KEYNOTE: A Lifetime of Disobedience - Joe Grand

KEYNOTE: A Lifetime of Disobedience - Joe Grand

Speakers: Joe Grand, Hardware Hacker, Engineer, Educator

Conference: Disobey

YouTube: https://www.youtube.com/watch?v=mgbIZtcbd_w

Overview

In his keynote address at Disobey, renowned hardware hacker Joe Grand delivered a compelling narrative centered on the indispensable role of disobedience in the world of hacking and personal growth. Grand argues that true hacking inherently requires operating outside established norms, whether those are technical specifications, societal expectations, or corporate mandates. Through a series of personal anecdotes spanning his decades-long career, he illustrates how this ethos of challenging the status quo has not only driven innovation but also shaped the ethical landscape of the cybersecurity community.

Grand's talk transcends mere technical exposition, positioning disobedience as a powerful tool that, like a hammer, can be wielded for either destructive or constructive purposes. He champions the positive side of this hacker mentality, emphasizing its capacity to foster curiosity, drive problem-solving, and ultimately contribute to a more secure and informed world. The keynote serves as both a historical retrospective on hacker culture and a call to action for individuals to advocate for themselves, question authority, and forge their own paths, whether in technology or daily life.

The significance of Grand's message lies in its timeless relevance to the hacker community and beyond. It challenges the prevailing negative connotations often associated with "disobedience" and "hacking," reframing them as essential catalysts for progress. By sharing his journey, from youthful mischief to pioneering ethical hardware research and advocating for responsible disclosure, Grand underscores the profound impact that a principled, disobedient approach can have on individual careers and the collective evolution of an industry that constantly grapples with boundaries and authority.

Background

▶ Watch: Introduction: Disobedience is essential for hacking (0:00)

The concept of disobedience, as championed by Joe Grand, is deeply embedded in the historical and cultural fabric of hacking. From its nascent stages, hacking has been characterized by a fundamental desire to understand systems, explore their limits, and often, operate beyond their intended design. This curiosity-driven exploration frequently necessitates challenging rules, assumptions, and established authorities, which Grand explicitly equates with an act of disobedience.

Early hacker culture, particularly in the United States and Europe, fostered this spirit through various mediums. Grand references Yipple and 2600 magazine in the US, alongside Hack-Tic magazine in the Netherlands, as pivotal platforms for sharing knowledge and building community among like-minded individuals who sought to demystify complex systems like telephone networks and software. These publications provided a crucial alternative to mainstream information, allowing hackers to document their explorations and discoveries, often in defiance of corporate secrecy or legal restrictions.

A cornerstone of this historical context is The Mentor's Hacker Manifesto, published in Phrack magazine in 1986. Written by a hacker who had been arrested, the manifesto articulated the unique perspective of hackers—their innate drive to explore, their disdain for superficiality, and their belief in the inherent beauty of information. Grand himself recalls having a printout of this manifesto on his bedroom door as a kid, highlighting its profound influence on his formative years and reinforcing the idea that hackers often feel misunderstood or unfairly targeted by a society that doesn't grasp their motivations.

The problem, as Grand illustrates, often arises from the clash between this inherent hacker curiosity and the rigid boundaries set by vendors and legal frameworks. He cites Microchip Technology as an example, whose data sheets define strict operating parameters for their microcontrollers. The vendor explicitly states that using their products "in a manner outside the operating specifications" is likely "dishonest and possibly illegal methods used to breach the code protection feature," implying theft of intellectual property. This perspective automatically criminalizes any exploration beyond the documented limits, directly contradicting the fundamental hacker impulse to push boundaries, even for positive ends like vulnerability research or data recovery. This persistent corporate stance, coupled with early societal misunderstandings of computer exploration, created an environment where hackers often had to operate in a gray area, making the act of disobedience a necessary component of their work.

Grand’s personal journey reflects this dynamic, from youthful "mischievous stuff" and involvement in early hacker groups like Renegade Legion, to forming The Loft, one of the first publicly-facing hacker groups in the US. The Loft, by publishing vulnerabilities (including early ones against Microsoft, which dismissed them as "theoretical"), directly challenged the industry's reluctance to acknowledge and fix security flaws. This commitment to full disclosure, even when unpopular with vendors, established a precedent for forcing accountability and underscored the "fight for the users" ethos that became central to their philosophy.

Key Findings

▶ Watch: Positive side of disobedience and hacking as a tool (2:00)

While Joe Grand's keynote is not a presentation of traditional scientific findings, it offers profound insights and principles derived from a lifetime of experience in the hacking and engineering communities. These "key findings" are not discoveries of new vulnerabilities but rather philosophical tenets that underpin effective and ethical hacking.

