The infosec community has undergone a post-Weinstein cultural shift, as evidenced by the soul-searching following allegations against Morgan Marquis-Boire
In 2015 I noticed something odd on Twitter — without context or explanation, Andrea Shepard, a Tor developer, had posted a string of random letters and numbers. Tweets: @comzeradd , @evacide , @fox , @wibrr , @lorenzofb , @askpang , and @sarahjeong Tweets: Nikos Roussos / @comzeradd : Great article by @sarahjeong http://www.theverge.com/... Emphasizing on how a community offers free pass to a sexist or abusive male using the excuse: “but he does good work”. What about all the talent we lose by disbelieving or ignoring the victims? Eva / @evacide : Has infosec really changed in 2017 because of the difference between the way Jake Appelbaum and Morgan Marquis-Boire were treated? @sarahjeong thinks so. I hope she's right. http://www.theverge.com/... Karolina Szczur / @fox : “Sexual harassment is a systemic cultural failure where men are repeatedly given a pass when they don't deserve one.” https://www.theverge.com/... @wibrr : “The system doesn't always actively victimize women, but it consistently forgives men where it refuses to forgive those who are not men.” https://www.theverge.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : “If you get hacked at a hacker conference, well, you were warned. If you get raped at a hacker conference, well, you were warned.” https://www.theverge.com/... Alex SoojungKim Pang / @askpang : This @sarahjeong piece is great, and the detail at the end— of women using the tools that they're accused of not being competent to handle to share information about harassers— is beautiful. https://www.theverge.com/... pic.twitter.com/lSkRc3Vdt5 Sarah Jeong / @sarahjeong : Women keep asking me if anything will actually change after Weinstein. I always say yes, if only because infosec, of all f**king things, has changed. https://www.theverge.com/...
Context & Ripple Effects
This December reflection lands two months after [[a:923171|Morgan Marquis-Boire was cut loose by EFF, First Look, Citizen Lab, and other organizations]] following sexual assault allegations — the first concrete institutional consequence in a field that had long sheltered prominent men behind technical reputations.
The piece captures infosec figures like Eva Galperin and Sarah Jeong openly debating the "but he does good work" defense on Twitter, a conversation that reads differently now given what came later: [[a:883496|Marquis-Boire quietly resurfacing in 2025 as the undisclosed co-founder of crypto intelligence firm Unciphered]], suggesting the reckoning changed careers less than it changed the conversation.
First-order effects
- Organizations including EFF, First Look, and Citizen Lab have already severed ties with Marquis-Boire, converting an open secret into a public personnel decision with named institutions attached.
- Women in infosec — Tor developers like Andrea Shepard among them — are publicly weighing whether reporting abuse costs the community talent it claims to value.
Second-order effects
- Conference organizers, funders, and employers across the security field face pressure to apply the same institutional cutoff to other prominent figures rather than wait for each allegation to force a decision.
- The episode raises the price of the 'indispensable hacker' shield, making donors and partners more likely to demand accountability processes before associating with celebrity researchers.
Third-order effects
- If the pattern holds, technical contribution stops functioning as reputational currency in security — though the Unciphered reentry suggests consequences may reset when someone moves to an adjacent industry under a new venture's brand.
The trend: Infosec is moving from hero-worship of elite hackers toward institutional accountability, but enforcement remains uneven once accused figures leave the field's spotlight.