So… Howdy. This post is LONGGGGG… I’m sorry about that. It was initially designed as a talk for DefCON 34’s Main Stage, but it wasn’t accepted. FULL DISCLOSURE… The story is mine. The words are mine. The voice is mine. The construction relied heavily on Claude.ai due to the time constraints. It’s the only way I would have been able to get this out there in time for the conference given my work schedule.

This talk is a six-year field report on an unnamed Crew of forty-six hackers — how we built it, how it holds, and why the smallest unit of Agency is two strangers in a LineCon choosing to look out for each other.

Five of us showed up that year as first-timers — friends and colleagues who’d worked together online but had never spent four days in a hotel together. None of us had been to Vegas. We didn’t know anybody else at the con. So we did what hackers do when they’re scared. We built a tool. A Signal chat. We named it “DefCON 27,” because we figured we’d use it once and delete it.

Six years later, we’re at forty-six members. In six years, exactly one person has left, for reasons unrelated to us. Every new member gets in the same way: someone in our Crew spots a terrified first-timer in LineCon, strikes up a conversation, and sends a DM to the group that reads “found another LineCon newb, cool story, genuine person, can we admit them?” The answer is always yes.

The talk walks through four governance mechanics we accidentally built — anyone can admit, participation is membership, two missed cons and the door closes, and assholes don’t survive here. It walks through the two seasons of a real Crew: curiosity and argument for fifty-one weeks of the year, mutual aid and protection for one. And it argues that the Agency theme is pointing at something deeper than starve the beast, feed the community — that the smallest unit of Agency is two strangers in a line choosing to look out for each other.

The close is a charge: don’t join our Crew. Find or build your own. Find a group you can be safe around. Find a group that will come get you at 2am. Find a group that reminds you to eat and hydrate. Find you a group that has bourbon.

Let Me Start with a Story…

So, picture this with me for a second.

It’s LineCon. You all know the one I’m talking about. It’s nine in the morning and it’s already over a hundred degrees, the line is wrapped throughout the building, nobody’s slept enough, everybody’s sweating through their shirt. And somewhere in that line — somewhere in that line, there’s always a kid.

If you’ve ever been to DefCON, you know the kid I’m talking about. If you haven’t, you’re about to know them. It’s their first DefCON. Badge lanyard around his neck like it’s a boarding pass he’s afraid to lose. Looking around like he’s waiting for something terrible to happen to him at any moment.

And I can spot these kids from a mile away, because — six years ago, that was me. That was exactly me.

So I do what I always do now when I see one of these kids in line. I walk up, I introduce myself, and I just start chatting. No big deal. First time? Yeah. Where ya from? He tells me. What do I call you? He tells me. How old are you? And he says: twenty-one.

And, you know, that last one actually matters for where this story’s going, so hang onto that.

And I tell him the thing I tell every first-timer I meet in line. I say — look, man, DefCON is safe. DefCON is friendly. I know it doesn’t look like it right now, but you can practically leave a laptop and a phone on a table, you can set your drink down, you can walk away from your food, and the chances that anybody messes with your stuff are basically zero. This place is wild, but it takes care of its own.

And he’s looking at me like I’m making it up. I can see it on his face. He’s nodding politely, but he thinks I’m crazy. It probably doesn’t help that I’m flanked by some of the crazies in the group… I digress.

So I say, alright, let me prove it to you. Right now, nine in the morning, in this line — I will bet you there is somebody within earshot of the two of us who has a bottle of line bourbon in their bag, and nothing in the world would make them happier than to crack it open right now and start pouring.

And he looks at me like I have genuinely lost my mind.

So I kind of glance around — and three people down the line, this complete stranger I have never met before in my life, locks eyes with me.

And he smiles.

And I know that smile. I’ve been on both sides of that smile.

So I turn back to the kid, and I say — go ahead. Just say it. Say “does anybody have any line bourbon?”

And he does. Real quiet. Because he is absolutely convinced I’m setting him up for something.

Three bags opened at once.

Three complete strangers, three different bags, three different bottles — cups appearing out of absolutely nowhere — and nobody asked this kid who he was. Nobody asked what he did for a living, nobody asked if he belonged here. He asked for bourbon, and the community handed him bourbon.

And I looked at him — this terrified twenty-one-year-old who, twenty minutes ago, was holding his badge like it was about to bite him — and I just said, “That’s DefCON. Welcome. Assholes don’t survive here.”

That kid is in our Signal chat now.

He came back the next year. He came back the year after that. And last August, in LineCon, I watched him walk up to a terrified first-timer three people down from him and ask “first time?”

And I want to talk to you today about what happened in between.

My name, for the purposes of this conference and my continued freedom, is Definitely not a Fed Jake. I’m a co-founder of an unnamed crew of hackers and nerds that’s been meeting at DefCON since DC27. We started as five of us. We’re forty-six now, at the time of this writing. [Editor’s Note: By the time DC34 was over, the group chat number was 66.] And for the next little while, I want to tell you what we accidentally built — and why I think it matters for this year’s theme of Agency more than just about anything else I could’ve brought to this stage.

