GWEEDS▊
A pseudonymous hacker who stood up at a 2002 conference and told a room full of his own kind that the security industry was a racket — that "full disclosure" had become resume padding, that the scene was selling itself to corporations and the FBI, and that when the famous hackers testify to Congress the only thing that grows is the surveillance budget. He named names, including the most respected crew in the room. The industry buried him in rebuttal e-mail by the next morning. Twenty years on, the thesis outlived the man: the whole antisecurity movement is a footnote to a talk almost nobody has a clean recording of.
They're making money, sure; but they're also increasing the reach of the Federal police state at the expense of fellow hackers who are being caught and put in jail.
Gweeds at H2K2, 2002, on hackers-turned-security-firms — as reported by Thomas C. Greene, The Register, "Gweeds gets killed"
- WHO
- "Gweeds" — pseudonymous hacker, essayist, and speaker. Legal identity not established in the public record; this file makes no claim about it FACT
- SCENE
- Cult of the Dead Cow–adjacent milieu; the 2002 "antisecurity" / ~el8 backlash against the security industry (see The Antisecurity Movement)
- THE THESIS
- The security industry manufactures fear, monetizes "full disclosure," and — by feeding the state's cyber-defense budget — "increases the reach of the Federal police state" at the expense of the hackers it criminalizes
- THE ARTIFACTS
- The H2K2 talk "Black Hat Bloc, or How I Stopped Worrying About Corporations and Learned to Love the Hacker Class War" (July 14, 2002); the essay "Reasons Forgotten"; the ~el8 zines. The ideas, not the biography, are the record
- STATUS
- PSEUDONYMOUS — the person receded; the argument was absorbed into the antisec movement and every "your favorite whitehat is a narc" flamewar since
This is not a person file — it is an idea file with a handle attached to it. "Gweeds" is a pseudonym, and the honest position is that we do not know, from the public record, who he was. What survives is a thesis and the fight it started: that the computer-security industry is silicon snake oil, that the revolving door between the underground and the consultancies is a betrayal, and that the hackers everyone admired were quietly building "the reach of the Federal police state." The industry called it FUD with no evidence. He called the industry a racket with no shame. The archive keeps both, and keeps the receipts thin where they are thin.
the drama timeline
ACT I — REASONS FORGOTTEN (the essay)
Before the talk there is an essay: hacking as exploration, hollowed out into a job interview.
-
c. 2002
"Reasons Forgotten"
In the essay "Reasons Forgotten," Gweeds argues the hacker impulse was always exploration — access, curiosity, "machines and places no one had ever been before" — and that the security industry quietly co-opted it. He lays out two "misconceptions" the industry sells: that software vulnerabilities are to blame for every intrusion ("security is all about trust"), and that publishing exploits raises the general level of security when in practice it "helps no one but big business, and big brother." The mood, in his own words: "Everyone is willing to sellout everyone else for the almighty dollar. […] Better reserve those defcon tickets now."
ACT II — BLACK HAT BLOC (H2K2, July 2002)
He takes the thesis off the page and says it to a live room, and names the most respected crew in it.
-
JUL 14, 2002
The manifesto talk
At H2K2 — the 2600/HOPE conference in New York — Gweeds delivers "Black Hat Bloc, or How I Stopped Worrying About Corporations and Learned to Love the Hacker Class War." The argument: hackers now find bugs "with the specific intention of selling out" and standing up a security company; BugTraq is resume fodder; conferences like BlackHat exist to frighten CEOs into buying product. It is the manifesto the antisecurity movement had been missing.
-
JUL 14, 2002
Naming L0pht
The talk's sharpest passage, as reported: "L0pht went in front of Congress and testified at the behest of NIPC… The result is that NIPC got increased funds for cyber-defense and FBI got more funding to fight cyber crime. And now L0pht (@Stake) enjoys federal security auditing contracts," after which came the line above about the "Federal police state." This is his charge against L0pht / @Stake. Note at full strength: L0pht testified at the request of Senator Thompson's office, not NIPC; and the claim that @Stake "enjoys federal security auditing contracts" was never substantiated by Gweeds or anyone else. ATTRIBUTED
ACT III — GWEEDS GETS KILLED (the fallout)
The Register reports it, likes it, and the security industry answers within hours — not with evidence so much as with volume.
-
JUL 15–16, 2002
The Register runs it — and the backlash
Thomas C. Greene writes it up ("Security industry's hacker-pimping slammed"), noting the angle "doesn't get enough play in the press." A day later he publishes "Gweeds gets killed" — "damn few page hits but a vast flood of e-mail." The rebuttals, reproduced in full, hammer the same point: where is the evidence? One @Stake-adjacent reader: "I would like to see some evidence to back up the statement that @Stake now enjoys federal security auditing contracts. Any tiny bit of evidence." Greene's own footnote hedges: "Gweeds' characterization, while not strictly correct, is revealing and worthwhile."
