The legendary hacker con was less packed than usual — and some people liked it that way.
To walk the halls of DEF CON this year was to experience a familiar assault on the senses — the electronic blinking of the event badges and DIY cyberpunk jewelry, sky-high pink mohawks, tinfoil hats and the red T-shirts worn by the conference volunteers or Goons. As always, even in the shadow of Covid, DEF CON celebrates the agitators, outsiders and nonconformists of the tech world.
It was the DEF CON we know and love.
But this year it was only five or six on the dial. Not the usual 11. The overwhelming, teetering-upon-the-edge-of-complete-chaos-but-never-actually-tipping-over feeling was missing.
“It was definitely lower key than usual,” said Eric, who has been coming for nearly a decade and asked us not to use his full name. “There seem to be a lot fewer people.” He paused, looked around and lowered his voice a little, “To be honest, I kind of like it this way … I must be getting old.”
“This was one of the most mellow DEF CONs,” said Mark Rogers, DEF CON’s head of security, during the closing ceremonies on Sunday. There were just seven medical emergencies, he added, calling that “a really low number … considering the amount people were drinking.”
In 2019, the last year of an all in-person DEF CON, more than 30,000 attended, according to the event website. This year, almost that many — 28,000 — have so far watched one or more of the dozens of sessions online, organizer Jeff Moss said during the closing ceremony.
About 8,700 people attended in-person this year, plus about 1,000 volunteers, speakers, organizers and journalists, he added.
No wonder then, that the corridors, though sometimes thronged, were actually navigable for a change. Keynotes like Roy Davis’ talk on hacking ATMs for fun and profit, though more than three-quarters full, didn’t require attendees to line up in advance to ensure a seat — as hot ticket talks in a typical year usually do.
The reason of course was that many stayed away, fearful of the Covid Delta variant that’s led to a spike in new — and breakthrough — cases of the virus in Las Vegas, as well as many other places across the country. For many, even those fully vaccinated, the risk of an infection — or passing it to their unvaccinated children at home — was just too big of a chance to take.
Organizers announced back in April, when Delta was infecting the unvaccinated at an alarming rate, that the event would be hybrid — with in-person attendees being required to wear masks and show proof of vaccination.
But requiring proof of vaccination also requires attendees to show ID, to ensure that the vaccination card was actually issued to the person presenting it. This brought howls of outrage from some long-time attendees, complaining it was a betrayal of the traditionally rebellious and counterculture spirit of DEF CON, which for almost three decades required payment in cash and boasted that it keeps no record of attendees.
That commitment to privacy has not changed, Moss told README. The ID check “is not done by us. It’s a third party [checking that IDs match vaccination cards] … And it’s not recorded. It’s not like Clear or one of these other places where they’re taking all of your data, and now it’s part of their data mining mega database.”
Enforcing a mask and vaccine mandate was essential to mitigate the possible spread of the virus among attendees, Moss added, “What I was trying to do is create the safest [in-person] experience possible.”
Organizers had opted to go ahead and allow people “to make their own informed decisions,” he said. “If they want to come, great, and then for the people who don’t feel safe, you have a virtual option, which is free.”
But Moss acknowledged that he might not have pushed ahead with an in-person event at all, if he had been able to foresee the risk that the Delta variant poses to even fully vaccinated people.
“If I had a crystal ball, and I knew Delta was coming, I would probably have come to a different decision. But I didn’t,” he said, adding that commitments had been made and contracts signed long before June, when the risk of “breakthrough” Delta infections hitting even fully vaccinated people became apparent.
In recent weeks, Moss faced a storm of criticism online for not cancelling the event. He said many complaining were experiencing “cognitive dissonance” — berating DEF CON organizers while engaging in risky activities in their own day-to-day lives.
“I couldn’t understand how [an event requiring vaccination and masking] could be less safe than what I was watching people do every day,” he said. “People flying in airplanes, people going to sporting events, everybody’s doing other things … And the people on Twitter are not necessarily up in arms complaining about that.
“I understand emotions are very high and people have opinions. But … the people who were complaining are probably going to the supermarket where they’re around unvaccinated people. They think they can justify that, they can come up with a reason why they [do that] instead of having the food delivered … So clearly there are things in their day to day life, which they’re taking some risk for.”
Some attendees, seeking to justify their decision on Twitter, mentioned that high transmission rates and low levels of vaccination and compliance with public health best practices like masking made their home environment likely no safer than DEF CON, where everyone was vaccinated and compliance with masking requirements was almost universal (Rogers, the head of security, said only two people had been removed from the event for not wearing a mask.)
“I’m from Texas,” tweeted hacker and author Jayson E. Street, “If people think I was safer at home, they’d be wrong!”
Cody Bernardy, an Army vet who owns his own cybersecurity consultancy, told README that he felt safe at the con, where organizers were “doing a pretty good job, in my opinion, enforcing masks.” He said the vaccination card check process was “great … to vet out people doing straw purchases.”
Nonetheless, debates about how to best manage risk as the pandemic has dragged on have become very polarized — another factor that entered into the organizers’ calculations, Moss said. “You’re never gonna please both sides. You have people who don’t want to wear masks and don’t want to get vaccinated. Which side would you rather anger? … I’d rather not have [those] people show up who don’t want masks and don’t want vaccinations. Let them self-select.”
In the end, Rogers said, only about 25 people were turned away because they didn’t have the required vaccination documentation.
Due to the global Covid crisis last year, the decision to go virtual was easy, Moss said, even though contracts for the August event are often signed many months in advance. “You had a lot more room to negotiate with your suppliers [last year]… everybody was willing to work with you.”
This year, organizers had less room to maneuver as the country started opening up and Covid restrictions and mask rules ended nationwide. “When all the states are open, and everything is operating [normally], you can’t claim force majeure or act of God. Everything is open. … So even if you wanted to cancel, it would be impossible to cancel. Because you’ve already made your commitments.”
