How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Question

Summary:

For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers:

• The professional people hired by often large company to ensure network security. These are the good guys.
• The delinquents, who act on their own outside of any professional and legal frames. These are the bad guys.

However such people are missing that before being hired as a professional IT security engineer, one need to develop certain knowledge which must mandatory pass through personal experience.

Moreover, such news and movies added to the technical nature of this matter brings some kind of "mysterious" feeling on this subject, causing often very emotive reaction from people ranging from fascination to reject.

How can we preserve the sensitivity of other people and present ethical hacking in a positive, understandable way?

This question mainly focuses on school administration where teachers and principals may not be rightly informed on the subject and, for the sake of protecting pupils from bad influences, may be encouraged to take wrong decisions.

Background story:

(Serving as a concrete illustration of the question above)

Let me be frank here. I changed my school two years ago when I was in grade 7 (12 yo). I have always had difficulties in making new friends and this time was no exception. I had always been interested in technology and since I had nothing better to do, I got into coding and, in the process, Penetration Testing. I created my own website on penetration testing and everyone in school started calling me the hacker of the school. In this process, I made a lot of friends and often helped them solve problems related to technology.

But, you have to understand that here in India, you just need a BSc (bachelor of computer science) degree to become a school teacher. The two ladies who taught computers in my school got jealous of me over two years and went and blabbed a whole lot of nonsense to the principal.

The principal called my mother and told her that there was no surveillance at home and that she is a bad parent who is destroying my future. My mother, being the awesome person she is, believes that learning Hacking is just a way to gain knowledge and defended me

The conversation with my principal went something like this

Principal: So what do you mean by ethical hacking? (she insists on calling penetration
           testing that)
Me: Basically finding bugs in code and fixing them before a bad guy can exploit them.
Principal: But why would you want to do that? Can't companies hire people to do that?
          I'm a principal do I go and find faults in other schools? (She has been
          brainwashed)
Me: Because there are open source codes and free software and the organisations can't
    afford to hire people to do the job. Also, I think it is fun.
Principal (to my mother):Why are you even letting Rahul do all this?
Mom: Because I think this is a part of learning and since he is getting good grades, I
     don't see anything to complain about.
Principal: But why do it at this age?
Mom: Because this is his passion.
Principal: There is no surveillance at home. He is going down the wrong path. I am
           banning him from using school computers and forbidding him from taking
           computers as his hobby. (referring to the hobby subject in school) 
Mom: If he's going down the wrong path, then take him in the computer hobby and bring him to the right path.
Principal: We cannot trust him.
Mom (sarcastic and bitter): So should we take away his phone, lock away the computers,
                            destroy his passion?
Principal: Mrs <insert surname here>, If I was in your place, I would have done that long ago.

Shortly after this, I changed my school again. How can I prevent a similar situation from taking place at my new school?

PS: I'm in grade 9 now (14 yo)...

Answer 1

Sadly I think that such situation isn't new and isn't going to disappear in the near future. I don't know if you ever read the Hacker Manifesto? This text was written in the eighties, but chances are that you will recognize yourself in some aspect of this text...

It is interesting in your text that you first explain that you had difficulties to make friend, so you thought how to resolve the issue and finally made up a solution. So now you are reaching step two: how to deal with the authorities (I could limit it to the school administration, but I think the problem is more general than that, the school administration people just react to the wrong image that hackers have in the usual (sub)culture).

I worked as technical support engineer for a few years. Starting from day one, we were told to use the word "issue" as few as possible, and in all case to avoid the word "problem" at all cost. Instead, when communicating with a customer, we should only discuss about "unexpected behaviors", "fixes" and "improvement".

This might sound silly, but the fact is that using positive words makes your audience in a positive feeling, while using negative words just amplifies all the wrongs feelings they may already have.

So my advice for your next step, now that you have the technical skills, would be to develop your "marketing side".

You talk about bugs, exploits... Arrgh, such twisted, chilling, horrible words are they to the ears of the principal. Some kids loose themselves by touching drugs, this one touches BUGS! May someone save his soul!

Would you talk instead of sharing good practice from instance. In some way, ethical hacking is just about that: someone does not apply some good practice, causing a security weakness on his system, so you share good practice with him for his and others safety.

Would you imagine the principal stating "I'm a principal, do I go and share good practice with other schools"? I suppose you get my point ;). Added to the fact that using positive words makes people in a more positive feelings, it also lets less room for them to argue. It is easy to criticize someone hacking into systems, breaking security measures and exploiting bugs. It is less easy to criticize someone for sharing good practice, for acting as a good and responsible civilian taking his share to participate to public safety.

Another point is, I do not know the exact relationship you can have with the people working for your school, but it would be of great help if you could "sympathize" with some IT staff or related. The goal here being to be visibly helpful, so it would not be kid's word against principal's words, but that someone else working for the school (and thus someone whose words are more trustable from principal's point of view) can testify to the fact that, for instance, you gave some advice to solve a network or computer issue, that you are involved in helping other's difficulties, etc.

I'm conscious that there is most likely no real "IT people" in the school, the goal here is just to be flagged as a clean, helpful, benevolent and responsible person. If you don't do anything, due to your unusual and misunderstood hobbies, you are flagged as an irresponsible nasty looser by default. It's up to you to try to reverse this flag by choosing which image of yourself you want the other to perceive. This passes by the words you employ and by your visible actions, so choose both well.

At last, you may also begin to build some kind of a CV, it could be as simple as:

• A listing collecting where and how you brought your technical help. The more concrete the better: "I'm finding bugs to prevent bad people from exploiting them" does not tell anything to the principal (except that your deal with something related to bugs and bad people), "the website example.com had a flaw allowing anyone to access all user's personal information, I informed the site owner so he was able to correct it": how one can reasonably be against such initiative?
• If you participated to some public competitions, no matter the result, such competition would be steps towards the certification exams you will encounter later in your professional life,
• If there is any public project in which you were involved. Involvement implies relationship and responsibility, and the links and participation you create now may be useful for you in the future (having participated in a open-source project is always a large bonus when applying to high schools).

Writing and maintaining such listing will be useful for you in the future, and I would definitively not imagine a principal arguing that you are destroying your future if you say that "IT security engineers are effectively needed and largely hired by companies, and I'm studying to become one of them. By the way here is my CV"

To summarize all this in three words, it would be communicate, communicate, communicate. Choose your words, avoid anything which might be wrongly perceived, cooperate with the school administration so they learn to know you a good way, whenever possible use your personal experience for school projects (I remember for a subject-free presentation in English course having presented the basis of reverse engineering to my schoolmates ;) ).