LAS VEGAS—In the movies, hackers pound keyboards feverishly while mysterious numbers scroll across old-fashioned screens. They look intense, driven, but when the job is done, it's party time.
In the real world, those hackers might be suffering episodic or chronic stress, according to the National Security Agency (NSA), which ran a scientific psychological study on the matter. The results weren't very surprising (fatigue + stress = bad), but having statistically valid proof gives the issue a certain gravitas they wouldn't have had otherwise.
Stress in Cyber
During a panel here at Black Hat, Dr. Celeste Lyn Paul, a senior researcher with the NSA, pointed out that it was one of four conference tracks focusing on mental health; others cover addiction, PTSD, and avoiding burnout and depression.
"Anyone who's worked in this field has known these issues exist," she said. "Now we can focus on safety and health."
Dr. Paul, who earned a Ph.D. in Human-Centered Computing and teaches human-computer interaction at the University of Maryland, argued that acute stress, the kind that puts you in fight-or-flight mode, isn't necessarily a bad thing. But episodic stress—stress events over and over—doesn't give you time to recover, and can exacerbate ill health. And chronic stress—continuous stress with no sense of control—can make a healthy person sick.
Other government agencies have already thought about how to measure stress. The Samn-Perelli test, for example, measures fatigue and frustration in fighter pilots. And NASA's task load index measures frustration, fatigue, and a multi-part component called cognitive workload, which subdivides into Mental, Physical, Time (rushed or not), Performance success, Frustration, and Effort.
The NSA developed a quick one-page survey for cyber operators to fill out before and after an operation. "We made it short on purpose," said Dr. Paul. "Working in a mission environment, we didn't want to affect the mission by stressing our operators."
The Result? Time Matters
The NSA study took place at four agency locations: DC, Georgia, Texas, and Hawaii. It involved 126 operators, both civilian and military, with 361 total surveys. Statistics wonks will appreciate that the results of the study proved to be statistically significant. But for the rest of us, I'll cut to the chase.
The self-reported Success estimate hardly varied, suggesting that the operators considered the mission to be all important, regardless of the effect on their fatigue and other effects. The one component that dashed their feeling of success was fatigue. And fatigue was significantly less with missions under five hours compared with those that are longer.
"Cyber is hard," said Dr. Paul. "There will be stress. When it becomes unmanageable it's where we see negative effects. And it's harder in our environment. It's about protecting the nation, life, property and sovereignty. Imagine being the guy at the keyboard in charge of all that. You make a mistake, you could affect a lot of people."
She closed on an optimistic note, though. "What we found out from this work is going to help, and we have started making progress."
Josiah Dykstra, an NSA Subject Matter Expert, urged Black Hat attendees to use the NSA data to evaluate their own operations. "Many of you do work similar to ours," he said. "You can review your policies on breaks, scheduling and operation length. And you can empower operators with happy, healthy work environments."
The survey form and the entire study will be made available on the NSA.gov website, Dykstra said.