8 ms·

It has been a fairly common story, and part rumor, that intelligence agencies like to recruit young people active in the cyber criminal scene, and that the IT s

by belorn 2y ago

It has been a fairly common story, and part rumor, that intelligence agencies like to recruit young people active in the cyber criminal scene, and that the IT security industry also adapted this approach. They basically becomes part informer and part subject expert, especially since IT security expertise seems to be a difficult subject matter to teach in universities. When I studied IT security in university, about 10 years ago, I heard multiple version of this several times, with one student from my university getting employed because they managed to demonstrate a hack on a bank. I always hope that such recruits had a bit tighter surveillance from their employee, but no one in the industry describes such recruits as "highly susceptible to extortion and coercion from current members of the same gang", and absolutely no one described them as members of violent street gang. It might have been a fair label but at most, such teens were describe as smart but mischievous. Might not be the best people to be responsible for national security, or peoples bank accounts, but it seemed to be the culture of that industry. Has other people in the IT security industry had the similar experience of this culture?

Quarrelsome 2y ago
while I agree there's typically a big event where the state has incredible leverage over the subject that is part of the flip. As far as we can see in this story; there is no leverage. So for all we know this guy is doing what he did in his last job and selling secrets gained working here to competitors. Imagine if DOGE feeds all the data they get their hands on into an LLM and he sells a copy of that to a foreign nation, allowing any other government a text-based interface to ask any questions of any of the internal workings of the US administration, government, citizens or even some of its secrets.
- notahacker 2y ago
  Even without the leverage, I think that former teenage hackers turned pentesters or three-letter-agency adjuncts are hired for specific skills on the understanding they're being watched and they're probably not getting access to much more than a sandbox or adversary data and the money and freedom's all in scrupulously obeying the rules That feels a little different to hiring people with cracking credentials for auditing jobs, giving them full access to extensive government records (and possibly the right to backdoor them) in a move fast break things environment on the understanding that they're probably above the law and they're less likely to be punished than anyone barring their way. I doubt the success rate of converting teenage tearaways to scrupulous white hats in boring businesses is 100% either....
donmcronald 2y ago
> They basically becomes part informer and part subject expert, especially since IT security expertise seems to be a difficult subject matter to teach in universities. I don't think the argument they can act as an informer for things going on inside government agencies works. They've never been on the inside. And I don't see what it has to do with IT security. What are they doing that's security related? Isn't what they're claiming to be doing pretty much data analysis? The only overlapping skill I can see is a willingness to exfiltrate data, if they're doing that, without giving consideration to the rules or consequences.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
b8 2y ago
People get clearances even if they've used hardcore drugs such as cocaine and various more serious crimes than computer crimes. The adjudication guides for clearances explain this in more detail. I have a friend who exploited RCE full-chain exploits on productions servers and used to DDoS. He got a TS/SCI clearance no problem and didn't even finish college. I interviewed too and admitted to that stuff. They cared more about me admitting to cheating in math at college lol.
- Manuel_D 2y ago
  TS/SCI clearance is a lot more about truthfulness. The adjudicators are looking for secrets that can be used as leverage. Publicly writing reviews for cannabis strains is not a risk. A Mormon secretly hiding alcoholic tendencies could be. I'm also told that owning foreign property is unfriendly countries, and debt are the other big reasons for clearance denial.
  - throwaway2037 2y ago
    > owning foreign property is unfriendly countries This is pretty darn specific. It must be tiny fraction of applicants. Hell, most Americans never leave the United States in their lifetime. The security concern about heavy debts or debts to unfriendly counterparties makes sense to me. But what is the security concern with "owning foreign property is unfriendly countries"? They can take it from you?
    - adbachman 2y ago
      The concern is always leverage and conflict of interest. Is there something about you that you would do anything to keep covered up? Are you susceptible to outside influence? Can anyone, in any country, compel you to act counter to the interest of your employer? Foreign property means you are, at the very least, going to take interest if/when the foreign government threatens it.
      - error_logic 2y ago
ozim 2y ago
