Chaos Communication Congress: A Very German Hacking Conference
From WWII, through the leftwing rebellions of the 80s, to the squats of Berlin, the CCC is a hacking conference built on politics. And volunteers.
Photo: Joseph Cox
Mime artists lounge on the carpeted staircases, hundreds of tables littered with laptops stretch throughout various halls, and one man lies fully dressed and face down in a squatter's mattress, burnt out from the previous night of ferociously hitting keyboards.
Members of dozens of Chaos Computer Club (CCC) chapters spread around Germany, along with attendees from all over the world, have descended on Hamburg for four days of hacking, debating, lectures, and drinking Club Mate.
This is the Chaos Communication Congress, the CCC's annual arts, politics, and security conference, built by an over-thousand strong volunteer army.***
"Nobody gets a cent for anything," Linus Neumann, a CCC spokesperson, told me in a Berlin cafe before the Congress. Whether that's the people filming the talks, the guides making sure that broadcast media don't point cameras at people without their permission, the trained first-aiders who can respond to accidents, or the guys running the cloakroom and checking people's wristbands as they enter the conference, nobody gets paid, and they often buy a ticket for the event themselves to support it.
Tim Pritlove, a long time CCC member and former Congress organiser, doesn't think of it as simply working without pay though.
"It's not really for free. I really think you can't look at this like that: because it's not work," he said over coffee at the most recent Congress. "It's their event: they own it. It's built into their DNA and they can't really live without it."
Over the years, and in part thanks to this volunteer aspect, the CCC has managed to store a significant amount of cash.
"I'm not going to say that we're particularly rich, but, from a financial perspective, we're comfortable," Neumann said. "We could bear the financial risk to completely ruin the whole thing, and not get bankrupt over it."
"This money is there because everybody exploits themselves: because everyone does the volunteer work," he added.
This idea of volunteering is what really separates the Congress from other hacking conferences. And, it's a holistic, multidisciplinary approach.
DJs, artists, hackers, technologists, activists and others all come together to share and discuss the issues of their time, and party late into the night, in the Congress' own warehouse-style nightclub.
"Many people are very surprised to see, when they come here for the first time, that it's much more inclusive, much more broadly defined, than they thought," Pritlove said.
There are some people who are not particularly welcome at the Chaos Communication Congress, however.
"A person working in the military area in Germany and [who] attended CCC, probably wouldn't tell anyone, and they probably wouldn't pride themselves on stage," Neumann said.
At Black Hat, one of the main US hacking conferences, the 2013 keynote speech was delivered by National Security Agency Chief Keith Alexander.
This, clearly, would never happen at the Chaos Communication Congress.
"That'll be the day when I quit," the CCC's chairman, who goes by the handle "dodger," told me. "We try as hard as possible to avoid people who work for the intelligence industry or things like that."
But a grey area comes in when dealing with ex-military or secret service. If the CCC issued a blanket policy against inviting those who had worked in those spheres, "then we can't have any whistleblowers," such as Edward Snowden, dodger said.
That anti-military mindset can be traced throughout the Congress' history, and the political events that led to its creation.***
In 1981, a hacker and amateur radio operator called Wau Holland, and a small collection of like minded people, met in the offices of left-wing newspaper Die Tageszeitung to discuss data, computers, and what the affect of these might be on populations.
"Wau Holland was a visionary for society," Neumann said. Even as far back as the early '80s, when most people did not own a computer, and the worldwide web was yet to be created, Holland and others saw the future of these networks as exciting and alarming.
Three years later, in 1984, the CCC announced the first Chaos Communication Congress, a regular meet-up in Hamburg. "The first incarnation of the Congress was rather small, probably 200 people," Pritlove said.
But despite its modest size, the '84 Congress encompassed all of the same things that the gathering touches upon today. Workshops, lectures, and crowds of people hacking away at laptops for days on end.
"Same topics, same attitude, same people," Pritlove said.
The CCC then created an "eingetragener Verein (e. V.);" essentially a legal body that would allow the group to process finances.
Having a formal entity also gave the group some legitimacy, and legislative protections while carrying out their work: indeed, hacking into banking systems or telecommunications networks could easily be interpreted by law enforcement as criminal and nefarious activities. Operating as an e.V. lowered the risk of any intervention.
"It was just construction that was later adopted in order to not be recognized as a terrorist group," Pritlove said jokingly. "That was the alternative."
