Monday, March 23, 2015

CSI:Cyber Really Sucks

As an Information Security Professional, I love cheesy hacker shows and hacker movies.  I can't name a hacker movie I didn't *love*.  They're all amazing in their own specials ways (yes, even the Wargames sequel).  As for TV shows, of course I was a huge fan of "Numb3rs", "Leverage", and "Lie to Me" when they were airing.  For some reason I couldn't get into "Scorpion", probably because the main character is just a huge dick.  CSI:Cyber is something else entirely though.

So, we're three episodes in.  That's probably enough time for the actors to get their groove, and to get a taste of the general algorithm of the show.  I actually really like all these actors, and after the first somewhat bumpy first episode, their chemistry seems to have clicked into place.  I really like that the Avery character has this whole Lightman/Ekman thing going on.  Of course Peter MacNicol is great in everything he does.  The way the three hacker kids interact is somewhat annoying.  Daniel is the stuck up whitehat who thinks working with blackhats is beneath him, and Raven and Brody being "former blackhats", who are now being groomed by Avery to "hack for good".  This isn't really the way things work when real kids are blackmailed into signing plea deals.  There's usually a lot more babysitting involved.  The polarity of the whole whitehat/blackhat thing is I think way overdone, especially when it seems like "blackhat" means illegally breaking into shit, and "whitehat" means illegally breaking into shit while carrying a badge.

Hey, remember that time that 4chan figured out how to Google for baby monitors?  There was a huge media frenzy at the time.  What if, instead of being dicks and simply yelling at the babies, they set up an international rich white baby auction, connecting eccentric millionaires all over the globe who, for some reason, really want to buy rich white babies for a few hundred thousand dollars a pop.  This has got to be the absolute worst business plan I've ever heard.  If you haven't been watching, this is the first episode, and our first clue for unraveling the algorithm.  What they appear to be doing in each episode is pulling down some extremely sensationalist headline, usually backed up by some legitimate bit of security research, and then they put some psychopath or absurdly moronic criminal syndicate behind it.  This is the core of the problem.  The entire show seems to be driven by sensationalist headlines, rather than actual crime statistics, or real security research.

I take my job very seriously.  The primary goal in all the work I do is to make things as expensive as possible for potential attackers.  A huge part of this mission is to arm the general public with the knowledge that they need to make informed risk assessments.  This brings me to the most sickening part of the show, the tagline of "It could happen to you..".  Fear is absolutely the enemy of rational thought, and unfortunately the entire purpose of this show seems to be to scare the general public away from new technologies rather than teaching them to understand the risks.

The big annoyance here is that the show has such potential.  There's a lot of real cyber crime that happens every day.  Not mundane stuff either.  Carding rings are still running rampant.  Large companies are getting penetrated from silly bugs, and there has been a huge rise in corporate espionage.  All of this crime is done by real people with real incentives.  They have real business plans and serious profit motives.  Crazy-Pants McGee doesn't do cyber.  The psychopaths belong on the other CSI shows.  If they really want to focus on real threats that affect real people, they need to stop reading the tabloids, and start focusing on real issues that can really educate viewers about how to safely navigate this crazy world.