I see you are mixing up IT security jobs where you can hire „mischievous people” with IT admins. I say 90% of security is admin work where one has access to various stuff. Then you have red teams, pentesters, consultants- that don’t have ever privileged access to anything. They should find flaws and pass recommendations to IT admins. If they hack anything at all - it has to be outlined in scope and strictly monitored. For both sides protection as if „hacking person” doesn’t get blame for something he did not touch by him but at the same time someone pulled off something nasty.
- belorn 2y ago
  I think you would be a bit surprised with both the university programs that teach it security, and also which companies that look to employ them. IT security can be admins, it can be programmers that focus on exploit vunerbilities, it can be reverse engineers, it can be pentesters, it can be red teams, and it can be people with high domain knowledge in a very narrow field related to security. IT security is a very wide field. IT security programs focuses a bit on everything, but as in my university, they gave the person responsible for the program a fairly free range to focus on what they thought was what the market wanted. Different universities will focus on different aspects. The organizations that seek such employees are also quite wide. The military, the intelligence agency, large software companies, large companies with internet assets (like banks, but also game studios), government departments like the tax office, and then naturally we got all kind of IT security firms with red teams, pentesters, consultants and so on. A big hire of my class was also a network company developing network finger rules for deep packet inspections, which wanted people skilled with reverse engineering and decompiling (they may or may not have employed people who had experience cracking games).
  - ozim 2y ago
    Not saying IT security cannot be admins, sounds like you are bringing theoretical viewpoint. I already have some years of experience and certifications in the field - so it is hard to surprise me. I am pointing out that in most places there is separation of duties so you don't give "red teamer" or "pentester" access to any databases when they are in offensive role. Then most likely administrators (who can have formal education on paper called cybersecurity) who have loads of work so 90% is configuring and keeping all configuration proper will have requirements like background checks and you are not going to hire "mischevious people" for that role. Security is a broad spectrum but still offensive testing is maybe 1-2% of the work that needs to be done, all those systems need people to configure them. Having good security 90% of work is waking up updating software and keeping configurations of systems documented and in proper state. If some company doesn't have their security posture basics fixed there is no point of doing "red team assessment" or a "pentest" with them, that would be waste of time.
zeroCalories 2y ago
Don't know about intellegence agencies but I got to know pentesters / red teamers at some large companiese, and they were cool but had a very unsavory side. Several times I found myself in conversations where they were admiting to serious crimes and unethical behavior. I suspect that you need to be passionate about wanting to do bad things if you want to be good at security.
- Fnoord 2y ago
  Stories from their young years or recent? Bragging or back when it occurred a sign of skill? There's nuances to be found here.
h0l0cube 2y ago
> that intelligence agencies like to recruit young people active in the cyber criminal scene Just linking this back to the story, am I mistaken in saying that DOGE is not an intelligence agency? (It certainly is a great position to exfiltrate information however.)
- gadders 2y ago
  I think the implication is that if the person concerned (dox-ed again by Krebs) would pass an intelligence agency review, they should be OK for fraud investigation.
  - WD-42 2y ago
    Why? They aren’t the same thing, not even remotely close skill set. Also why do people keep calling this doxxing. These are public employees.
    - gadders 2y ago
      >>why do people keep calling this doxxing. Because they are getting death threats, and that is only reason their names were made public.
      - WD-42 2y ago
        that doesn’t mean they are being doxxed. That just means their identities are known, just like any other public figure that receives death threats.
        gadders 2y ago
        Wired looked up their details and made them public.
        WD-42 2y ago
        I’m replying to yet another poster with nothing technical in their comment history, just political crap. When did HN become infested by brain rot. Post probably should have been flagged after all.
onetimeusename 2y ago
Yes, I've seen a number of people with criminal records hired. I don't really want to present my comment as an argument against every point Krebs made. I don't really have an opinion on whether the individual mentioned is a suitable hire. But in infosec a lot of people probably got into it because 'hacking' is cool and glorified by the media. It's rebellious and appeals to a lot of teens I think. I don't think it's as serious as Krebs suggested that you could be extorted or compromised. It seems like it's just a bunch of inexperienced people in a discord channel. Soliciting a DDoS on there, to me, just seems like youthful nonsense. If you were actually in some kind of criminal hacking enterprise I bet you would know not to make mistakes like leaving a paper trail to your identity in a discord channel where you solicited a crime. I haven't seen the people with criminal records for cyber crimes be less trustworthy in the industry. Some of them just made stupid mistakes when they were younger and sometimes dumb kids get way overcharged for cyber crimes. For the most part I think it's fine for kids to go through a phase where they think it's cool but they don't really know what they are doing. A lot of people have done that. A lot of 13 yr old kids on the internet have talked about hacking banks and things like that and they aren't all going to be in a gang. Another analogy is how a lot of people get into chemistry because they like blowing things up. Not all those people are terrorists.
- zacharycohn 2y ago
  > Some of them just made stupid mistakes when they were younger and sometimes dumb kids get way overcharged for cyber crimes. For the most part I think it's fine for kids to go through a phase where they think it's cool but they don't really know what they are doing. I think a lot of the concern is that these kids aren't out of that phase yet.
  - FrustratedMonky 2y ago
    Yeah. I'm all for kids hacking, and even hackers with criminal records getting a second chance at security firm. Hacking is done for a lot of reasons, it could be just an interest in solving puzzles, and they happened to get in trouble with the law. The part I'm not digging, is they seem a bit young to be taking over the Treasury Dept, or any department. It seems like this would have been better done by an Accounting Audit Firm, not hackers. Hackers are just trying to get in, get data. An accounting audit would be more about finding impropriety. So, it seems on the surface like 'finding waste' is not the goal.
dpweb 2y ago
I’d also distinguish between the hacker to gets access to a forbidden system out of curiosity or for a challenge, from a person who pays a ddos service to attack someone they don’t like (one of the accused actions of this kid). The latter displays no competency in hacking or cybersecurity, only the attempt to harm another. My concern in their access to secure government systems is not their hacking competency (which has not been demonstrated), but their sociopathy which has.
- bakuninsbart 2y ago
  Sociopathy is a very strong word, but they do show a pattern of criminal and anti-social behavior. This is not too uncommon in teens, and many young problem kids reform into good members of society either by being shown consequences for their negative behavior, or more or less naturally "mellowing out". The issue here is that these kids seem to fail upwards, and as you say, get rewarded for anti-social behavior, which sets them on a terrible path for the future. In the Com chat log shared in the article, they made fun of Edward Coristine for his complete lack of programming skills, and the other "doxxed" members of the DOGE team have some smaller projects online as well. If that's the kind of code SpaceX and Tesla run on, I'd give all of their projects a very wide berth.
  - ZeroGravitas 2y ago
    The guy who bought a DDOS and got fired from an anti-DDOS company for leaking secrets to a rival is an ex-Wall Street multimillionaire's son. He's never going to fail any way but up.
wraptile 2y ago
Equating script kiddies to some genius cyberhackers worth recruiting is laughable when we literally have PHDs and 6 figure salary professionals willing to be recruited legally with zero baggage. Why are the top digital safety institutions hiring the very bottom of the barrel?
- modo_mario 2y ago
  Not to mention it's not even their job in this case. They're likely doing some data analysis.
- michaelt 2y ago
  > Why are the top digital safety institutions hiring the very bottom of the barrel? I don't know anything about "The Com" or top digital safety institutions. But I do know that historically, some parts of hacker culture have drawn heavily from political theories of anti-authoritarianism, anarchism, and libertarianism. If the authorities and rules intend that I not have access to something, and I have a fascination with bypassing that and getting access anyway, am I not subverting power structures in the most literal sense? If large corporations believe they alone should control the software that runs on my printer, so that they can ensure only authentic supplies are used and premium features are only available on premium devices, while I believe every user should be able to modify their printer's software and behaviour without limit, including to bypass such restrictions - is this not an anarchist stance, opposing coercion and mechanisms that perpetuate control? If the exploit-discovering side of cybersecurity is inherently anti-authority, recruiting people who've never defied an authority in their life might not be the best move.
chonkerz 2y ago
I think the difference is in the kind of positions the "second chance" people get hired to. They aren't put in positions where they could cause significant wide scale harm with no auditing or barriers. The debate isn't whether he should go to jail. The debate is whether he should get a clearance for some of the most powerful access someone can possibly get. He's not suitable. Why can't Musk replace him? He's just a kid.
- rob74 2y ago
