Defcon is one of the world's premier hacking conferences, yet few women attend. Complaints about sexist behavior offer a window into the culture its organizers downplay as harmless fun.
Nine contestants playing Hacker Jeopardy in a crowded Las Vegas ballroom room probably didn't expect to become the latest symbol of the tech industry's struggles to include women.
But then the master of ceremonies told them one of the categories would be "Dicks." The answers were tongue in cheek, like "Dick Cheney" and "Charles Dickens." But then came a question about an actual dick. Contestants had to give the size of a certain porn star's penis to within a half an inch. Women, one wearing skimpy clothes and a strap-on dildo, played roles on stage, such as serving beers. They also took off a piece of clothing each time contestants got a double jeopardy right.
To many of the thousand attendees, this was a fun Friday night event for this year's Defcon, a volunteer-run hacker convention that's been held each year in Las Vegas since 1993. This show, and the Black Hat conference earlier the same week in Las Vegas, are the premier hacking events of the year.
Defcon is a more free-wheeling hacker meetup, while Black Hat features dozens of corporate sponsors and exhibitors. Together they draw some of the biggest names in cybersecurity, from Dan Kaminsky -- who once found a flaw in the internet's core that could have let hackers impersonate websites and intercept email -- to Radia Perlman, who created one of the foundational protocols that power the internet. Some of the issues discussed at Defcon have forced major changes, like when Chrysler recalled 1.4 million Jeeps after hackers demonstrated they could remotely take control of the vehicles' transmissions.
That's partly why Debra Farber, senior public policy director for cybersecurity and privacy at Visa, was stunned by Hacker Jeopardy. To her, women taking off their clothes in front of a group of men could have been mistaken for a bad Hollywood portrayal of a frat party.
"I felt like women took 20 steps back," said Farber, who attended Defcon as a representative of Women in Security and Privacy, a project to support women in the $75 billion cybersecurity industry.
David Helder, who's attended Defcon on and off since 1999, was also embarrassed by the scene at Hacker Jeopardy. He posted a photo on Twitter of one of the "Dicks" category questions with the caption: "Men play. Women give them beers. Why aren't there more women in security?"
Helder's photo struck a nerve -- it's been retweeted more than 900 times. As it spread across Twitter, female attendees at the conference also began posting about their experiences of being harassed, insulted and excluded at the conference this year and in years past.
With that, Defcon became the latest example of the boy's club in tech and the industry's failure to treat women as peers.
The tech industry has a problem. Generations ago, women were at the forefront of computing. They invented some of the first computer coding languages. They led projects to program the lunar landing module that took the Apollo astronauts to the moon. They invented key parts of Wi-Fi technology decades before your phone was even on the drawing board. A woman, Ada Lovelace, even wrote what was considered the first computer algorithm -- back in the 1840s.
And then suddenly, the field of women dried up. There are lots of theories about why, but now Silicon Valley is attempting to address the fact that one of the world's most lucrative industries is largely a male-dominated field, with few women and minorities. Women make up about a third of the workforce at Apple, Facebook and Google. Look deeper and you'll find most of the boardrooms and senior leadership of these companies dominated by men, with a few exceptions.
In cybersecurity, women make up 10 percent of the workforce, according to the IT security organization ISC2. "This is a lucrative business and very intelligent people want in," said Deidre Diamond, CEO of cybersecurity recruiting and training company CyberSN. That includes women.
At this year's Defcon, women represented between 8 percent and 12 percent of the estimated 22,000 attendees. That's typical of other years.
When you look at Hacker Jeopardy, with its stripping, dildos and dick jokes, it's not hard to imagine why some women would feel less than welcome. What's more, the organizers of the event clearly saw room for improvement after Friday night. On the second night of the two-night event, organizers changed the rules -- if contestants answered correctly, they could opt to send a donation to the Electronic Frontier Foundation rather than see a woman take off an item of clothing. Only one contestant decided to see someone strip, and then the crowd booed and the male referee took off his pants.
