What’s the once staunchly metal hacker convention Kiwicon doing swapping skulls for stuffed toys, and what’s the deal with the new con on the block? Alex Stronach reports. 

It starts with hackers, pyrotechnics, and an alpaca in a party hat.

No, wait, let’s rewind.

It’s June 2019, and every Kiwi pundit is grappling with a question they’re critically under-equipped to answer: just what is hacking? Did National hack the budget? Was Grant Robertson a liar when he claimed to have been hacked? The budget breach disappeared from the headlines without anybody ever answering those questions, but I wasn’t happy, so I kept asking. My questions took me to Kawaiicon, and Kawaiicon was a story of its own.

The Wellington hacker convention (formerly Kiwicon) is in its 12th year, and it’s one of the biggest information security events in the southern hemisphere. It attracts hackers of all stripes: offensive (“red”) teams, defensive (“blue”) teams, and folks who live somewhere in between (“purple teams”), and also brings in techie sorts from a dozen different fields outside of security. Tickets sell out in a matter of hours. Adam “metlstorm” Boileau had been running the event that entire time but this year handed the reins over to a younger hacker – Erica Anderson, aka sputina – to head the crew.

I’d been hearing about it for months, a sort of telephone game about something dramatic going on behind the scenes: the sudden name change, the new aesthetic, the sister convention Purplecon splitting off into a venue across town. I walked in expecting to find a war. Kiwicon is semi-infamous for its bogan aesthetic, outlaw attitude, and open bar at the afterparty. It’s a bearded guy in a black hoodie with a skull on it. It’s, well… metal.

I’m not sure what I expected from metl; for him to speak in machine code, for him to be wearing six layers of black hoodies with different skulls on them, for my phone to spontaneously explode when I got too close. The man could be a T-1000 and still not live up to half the rumours. He wore camo pants and an M1 helmet with Born to #Shell printed on it, but he was jovial, animated, talkative. I asked him the question: what is hacking? He talked about playfulness, having fun, and how hacking was, at the end of the day, just using tech in ways it wasn’t meant to be used.

The conversation turned to the handover, and he talked about the younger hackers in a gentle, almost fatherly way. The convention had adopted a totally new look: vibrant colours, cartoon animals with big eyes, glitter all over the place, but it didn’t seem to bother him; he called it an extension of artists like Bowie who delighted in blurring lines — somewhere between creativity, self-expression and friendly trolling.

“We take not-taking-ourselves-seriously pretty seriously,” he said.

It’s hard to walk into the main stage at Kawaiicon and not be struck by its contradictions. Eight-bit versions of classic metal songs blast over the speakers. The massive screen is covered in cute cartoon animals. There’s a life-sized toy alpaca in a party hat. At the start of the first day, metlstorm comes onstage, and the animals disappear, replaced with a black skull filled with red worms, or maybe tentacles. Guitars blare, pyrotechnics go off, and metl announces that the ‘con’ (convention) will be business as usual.

It won’t be.

Metl’s signature skull-and-crossbones aesthetic has been a major part of the con since day 1, and there was consternation from some older hackers at the announcement: that sputina would make it cute and girly and nonthreatening. She took that idea and ran with it, renaming it Kawaiicon (from the Japanese “kawaii” for “cute”), putting cartoon and ASCII animals everywhere, adding as many bright colours as she could. Throughout the event, metl would take over the stage and announce that he’d defeated sput and brought back the skulls, only for her to reappear, chase him off, and bring back the animals.

One of the convention badges has a cute sheep with a pentagram carved into its forehead and black sludge leaking from its eyes. On stage on day 1, sput is wearing a shirt with a cartoon Baphomet on it.

Sput is, like almost everybody at the convention, a former alternative kid. She’s more punk than metal, but it still seems like much of the new aesthetic is a punchline to her. She thought it would be funny to put all the big bogan hackers in the cutest room she could, and things snowballed from there. It’s not clear how serious she’s being, but it’s not clear how serious anybody is being. There’s a refusal to be pinned down that seems common to everybody in the building. But, like many people I spoke to, she voiced sincere concern about information security being dark and unwelcoming, and that it needed to be less scary if they were going to bring new people in.

On the first day, Courtney Eckhardt, an incident response specialist, had given a talk on the mechanics of being good to each other; a guide not about being a better hacker, but being a kinder hacker. I thought about it as sput spoke about hacks being made worse because people were scared to come forward and honestly discuss what had happened; crucial details go unseen because somebody came forward late or not at all, letting attackers go longer undetected or deal more damage.