In the same year the Congress started, Wau Holland and another CCC member, Steffan Wernery, carried out a 'bank-robbery.' They pinched 135,000 Deutsche Mark (around $75,000) using vulnerabilities in Bildschirmtext (BTX), an early computer network run by the German federal post and phone network, and credited the cash into a bank account owned by CCC.
"I think Germany is an island where hackers are respected"
Initially, the government body behind the network had ignored the issues raised. So CCC shared details of the hack with one of the largest broadcasters in the country, and after a media frenzy, the problems were fixed. The cash was returned.
"From the beginning [the CCC] was playing the media game," Pritlove said, adding that the perception of hackers in Germany instantly became a "Robin Hood-esque thing."
Other, high profile hacks contributed to this image. To protest against the use of biometric data in passports, the group published a fingerprint of Wolfgang Schauble, Germany's then interior minister; together with a Dutch citizen group, CCC uncovered vulnerabilities in electronic voting systems after the machines were used in Germany; and in 2011 the group reverse-engineered a piece of powerful malware used by the country's law enforcement.
And then just recently, in an echo of the '84 BTX hack, German news program Tagesschau reported on researchers' findings that European payment terminals are plagued with serious vulnerabilities, allowing an attacker to move funds to any bank account in Germany.
"So the hacker image in Germany is totally different from the rest of the world, especially the US, where it was generally associated with criminal activity," said Pritlove. Instead of being seen as a swath of cybercriminals, as media often portrays hackers in the US, CCC members have been asked to testify at several government hearings, and provide expert testimony on surveillance, IT legalisation, and data retention.
"I think Germany is an island where hackers are respected," added dodger, the CCC chairman.
But there have been points when the German hacking scene, and the club, could have been destroyed completely.***
A group of CCC affiliated hackers led by a man called Karl Koch was arrested for breaking into US computers, and selling operating-system source code to the then Soviet secret service, the KGB. In 1989, Koch was found burned to death in a forest near Celle, near his native city of Hannover.
The whole episode was "threatening to be the end of the CCC," Neumann said—a severe dent to the image of hackers, and what they stood for.
The Congress moved several times between Hamburg and Berlin, Pritlove explained. The gathering took place in Berlin when the wall came down in 1989, making the capital a "crazy place," Pritlove said, where "every subgroup of society is somehow big enough to sustain itself."
Then in the late '90s, the Congress ballooned, perhaps more than ever before. "Finally hacking was cool, every kid had his computer," Pritlove said.
"The 'world wide web', 'cyberspace', everything was totally exciting," he added. "The year 2000 was coming, finally the future is here!"
During this entire time, a constant political line had run through the CCC and Congress' growth. From the offices of left-wing newspaper Die Tageszeitung, through the anti-capitalist squats of Berlin and Hamburg, right up to today with a Somalian refugee delivering the keynote speech on the conference's main-stage, politics has played a vital role in shaping the club and its actions.
Other political talks include the annual State of the Onion session, an overview of the previous year for the Tor anonymity network, and discussions on the effect that surveillance systems are having on our cities.
"We told them in '80s, and now it's happening," dodger said.
"You can't separate them," said Pritlove, referring to the Congress and politics. All three agreed that the political lineage of CCC and the Congress stretched back much further than the club's founding: one sees it as ultimately a post-WWII reaction, and Pritlove notes the aggressive, leftist political movement that sprung up in the 70s.
The solution was "we need to stop this. We need to find a different way, we have to start our march through the establishment. We need to be constructive. We need to walk in where these decisions are made that we criticise, we can't just stand outside and throw Molotov cocktails all the time and kill people."
That entering into the establishment has been well-received. In November 2015, Germany's interior minister public stated that if a large scale internet-related or cyber incident occurred, it would be the CCC that he would like to turn to.
"This whole event is an operating system now"
Up to this point, in the mid-00s, the Congress had been a largely insular affair. Although it was attracting hackers from all over the country and Europe too, those across the pond were largely oblivious to it.
So, Pritlove told me, CCC started to reach out to US contacts, and invite them to give lectures.
"They came home, and told all their friends about it, and the next year there were 20, and the next year there were even more," Pritlove said.
The Americans were apparently surprised. "Hacker conferences in the US are full of cops, full of business, full of secret service, full of mistrust," Pritlove continued. "It's a lot about money."
The Congress, meanwhile, "was pure freedom, and [Americans] are still in this George W. Bush era, full of horror and terror and crackdowns on hackers."
