Hacking for good(2)

Now the 25-year-old Luo has his own company, LEVSON Network Technology Co, researching and developing network information security protection techniques and helping leading China e-commerce businesses, like yhd.com and dianping.com, secure their systems.

"Information security is such an important issue for e-commerce businesses, but the way some companies approach the problem depresses me," Luo said. A striking example was when Luo and his team tried to work with a well-known website but instead of looking at solutions to their problems the company's IT departments began fighting over who was responsible.

Reality not fiction

Unlike the fictional portrayal of hackers like Lisbeth Salander or Plague in Stieg Larsson's Millennium trilogy where they are seen as introverted outsiders and sport tattoos and body piercings, real-life hacker Fang Jiahong looks like any other office worker - as do all of these professional hackers.

But unlike most office workers these guys talk about mathematics during lunch breaks. And unlike the black hat crackers who are usually loosely organized and communicate through chat rooms, the white hat hackers work together professionally.

The members of the Keen Team got to know each other through their work as information security engineers at IT companies like Microsoft, Google or Intel or with security departments in major international companies like Morgan Stanley and the Dow Chemical Company.

Their shared interest in information and network security research led them to walk away from these leading companies to create their own business. "When I worked for the Microsoft security response center I could only study Microsoft's systems and software. But now my fellow workers and I have opportunities to edge into other areas including Apple's computer and mobile systems," Fang said.

Information security degrees in Chinese universities have been developing for more than a decade, and can rival degrees from foreign universities. Although many students complete these degrees like Fang Jiahong and Luo Qinglan and have the skills, very few remain working in this field.

"The job needs a lot of enthusiasm and intense concentration. Very few people can stay concentrated, reading program codes for hours on end," Fang said.

Another reason for graduates not remaining in program security is a disparity in incomes. According to Wang Huaibin, the deputy secretary-general of the Shanghai Information Security Trade Association, the annual income of information security professionals in major international IT companies can be 1 million yuan ($164,128) but the average annual salaries of researchers in Chinese institutions is about 100,000 yuan.

Back to front

Wang Huaibin said there was a back-to-front factor in starting salaries for information security graduates. Graduates from the leading universities who go to work in institutions, government departments or banks can expect an annual income of about 100,000 yuan. Graduates from second-tier universities working for security companies can collect more than 200,000 yuan annually. But self-taught "experts" with diplomas not degrees can attract 300,000 yuan annually. Some workers in IT security have no official qualifications at all but can earn as much as 500,000 yuan a year with under-the-table payments.

The anomaly stems from the way the universities structure their courses. "Although the exam scores needed to be accepted for the information security degree at Shanghai Jiao Tong University have always been the highest of all the majors over the past decade, there aren't many graduates who continue working in this area. One reason is that the degree course is mainly theoretical, but real information security work requires practical experience. We are looking at this issue and ways of encouraging young hackers who are not so successful in academic tests to join the industry."