CAROLYN MEINEL▊
- ALIAS
- "the Happy Hacker" · HappyHacker · "Ms HappyHacker," per attrition.org's file [1]
- OPERATION
- The Happy Hacker · the "Guide to (Mostly) Harmless Hacking" subscription newsletter FACT
- HABITAT
- Mailing lists, Usenet, and the inboxes of beginners, late 1990s; New Mexico per attrition.org [1]
- CREDENTIAL
- M.S., industrial engineering, University of Arizona, 1983 — real, and not a security qualification FACT
- STATUS
- UNKNOWN — the research file's status column, and it has stayed that way
- DISPOSITION
- FBI suspect, 1999 web-defacement inquiry — no charge appears in the record we hold ATTRIBUTED
The Happy Hacker: A Guide to (Mostly) Harmless Computer Hacking
The title of Carolyn Meinel’s book and the brand she built her “GUIDE TO (mostly) HARMLESS HACKING” newsletter around — self-styling herself the friendly, beginner-safe face of hacking instruction. The wider scene, and the watchdogs at attrition.org, spent years cataloguing the errors in the “mostly.” The book.
The specimen, observed through the late 1990s across mailing lists and beginner inboxes, taught hacking that was — by its own subscription-form promise — mostly harmless. The taxonomists at attrition.org kept a running count of the "mostly."
What you are about to observe is not the usual specimen of this list. No conviction. No quashed subpoena. No plagiarism percentage. What the field documented here instead is something subtler and, to the working naturalist, more instructive: an organism that changes plumage — repeatedly, formally, on the record — and a community of taxonomists who followed it through every molt, notebooks open.
It is impossible for a normal functioning human to keep track of seventeen careers. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE REINVENTIONS (1983 ONWARD)
Most organisms settle into a niche. This one treated niches as seasonal plumage. The field would later count the moltings and publish the number.
-
1983
The credential
Earns an M.S. in industrial engineering from the University of Arizona — the documented degree, genuine and undisputed, and the one credential in the file that is not a security qualification.
-
1983–1990s
Seventeen ways of being
A GIAC paper — "The Diary of a Self-Proclaimed Security Guru and Self-Made Hacker: An Unauthorized Carolyn Meinel Story" — catalogues at least seventeen distinct professional identities she had claimed: industrial engineer, research engineer, aerospace consultant, senior scientist, freelance writer, president/lobbyist, programmer, lawyer, journalist, e-zine publisher, tech market research consultant, technical recruiter, adjunct professor, and more.
Seventeen. The field does not encounter this often. Most specimens manage two identities, perhaps three. This is a career list with the approximate turnover of a minor-league dugout.
ACT II — THE HAPPY HACKER (LATE 1990s)
The final plumage is the brightest: guru. Observe the delivery mechanism — not the conference stage, not the courtroom, but the subscription newsletter, arriving weekly, addressed to the curious and the credulous alike.
-
LATE 1990s
The guru plumage
Publishes The Happy Hacker and the subscription newsletter "Guide to (Mostly) Harmless Hacking," positioning herself as a security authority and hacker educator for beginners. The brand gets her a media presence the technical community will spend years disputing.
-
MAY 1999
The errata file opens
Attrition.org's dossier logs its dated verdict on the May 3 Happy Hacker issue: "FULL of serious errors." Brian Martin and other security professionals document technical errors in her published materials; per the research file, the community's view of the brand ranged from harmless-but-wrong to actively damaging to the beginners who trusted it.
A note on ecosystem roles: this community fact-checks for sport. Publishing a weekly security newsletter above it is like keeping bees in shorts. Survivable, with precision. Punished, without.
ACT III — THE INVESTIGATION (1999)
Then the men with badges arrive, and the file acquires its strangest chapter — the one in which the specimen and its chief taxonomist end up, briefly, describing the same events.
-
1999
The FBI comes calling
FBI agents identify Meinel as a suspect in connection with web-defacement incidents. She initially agrees to a lie-detector test, then declines after consulting lawyers. Her own public statement — preserved, with commentary, in the attrition archive itself — describes an Albuquerque agent demanding the polygraph and calls the episode harassment by the FBI. No charge follows in the record we hold.
Savor the ecology of this moment: her account of the episode survives because her critics archived it. In this habitat even the rebuttals are filed by the opposition, which is either damning or a public service, depending on which side of the glass you stand.
-
EPILOGUE
The species description
The GIAC paper files its unauthorized biography; the attrition dossier — errata, investigation file, and her mirrored rebuttal — remains online. The research file's status column reads: unknown. The archive keeps the tape running.
both sides, on the record
The credential gap: the documented degree is an M.S. in industrial engineering (Arizona, 1983) — genuine, and not a security qualification; the security-authority positioning was self-conferred through the Happy Hacker brand [3] [4].
The errata file (attrition.org's, theirs not ours): Brian Martin and other security professionals documented "serious errors" in her published technical materials, item by dated item [1]. Per the research file, the community's assessment ran from harmless-but-wrong to actively damaging to the beginners who trusted the materials.
The identity catalogue: at least seventeen claimed professional identities, per the GIAC paper [3]. The investigation: named an FBI suspect in the 1999 web-defacement inquiry; agreed to a polygraph, then declined after consulting lawyers [2].
Her stated project was education, and it said so on the label. The newsletter's own title promised "(Mostly) Harmless Hacking"; she positioned herself as an educator for beginners and published in the open, under her own name, in a community that grades in public [1] [4].
The credential is real. The M.S. is a genuine degree from a real university, disputed by no one — the charge is adjacency, not fabrication. And seventeen careers is a count of claimed identities, not a fraud finding: no fabricated degree or forged credential appears in the record we hold [3].
Scope of the record: the "serious errors" file is attrition.org's documentation, adjudicated by no court or standards body. The FBI item is suspicion — no arrest, charge, or prosecution appears in the record we hold — and declining a polygraph on the advice of four lawyers is standard counsel, not evidence. Her own account, which her critics preserved, calls the episode harassment; she said it in public, on the record, at the time [2].
YOU DECIDE
Scoped to the claims, never the woman. The claim "security authority" rests on a self-conferred brand; weigh it against a genuine-but-adjacent degree and an errata file that belongs to attrition.org, not to a court. The FBI item is suspicion that never matured into a charge in the record we hold, and her rebuttal is part of the same archive.
Weigh the costly signals: she published under her own name, every week, into a community that was flaying her for it; that community kept its errata — and her rebuttal — online for a quarter century.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD
RESEARCH & REFERENCE
GIAC — "The Diary of a Self-Proclaimed Security Guru and Self-Made Hacker: An Unauthorized Carolyn Meinel Story" ATTRIBUTED — the seventeen-identity catalogue and the credential record.
giac.org/paper/gsec/389/…/101000
THE COMMUNITY & THE DISCOURSE
Attrition.org — the Charlatan List (parent index) FACT — the errata project this site succeeds; Meinel's file sits alongside the rest of the era's roster.
attrition.org/errata/charlatan/
The standard. Everything above is sourced to the attrition.org documentary archive, a GIAC research paper, and the subject's own published output — including her own rebuttal, preserved by her critics. Facts are stated as facts; characterizations are stated as characterizations and wear their author. The errata belong to attrition.org, not to a court; the FBI item is suspicion, never a charge in the record we hold. The defense is presented at full strength, including what the record does not show. No motive is asserted, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.