Firstly, Grand asserts that disobedience is not merely an act but a fundamental tool for progress and innovation. He likens it to a hammer: capable of destruction or construction. His advocacy centers on wielding disobedience for positive outcomes, such as shaping the world, driving personal change, and improving technology. This reframing challenges the often-negative societal perception of disobedience, emphasizing its potential for good when guided by ethical intent.

Secondly, Grand highlights the necessity of operating "outside the bounds" as a core technical and philosophical approach. In hardware hacking, this means intentionally pushing components beyond their manufacturer-specified parameters, as demonstrated by his fault injection techniques on microcontrollers. Beyond the technical, this principle extends to challenging corporate processes, legal interpretations, and traditional media formats, advocating for a mindset that questions limitations and seeks alternative solutions.

Thirdly, the keynote underscores the critical importance of community and the free exchange of information. Grand's experiences with early hacker magazines, bulletin board systems, and groups like Renegade Legion and The Loft illustrate how shared knowledge, even about "mischievous stuff" like carding or phone phreaking, fostered skill development and collective identity. The Loft's commitment to publishing vulnerabilities and making "the theoretical practical" solidified the value of disclosure in driving security improvements, even as the ethical considerations of disclosure evolved over time.

Fourthly, Grand stresses the vital need for self-advocacy and boundary-setting within the demanding cybersecurity industry. His personal decision to leave At Stake, a venture-backed security company, despite potential financial gain, and his later choice to limit his involvement in repetitive cryptocurrency recovery projects, exemplify this. He explicitly warns against burnout and exploitation, urging individuals to "disobey" expectations and say no to projects that compromise their mental health or ethical beliefs. This finding emphasizes the human element of hacking, recognizing that sustained contribution requires personal well-being and alignment with one's values.

Finally, the overarching finding is the power of the Do It Yourself (DIY) ethos. Grand concludes by connecting the "Disobey" conference name to the "DIY" within it, asserting that individuals and communities possess the agency to create their own paths, build their own solutions, and challenge reliance on corporations or governments. This DIY spirit, he argues, is the ultimate expression of positive disobedience, empowering people to make things happen and shape their environment.

Technical Deep Dive

▶ Watch: Hardware hacking: operating outside defined chip parameters (4:00)

Joe Grand's career is deeply rooted in hardware hacking and reverse engineering electronics, providing concrete technical examples of his "disobedience" philosophy in action. His approach frequently involves operating devices outside their manufacturer-defined specifications to uncover vulnerabilities or bypass security features.

A prime illustration of this is his discussion of fault injection techniques on microcontrollers. Grand references a typical Microchip microcontroller data sheet which specifies a "permissible combinations of voltage and frequency" (e.g., a chip running at 3 volts can only operate up to 4 MHz before being out of spec). As an engineer, one would adhere to these gray-shaded regions. However, as a hacker, Grand intentionally disobeys these bounds. He poses the question: "What if I operate that chip at 20 megahertz or 100 megahertz for some like microsecond amount of time at just the right spot during some boot process or hash compare or security check or whatever it is and do fault injection to skip over something and get access?" This deliberate manipulation of operating conditions, beyond the vendor's guarantee, is a direct technical manifestation of disobedience to achieve a security bypass. He explicitly highlights Microchip's statement that "All of these methods... require using the microchip products in a manner outside the operating specifications," which they equate to "theft of intellectual property." Grand strongly refutes this, arguing that such exploration can be for positive, curious, and ethical purposes.

Early in his career, Grand indulged in building "mischievous stuff" with electronics. One notable example was a simple tone generator built using a 555 timer (or 556) that produced a high-frequency square wave, around 4 kHz. This device, concealed in an Altoids tin, was deployed in classrooms to create an annoying, high-pitched sound that teachers struggled to locate, demonstrating the power of small-scale, disobedient technical interventions.

His work on the Defcon badges further showcases innovative hardware design and the fostering of technical engagement. Starting with Defcon 14 (over 20 years ago), Grand created the first electronic conference badge. These badges were not just decorative; they were designed to be hackable. Early iterations featured a debug interface for a Microchip PIC microcontroller, allowing attendees to program them using assembly language. Subsequent badges incorporated increasingly complex features, such as LED matrices, infrared (IR) transmission for trading "wares" (data), and designs that required physical interaction (e.g., combining different badge shapes to form a larger puzzle). He experimented with advanced manufacturing techniques like aluminum substrate with laser engraving and zero-power LCDs. The underlying technical goal was always to engage attendees, encourage learning, and facilitate interaction through hands-on hardware hacking.