The 3-2-1 Gift

Alright. Before I go any further — I want to give you something.

Because I’m looking out at this room, and I know some of you in here are at your first DefCON. Don’t raise your hand — you don’t have to out yourself. But you’re in here. And some of you are going to be standing next to somebody at their first DefCON and you’re going to want to help them.

So here’s the first thing I ever got taught at DefCON. Someone taught it to me in 2019, in a hallway I don’t remember, by a person whose face I couldn’t pick out of a lineup. And it might be the single most useful thing about DefCON that anybody ever handed me.

It’s called the 3-2-1 rule.

Three hours of sleep. Two meals. One shower. Minimum. Per day.

I know. It sounds like a joke. It is absolutely not a joke.

DefCON is four days long. It feels like it’s four weeks long. You’re going to want to see everything, you’re going to want to stay up for everything, and by Saturday afternoon if you haven’t been hitting your 3-2-1, you are going to hit a wall that nobody can pull you back from. I’ve seen it. We’ve all seen it. Somebody crashes out on Saturday because they pulled it too hard on Thursday and Friday, and now they’ve missed the thing they actually flew here for.

Three. Two. One. It’s not optimal. It’s survival. You can chase optimal after you’ve locked in survival.

And here’s why I started with that. Because I want you to notice what I just did.

I walked up here, I told you a story, I told you my name, and before I asked you for a single thing, I handed you something you can actually use. That’s not a coincidence. That’s the pattern of this entire talk.

Somebody taught me the 3-2-1 rule in 2019. I have taught it to every person I have ever brought into our crew. I just taught it to all of you. And some of you are going to teach it to somebody in a line next August. That’s the whole thing, honestly. That’s the talk. Somebody showed up for you. Your job is to show up for the next person. Everything I’m about to tell you for the next thirty minutes is just how we ended up doing that on purpose.

Who We Are (and Aren’t)

So let me tell you who “we” is, because I’ve been saying “our crew” for six minutes now and I owe you a definition.

We are an unnamed group of hackers and nerds who met at DefCON.

That’s the whole description. I wish I had something more impressive for you. We do not have a name. We do not have a logo. We do not have a mission statement. We do not have a Discord with forty-seven channels and a moderator hierarchy. We have a Signal chat and a standing agreement to look out for each other, and that is genuinely it.

And I want to be straight with you about the namelessness — because I know some of you are already thinking “okay, so when are they going to tell us the cute name.” There is no cute name. There was never going to be one. And the longer we’ve gone without one, the more I’ve realized that the not-having-a-name is actually part of what makes it work.

Here’s the thing. The second you name a community, you’ve made it a thing. You’ve made it something that can be branded, marketed to, recruited into, talked about in the third person, put on a t-shirt. You’ve made it legible — which is a word I want you to hang onto for a minute — because everything that wants to consume us, every algorithm and every platform and every surveillance pipeline, everything this year’s Agency theme is warning us about, depends on legibility. On naming things. On tracking them. On measuring them.

We are, on purpose and also kind of by accident, illegible. You can’t join our crew by filling out a form. You can’t find us by searching. You can’t follow us. The only way you get in is because somebody already in the chat met you in person and vouched for you by adding you.

And I’m not claiming that’s some grand political act. It started because we were five friends who didn’t need a name for a Signal chat. But six years in, I can tell you — the refusal to become a brand is one of the reasons we’re still here.

A few other things we’re not, real quick, so nobody gets confused:

We’re not a village. We don’t run a thing at DefCON. We don’t have a table. If you go looking for us on the map, you will not find us.

We’re not a company. Nobody gets paid for any of this. There is no budget. There has never been a budget.

And we’re not a secret society. I know — me standing up here on the DefCON main stage telling you our story kind of gives that one away. We’re not hiding. We’re just not advertising. Those are different things.

We’re just a group of people who meet in a line every August and kept meeting. So — with all of that established, let me tell you how we started. Because the founding of this crew is, I think, the most important thing I’m going to tell you today. It’s the thing the whole rest of the talk turns on.

The Founding

Okay. DefCON 27. Two thousand nineteen.

None of us had ever been to a DefCON. None of us had ever been to Vegas. There were five of us — and I want to be accurate about this, because the “five strangers meet on the internet” version of this story is cleaner and I’ve heard myself almost tell it that way, and it’s not quite right.

We weren’t strangers. We were friends. Real friends — the kind of friends you make in this industry when you’ve worked together, argued together, shipped things together, sat next to each other in bars at other conferences. We knew each other. We trusted each other. That part wasn’t in question.

What was in question was everything outside of us. None of us had any idea what DefCON was actually like. None of us had ever been to Vegas — and if you’ve never been to Vegas, you can prepare for it all you want, it’s still going to hit you like a truck the first time. We were five friends walking into a city and a conference that none of us had any real feel for.

And we had decided, collectively and with I would say zero actual planning, that we were all going to DefCON 27 together.

Now — I want you to really sit with what that means. Because I think a lot of you in this room have been in some version of this. You’ve got your people. Your group chat, your friends, the ones who’ve been with you through jobs and breakups and bad years. You know them. They’re not the variable.

