Pablo de la Riva Nov 6, 2018 10 min read

The Flow state: Hacking for hacking’s sake

Paul Graham, one of the foremost experts and educators on the hacker phenomenon, talks about how two of top hackers’ main traits are their curiosity and their capacity for concentration. Hackers are tremendously curious about how things work; this is linked to their ability to program, which basically amounts to making something do what you want it to.

Curiosity is a very interesting cognitive process associated with the areas of the brain that are linked to obtaining rewards and learning. In other words, curious people learn better and obtain pleasurable feelings from that interest.

On the other hand, hackers have great capacity for concentration, for focusing all their attention on a single task, which allows them to optimize limited perceptive and memory resources. Concentration also stimulates the production of alpha, beta, theta and delta waves, which are associated with creativity and problem solving. Both aptitudes are very relevant to the hacker's activity.

These traits give us an excuse to focus on a topic that hasn't been addressed much to date, perhaps because it is so new: hacker psychology. Specifically, its motivational aspects. Albeit, there are more and more studies analyzing research on psychological processes having to do with new technology-related areas and phenomena, but there is no question that this is a study area that must be deepened, from a psychological and sociological perspective. There is a reason we are discovering phenomena stemming from people's recent massive interaction with new technologies, mainly the use of internet, and where we are ill prepared to handle the negative repercussions they may have. The growing power of “hacktivism”, virtual interactions and cybercrime are examples of this kind of phenomena.

However, to return to the subject of this post, we can use currently existing knowledge in psychology to delve into hacker behavior. Specifically, Csikszentmihalyi's Flow Model may serve to better see the motivations behind the hacker phenomenon and help us understand a particular way of behaving that has even become a subculture in and of itself.

The term Flow has been defined by Csikszentmihalyi as “a state in which someone is completely absorbed in an activity for their own pleasure and enjoyment, during which time flies, and actions, thoughts and movements flow uninterruptedly”; it is an “optimal experience, those times when people report feelings of concentration and deep enjoyment with high interest in the activity.” This definition encompasses the top hacker traits that Graham talked about: concentration and fascination with the task, which can be connected very easily with curiosity and, in this area specifically, with the Geek concept.


To understand Flow we have to start by talking about motivation as a core element.

Motivation may be defined as the force-energy that favors the start of a behavior; that which moves us to act, to do something. Our every behavior is motivated, and there is an identifiable reason for everything we do; something that pushes us to do it.

When a hacker is programming for hours in front of a screen, barely eating or drinking, we can consider several motivational alternatives for this behavior.

  • One of them may seem obvious if we look at it in the context of cybercrime—the economic motive. Profit, money or whatever name we give it. Today, a good hacker can make a significant economic profit whether doing their work legally (analyzing a company’s security vulnerability, for example) or doing it illegally, using those vulnerabilities to crack a system. This is what is called extrinsic motivation in psychology, where the source of motivation is external to the subject (to put it simply); the thing pushing that person to act is something outside them.
  • Another example of extrinsic motivation could be social recognition, from the hacker community for example, for doing something singular. These are very common motivations that are often associated with the hacker world; however, although they are important and very relevant for explaining this phenomenon, they are possibly not the most representative of the motivations found among top hackers.

For the most part, hackers are born into and develop in a very private, solitary context, in which they teach themselves. Learning hacking is often a very individual task that permits certain levels of interrelation but where in general the subject is alone in front of their computer. Along with this, hacking also has a high self-education component, individual self-learning, where the hacker acquires new skills and knowledge that bring them increasing expertise.

  • It is this context that allows us to examine another kind of motivation, intrinsic motivation, which can be defined as the need to act because of curiosity; the pure pleasure of obtaining skills and self-fulfillment, even after having achieved a goal and without any need for external gratification (extrinsic motivation).

In this case, the activity takes place in a mental state that doesn’t contemplate reward, even when the activity represents a major investment of energy or effort. If we return again to the example of the hacker who is programming for hours while barely eating or drinking, this time we can analyze his or her behavior from the standpoint of intrinsic motivation. According to Deci and Ryan (1985) , there are 3 types:

  • Intrinsic motivation toward knowledge, for the pleasure of learning.
  • Intrinsic motivation toward accomplishment, to improve oneself.
  • Intrinsic motivation toward stimulation of one’s own senses.

Any hacker may see themselves reflected in these motivations when they enter the world of hacking. The hacker begins to understand the rules of hacking, as if it were a game; they acquire skills and achieve objectives in a circular improvement process. This positive feeling of learning creates a perception of competency and self-confidence, which “rekindles” the intrinsic motivation process. This is the moment when the hacker reaches the Flow state. In this state, hacking isn’t the means to any end—it is an end in and of itself.

This combination and balance between a task’s challenge and the skill that the hacker begins to acquire is what leads to the state of pleasure, fun and self-fulfillment.

Evidently, these consequences mean that the hacker repeats the behavior and maintains it for long periods of time, which allows them to attain high levels of the concentration we talked about at the beginning of the post.


If we go back to the example of the hacker programming for hours, barely eating or sleeping, and we look at it from this flow perspective, we can now make a deeper and more complete analysis of their behavior. And being able to analyze the behavior of a subject or group of subjects enables us to predict it and influence it, where applicable.

If we can manipulate the skill and challenge variables, we can influence the behavior and that could have different practical applications, depending on our interests. For example, we can adapt tasks and settings to get the hacker “into the zone”, but it may also be in our interest to keep them in a relaxation zone or anxiety zone in some cases.


In conclusion, behavior is a reflection of how a person functions. Through knowing it, like a hacker knows their program or a system, we can understand it, which in turn leads us to another possibility: that of being able to hack it.


Pablo de la Riva

Pablo de la Riva founded his first company when he was 21 years old – a security consulting firm – and Revelock was his first software startup experience. He has been working in the anti-fraud sector for almost 15 years, first as a cyber-security analyst, then as a team leader, later as CTO with almost 200 people reporting to him and now as CEO.