychologically suspect (like talking to a burning bush) can be acceptable and transformative in the right context.

I see a strong correlation between the behaviors of someone with schizotypal personality and a hacker. Certainly I'm not suggesting schizotypal disorder is a trait required for hackers. Like any other subculture the reasons people are drawn in can be widely influenced by environment. But there is a correlation between the diagnostic criteria and the typical profile of a hacker.

Schizotypal personality is characterized by five or more of the following (From Wikipedia):

1. Ideas of reference (excluding delusions of reference)
2. Odd beliefs or magical thinking that influences behavior and is inconsistent with subcultural norms (e.g., superstitions, bizarre fantasies or preoccupations)
3. Unusual perceptual experiences, including bodily illusions
4. Odd thinking and speech (e.g., vague, circumstantial, metaphorical, overelaborate, or stereotyped)
5. Suspiciousness or paranoid ideation
6. Inappropriate or constricted affect
7. Behavior or appearance that is odd, eccentric, or peculiar
8. Lack of close friends or confidants other than first-degree relatives
9. Social anxiety that tends to be associated with paranoid fears rather than negative judgments about self

Can you think of a serious hacker who doesn't exhibit five or more of these traits?

If you look at the terminology of hackers there is evidence of meta-magical thinking (especially references to mythical creatures). There also tends to be a strong affinity for escapism in science fiction and fantasy. Hackers usually seek isolation, preferring to peer only in cyberspace. When they do gather, such as at Defcon, you can't help but notice that the audience personifies the odd, eccentric and peculiar. Hackers tend to be unfairly categorized as having poor communication skills, perhaps it's just a byproduct of the way their minds work. Some hackers have a hyper-inflated sense their own importance, perhaps this is ideas of reference rather than ego. Most of the symptoms fit the stereotype.

But the point of this article is that partial genetic traits like this can be an enormous source of strength. They use the ability for unconventional thinking to innovate new ways to do things. For ethical hackers this results in creative techniques to expose vulnerabilities. For the black hat hacker this results in innovative new ways to pwn users and systems. I would argue that without these genetic traits there would be far less exotic malware like polymorphic viruses, self defending worms and tamper proof obfuscation. The powers of thought combined with the tendency towards isolation would also correlate well with the ability of the black hats to stay ahead of defenses (producing variants faster than we can keep up).

Before anyone gets offended by this suggestion, please know that I am certainly not a biologist or psychologist, nor do I have statistical data to back this up. Like attempts to related ADD to hackers in the past, this is merely an unprovable observation.

What I do know is that the enemy is formidable, bringing the full force of their intellects to bear. As security professionals we may be defending against more than an army of hackers, we may be defending against their genes.

Comments

[justin_foster]

There are a couple of points that didn't fit the body of the article:
- The best example I found of a disorder that can be "Too Much Of A Good Thing" is OCD. Have too much and you can't leave the house, have a little and it gets you into an ivy league school
- There is another disorder on the spectrum called Schizoid personality disorder [http://en.wikipedia.org/wiki/Schizoid_personality_disorder] with many of the same symptoms. I avoided referring to this condition to not confuse the article
- In the research I did into Schitzotypal personality there is generally disagreement as to if some of the symptoms are truly part of the disorder or a result of the isolation
- The Sapolsky lecture contains some potentially inflammatory content. Judging by various comment reactions there is a lot of dissension to this opinion as well
- If you search for a personality profile of a hacker there are many articles that say that its impossible to generalize. The personality profile I linked to is out of convenience (I'll admit it)

[Ben]

I think much of the same can be said for autism and Asbergers syndrome, as well as OCD as you pointed out in your comment above. Of course, this then begs the somewhat humorous question: do you have to be at least a little bit mentally ill to be in this industry? :) It seems the obvious answer is "yes" but there's, again, no statistical evidence to back that up. ;)

[justin_foster]

I totally agree Ben.

I think the somewhat shocking thing to me is that all of these disorders have mild versions with positive values. I picked schizophrenia because it generally has negative connotation, that previously I didn't know there was a good side to.