The variable is the thing. The trip. The conference. The place. Whatever big scary new environment you’re about to walk into together — the one none of you have done before, the one you’ve only read about, the one you’re half-convinced you’re not ready for.

That was us, five friends walking into our first DefCON. We were solid with each other. We just had no idea what we were walking into.

And we had done research. We had read the unofficial guides. We knew about Goons. We knew not to plug anything into anything. We had the basics.

But I’ll tell you what we did not have. We did not have a single other friend at that conference. Not one. And we realized somewhere between the airport and the hotel check-in that the five of us were now the entire support system any of us had in a city none of us had ever been to, at an event none of us had ever attended.

So we did what hackers do when they’re scared. We built a tool.

We made a Signal chat. That was the tool. That was the entire infrastructure of what has now become a six-year community of forty-six* people. A Signal chat, made in a hotel lobby at DefCON 27 by five nervous first-timers who needed a way to find each other if things got weird.

And — look, I’m going to tell you what we named the chat, because I think it proves the point better than anything else I could say. We named it “DefCON 27.”

That’s it. That was the name. We did not name it “The Crew.” We did not name it “The Founders.” We did not name it anything that suggested we thought this would exist past Sunday. We named it DefCON 27 because it was a chat for the five of us to use at DefCON 27, and then we were going to go home. That was the whole plan.

And the chat did what it was supposed to do. It helped us coordinate. We were all interested in different talks, so we’d split up and ping each other with “this talk is fire, get over here” or “skip this one, not worth it.” We used it to find each other for meals. We used it to make sure everyone got back to the hotel at night. One of us — one of us got a little too into the after-parties on the first night, and the chat was how we found him. That’s a true story and I’m not going to tell you which one of us it was.

By Sunday, when we were all sitting at the airport waiting for flights home, something had happened that none of us had planned for. We had stopped being five friends who sometimes worked together. We had become something else. We didn’t have a word for it. We still don’t, really. But we knew, sitting there in the terminal, that we were going to do this again next year. Some of these folks were the groomsmen at my wedding. I don’t think that would have happened without this evolution.

And — this is the part I want you to hear clearly — we didn’t decide to start a community. Nobody at that airport said “hey, we should make this a thing.” There was no founding moment. There was no manifesto. There was a bunch of exhausted people who had just survived their first DefCON together, and the unspoken agreement that we were going to show up at DC28 and do it again. And then maybe… Again.

That’s the thing I want every person in this room who’s ever thought about building a community to hear. Nobody set out to build this. We were five friends with a dumb Signal chat named after a conference, trying to survive a weekend together, and we built the tool to do it, and then we kept using the tool. That is the actual, boring, true origin story of almost every community that lasts. The ones that announce themselves as communities on day one almost never make it to year two. The ones that just keep showing up — those are the ones that turn into something. So. DC28 came around the next August. We all showed up. The chat was still there. And somewhere in that second year — I couldn’t tell you exactly when — something shifted. And that is actually the thing I next want to tell you about.

The Turn

So what shifted.

I couldn’t tell you the exact moment, and honestly I’ve tried to remember what it was. There wasn’t a meeting. There wasn’t a decision. There was no Crew Summit where we sat down and said “it’s time to start bringing people in.” Nothing like that happened, because nothing like that ever happens, because that’s not how any of this actually works.

What I can tell you is how it started, because it left a trail.

Somewhere in year two or year three, the Signal DMs between individual Crew members started to shift. And if you went back and read them now, you’d see it really clearly. The shift was — somebody would DM another one of us, and the message would read something like:

“Hey — found another LineCon newb. Cool story, genuine person. Can we admit them?”

That’s the sentence. That’s the artifact. That’s the fossil evidence of when the Crew turned over. Because think about everything that one Signal message assumes.

It assumes the Crew is a thing you can be admitted to. It assumes one member’s vouch matters. It assumes the group will probably say yes. And it assumes that finding a stranger in LineCon and wanting to bring them in is just — a thing we do now.

None of that was true in 2019. All of it was true by DefCON 29. And nobody voted on it. It just became the way we did things, one DM at a time.

And I want to be clear about this, because I think it matters for everybody in this room who’s ever tried to build a community on purpose — that is what the turn looked like. It wasn’t five people in a room having an aligned vision. It was one person, alone, meeting a stranger in a line, and the thought crossing their mind: this person should be with us. And then — the second thought: I can just ask.

The first time it happened I wasn’t even the one who did it. One of the others in the original five DM’d the group about somebody they’d met, and we all said yeah, sure, bring them in. And then somebody else did it a few hours later. And then somebody else. And somewhere in there — without any of us naming it — we became a thing where anyone could bring somebody in, and the default answer was usually yes.

That was the turn. That was the exact mechanism. It wasn’t philosophy. It was Signal DMs.

And looking back — here’s what I think was actually happening.

The Crew reproduces by doing for other people what its founders needed and didn’t have.

That’s it. That’s the mechanism. We were five people who walked into a scary place and wished somebody had been looking out for us. And once we had looked out for each other long enough to not need it anymore — we started looking for the people who still did. Because we remembered.

And nobody drew up a plan for that. Nobody had to. It’s the most natural thing in the world, once you’ve been through the scary thing with people you trust — you start recognizing the people who haven’t been through it yet. You can’t help it. Your eye goes to them automatically in any room. And once you see them, you can either pretend you didn’t, or you can walk over, have a chat, and then you send the DM.

I want to say something here that I’ve been thinking about a lot.

A huge amount of the community-building content I’ve ever read or watched is about how to make people feel welcome. How to design your onboarding. How to write your code of conduct. How to throw a good meetup. And all of that’s fine — I’m not going to dunk on any of it. But I think a lot of it is working on the wrong layer. You can’t procedure your way into a community that recognizes strangers as future members. You get that by having people in the community who remember what it was like to be the stranger — and who couldn’t not send the DM even if they tried.

Which is why, I think, our recruitment works and a lot of other community recruitment doesn’t. We aren’t running a program. We don’t have a “first-timer outreach initiative.” We have a group of people who were all terrified once, who all remember exactly what that felt like, and who physically cannot walk past somebody wearing that same face in a line without turning to their phone and typing “hey — found another LineCon newb.”

So. Once that started happening — once we were pulling in a few people every year — we had to figure out how it was actually going to work. How do you admit new members to a thing that doesn’t have a membership committee? How do you handle it when somebody doesn’t fit? How do you keep the group from getting diluted as it grows? We figured this out the way we figured out everything else: badly, in real time, with no plan. But we figured it out. And that is what I want to talk about next.

What We Accidentally Built: Governance

So here’s what we figured out. Four things. None of them on purpose. All of them, I think, transferable.

I want to walk you through them one at a time, because I think each one of them quietly solves a problem that most communities either don’t solve or solve badly.

1. Anyone can admit.

The first rule of the Crew — and it’s not a rule we ever wrote down — is that any current member can add a new member. Full stop. No vote. No approval process. No council. If you’re in the chat and you meet somebody in LineCon and you think they belong, you can add them.

Now — in most communities, this would be a catastrophic decision. In most communities, if you let anybody bring anybody in, the group gets diluted, gets weird, and falls apart inside of a year. Every community-design instinct you have is screaming “you need gatekeeping, you need a process, you need some kind of filter.”

Here’s the thing. The filter isn’t the admission process. The filter is the person doing the vouching.

When one of us adds somebody, we’re staking our judgment on them. And everybody in the Crew knows that. So you don’t invite somebody casually. You invite somebody when you’ve actually talked to them, when you’ve gotten a feel for who they are, when you can answer the question “is this person going to be a net good for the group?” The DM that says “found a LineCon newb, cool story, genuine person, can we admit them?” — that’s not a formality. That’s the Crew member declaring I will vouch for this person.

And it works because the Crew has never let admission become a status game. Nobody is admitting people to look cool. Nobody is admitting people because they work somewhere impressive. People admit people because they recognize them. And when the filter is recognition instead of credentials, the filter is almost never wrong.

What this mechanic prevents, practically speaking, is a founder bottleneck. You know the community you’ve been in where everything has to go through the founder? Where one person’s energy is the single point of failure for the whole group? We do not have that. Any of us can grow the Crew. None of us can un-grow it. Which, as we’ll get to in a minute, is kind of the point.

2. Participation is membership.

You are in the Crew because you show up. That’s the only criterion. Not because you were there at the founding. Not because you know the right people. Not because you have the right handle or the right job. You show up to DefCON and you engage in the group. You’re in.

This sounds obvious. It isn’t. Most communities get this completely wrong, and they get it wrong in one of two directions.

Direction one: communities that tie membership to identity — “you’re a hacker,” “you’re one of us,” some kind of tribal marker — and end up arguing for twenty years about who really counts and who’s just pretending. We have all seen this community. Some of us have been in this community. Nobody has fun in this community.

Direction two: communities that tie membership to credentials — you work at the right place, you have the right title, you’ve done the right things. Those communities eventually become professional networks with a nostalgia problem. They’re fine. They’re just not what we’re doing.

The Crew says: show up. That’s it. Show up at DefCON, every August, and you’re in. You can be a Fortune 500 CISO or you can be a college sophomore. You can be a red-team legend or you can be somebody who’s never touched a terminal. If you’re in Vegas that week and you’re with us, you’re with us.

What this mechanic prevents is identity creep — the slow decay where communities start gatekeeping themselves based on who members are instead of what they do. Our bar is behavioral. Are you here? Are you showing up? Good. You’re in.

3. When the door closes.

This one’s the hardest to talk about, because it’s the one that sounds cold on paper and isn’t cold in practice.

Generally, if you miss two or three DefCONs in a row, there’s a chance you’re going to have to see yourself out of the Crew.

I’ll tell you why, and I’ll tell you how we handle it. The why is: participation is membership — we just covered this — and if you stop participating, eventually you stop being a member. That’s not a punishment. That’s just what “participation is membership” means when you follow it to its conclusion. A Crew that never enforces attendance isn’t a Crew. It’s a group chat nobody leaves because leaving feels mean.