  > Why can't Musk replace him? Because, like Trump, he values loyalty above all else? That's the reason why he reinstated that other guy who resigned after his extreme-right social media posts were unearthed (https://www.theguardian.com/us-news/2025/feb/07/musk-doge-staffer-quits https://www.theguardian.com/us-news/2025/feb/07/musk-doge-st...). That's also the reason why Trump pardoned all January 6 rioters, even those convicted of violent crimes. If it's his people vs. some random cops, he will always favor his people.
  - watwut 2y ago
    I think that in the cases you mention, the extreme-right social media posts appealed to Musk and Trump actively wants people to do violent crimes on behalf of his coup. Neither case was them valuing loyalty over something else. They rewarded people who did exactly what they wanted.
- benzible 2y ago
  "Suitable" depends on what the aim is. If this were a good faith effort to find "waste and fraud" then clearly not. But if the goal is to destroy the capacity of the government to place any restraints on enterprise (and in particular Musk's enterprises), and an assault on the rule of law in general, and the instantiation of a racist ideology, then he's ideal. The fact that they let him go in the first place was the surprising part as what he said was no worse than what many Trump appointees have done.
sandworm101 2y ago
Those kids make good "experts" in thier narrow fields, but that doesnt last long. They are generally not effective leaders, thier usefullness drying up as the state of the art moves on. Some grow up and learn how to operate as leaders in a corporate or government environment, but most burn out once they meet the next generation of golden childs. That's actually ok in a military context. Most kids right out of highschool dont serve more than a handfull of years. Then they are the corporate world's problem.
- lmeyerov 2y ago
  They are not considered experts in their fields. They are not senior in their fields, so that criteria is already off the table, eg, how to deal with legacy, production, and high sensitivity systems in regulated environments. (There are COBOL servers there!) Data science and accounting are fields too, so not sure why that is ignored. So that leaves junior criteria. I taught in one of the depts of one of 'the better' ones, and his peers are publicly lauding him with laughable examples of 'excellence' -- nowhere close to examples we use for describing top students. They sound like regular A/B-grade CS students: unproven new grads. Motivated and high-energy, yes, which is sensible for a junior low-trust role if they pass other basics like references and criminal checks. At our current company, we would not have hired several of them in our entry roles due to the obvious issues that our routine diligence would surface (in recent work history: associating with criminals & criminal orgs, repeat googleable public displays of racism, etc). And the rest, for likely not being at the level of top students applying to us, irrespective of evaluating on academics vs DIY. Their examples would need to be significantly more compelling to change the conversation.
skirge 2y ago
young people hack because of curiosity and some sort of believing in justice (fight corporations, political activism). They are not regular gangsters.
- computerthings 2y ago
  hmmm https://news.ycombinator.com/item?id=42996313 https://news.ycombinator.com/item?id=42996313
WD-42 2y ago
That’s great. What does the infosec industry have to do with DOGE?
- teddyh 2y ago
  Both involve coming to other people’s system and making sense of them as an outsider.
alistairSH 2y ago
If these hires exist (and I'm doubtful they do, at least at any scale beyond "this one kid is an actual genius!"), are they then given the "keys to the kingdom"? Musk/Trump wanted this kid to have what amounts to superuser access to the government purse, which is unheard of for any new hire, let alone one with this kid's background.
jknutson 2y ago
I agree with you. When I was younger, I played a lot of Minecraft PVP servers, and for whatever reason these PVP servers cultivated a weird and toxic community of cyber criminals about them. For reference/star value, the recent headline of the kids stealing 200m in crypto via social engineering— I played with those very same people when I was younger. As in, the people who were sent to jail. Their story repeats itself a dozen times over from my now-fragmented friend group from that time. Many young kids getting into ill-fated get rich quick schemes ranging from credit card fraud to refunding (mail fraud) all the way to sim swapping, blackmail, doxxing, and even real life violence and gang activity. A few of my earliest friends were just indicted for home invasions and armed robbery in some scheme to steal crypto. All of them from Minecraft, weirdly enough. Anyways, those who didn’t end up in jail or “on the run” from participating in these stupid schemes, I tend to notice a common trend towards security related work. I know one guy who went from fraternizing with the same now-criminally-indicted people I hung around to working for the FBI’s cyber crimes unit (fitting, I guess). Another one now works with a defense contractor developing spyware, as far as I can tell. Many more work in different areas of cyber security and programming et al, including myself. The cyber-crime adjacent to cyber security pipeline is very much so real.

