Why Most Good Hackers Come From Russia

Needless to say, you know how good Russian hackers are. Both in the field of cyber security (white hat hackers) and cyber crime (black hat hackers) there are experts from Russia. It is not an exaggeration to say that Russian hackers are "better" than hackers from other countries.

So why do most of the good hackers come from Russia?

It is argued that the reason why hackers from Russia and other former Soviet countries are so numerous and skilled is that these countries have traditionally placed more emphasis on teaching information technology at the middle and high school levels than Western countries.

In addition, these countries lack a Silicon Valley-like system to help talented IT professionals turn their skills into well-paid jobs. As a result, many IT professionals decide to take the hacker route.

Further analysis

In this article, we will analyze whether the first hypothesis is correct. The analysis is based on educational data from the United States and Russia. The data shows that there is a clear and important difference between the teaching and testing of IT subjects in the United States compared to Eastern Europe.

Compared to the US, Russian high school students are more likely to major in IT subjects. We can gauge this by looking at the number of high school students in the two countries who choose to take the Advanced Placement (AP) exam for computer science.

Why Most Good Hackers Come From Russia Picture 1

 

According to an analysis by The College Board, in the 10 years from 2005 to 2016, a total of 270,000 high school students in the US chose to take the national exam in computer science (the "Computer Science Advanced Placement" exam).

Meanwhile, a 2014 study by Perm State National Research University found that about 60,000 Russian students registered for a similar exam (the "Unified National Examination"). By extension, in 10 years, about 600,000 Russian students took the exam in computer science at the high school level, twice as many as in the United States.

In 'A National Talent Strategy,' an in-depth analysis of IT career prospects by Microsoft, the authors warn that computer science is still taught in only a small number of U.S. schools despite its growing importance. The Microsoft study notes that while there are 42,000 high schools in the U.S., only 2,100 were certified to teach computer science in 2011.

Start from a young age

Students in Russia are required to learn computer science at a much younger age than at secondary school. The Russian Federation for Educational Standards (FES) stipulates that computer science is a compulsory subject in secondary school, and schools are free to choose whether to include computer science in their secondary school curriculum at the basic or advanced level.

The core components of the computer science curriculum that FES sets for secondary schools in Russia are:

1. Theoretical basis
2. How computers work
3. Information technology
4. Network technology
5. Algorithm
6. Programming languages ​​and methods
7. Modeling
8. Information Technology and Society

Junior High School

There are also distinct differences in the way computer science/informatics is taught in the two countries as well as the level of proficiency that candidates must demonstrate in the respective exams.

According to Perm research, in computer science exams, Russian teachers want to test the following issues:

Section 1: "Mathematical foundations of informatics".

 

Section 2: "Algorithms and programming".

Section 3: "Information and computer technology".

The test documents consist of three parts:

Part 1: It consists of a multiple choice test with four options for the school and it covers knowledge from all three sections. The time to complete this part is quite short.

Part 2: Includes a set of tasks at complex, medium and advanced levels. Candidates will be asked to give short answers such as a number or a series of characteristics.

Part 3: Consists of a set of tasks of even higher complexity than the advanced level. Candidates will be required to write detailed answers in a free-form manner.

According to a study by Perm in 2012, part 1 has 13 questions, part 2 has 15 questions and part 3 has 4 questions. The exam covers the core topics of the school computer science curriculum. Part 3 is the most laborious part. It includes tasks on analyzing algorithms, drawing computer programs. The answers will be checked by experts from the regional examination board based on standard assessment criteria.

In the United States, the content of the AP computer science exam is written in the College Board document.

Areas that American teachers test include:

Computational Thinking Practice (P)

P1: Connect computer

P2: Create calculation software

P3: Summary

P4: Problem analysis and software

P5: Communication

P6: Collaboration

Concept Sketch:

Big Idea 1: Creativity

Big Idea 2: Abstraction

Big Idea 3: Data and Information

Big Idea 4: Algorithms

Big Idea 5: Programming

Big Idea 6: The Internet

Big Idea 7: Global Impact

Further analysis of the tests

How do the two types of tests compare? Alan Paller, research director at the SANS Institute, an educational organization focused on information security, said that components 2, 3, 4 and 6 of the Russian computer science curriculum are 'basics' for building cybersecurity skills and are currently taught in high school to all Russian students.

Why Most Good Hackers Come From Russia Picture 2

 

'In the United States, very few middle schools teach these things ,' Paller said. 'We generally don't teach these topics and certainly don't test them. The Russians do this and they've been doing it for 30 years. Which country produces the best cybersecurity people? It goes without saying.'

Paller notes that the Russian curriculum virtually ensures that all children have more hands-on experience with computer programming and problem solving. For example, on the US AP exam, no programming language is specified and the learning objectives are:

1. "How are programs developed to help people and organizations?"
2. "How are programs used to express creativity?"
3. "How do computer programs implement algorithms?"
4. "Why does abstraction make the development of computer programs possible?"
5. "How do people develop and test computer programs?"
6. "What mathematical and logical concepts are fundamental to programming?".

'You see, they don't teach programming at all. They teach kids how to write a complete program ,' Paller writes. 'It's like they teach kids how to look at [computer software] but not how to make it. The main reason why [US] cybersecurity education fails is that most students graduate with no applicable skills.'

The Road Ahead

One bright spot is that computer science is becoming a more popular focus for American high school students. According to the latest report from the College Board, nearly 58,000 American students took the AP computer science exam in 2016, up from 49,000 in 2015.

Still, computer science lags far behind most other subjects in the U.S. More than half a million students took the AP English exam in 2016, with 405,000 taking English literature, nearly 283,000 taking the AP government exam, while about 159,000 took an AP exam called 'Human Geography.'

This is not good news because according to employers, there is currently a shortage of highly qualified cybersecurity experts. Cybercrime is increasingly rampant, so the demand for cybersecurity experts is very high.

The shortage of human resources in the IT industry is especially serious for American businesses. Due to the lack of domestic human resources, American giants are forced to recruit talents from abroad. This is not easy to do because of the tight immigration policy.

Conclude

It can be said that the education system has helped Russia produce many cyber security experts (white hat hackers) and notorious cyber criminals (black hat hackers). Russian hackers are not only numerous in quality but also very good in expertise.

Therefore, in order to surpass Russia, the best way for the US and other countries to do is to change their education system to focus more on Information Technology subjects.