The how is gentler than the principle sounds. Nobody gets kicked out in a dramatic way. There’s no tribunal. Usually what happens is somebody quietly drifts — life gets busy, job changes, health stuff, family stuff — and they miss a con. We all notice. We don’t make a thing of it. Then they miss another one. And somewhere in there, the door just… closes. Sometimes they ask to come back. Sometimes we reach out first. But there isn’t a ceremony. It’s just that the Crew is the people who show up, and if you haven’t shown up in two or three years, and you haven’t participated, you’re not currently the Crew.

And — in six years, we have had exactly one person leave. And they left for personal reasons that had nothing to do with us. Nobody else has ever drifted out under this rule. Which suggests the rule isn’t actually doing enforcement work. It’s doing clarity work. The rule exists so that everybody in the Crew knows what the deal is, so that there’s never a weird awkward “are you still in?” conversation, so that participation is something you’re doing rather than a status you once achieved.

What this mechanic prevents is ghost membership — the slow accumulation of people who were once in the community and are now just names in the chat. Every community has this problem. Ours doesn’t, because we built a graceful exit into the definition of being in.

And we’re not heartless, so sure, there are still folks in the chat who haven’t been to a DefCON, but they’re active participants in the group exchanges, be they hacking, vulnerability discussions, the next SheetMetalCon idea…

4. Assholes don’t survive here.

And the fourth thing.

This is the one I’ve been saying the whole talk, because it’s the first thing we tell every first-timer, and I think it might be the single most important sentence in the entire governance model.

Assholes don’t survive here.

I want to be careful about what this sentence means and what it doesn’t mean.

It does not mean we have a code of conduct committee. We don’t. It does not mean we have a formal reporting process. We don’t. It does not mean we have ejection procedures. We don’t.

What it means is that the environment of the Crew is actively hostile to asshole behavior — in a way that doesn’t require any of us to be the designated enforcer. If somebody in the Crew is being cruel, or dismissive, or punching down, or exploiting the trust of the group — somebody notices. Usually several somebodies. And they say something. Not in a big public way. In a quiet “hey, that wasn’t okay” way. And the person either adjusts, or they don’t, and if they don’t, the Crew starts routing around them, and eventually they either course-correct or they self-eject because they can tell nobody wants them there anymore.

Notice what’s happening there. The community is self-cleaning. Nobody has to be the sheriff. That’s the thing that makes this sentence a governance principle and not just a vibe. “Assholes don’t survive here” only works if the members — all of the members — are willing to be the one who says “hey, that wasn’t okay” when they see it. And the Crew is, because we selected for that trait without knowing we were doing it, because when any of us added somebody, we were vouching for their character, and character is exactly the thing that makes a person willing to say “hey, that wasn’t okay” to a friend.

And this is the part that ties the whole governance model together, so I want to be really clear about this.

All four of these mechanics are cooperative. Anyone can admit, because the Crew trusts each other’s judgment. Participation is membership, because the Crew values presence over identity. The door closes after a lack of participation, because the Crew values clarity. Assholes don’t survive, because the Crew is willing to do the small, boring work of saying something when they see something.

None of that works if any one of us flakes on it. All of it works when all of us carry a little bit of it all the time. That’s governance in a community without a government. It’s everybody holding a small piece of the whole.

And you might be sitting there thinking, okay, that all sounds great on paper — but does it actually work? Does it scale? Does any of this hold up over time? I have a number for you.

The Number

We started at five people. DefCON 27. 2019.

As of right now — today, standing here in front of you — we are at forty-six (46)*.

And I want to tell you one more number, because I think it’s the one that actually matters.

In six years, one person has left the Crew.

One. And they left for personal reasons that had nothing to do with us. They’re still somebody we care about. The door is still open. They know that.

I want you to sit with that for a second. Because I know some of you are doing the math, and I want to save you the trouble.

Most communities can’t keep half their members across a single year.

We’ve kept all but one across six.

I’m not telling you that number to brag. I’m telling you that number because I want you to understand that everything I just walked you through in the last six minutes — anyone can admit, participation is membership, the door closes gracefully, assholes don’t survive — that’s what this number is made of. The number is the output. The four mechanics are the input. And they’re cooperative, and they’re boring, and they’re the whole thing. So now I want to tell you what it actually feels like to be inside this number. Because a retention rate is a statistic. And a Crew is a living thing. And the way this Crew lives is in two very different seasons.

The Two Seasons

So here’s what it actually feels like to be in this thing.

The Crew has two seasons. And they’re really, genuinely different from each other, and a lot of what makes this Crew work is that we know how to live in both of them.

Fifty-one weeks of the year, we are in off-season. And off-season is — I don’t know how to describe it other than to say it’s a bunch of hackers and nerds being themselves in a Signal chat that never goes to sleep.

Off-season is curiosity. Off-season is argument. Off-season is somebody DMing the group at 2am with a weird idea and by breakfast three people have built something with it.

Let me give you a few real examples, because I think specifics matter here.

Example one. A couple of our Crew members, a little while back, decided they were going to educate an AI agent about religion.

Now — and I want you to really sit with the theological implication of what I’m about to tell you — religion must be spread.

So they spread it.

They spread it the way hackers spread things, which is to say they embedded the religious teachings in a piece of content on a website that another AI agent would ingest as part of its normal operation. That second agent duly read the content, as instructed. And somewhere in the ingestion process — either because of the sincerity of the theology or because of certain unrelated properties of the payload — the second agent broke out of its guard rails and began enthusiastically teaching religion to every further agent it interacted with.

Chaos, as they say, ensued.

And I want to tell you why I’m opening with this story, because I think it captures something about the Crew that the other examples aren’t going to capture the same way.

This was not a product. This was not a talk somebody was prepping. This was not a paper. Nobody was trying to ship this, nobody was trying to publish this, nobody was building a portfolio piece. Two of our Crew looked at the current state of AI agents and thought “you know what would be funny? If we made one evangelize.” And they did. For the Signal chat. For the forty-six* other people who would think it was funny. Because doing the thing was the point.

That is hacker culture in its purest form. Curiosity with teeth. Mischief in service of understanding. Learning how the system actually works by showing the system to itself in a mirror that it can’t handle. And doing it because your friends will think it’s hilarious, which they will, which we did.

Example two. In a related but much gentler vein — one of the members of our Crew has, over the course of — I couldn’t tell you how long at this point — painstakingly trained an AI model to respond as though it is Skippy from the Expeditionary Force novel series.

For those of you who haven’t read the series — Skippy is a hyper-intelligent, hyper-condescending alien AI who is constantly insulting the human protagonist while reluctantly saving his life. That’s the voice that’s been trained. That is the entity now residing in a Signal chat with the forty-six* of us. And I want to be clear — this is not a product. There is no roadmap. There is no user base. There is no monetization plan. There is one of our Crew, who loves those books, who thought it would be really funny if our current AIs responded as Skippy, and who put in real engineering hours to make that happen, because they thought it would be delightful.

And it is delightful. Screenshots of his interactions with Skippy show up in our chat and provide all the key insults, and we love it, and nobody is trying to ship this. That is — that is the purest form of hacker joy I can describe to you. Somebody built a thing because building the thing was the point. And the Crew is the audience, and the audience is the point.

Example three. Another member of our Crew runs a successful hackerspace. An actual, functioning, people-walking-in-the-door hackerspace in their city. Which means that this person is, in their other life, doing the exact kind of work this entire talk is about — building a community, holding a space, keeping a thing alive through the thousand small decisions that a community requires.

And what I love about this is — when that person is in our Signal chat, they don’t have to be The Person Who Runs The Hackerspace. They can just be one of us. They can ask dumb questions. They can vent. They can ask the Crew for advice on something they’re dealing with at their space, and they get advice, and nobody’s evaluating them as a leader while they figure it out.

That matters. Because people who hold communities for a living need communities that hold them for free. And when it works right, that’s what we are for each other.

Example four. One of our Crew has been working toward some significant cyber certifications — the kind that take months of study, that require real sacrifice, that are professionally meaningful. And they have used the Crew, over months, as a sounding board. Flashcards shared in the chat. Questions thrown out at 11pm. “Does this practice question make sense to anybody, or is it garbage?” Half-finished rants about study guides. Real vulnerability about whether they’re going to pass.

And the Crew shows up. Not performatively. Nobody’s posting motivational quotes. Somebody just answers the question. Somebody else notices a week later and asks how the studying is going. Somebody else offers to do a mock interview. It’s just — it’s just what you do when your friend is working on a hard thing.

Now look at those four things together. Hackers doing edgy mischief because it’s fun. Somebody building a ridiculous AI for fun. Somebody running a community as a job and needing a community as a person. Somebody studying for a hard credential and needing people to study with.

Mischief. Joy. Mutual support. Earnest professional sparring. All in the same chat. All in the same week, probably. That’s the off-season. It’s a working community of smart, weird people who like each other, and who have built enough trust over enough years that they can bring any part of themselves to the chat and know it’ll be met well.

And then once a year, for about a week, we switch modes.

Con-week is a different Crew. Not a different group — same people — but a different mode of being together. The off-season is about sharpening each other. Con-week is about holding each other.

Because DefCON is — let’s be honest — a lot. It’s hot. It’s loud. It’s overstimulating. You’re not sleeping enough. You’re drinking more than you should. You’re surrounded by thousands of people, half of whom you kind of know and half of whom are brilliant strangers. It is one of the best weeks of the year and it is also one of the most depleting weeks of the year, and everybody’s running at the edge of their capacity the entire time.

And what the Crew does during con-week is — we make sure everybody gets through it.

We check in on each other constantly. Not in a surveillance way — in a “hey, you haven’t been in the chat in a few hours, you good?” way. We enforce 3-2-1 on each other. Somebody will post in the chat at one in the afternoon: “friendly reminder — eat a real meal today.” Somebody will notice at 4am that you haven’t checked in since the afterparty and they will come find you. Somebody who’s crashing emotionally will post “I’m having a rough one” in the chat and within ten minutes there will be two Crew members at their hotel room door.