by belorn 2y ago

Quarrelsome 2y ago

while I agree there's typically a big event where the state has incredible leverage over the subject that is part of the flip. As far as we can see in this story; there is no leverage. So for all we know this guy is doing what he did in his last job and selling secrets gained working here to competitors. Imagine if DOGE feeds all the data they get their hands on into an LLM and he sells a copy of that to a foreign nation, allowing any other government a text-based interface to ask any questions of any of the internal workings of the US administration, government, citizens or even some of its secrets.

notahacker 2y ago
Even without the leverage, I think that former teenage hackers turned pentesters or three-letter-agency adjuncts are hired for specific skills on the understanding they're being watched and they're probably not getting access to much more than a sandbox or adversary data and the money and freedom's all in scrupulously obeying the rules That feels a little different to hiring people with cracking credentials for auditing jobs, giving them full access to extensive government records (and possibly the right to backdoor them) in a move fast break things environment on the understanding that they're probably above the law and they're less likely to be punished than anyone barring their way. I doubt the success rate of converting teenage tearaways to scrupulous white hats in boring businesses is 100% either....

donmcronald 2y ago

> They basically becomes part informer and part subject expert, especially since IT security expertise seems to be a difficult subject matter to teach in universities. I don't think the argument they can act as an informer for things going on inside government agencies works. They've never been on the inside. And I don't see what it has to do with IT security. What are they doing that's security related? Isn't what they're claiming to be doing pretty much data analysis? The only overlapping skill I can see is a willingness to exfiltrate data, if they're doing that, without giving consideration to the rules or consequences.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

b8 2y ago

People get clearances even if they've used hardcore drugs such as cocaine and various more serious crimes than computer crimes. The adjudication guides for clearances explain this in more detail. I have a friend who exploited RCE full-chain exploits on productions servers and used to DDoS. He got a TS/SCI clearance no problem and didn't even finish college. I interviewed too and admitted to that stuff. They cared more about me admitting to cheating in math at college lol.

Manuel_D 2y ago
TS/SCI clearance is a lot more about truthfulness. The adjudicators are looking for secrets that can be used as leverage. Publicly writing reviews for cannabis strains is not a risk. A Mormon secretly hiding alcoholic tendencies could be. I'm also told that owning foreign property is unfriendly countries, and debt are the other big reasons for clearance denial.
- throwaway2037 2y ago
  > owning foreign property is unfriendly countries This is pretty darn specific. It must be tiny fraction of applicants. Hell, most Americans never leave the United States in their lifetime. The security concern about heavy debts or debts to unfriendly counterparties makes sense to me. But what is the security concern with "owning foreign property is unfriendly countries"? They can take it from you?
  - adbachman 2y ago
    The concern is always leverage and conflict of interest. Is there something about you that you would do anything to keep covered up? Are you susceptible to outside influence? Can anyone, in any country, compel you to act counter to the interest of your employer? Foreign property means you are, at the very least, going to take interest if/when the foreign government threatens it.
    - error_logic 2y ago

ozim 2y ago

I see you are mixing up IT security jobs where you can hire „mischievous people” with IT admins. I say 90% of security is admin work where one has access to various stuff. Then you have red teams, pentesters, consultants- that don’t have ever privileged access to anything. They should find flaws and pass recommendations to IT admins. If they hack anything at all - it has to be outlined in scope and strictly monitored. For both sides protection as if „hacking person” doesn’t get blame for something he did not touch by him but at the same time someone pulled off something nasty.

