One day last summer, Pittsburgh hacker Chris Valasek and fellow researcher Charlie Miller huddled over a laptop in Miller’s St. Louis home. From there they took over the controls of a Jeep Grand Cherokee that was driving on a highway ten miles away. First, they commandeered the air conditioning, blasting cold air into the vehicle. Then they messed with windshield wipers. Then the radio. And then? They cut the transmission.
Despite how it looked, they weren’t intent on harm — and the driver of the Jeep was in on it. Their mission was to expose the vulnerability of automobiles that increasingly rely on software. And they did it well.
Known as the “Jeep Hack” and detailed in a July 2015 Wired article, their exploit—the culmination of several years of research—was a game-changer in the field of vehicle security.
Less than a week after their exploits went public, Fiat Chrysler announced the recall of 1.4 million vehicles that contained the wireless entertainment system that allowed Valasek and Miller to take control. In March of this year, the Federal Bureau of Investigation issued an alert warning motorists of the threat of attacks on their vehicles via remote access.
When he’s not hacking for the greater good, Valasek works as security lead at Pittsburgh’s Uber Advaned Technologies Center in the Strip District. Who better to hire to protect the fleet? (As reported by Wired in an updated article last month, Miller now works there as well.)
Chris Valasek, left, and Charlie Miller hamming it up.
Over an iced coffee at Lawrenceville’s Espresso a Mano—a short distance from the Uber center—the 34-year-old Valasek talked about his love of all things Pittsburgh, his latest research, and his involvement with a group of educators to start a high school that aims, among other things, to teach kids the fine artistry of hacking.
Valasek’s formal training in computer science began at the University of Pittsburgh.
“It was the only school I applied to,” says Valasek who, less than two weeks after graduation, was offered a job in programming in Atlanta and moved south. Eventually, he worked for a company that allowed him to work remotely. He moved back to Pittsburgh in 2011 and started working at Uber in September of last year.
“For me, Pittsburgh offers all the amenities of a city, but it doesn’t feel suffocating to me like New York or Los Angeles or San Francisco. All my people are here,” says Valasek, who grew up north of Pittsburgh in Ford City. Since his return, he has resided in Shadyside.
Valasek wasn’t so much surprised as excited to find that when he returned, Pittsburgh had firmly established itself as a state-of-the-future tech hub.
“We have some of the hottest biggest companies to work for here in tech,” Valasek says, adding that one of his favorite new pastimes is showing West Coast friends around the city. “You’re like ‘Here’s a house you can buy,’ and they are like ‘What?’ I have friends that own a house, and they are thinking about starting a brewery too. It’s not just a pipe dream. You can accomplish something like that here.”
Not long after his return, Valasek began volunteering with Maureen Anderson, who at the time was the career readiness and post-high school planning teacher at City Charter High School in Pittsburgh. The two started an after-school club to get kids interested in cybersecurity.
The club didn’t take off the way they had hoped and the pair realized that they needed to expose kids to cyber concepts at an earlier age. So they partnered again, this time with a group of educators trying to start a technologies and trade space charter school for Pittsburgh students. For Valasek, it was critical that the school include a cyber education component.
“I want to create a curriculum for kids in 7th through 12th grades,” he says. “I realize that getting them in 10th grade, you are already too late. They have already made up their minds of whether they want to do computers or not.”
Chief among Valasek’s priorities is teaching students that they do not need to be a programmer to work in tech. There are countless unfilled positions in the field of cybersecurity where ethical hackers like Valasek can thrive.
“I was a terrible programmer,” says Valasek. “I like to think that I am fairly good at breaking other people’s stuff. Not everyone has to build. We need breakers to make builders build better things.”
The high school envisioned by the group that Valasek and Anderson are working with builds off the recent success of the maker movement and will target urban students who may not be college-bound directly out of high school.
“What’s a year of college going to cost you these days? We’ll say at least 30 grand. If you can come out of your senior year [of high school] making 40 Gs a year, and you don’t have any student debt, you are so far ahead of your peers that it is ridiculous,” Valasek says.
Their plans morphed into high gear when, in the fall of 2015, Laurene Powell Jobs, Steve Jobs’ widow, launched a $50 million initiative called XQ: The Super School Project inviting teams of educators and students to rethink high school. Valasek and Anderson competed to be one of the five winning schools to receive $10 million each.
Anderson explained that Valasek’s input was crucial; he prepared a detailed cybersecurity curriculum that will ideally allow high school students to graduate with a university-backed certification and begin working in the field. Their team in the XQ competition—they were team number 1,574—made it through the first two rounds of vetting in the XQ project and submitted their final proposal in May. While they weren’t one of five schools selected in the extremely competitive project, their attempt served a purpose.
“No matter what, it was the most amazing experience because I got to work with really phenomenal people like Chris,” says Anderson, who in addition to working full-time at City Charter High School, is in grad school at Point Park University to earn her principal’s certificate and doctorate in education. “He wanted to get involved with youth in school. He’s very enthusiastic about more young people learning about coding and cybersecurity.”
When Valasek is not working, he spends time boxing and wakeboarding on weekends at a property he owns north of Pittsburgh that he shares with two shelter dogs: Karma and Ada. The latter is named for Ada Lovelace, an English mathematician from the 1800s who is widely credited with writing instructions for the first computer program.
It takes some prodding to get Valasek off the topics of Pittsburgh’s awesomeness and the importance of cybersecurity education and back to his latest research. Namely, any plans for future hacks with Miller?
In late July, the two presented their latest work at Black Hat, a global meetup of cybersecurity researchers.
“The last couple of years have been ‘Can you control a car? What can you control? and ‘Can you do that remotely?’, he says. “Now, we are looking back at this and saying ‘Say you want to fine tune this, and say that we can control in any granularity that we want. It’s kind of refinement of the beginning of the process, which is cool.”