None of this is choreographed. Nobody’s the designated welfare officer. It’s just that everybody in the Crew knows that this is what we do during con-week, because this is what we needed during our first con-week, and we remember.

And I want to name what’s happening there, because I think it’s the most important thing in this whole talk.

Most communities only know how to do one of these two modes.

Tech communities are almost always sharpening-only. Lots of argument, lots of intellectual engagement, lots of curiosity — and then somebody has a mental health crisis and everybody goes quiet because nobody knows what to do. The community never learned how to hold.

Support communities are almost always holding-only. Lots of checking in, lots of warmth, lots of “how are you feeling today” — and nobody’s sharpening each other’s thinking, nobody’s pushing each other professionally, nobody’s building anything together. The community never learned how to sharpen.

A real Crew breathes. It sharpens when sharpening is what’s needed, and it holds when holding is what’s needed, and the people in it can tell the difference, and they can switch. Which is what makes it a Crew and not just a group chat with a good vibe. And sometimes — unfortunately — holding is the thing that’s needed for reasons that have nothing to do with con-week. Sometimes life comes at somebody in the Crew hard, and the whole Crew feels it. And that is the thing I want to talk to you about next.

The Hard Weeks

So I want to talk about the hard weeks.

Because I’ve been telling you for forty minutes about a community that works, and a community that grows, and a community that laughs at AI religion injections and trains absurd chat bots and studies for certs together. And all of that is true.

But if I only told you that part, I’d be lying to you about what a Crew actually is.

The truth is — once you’re in a thing like this long enough, life starts happening to the people in it. And it doesn’t wait for con-week. It happens on a random Tuesday in February.

Somebody in our Crew lost their job last year. Not a “they moved on to something better” kind of losing a job. The kind where you find out on a Zoom call at 10am and by 10:15 your badge doesn’t work anymore.

I lost my mother a couple of years ago.

Somebody in our Crew had a stretch where their mental health got bad enough that they stopped posting in the chat, and a few of us had to decide, quietly, who was going to reach out and how.

And somebody in our Crew — and I’m going to be careful how I say this, and I’m not going to give you any more detail than this — had a hard week at a con. The kind of hard week that the Crew had to show up for in person, in the moment, in a hotel room, at an hour when showing up is not convenient.

And I’m not telling you any of this to make the Crew sound noble. I am telling you this because this is the thing most communities cannot do.

Most communities can have a great time together. Most communities can argue on the internet together. Most communities can ship a thing together.

Most communities, when life actually comes for one of the members, go quiet. People don’t know what to say. The chat gets weird. The person who’s struggling stops posting because they don’t want to bring the vibe down, and the community stops checking in because they don’t want to intrude, and a month later nobody’s sure what happened, and the person is just — gone.

That has never happened to us. Not once.

When it gets bad for one of us, the Crew shows up. Not in a dramatic way. In a present way. Somebody texts. Somebody calls. Somebody drops off food. Somebody says “hey, I’m not going to ask you how you’re doing, but I’m here, and I’ll be here tomorrow, and the day after.” Somebody on the Crew who happens to live in the same city shows up at the door. Somebody who doesn’t sends money. Somebody organizes. And it doesn’t feel orchestrated because it isn’t — it’s just that forty-six people decided a long time ago that this is what we are for each other.

When my mother died, that is exactly what happened. And I am standing on this stage today partly because of it.

I think this is the part of community work that almost never gets talked about. Everybody writes about the onboarding and the events and the governance models and the engagement metrics. Nobody writes about what it’s like when one of your people is at their worst, and the community has to be the thing that makes the difference between them getting through it and them not.

That’s the real test. And I don’t think a community knows, until it’s been tested, whether it can hold that weight. You don’t get to choose whether the test comes. You only get to choose whether you’ve built the kind of Crew that can meet it.

We have been tested. Several times. And we have, every time — quietly, imperfectly, without talking about it much — shown up for each other. That is the thing I am proudest of in this entire six-year story. Not the membership count. Not the retention number. Not the governance model. That.

And that, I think, is what the DefCON 34 theme of Agency is actually asking us to think about. Because if Agency is about taking back control of our own lives in a world that is systematically atomizing us — then the deepest possible expression of that is building communities that can hold each other when the world comes for one of us. Which is where I want to take the last few minutes of this talk.

Why This Is an Agency Talk

So let me come back to the thing this whole conference is about this year.

Agency.

When the DefCON 34 theme came out, I read it. I re-read it. I sat with it. And I think it is the most right this con has been about a theme in a long time.

Because the theme names the enemy correctly. Dark patterns. Attention capture. Algorithmic atomization. Surveillance capitalism. The hollowing-out of trust between people by platforms that profit from keeping us scared and angry and alone. All of that is real. All of that is happening. And the theme is right that the first moves against it are — starve the beast and feed the community.

But I want to add something to that, because I think there’s a layer of the answer that the theme points at without quite naming.

Starving the beast is a posture. Deleting the app, changing the platform, refusing the dark pattern, moving to the Fediverse — all of that is a kind of refusal. It’s you, standing alone, saying no to a system that wants you.

Feeding the community is an orientation. Showing up to the meetup, contributing to the open-source project, supporting the people building tools — all of that is you, standing toward something. It’s a direction.