belorn 2y ago
I think you would be a bit surprised with both the university programs that teach it security, and also which companies that look to employ them. IT security can be admins, it can be programmers that focus on exploit vunerbilities, it can be reverse engineers, it can be pentesters, it can be red teams, and it can be people with high domain knowledge in a very narrow field related to security. IT security is a very wide field. IT security programs focuses a bit on everything, but as in my university, they gave the person responsible for the program a fairly free range to focus on what they thought was what the market wanted. Different universities will focus on different aspects. The organizations that seek such employees are also quite wide. The military, the intelligence agency, large software companies, large companies with internet assets (like banks, but also game studios), government departments like the tax office, and then naturally we got all kind of IT security firms with red teams, pentesters, consultants and so on. A big hire of my class was also a network company developing network finger rules for deep packet inspections, which wanted people skilled with reverse engineering and decompiling (they may or may not have employed people who had experience cracking games).
- ozim 2y ago
  Not saying IT security cannot be admins, sounds like you are bringing theoretical viewpoint. I already have some years of experience and certifications in the field - so it is hard to surprise me. I am pointing out that in most places there is separation of duties so you don't give "red teamer" or "pentester" access to any databases when they are in offensive role. Then most likely administrators (who can have formal education on paper called cybersecurity) who have loads of work so 90% is configuring and keeping all configuration proper will have requirements like background checks and you are not going to hire "mischevious people" for that role. Security is a broad spectrum but still offensive testing is maybe 1-2% of the work that needs to be done, all those systems need people to configure them. Having good security 90% of work is waking up updating software and keeping configurations of systems documented and in proper state. If some company doesn't have their security posture basics fixed there is no point of doing "red team assessment" or a "pentest" with them, that would be waste of time.

zeroCalories 2y ago

Don't know about intellegence agencies but I got to know pentesters / red teamers at some large companiese, and they were cool but had a very unsavory side. Several times I found myself in conversations where they were admiting to serious crimes and unethical behavior. I suspect that you need to be passionate about wanting to do bad things if you want to be good at security.

Fnoord 2y ago
Stories from their young years or recent? Bragging or back when it occurred a sign of skill? There's nuances to be found here.

h0l0cube 2y ago

> that intelligence agencies like to recruit young people active in the cyber criminal scene Just linking this back to the story, am I mistaken in saying that DOGE is not an intelligence agency? (It certainly is a great position to exfiltrate information however.)

gadders 2y ago
I think the implication is that if the person concerned (dox-ed again by Krebs) would pass an intelligence agency review, they should be OK for fraud investigation.
- WD-42 2y ago
  Why? They aren’t the same thing, not even remotely close skill set. Also why do people keep calling this doxxing. These are public employees.
  - gadders 2y ago
    >>why do people keep calling this doxxing. Because they are getting death threats, and that is only reason their names were made public.
    - WD-42 2y ago
      that doesn’t mean they are being doxxed. That just means their identities are known, just like any other public figure that receives death threats.
      - gadders 2y ago
        Wired looked up their details and made them public.
        WD-42 2y ago
        I’m replying to yet another poster with nothing technical in their comment history, just political crap. When did HN become infested by brain rot. Post probably should have been flagged after all.

onetimeusename 2y ago

Yes, I've seen a number of people with criminal records hired. I don't really want to present my comment as an argument against every point Krebs made. I don't really have an opinion on whether the individual mentioned is a suitable hire. But in infosec a lot of people probably got into it because 'hacking' is cool and glorified by the media. It's rebellious and appeals to a lot of teens I think. I don't think it's as serious as Krebs suggested that you could be extorted or compromised. It seems like it's just a bunch of inexperienced people in a discord channel. Soliciting a DDoS on there, to me, just seems like youthful nonsense. If you were actually in some kind of criminal hacking enterprise I bet you would know not to make mistakes like leaving a paper trail to your identity in a discord channel where you solicited a crime. I haven't seen the people with criminal records for cyber crimes be less trustworthy in the industry. Some of them just made stupid mistakes when they were younger and sometimes dumb kids get way overcharged for cyber crimes. For the most part I think it's fine for kids to go through a phase where they think it's cool but they don't really know what they are doing. A lot of people have done that. A lot of 13 yr old kids on the internet have talked about hacking banks and things like that and they aren't all going to be in a gang. Another analogy is how a lot of people get into chemistry because they like blowing things up. Not all those people are terrorists.