More recently, Grand has applied his hardware hacking expertise to cryptocurrency wallet recovery. While he explicitly states he is "not a cryptocurrency person," he uses his skills to help individuals recover lost digital assets. This involves physically hacking chips within these wallets, often employing the same "outside the bounds" techniques he discussed earlier. These projects, often documented in viral videos, represent a direct application of disobedience for tangible positive impact, challenging the notion that such technical exploration is inherently malicious. The technical challenge, rather than the financial reward, is what drives him in these endeavors.

Demo / Proof of Concept

▶ Watch: Vendor perspective: hacking methods are dishonest and illegal (6:00)

While Joe Grand's keynote was a retrospective narrative rather than a live technical demonstration, his entire career serves as a proof of concept for the power and positive impact of disobedience. He meticulously detailed numerous projects and life choices that embody this philosophy, effectively "demonstrating" its principles through real-world application.

One of his earliest and most tangible "demos" was the high-frequency tone generator built with a 555 timer. This simple circuit, capable of emitting a super annoying 4 kHz sound, proved that even small acts of technical mischief could have a discernible impact and challenge the immediate environment, albeit for humorous or disruptive purposes. It was a foundational experience in understanding how operating slightly "outside the lines" could yield unexpected results.

A significant portion of his "demonstrations" came from his involvement in the Discovery Channel show "Prototype This!". In this show, Grand and his team built elaborate prototypes that pushed the boundaries of engineering. Projects included a wearable airbag (an early concept for fall protection), an automated pizza delivery robot (an autonomous vehicle for food delivery), the "Get Up-and-Go" capsule (a futuristic alarm and preparation system), a robotic firefighter assistant (integrating advanced sensing for smoke-filled environments), and a 30-foot giant computer-controlled hydraulically operated water slide simulator. These projects, while technically complex, also represented a form of disobedience against conventional engineering, aiming to create "bigger" and "crazier" solutions than typically conceived. Grand's insistence on sharing his schematics, documentation, and notes for these projects, despite initial resistance from the production company, was a "demo" of open-source principles and knowledge sharing in defiance of traditional media's closed approach.

Perhaps his most widely recognized "proof of concept" in the hacker community is the creation of the Defcon electronic badges. Starting at Defcon 14, these badges transformed from simple blinking lights to complex, hackable devices featuring Microchip PIC microcontrollers, LED matrices, infrared transmission, and experimental circuit board techniques like aluminum substrate with laser engraving and zero-power LCDs. Each iteration was designed not just as an accessory but as an interactive puzzle and learning platform, compelling attendees to engage with hardware and software (e.g., assembly language programming). Grand's eventual decision to step away from designing the badges, a "defiance" against expectations, inadvertently "demonstrated" the power of decentralized innovation, opening the door for new designers to bring their own unique flavors to the badge life.

Finally, his work in cryptocurrency wallet recovery serves as a contemporary demonstration of using advanced hardware hacking techniques for benevolent purposes. By physically manipulating and extracting data from chips within these wallets, often bypassing their intended security features, Grand provides a direct, impactful "demo" of how "disobedience" to a chip's design can lead to positive outcomes for individuals. These efforts, captured in viral videos, showcase the practical application of his philosophy in a high-stakes, real-world scenario.

Defensive Implications

Joe Grand's keynote, while not prescriptive in terms of specific defensive cybersecurity tools or strategies, offers profound defensive implications by advocating for a fundamental shift in mindset within the security industry and among its various stakeholders. His emphasis on disobedience provides a framework for stronger, more resilient defense mechanisms.

Firstly, for vendors and product developers, the clear implication is the necessity of embracing a hacker mindset in design and security. Grand's anecdote about Microchip Technology's data sheet, which labels any operation outside defined parameters as "dishonest and possibly illegal," highlights a critical disconnect. Defenders should anticipate and even encourage "disobedient" exploration by ethical hackers. Instead of penalizing researchers for operating outside expected bounds (e.g., running a chip at 100MHz instead of 4MHz to induce fault injection), vendors should learn from these findings. This implies robust vulnerability disclosure programs that respect researchers, acknowledge their contributions, and facilitate coordinated fixes, moving beyond the vendor-defined concept of "responsible disclosure" to a more collaborative "coordinated disclosure." Taking ownership of security flaws, rather than dismissing them as "theoretical," is paramount.