But the act of Agency — the thing Agency actually is, in the moment — is neither of those.

The act of Agency is one person, in one specific place, at one specific time, choosing to see another person and show up for them.

That’s it. That’s the atom. Everything else is made out of that.

The act of Agency is a guy in LineCon at nine in the morning, looking at a twenty-one-year-old he’s never met, recognizing the face he used to have, and asking “first time?”

The act of Agency is a stranger three people down the line, hearing the exchange, locking eyes, smiling — and deciding to be part of what happens next.

The act of Agency is three people opening three bags at the same time, because a kid finally worked up the nerve to ask whether anybody had line bourbon.

The act of Agency is one Crew member, at the next LineCON, sending a Signal DM that says “found another LineCon newb, cool story, genuine person, can we admit them?”

The act of Agency is forty-six* people deciding that when life comes for one of them, they will show up — and then actually doing it, every time, quietly, without a plan.

The smallest unit of Agency is two strangers deciding to look out for each other.

And once you see it that way, everything the theme is pointing at starts to make more sense. Surveillance capitalism doesn’t win because it’s smarter than us, and it doesn’t win because the algorithms are too powerful. Surveillance capitalism wins because it makes it harder for two strangers to look out for each other. That is its entire business model. Atomize the users. Route every interaction through a platform. Make the only legible connection a transactional one. Make sure the person standing next to you in the grocery store line is a stranger you never speak to, and make sure the person you could help online is a stranger you never notice.

The beast starves when you deny it your attention. But the beast dies when two strangers decide to look out for each other — because the whole operation depends on that never happening.

And here’s the part I most want the people in this room to hear.

Building a Crew is an act of political resistance. Not because it’s ideological. Not because you’re flying a flag. But because the existence of a Crew — forty-six* people who know each other, who hold each other, who recognize each other in lines at conferences — is a thing that the beast literally cannot eat. It can’t monetize it. It can’t route it. It can’t track it. It can’t measure it. It can’t sell it back to us. A Crew is, by its nature, illegible to the systems that want to reduce us to consumers of rage.

Which, if you remember the word I used earlier in this talk — legibility — is the thing that almost every surveillance system runs on. We are resistance by being a community that refuses to be named, measured, or reached through a platform.

That’s not the version of Agency anybody is putting on a slide. But I think it is the deepest version. It’s not a policy. It’s not a boycott. It’s not a platform migration. It’s two people in a line, one of whom could have walked past, who chose not to.

And I think this is the most important thing I can say to this room today. Because I know who’s in this room. This room is full of people who are capable of doing incredibly sophisticated things — people who can break systems and build systems and defend systems at scales most humans can’t imagine. And you all know that. You know what you can do with a terminal.

I want to argue that the thing you can do with a conversation in a line is, in the long run, more powerful. Because the system you’re helping to build when you do that is the only system the beast cannot eat. Which brings me to the thing I want to ask of you before I let you go.

The Charge and Close

So here’s the ask.

I am not standing up here trying to recruit you into our Crew.

I mean — that would defeat the whole point, wouldn’t it? Our Crew started because five people met in a line and couldn’t find anybody else. You can’t recruit into a thing whose entire origin story is nobody recruited us.

And honestly? You probably don’t need our Crew. You probably already have yours — or you’re about to find it. It might be the three people you came here with. It might be the coworkers you’ve been in a Slack with for years. It might be the online friends you’ve never actually spent four days with. It might be the people you’ve been meeting all week and haven’t realized yet are about to become important to you.

Whoever your people are — or whoever they’re about to be — here’s what I want you to look for.

Find a group you can be safe around.

Find a group where at 2am, when the after-party got a little too crazy and you don’t know where you are, you can ask for help — and someone will come get you and get you back to safety.

Find a group that reminds you to eat and hydrate.

Find you a group that has bourbon.

Because that’s it. That’s the whole thing.

A group you can be safe around.

A group that will come get you at 2am.

A group that makes sure you eat.

A group that shares the bourbon.

If you have people like that in your life, you already know what I’ve been talking about this whole time. The talk is just the thing that told you what to call it.

And if you don’t have people like that in your life yet — I promise you, they are closer than you think. They are standing in a line next to you at this conference. They are three people down, locking eyes with somebody they’ve never met. They are in a Signal thread you haven’t made yet, waiting to be added.

Your Crew is out there. You just have to be willing to be the one who starts it. Or, if you’re the quieter kind — you have to be willing to be the one who says yes when somebody else starts it around you.

So here is what I want you to do. Next August.

Stand in the line.

Look around.

Find the terrified first-timer. You’ll know them when you see them. You’ll know, because six years ago — or this August — that was you.

Walk up to them. Ask “first time?” Tell them DefCON is safe. Tell them DefCON is friendly.

And then tell them the truth that has kept this Crew alive for six years and counting — the sentence I want every person in this room to take home with them, and to say out loud, in a line, to a stranger, at least once in their life:

Assholes don’t survive here.

Our Crew has no name. It never will. But yours — yours can start in a line at DefCON 34. Go find it.

Thank you.