zacharycohn 2y ago
> Some of them just made stupid mistakes when they were younger and sometimes dumb kids get way overcharged for cyber crimes. For the most part I think it's fine for kids to go through a phase where they think it's cool but they don't really know what they are doing. I think a lot of the concern is that these kids aren't out of that phase yet.
- FrustratedMonky 2y ago
  Yeah. I'm all for kids hacking, and even hackers with criminal records getting a second chance at security firm. Hacking is done for a lot of reasons, it could be just an interest in solving puzzles, and they happened to get in trouble with the law. The part I'm not digging, is they seem a bit young to be taking over the Treasury Dept, or any department. It seems like this would have been better done by an Accounting Audit Firm, not hackers. Hackers are just trying to get in, get data. An accounting audit would be more about finding impropriety. So, it seems on the surface like 'finding waste' is not the goal.

dpweb 2y ago

I’d also distinguish between the hacker to gets access to a forbidden system out of curiosity or for a challenge, from a person who pays a ddos service to attack someone they don’t like (one of the accused actions of this kid). The latter displays no competency in hacking or cybersecurity, only the attempt to harm another. My concern in their access to secure government systems is not their hacking competency (which has not been demonstrated), but their sociopathy which has.

bakuninsbart 2y ago
Sociopathy is a very strong word, but they do show a pattern of criminal and anti-social behavior. This is not too uncommon in teens, and many young problem kids reform into good members of society either by being shown consequences for their negative behavior, or more or less naturally "mellowing out". The issue here is that these kids seem to fail upwards, and as you say, get rewarded for anti-social behavior, which sets them on a terrible path for the future. In the Com chat log shared in the article, they made fun of Edward Coristine for his complete lack of programming skills, and the other "doxxed" members of the DOGE team have some smaller projects online as well. If that's the kind of code SpaceX and Tesla run on, I'd give all of their projects a very wide berth.
- ZeroGravitas 2y ago
  The guy who bought a DDOS and got fired from an anti-DDOS company for leaking secrets to a rival is an ex-Wall Street multimillionaire's son. He's never going to fail any way but up.

wraptile 2y ago

Equating script kiddies to some genius cyberhackers worth recruiting is laughable when we literally have PHDs and 6 figure salary professionals willing to be recruited legally with zero baggage. Why are the top digital safety institutions hiring the very bottom of the barrel?

modo_mario 2y ago
Not to mention it's not even their job in this case. They're likely doing some data analysis.
michaelt 2y ago
> Why are the top digital safety institutions hiring the very bottom of the barrel? I don't know anything about "The Com" or top digital safety institutions. But I do know that historically, some parts of hacker culture have drawn heavily from political theories of anti-authoritarianism, anarchism, and libertarianism. If the authorities and rules intend that I not have access to something, and I have a fascination with bypassing that and getting access anyway, am I not subverting power structures in the most literal sense? If large corporations believe they alone should control the software that runs on my printer, so that they can ensure only authentic supplies are used and premium features are only available on premium devices, while I believe every user should be able to modify their printer's software and behaviour without limit, including to bypass such restrictions - is this not an anarchist stance, opposing coercion and mechanisms that perpetuate control? If the exploit-discovering side of cybersecurity is inherently anti-authority, recruiting people who've never defied an authority in their life might not be the best move.

chonkerz 2y ago

I think the difference is in the kind of positions the "second chance" people get hired to. They aren't put in positions where they could cause significant wide scale harm with no auditing or barriers. The debate isn't whether he should go to jail. The debate is whether he should get a clearance for some of the most powerful access someone can possibly get. He's not suitable. Why can't Musk replace him? He's just a kid.