"Two weeks later after they all returned, they founded hacker spaces in San Francisco, in Washington, in New York. One year later everywhere in the US, new hacker spaces were born," Pritlove said. "I think it's fair to say that the spark that ignited this really came from here, from this scene."
This distance between the military and German hacking scenes is drastically different from the much closer relationship in the US.
"Basically, anybody who works in the field of IT security in the US, is not going to get far without sooner or later being some kind of defense contractor, or somewhere in this area," Neumann said. "That's where the money is, that's where the interesting jobs are, that's where you build the fun stuff."
He also pointed to Roger Dingledine, co-founder and research director of the Tor Project, who has worked on several military funded contracts. (The Tor Project is currently trying to diversify its funding, and especially gain less of a reliance on US government money.)
In Germany, meanwhile, there just isn't this contractor, military-industrial complex, or at least anything to the same extent as the US.
There's not "much money in this, and not too much national pride in the military," Neumann said. So instead of going down that route, blossoming hackers in Germany are likely to head somewhere else: the CCC. "We have most of the researchers," Neumann added.***
This year, the Congress received over 13,000 attendees, and has become a whirling, intertwined contraption of various home-made networks and infrastructures.
The computers for scanning tickets as attendees roll into the conference run their own software, as do the cash desks. There is a logistics system for managing the stock of Club Mate bottles in the bars and to take the empty ones away. The "Silk Road" delivery system—a web of tubes weaving in and out of rooms all around the building—allows hackers to send small items across the conference centre.
Multiple, high bandwidth up-links provided attendees with seriously fast network connectivity; and a fully functional GSM mobile phone network lets anyone contact their friends while tinkering late into the night.
Even the video crews, who film, livestream, and archive the talks in high definition quality, also use their own cameras, setups and sometimes software.
"I would say it's even beyond the professional standard, because you just can't buy this service," Pritlove said. "This whole event is an operating system now."
That open-source nature is of course reflected in the attendees own devices of choice: during the "Infrastructure Review," an hour long presentation made by various groups handling the backbone of the conference, speakers announced that Linux was by far the most popular umbrella of operating systems, making up nearly a quarter of all computers used during the Congress. ("This time Linux has won," said the presenter, followed by shouts and applause from the audience).
"These are the companies that actually make this event possible," a speaker during the Infrastructure Review said, while showing a slide of various organisations. This year, those companies included Chinese corporate Huawei, Deutsche Telekom (the largest internet service provider in Germany), and just over a dozen others.
"We've got a little bit of a problem there: you can't run a conference like that without lending stuff from big companies," said dodger. "You need to get hardware. You can't pay for that hardware and own it; it's not possible." Indeed, at a conference of this size, which provides connectivity for thousands of people, likely nobody owns the hardware and infrastructure necessary to carry that out, so sponsors do have to be reeled in.
But this isn't necessarily like other conferences, where by providing gear, massive companies get to paste their brand all over the trade floor, in the hope of picking up some new customers.
"We try to find partners who lend us hardware, and we also try to have not one main sponsor. We don't allow banning or advertising in the Congress," dodger told me. Instead, anti-fascist and pro-refugee flags flood the conference halls. "The hardware sponsors get their logo on the CCC website with no Google indexing or so on. That's what they get."
These connections between the CCC and large corporates typically come about because a member will work for one of them, Neumann said.
"Of course we have people working at NXP," he told me, referring to a large computer network company. "If we want to talk to the head of NXP security branch, I have his number, I call him." These relationships have grown over the past three decades, and are "part of people's normal professional lives."
The real spine of the Congress is not the digital infrastructure or computer hardware, however. It is the army of volunteers who work at the conference for free.
"You need about a thousand people to take care of all the crap," Neumann told me.
Most of these volunteers are the so-called Angels: individuals who keep the system running steadily for four days, even under intensive usage. (Within twenty minutes of arriving at the Congress on the first day, I was asked by an Angel to grab some coat hangers from one room and move them to another. Naturally, I helped out, albeit a tiny amount).
And that volunteer culture is just one of the many reasons that the Congress is so intimately married to Germany. But it is also linked as a country with distinct historical and political lineage.
Neumann said that something like the Congress might be able to exist outside of the country, but it would likely be difficult: the sheer logistical challenge of getting over a thousand people to pull together for days or weeks on end is not an easy thing to imagine in other places.
When Pritlove was asked whether the Congress could exist outside Germany, he let out a long sigh.
"It's a very German thing," he said. "I don't know."