-
JUL 16, 2002
The ad hominem
The counter-attack turns personal. Multiple rebutters, in Greene's published responses, charge that Gweeds was himself an early Macromedia employee who "cashed in on options and never [had] to work again" — i.e., the man denouncing sellouts had sold out first. ATTRIBUTED This is a rebutter's characterization of a pseudonymous person, reproduced here as part of the fight, not adopted as fact.
-
JUL 17–24, 2002
The uglier edge: snitch lists
The same week, the movement's darker current surfaces: The Register runs "'Hacker' security biz built on FBI snitches," and the ~el8/antisec crowd circulates so-called "snitch lists" (the "NARC" files) — documents naming security-scene figures as alleged federal informants. troll.fan reproduces none of that material and treats every name in it as an unverified allegation. Days later Sir Dystic — a cDc member Gweeds had also named — steps up in The Register to rebut the claims about himself, and a friend of both writes in to defend L0pht at length as having "at great risk to themselves, released the information to all." The scene, characteristically, ate its own and then apologized in public.
ACT IV — THE THESIS OUTLIVES THE MAN
Gweeds disappears from the record; the argument does not.
-
2002–
Absorbed into antisec
The specific accusations went unproven and the man went quiet, but the frame stuck. "Full disclosure is a business model," "your favorite whitehat is a fed's contractor," "the security industry sells the fear and the fix" — every one of these is downstream of the Black Hat Bloc talk, and all of them resurface in the later antisecurity movement and its raids. The costly-signal test cuts against him — he never produced the contract paperwork — but the revolving door he described was, and is, entirely real.
both sides, on the record
The rebuttal (industry side): Gweeds offered no evidence for the load-bearing claim — that @Stake lived off "federal security auditing contracts." Contemporary responders in constant contact with @Stake said the opposite, and asked, repeatedly, for "any tiny bit of evidence." None was produced. On the record, that specific accusation is unsubstantiated.
L0pht's work was legitimate and freely given: L0pht testified to Congress at Senator Thompson's request, warned the public about real infrastructure risk, and — long before "full disclosure" was a slogan — "at great risk to themselves, released the information to all." Calling that a sellout, defenders argued, is the scene's habit of tearing down its own heroes. There is nothing wrong with a technologist making an honest living securing networks.
Gweeds' case: the revolving door is not a smear, it is the industry's actual hiring pipeline — the scene supplies the labor, the fear, and the demo. Full disclosure did curdle from "warn everyone" into "brag and get hired." Firms did monetize public vulnerability research into proprietary product while calling hackers evil. On the structure, not the specific contract, he was describing something that plainly existed [2].
The asymmetry was his real point: the "script kiddies" going to prison and the founders getting congressional face-time were, he argued, two ends of the same machine — and the press only ever told one side. Even the reporter who ran him over conceded the angle "doesn't get enough play" [2].
YOU DECIDE
The signature accusation — that @Stake fed off federal contracts — he never proved, and the people best placed to know said it was false; on that charge, he loses. But the structure he described — a security industry that recruits from the scene, sells the fear it discovers, and grows alongside the surveillance budget it helps justify — was not invented for the talk. Strip out the unproven specifics and you are left with an uncomfortable, durable thesis and a pseudonym nobody could quite answer.
The archive does not canonize the manifesto. It keeps the manifesto — and the rebuttal e-mail, in full.
evidence locker
PRIMARY / REFERENCE
The Register — "Gweeds gets killed" ATTRIBUTED — July 16, 2002; the "Federal police state" quote verbatim, Greene's hedged footnote, and the reader rebuttals (including the "any tiny bit of evidence" and Macromedia responses) reproduced in full.
theregister.com/2002/07/16/gweeds_gets_killed/ InfoconDB — Gweeds (H2K2 presenter) ATTRIBUTED — the talk title, date, and slot: "Black Hat Bloc, or How I Stopped Worrying About Corporations and Learned to Love the Hacker Class War," July 14, 2002.
infocondb.org/presenter/gweeds
CONTEXT & CROSS-LINKS
The Register — "'Hacker' security biz built on FBI snitches" ATTRIBUTED / DISPUTED — the informant allegation that ran alongside the antisec backlash; the underlying "snitch list" material is described, not reproduced.
theregister.com/2002/07/17/hacker_security_biz_built/ troll.fan — Mudge / L0pht CROSS-LINK — the crew Gweeds named as the essay's target, with its congressional testimony and disclosure record in full.
troll.fan/dossiers/peter-zatko.html troll.fan — Crew Rivalries CROSS-LINK — the scene's habit of eating its own, of which the Gweeds affair is a textbook case.
troll.fan/crew-rivalries.html
The standard. "Gweeds" is a pseudonym; this page asserts no real name, because none is reliably in the public record. The subject is his argument, not his identity. His charge against L0pht / @Stake is quoted verbatim from The Register and attributed to him; the target's side — that L0pht testified at a Senator's request and that the federal-contract claim was never substantiated — is given at full strength. The "snitch list" material is described as a concept and reproduced nowhere. The one thing the archive treats as established is that the talk happened and the fight was real; everything contested is labeled as such. If a line here couldn't survive scrutiny, it wouldn't be on the page.