rob74 2y ago
> Why can't Musk replace him? Because, like Trump, he values loyalty above all else? That's the reason why he reinstated that other guy who resigned after his extreme-right social media posts were unearthed (https://www.theguardian.com/us-news/2025/feb/07/musk-doge-staffer-quits https://www.theguardian.com/us-news/2025/feb/07/musk-doge-st...). That's also the reason why Trump pardoned all January 6 rioters, even those convicted of violent crimes. If it's his people vs. some random cops, he will always favor his people.
- watwut 2y ago
  I think that in the cases you mention, the extreme-right social media posts appealed to Musk and Trump actively wants people to do violent crimes on behalf of his coup. Neither case was them valuing loyalty over something else. They rewarded people who did exactly what they wanted.
benzible 2y ago
"Suitable" depends on what the aim is. If this were a good faith effort to find "waste and fraud" then clearly not. But if the goal is to destroy the capacity of the government to place any restraints on enterprise (and in particular Musk's enterprises), and an assault on the rule of law in general, and the instantiation of a racist ideology, then he's ideal. The fact that they let him go in the first place was the surprising part as what he said was no worse than what many Trump appointees have done.

sandworm101 2y ago

Those kids make good "experts" in thier narrow fields, but that doesnt last long. They are generally not effective leaders, thier usefullness drying up as the state of the art moves on. Some grow up and learn how to operate as leaders in a corporate or government environment, but most burn out once they meet the next generation of golden childs. That's actually ok in a military context. Most kids right out of highschool dont serve more than a handfull of years. Then they are the corporate world's problem.

lmeyerov 2y ago
They are not considered experts in their fields. They are not senior in their fields, so that criteria is already off the table, eg, how to deal with legacy, production, and high sensitivity systems in regulated environments. (There are COBOL servers there!) Data science and accounting are fields too, so not sure why that is ignored. So that leaves junior criteria. I taught in one of the depts of one of 'the better' ones, and his peers are publicly lauding him with laughable examples of 'excellence' -- nowhere close to examples we use for describing top students. They sound like regular A/B-grade CS students: unproven new grads. Motivated and high-energy, yes, which is sensible for a junior low-trust role if they pass other basics like references and criminal checks. At our current company, we would not have hired several of them in our entry roles due to the obvious issues that our routine diligence would surface (in recent work history: associating with criminals & criminal orgs, repeat googleable public displays of racism, etc). And the rest, for likely not being at the level of top students applying to us, irrespective of evaluating on academics vs DIY. Their examples would need to be significantly more compelling to change the conversation.

skirge 2y ago

young people hack because of curiosity and some sort of believing in justice (fight corporations, political activism). They are not regular gangsters.

computerthings 2y ago
hmmm https://news.ycombinator.com/item?id=42996313 https://news.ycombinator.com/item?id=42996313

WD-42 2y ago

That’s great. What does the infosec industry have to do with DOGE?

teddyh 2y ago
Both involve coming to other people’s system and making sense of them as an outsider.

alistairSH 2y ago

If these hires exist (and I'm doubtful they do, at least at any scale beyond "this one kid is an actual genius!"), are they then given the "keys to the kingdom"? Musk/Trump wanted this kid to have what amounts to superuser access to the government purse, which is unheard of for any new hire, let alone one with this kid's background.

jknutson 2y ago

I agree with you. When I was younger, I played a lot of Minecraft PVP servers, and for whatever reason these PVP servers cultivated a weird and toxic community of cyber criminals about them. For reference/star value, the recent headline of the kids stealing 200m in crypto via social engineering— I played with those very same people when I was younger. As in, the people who were sent to jail. Their story repeats itself a dozen times over from my now-fragmented friend group from that time. Many young kids getting into ill-fated get rich quick schemes ranging from credit card fraud to refunding (mail fraud) all the way to sim swapping, blackmail, doxxing, and even real life violence and gang activity. A few of my earliest friends were just indicted for home invasions and armed robbery in some scheme to steal crypto. All of them from Minecraft, weirdly enough. Anyways, those who didn’t end up in jail or “on the run” from participating in these stupid schemes, I tend to notice a common trend towards security related work. I know one guy who went from fraternizing with the same now-criminally-indicted people I hung around to working for the FBI’s cyber crimes unit (fitting, I guess). Another one now works with a defense contractor developing spyware, as far as I can tell. Many more work in different areas of cyber security and programming et al, including myself. The cyber-crime adjacent to cyber security pipeline is very much so real.