Kat Valentine, who works in cybersecurity and once helped provide technical support to a Hacker Jeopardy production many Defcons ago, said the contest isn't the source of the problem. It's just the latest example of larger issues within the hacker community.
"[Hacker Jeopardy] is a reflection of what the crowd -- the Defcon attendees -- want," she said in an email. "The change needs to come about with the Con and within the community itself."
Hacker Jeopardy was one point of controversy during a four-day event that did attempt to embrace women this year.
For example, Defcon founder and organizer Jeff Moss agreed to donate space in the vendor hall to Women in Security and Privacy, which Farber said raised about $10,000 for its cause. A women's networking event called TiaraCon was held over two days during Defcon, offering lessons on everything from lock picking to resume writing. Four conference volunteers, called Goons, were made available to deal with complaints of harassment.
Moss acknowledged that despite these efforts, there were complaints about both Hacker Jeopardy and Defcon as a whole. "Every year we get certain things right, and we make new mistakes," he said, adding that he's unsure how to address the harassment situation.
The conference's code of conduct specifically says harassment isn't allowed. "It's not about what you look like but what's in your mind and how you present yourself that counts at Defcon," the code says.
But how do you enforce that in a crowd of thousands?
At least one woman tweeted that a Goon brushed off her complaint of harassment. Moss called that "heartbreaking."
Another problem is that harassment comes in many forms, from cruelty to a slight. Lorrie Cranor, chief technology officer with the Federal Trade Commission, said that aside from Hacker Jeopardy and a strange comment a male attendee made to her, she largely had a good time.
"They don't see too many women coming here," she said. "That's sort of a problem."
Hacker Jeopardy organizer and master of ceremonies G. Mark Hardy said he was trying to hit the right tone with the event, which has traditionally been even more bawdy than this year. When he took over organizing the contest in 2013, he removed all the overtly sexual content, including a dominatrix character called Vinyl Vanna and all hints of nudity, he said. He's added some things back in since then to get the right mix. The dildo, he said, was not something he saw or planned.
Hardy, who doesn't use social media, said the negative reaction on Twitter came from a small group and only seems noteworthy because of "the availability heuristic," or when the mind leaps to the first example at hand to understand a larger issue.
"I was approached by dozens of people who said, 'That was the best thing ever,'" Hardy said. "Not a single person approached me with a problem or an issue."
Asked about the optics of a stage full of men being served beer and stripped for by women, Hardy didn't answer the question but offered that women are welcome to try out to compete in Hacker Jeopardy. "It is a meritocracy to get onto the stage and pick the teams," he said.
Some women did enjoy Hacker Jeopardy, including Genevieve Southwick, better known in hacking circles as Banasidhe. Southwick used to perform in the raunchier version of Hacker Jeopardy as Vinyl Vanna, the dominatrix. This year, she competed in the game on Saturday, the cleaner night, and led her team to victory. That's right, a woman won Hacker Jeopardy.
"I thought it was silly," Southwick said of the backlash, adding that all the women who participate onstage are industry professionals. In her years portraying Vinyl Vanna, Southwick said she felt "absolute empowerment."
Moss was hesitant to condemn the antics of Hacker Jeopardy, despite complaints. It's fine, he said, "if consenting adults are having fun." But, "If anyone is feeling ridiculed or diminished or demeaned, that would not be acceptable."
Four women I spoke with enjoyed and defended the event. They said it doesn't exclude women and fits with the character of Defcon, which includes seminars on everything from soldering circuit boards to tricking people into giving up sensitive information about corporate computer networks and, of course, hacking pretty much anything with wires in it.
One of these women is April Wright, who works in cybersecurity and wrote me an email explaining what she loves about the convention. "Defcon is like Spy School Summer Camp," Wright said. "There are very few rules, and that's what makes it great."