Partway through the second day, sput came onstage and announced she’d caught metl and subjected him to ‘cute re-education’. He came back out in a pink hoodie, with glitter in his beard, a stuffed alpaca and bandolier of bullets. He looked like he was enjoying himself.

The good-natured battle for the soul of Kawaiicon symbolises a moment of flux: an entire industry trying to negotiate its identity in a time when their skills are needed more than ever. In June 2017, a virus called NotPetya (speculated to be a Russian cyberwarfare attack that spun wildly out of control) took down the entire Maersk company for 10 days. Maersk controls about 20% of global shipping; another week or two, and we could have seen food shortages. The spectre of NotPetya hung over the convention when metl said, “We’re having fun with it but it’s serious fucking business. We’re not going to know how bad it is until somebody decides to really fuck with us.”

The question in every 2013 InfoSec article about bedroom hackers going mainstream was, “Can the punk kids work office jobs?” It was the wrong question: punk kids have been working office jobs since before punk was even a thing. The real question is: “Can the punk kids save the world?” Can they save each other? Maybe that’s where this new kindness is coming from. Nobody ever said it explicitly, but it came out sideways, in quiet moments and morbid jokes, and the stats back it up: the rate of depression and burnout among hackers is high. The pay is good but the stress is immense, and few people outside the industry understand how bad things are. It could be personal myth-making, but there’s a tangible feel that they’re the last line of defence against some great enemy that even they don’t know the name of. Injecting some softness and humour into that doesn’t just seem practical, it seems almost medicinal.

I asked sput the same question as everybody else: what is hacking? “To be a hacker,” she said, “you need to be curious and solve problems and do cool shit.” It seems like sometimes that means writing code to crack into a system and sometimes that means, well… knitting. A surprising number of hackers are into hobbies like crochet that need strong problem-solving skills to make something beautiful with ungainly tools.

Which brings us at last to Purplecon. It’s on the Wednesday, at Pipitea Marae down the road. Purplecon started in the Kiwicon spare room in 2018, but this year they had an entire venue to themselves and took the increased space as an opportunity to decorate. A sign on the wall tells me to drink water, and another tells me I look cute. The convention badges are knitted purple stars, done by organiser Jeremy Stott’s mum. One of the core organisers is Alex “mangopdf” Hope, a softly spoken Australian hacker with a shock of dyed blue-and-pink hair. Purplecon was envisaged as an event for “blue teams” (defensive hackers) and developers. Alex intentionally chose an aesthetic as far away from the traditional skull and crossbones as possible: pastels, lavender, a dedicated bubble tea station. The Kiwicon organisers had purchased the ‘Kawaiicon’ domain years ago for a laugh, and had occasionally joked about running a cute year: the Purplecon organisers clearly thought the idea was a good one.

Alex compared the traditional hacker aesthetic to markings on a wasp: “danger, stay away” – and that’s a problem when security matters more than ever, and infosec needs to be a bigger tent. Despite the lure of good money, information security isn’t an industry many people get into on purpose. There’s little formal training; more often than not, people fall into it by accident. It’s hard to recruit for, and doubly so when the industry’s favourite aesthetic is so daunting.

There was no tension between the conventions. Most of the Purplecon organisers were at Kawaiicon, manning tables or helping out behind the scenes; it felt less like a split than an organic growth in a different direction. The Purplecon website even made a joke about it.

The Purplecon manifesto claims “everybody’s rebelling the same way”, but they’re still rebelling. I asked a few different attendees at each con whether they thought hacking was inherently rebellious, and they looked at me like I’d asked if water was inherently wet. Of course they’re rebelling, even at the defence event with the bubble tea table.

There’s a nail painting station at Purplecon, and the bottles have a prominent 420 on the cap. “It’s a coincidence,” said Alex, “that’s just the colour [code].” I had the same feeling I’d later get with metl and sput: like I was – in the nicest way possible – being fucked with, just a little. The nail table had the weed number displayed prominently: a little tongue poking out at anybody who might want to take things too seriously. The same ethos as Kawaiicon, coming from a different direction.

I asked Alex the question: what is hacking?

“Everybody hacks something,” they said, “just not always with a computer.”

The knitted Purplecon stars were one of the least unusual things about the event. Knitting is perhaps the one thing I saw universally taken seriously, and I got given a few different reasons: it’s creative; knitting patterns are like a form of code, where the knitter is a computer; it’s taking simple tools and doing something unexpected. You can do a lot with knitting needles: you can knit, sure, but you can also write code into a scarf to slip it past the Nazis. Hacking isn’t an aesthetic or an event; it’s a mindset, a process, a very specific sort of curiosity.

How do you hack something? According to Alex, “you probably already have”.