Secondly, for security professionals and organizations, Grand's message underscores the importance of "first principles" thinking and questioning assumptions. Just as hackers don't accept a system's stated limits, defenders should not passively accept the security posture of their systems or the claims of their vendors. This means actively seeking out vulnerabilities, understanding systems at their deepest technical levels (as Grand does with hardware), and being proactive in identifying potential attack vectors that might not be immediately obvious. The ingenuity demonstrated by prisoners crafting tools for survival, or skateboarders creating a "key to the city" to navigate urban infrastructure, serves as a metaphor for the creative problem-solving defenders must employ to circumvent limitations and secure their environments.

Thirdly, the keynote has implications for community building and knowledge sharing within the defensive space. Grand's experiences with groups like The Loft, where vulnerabilities were openly discussed and published, demonstrate the power of collective intelligence. Defenders benefit immensely from open collaboration, sharing threat intelligence, defensive techniques, and lessons learned. Fostering environments akin to hacker spaces or hack labs (like the Helsinki Hacklab he mentions) can cultivate a new generation of security professionals who are encouraged to explore, experiment, and share their findings, strengthening the collective defense against evolving threats.

Finally, Grand's personal journey highlights the importance of self-advocacy and preventing burnout for individual defenders. The cybersecurity industry is known for its intense demands, leading to high rates of burnout. Grand's decision to set boundaries and say "no" to projects that would lead to repetitive, unchallenging work, even if lucrative, serves as a crucial lesson. Organizations should foster environments where security professionals can maintain their mental health, pursue challenging and engaging work, and feel empowered to advocate for their needs. A sustainable and motivated workforce of "disobedient" thinkers is ultimately a stronger defensive asset. By integrating these principles, defenders can move beyond reactive patching to proactive, innovative security strategies that truly anticipate and counter advanced threats.

Key Takeaways

• Disobedience is a Core Principle of Hacking: True hacking involves operating outside defined boundaries, whether technical specifications (e.g., fault injection on microcontrollers) or societal norms, to explore, understand, and innovate.
• Hacking for Positive Impact: Disobedience, like any tool, can be used for good. Ethical hackers leverage this mindset to uncover vulnerabilities, recover lost assets (like cryptocurrency), and advocate for user security, reframing hacking as a force for positive change.
• Challenge Authority and Question Assumptions: From vendor data sheets to corporate disclosure policies and traditional media formats, questioning established rules and advocating for one's own approach is crucial for progress and effective problem-solving.
• The Power of Community and Knowledge Sharing: Early hacker magazines, bulletin board systems, and collaborative groups like The Loft were essential for fostering community, sharing technical knowledge, and collectively pushing for security improvements through disclosure.
• Self-Advocacy and Preventing Burnout are Essential: In a demanding industry, it's vital to set personal boundaries, say "no" to exploitative or unfulfilling work, and prioritize mental health to ensure long-term engagement and passion.
• Embrace the Do It Yourself (DIY) Ethos: Individuals and communities have the power to create their own paths, build their own solutions, and drive change without sole reliance on corporations or governments, embodying the spirit of self-empowerment.

About the Speaker(s)

Joe Grand is a highly respected figure in the hardware hacking and engineering communities, known for his decades of pioneering work in electronics, reverse engineering, and security research. From a young age, Grand embraced a natural inclination for "mischievous stuff" and disobedience, which he channeled into a lifelong passion for understanding and manipulating technology.

His journey began with involvement in early hacker groups like Renegade Legion and later as a co-founder of The Loft, one of the first publicly-facing hacker collectives in the United States. Through The Loft, Grand and his peers became early proponents of full disclosure, publishing vulnerabilities (including those in Microsoft products) to force vendors to improve security for users. This advocacy even led him to testify before the United States government on the state of computer security, a landmark event where hackers willingly engaged with official bodies to raise awareness.

Grand's expertise extended to mainstream media as a host on the Discovery Channel show "Prototype This!", where he showcased innovative engineering projects and championed the sharing of technical documentation. He is also widely recognized for creating the first electronic conference badges for Defcon (starting at Defcon 14), transforming them into interactive, hackable devices that fostered community engagement and hardware learning. More recently, he has applied his unique hardware hacking skills to assist individuals in recovering lost cryptocurrency from physical wallets, demonstrating the practical, benevolent application of his expertise. Throughout his career, Joe Grand has consistently advocated for the positive side of hacking, emphasizing curiosity, ethics, and the importance of challenging norms to drive innovation and secure technology.