Vinnie Liu was recruited by the NSA when he was just 17 years old. He is now the CEO of Bishop Fox.
He says little about his work at the NSA, only that “My first year was on the red team, and in the second year, it was more externally facing.”
He had been recommended to the NSA by an Air Force guy he never met face-to-face and whose ‘handle’ he no longer remembers. But being recruited by such an organization in such a manner at such an early age would indicate a prodigious hacker. This is not the image he projects.
“I hadn’t been engaged in hacking in anything like a grand scale, like some scattered spider. But I spent a lot of time learning how systems worked and figuring out how to set systems up and take them down. I’ve always been more on the white hat side. I think that’s probably what caught their attention – I wasn’t trying to break into things for the thrill of it; I was just trying to learn.”
His earlier understanding of computers and programming came from an older sister who was away at college. “She would come home from college every now and then with books or materials, and I would just devour them. I found them fascinating. She’d come home with these various programming books, and I would just think ‘Oh, what’s that?’ So, I’d try to figure it out.”
He was less than 10 years old and already displaying some of the key characteristics of a hacker: an intense curiosity and desire to understand. But he had no concept of hacking or hackers. His motivation was simply to do what he enjoyed and have fun doing it – a motivation that has stayed with him through life.
Later, in high school, he started to learn about computers and computing. He clearly excelled since he was recruited by the NSA before even working toward a degree. He understood the concept of hacking, and obviously dabbled, but solely out of curiosity and the desire to have fun. “I had been spending a lot of time on IRC,” he explains, and it was here that he met the Air Force guy who recommended him to the NSA.
Asked if he did anything ‘shady’ with his growing knowledge, he said ‘No’. Pressed on the subject (‘What – not even breaking into the school’s computer network?’), he simply replied, “I don’t think that’s shady – it’s just de rigueur if you’re into programming and at school.”
He doesn’t say he did do this, but clearly implies he did this or similar.
“My definition of a hacker is somebody who likes to find a way around a control or a security system to get things to behave in ways that were unintended.” Note that he doesn’t specify any motivating purpose for hacking. For Liu, the act of hacking stands alone. It is the purpose of the hacker that differentiates between black and white hat hacking.
“I think intent is really important. There’s exploring, and then there’s exploring for the purpose of destroying or hurting or harming. There’s a distinction between those two things.” Liu liked to explore constantly, freely, for fun – but never harm. It is perhaps this total absence of any malicious intent from Liu that makes him reticent about his own hacking career.
Asked if he had ever considered selling his discoveries on the dark web, he replied that he couldn’t because it didn’t exist at the time. “When I started, in the first half of the 1990s, there was no dark web.” Again, we have this minor evasion of the point of the question – he didn’t, not because he wouldn’t, but because he couldn’t. But his answer was accurate: the dark web didn’t really evolve until after the Tor project software was released in 2002 and the Tor browser arrived around 2008.
Despite the apparent slight contradictions in his history (being involved in hacking within the NSA and considering breaking into school computer networks just par for the course), Liu clearly has a strong moral compass. He got into hacking solely for the purpose of having fun. He could do it, he enjoyed it, but he never had any malicious intent.
This moral compass came, he believes, “From both my parents and early educators, who I think were very good role models.” This suggests he believes that morality is something learned, not something innate.
Statistically, many hackers are neurodiverse. Neurodiversity simply indicates a brain and thought processes that are out of the norm. For hackers, it is often evident in ADHD and ASD (the latter was formerly called ‘Asperger’s syndrome’). It helps with what ‘normies’ (the majority of non-neurodiverse people) might consider to be thinking outside of the box, and engaging in long periods of sustained and deep concentration – both of which are clearly beneficial attributes for a hacker.
Is Liu neurodiverse? “No. I don’t consider myself to be neurodiverse,” he says. “My wife would call me nuts, but I don’t think I’m neurodiverse in the traditional sense. I just really enjoy what I do.”
Liu was only 17 when he took his first formal employment working for the NSA. This was in 1999. “I was a full-time employee,” he explains, “but they let me take classes.” It is difficult to classify what he did within the NSA, which he merely states as ‘externally facing’. Let’s assume he was a hacker for the NSA. Could that be considered black hat, since it would clearly intend some form of harm to the target? Or is any form of hacking for the good guys automatically white hat?
Either way, his career after the NSA was clearly and increasingly white hat.
During his two years at the NSA, the commercial ‘civilian’ security industry went through a rapid expansion, and “They started hiring a lot of my colleagues, especially the ones I really got along with.” @stake was founded in 1999, the same year he joined the NSA. A year later, @stake acquired Lopht Heavy Industries, an organization that had been a major magnet for serious and well-known hackers (including Weld Pond, Kingpin and Space Rogue).
By 2001, he realized that everyone was leaving to join private industry. “I decided to do the same. I left the NSA but first wanted to complete my degree course. That took another couple of years.”
By the time he was 21, he had two years’ experience working for the NSA, a recently acquired degree in Computer Science, and considerable knowledge of what we should politely call offensive security. “In a lot of cases,” he comments, “hackers [by which he means both internal red teamers and external attackers] wind up understanding a system better than the original developers; because they’ve thought so deeply about the system and how to subvert its behavior.”
This is by no means a simple process – and hackers are as prone to burnout as any other security practitioner. “I’ve seen a lot of brilliant, brilliant hackers – I mean real next level folks – burn out and just lose it.”
With his CV, he was never likely to have difficulty finding employment in the private sector. In 2003 he started work as a Security Consultant at the Advanced Security Center, Ernst & Young LLP, where he re-acquainted with Fran Brown. He and Brown had been in the same hall in college freshman year, and they took the same courses.
Within 18 months they were both recruited by Honeywell. Together they led Honeywell’s global penetration testing team. This time, he, well they, stayed for just 16 months. They began to get additional sub-contracting work on the side, “from friends who needed help”. They were already thinking about what to do next, and decided, “Hey, yeah, why not?”
Bishop Fox was the ultimate answer to this question, although the precise route is difficult to plot. Both Liu and Brown indicate they left Honeywell and moved immediately into Bishop Fox, which they co-founded. Liu’s LinkedIn profile suggests he did this the year before leaving Honeywell. Brown’s profile suggests it was concurrent with leaving Honeywell.
But the name Bishop Fox is a rebranding of the firm Stach & Liu LLC, which happened in 2014. Stach and Liu was itself not founded, according to Dun & Bradstreet, until 2011. It was rebranded to Bishop Fox in 2013 – possibly because the former sounds more like a law firm while the latter symbolizes both the protective and aggressive aspects of penetration testing and red teaming.
Nevertheless, regardless of the circuitous route to Bishop Fox, Liu and Brown founded a company that is now widely considered to be a top-tier authority in offensive security. Liu, as its CEO, has progressed from an offensive security performer to an offensive security ringmaster.
Is he still a hacker? “I’d like to think so. And certainly I would have given you a very affirmative ‘Yes’ 10 years ago. These days, I think my team thinks I’m a little out of date, but I’ve spent a large part of my career hacking into things. More recently I spend time managing the firm, but, yeah, I would like to think I’m still a hacker.”
Still this slight reticence in clearly stating he is a hacker. He clearly is a hacker – and since hacking is as much a state of mind as physical process, once a hacker, always a hacker. The clarity, however, is that he, Fran Brown, and the entire Bishop Fox organization are hackers for good.
Related: Hacker Conversations: Isira Adithya, the Evolution of an Ethical Hacker
Related: Hacker Conversations: Joey Melo on Hacking AI
Related: Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker
Related: Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption
