Recognizing dark humor and cynicism
For many years, professionals who work in teams and endure stress together have found ways to bond over that stress and use it as a source of solidarity. In professions such as the fire service, military, and law enforcement this often takes the form of a particular kind of “Dark humor”. In-jokes about casework, patients and situations might seem callous but frequently stem from a need to cope with seemingly futile or hopeless situations. For example, one Paramedic I worked with in the past was frequently called to take longtime smokers with Emphysema from a care home to the hospital. These patients, on oxygen and often presenting cyanotic (pale and blue around the lips and fingertips from poor oxygenation) would be referred to as the “Smurf Brigade”.
The field of DFIR (Digital Forensics and Incident Response) shares many similarities with emergency response. Partly this is due to the nature of the work being structurally similar to law enforcement and EMS. Like emergency response, DFIR jobs bring a lot of exposure to the less appealing aspects of the world — such as the full contents of a stranger’s browser history. Those of us who do incident response are frequently called to problem-solve in moments of high stress, to manage the emotions of people having very bad days, and generally to be professional and calm when those around us are driven to be neither. Like the paramedic in a patient’s home, forensic professionals can be regularly exposed to vicarious trauma.
I’ve often seen DFIR professionals coping with these stressors by relying on one another to receive and interpret stress through humor — particularly dark and reflective humor. It’s no mistake that the unofficial mascot of infosec for several years has been a smiling dumpster fire, or that the “This is fine” meme dog resonated so well in our industry.
I believe that dark humor, while shocking to those not accustomed to this coping mechanism, is a healthy way of sharing and coping with the negative aspects of response work. It allows individual relief from stress, fosters resilience and team unity, and can be an important factor in holding things like PTSD at bay.
To quote Mel Brooks (who is an expert on both humor and tragedy), “Comedy is a very powerful component of life. It has the most to say about the human condition because if you laugh you can get by. You can struggle when things are bad if you have a sense of humor. Laughter is a protest scream against death, against the long goodbye. It’s a defense against unhappiness and depression.”
With that said, there is one big risk of dark humor to your team culture: When things are truly difficult for the team, it’s extremely easy to slip over the edge from dark humor, to open cynicism.
“Cynicism, to me, is trying to make others as unhappy as you are.” — Ricky Gervais
Differentiating between dark humor and cynicism can be very difficult. Consider the difference between these two responses to a tough situation. Imagine that your response team frequently interacts with a sales team who are a bit too lax with security when building customer demos. They like to move fast and make sales (which, by the way, pays your salary in the end!). Your team is frustrated by repeated simple security mistakes in their test environment which cause extra work for the security team. After one such event, the team commiserates in a chat:
A: “Well that was dumb. I thought we only hired the best and brightest engineers.”
B: “We did, then we kept on hiring for a while longer!”
Compare that to a different back-and-forth between the same two responders:
A: “Well, that was dumb. I thought we hired the best and brightest engineers.”
B: “We do, but they care more about making their sales commission than they care about us having to work harder. They get the money, we get the work!”
The first snarky back-and-forth conveys some humor and some frustration but is generally a solid example of dark humor, provided no one actually believes that the engineers in question are actually dumb. The second one, though, pins a specific uncaring and negative trait on the partner team. While another staff member observing the first chat might think “Haha, that was funny, but let’s see what we can do to reduce the frequency of these”, they are more likely to see the latter and not want to bother improving things, because nobody cares.
“We can destroy ourselves by cynicism and disillusion, just as effectively as by bombs.” — Kenneth Clark
While dark humor is usually a healthy venting mechanism that multiple parties partake in, cynicism isn’t even healthy for the person doing it. It’s definitely not healthy for the rest of the team to experience, and it can be particularly unhealthy for more junior team members or people newer to the team. Both less experienced staff and those who have experience but are new to your team or company are watching the general vibe of the team chats, socials and communications to figure out how this team operates and what their role is. The worst thing you can do is prime them to believe that improvement is impossible, that others in the company are adversaries, or that eagerly engaging with change won’t be valued.
Security is a long game of gradual improvement in the face of entropy. Incident Response is a commitment that we will always be there to catch the unexpected failures in the system. Both of these positions absolutely require an outlook that recognizes the inevitability of bad things and our role in making them better again. In short, cynicism leaves everyone hopeless where optimism is our most precious asset. It’s critical that security teams in general — but DFIR teams in particular — operate with optimism. People who have misaligned incentives for security or who don’t understand the impact insecurity has on the organization typically aren’t evil, uncaring, or malicious. They just need more partnership with the security organization and that partnership needs to come with a positive outlook.
Recognizing the subtle differences between cynicism and dark humor can be difficult both in the moment and over time. Here are a few tests that my peers have told me they use in their environments.
Nobody is laughing
- After the comment lands, everyone is sympathetic (or quiet) or is doubling down on the comment vs laughing / commenting with jokes or other humor.
The “Saturday Night Live” or “The Onion” test
- The writers at Saturday Night Live and the satirical publication “The Onion” are masters of satirizing a difficult topic without leaving people feeling hopeless afterward. Imagine what’s being conveyed at the moment is being conveyed as a skit on SNL or an Onion article. Would that land with an audience, or would it leave people sad and defeated?
Is it “punching up”?
- The concept of “punching up” refers to comedians being able to make fun of those in social stations above themselves and the audience, but avoiding making fun of people in a less privileged position. This concept translates pretty well to assessing corporate humor; while it can be okay to make jokes and uncharitable assumptions about the motivations of top executives, those same jokes about peers or other teams you support could still be damaging to morale and teamwork overall.
“Inside every cynical person, there is a disappointed idealist.” — George Carlin
In my experience so far, this is the kind of team culture issue that is extremely easy to miss and overlook by everyone because it creeps up in non-obvious ways. Things that are funny at first become unfunny over time through repetition, or things that begin as a quick vent about a negative trend are reinforced through repetition until they are no longer a quick vent, but a sustained outlook. I’ll call this effect “Cynical drift”.
To keep cynical drift at bay, it’s critical for both management and technical leads to talk to one another and arrive at the same understanding of where the team will draw the line, how to recognize it, and then continually act to spot and correct it when it happens. It is key for the team leaders to explain to everyone how to differentiate dark humor from cynicism and put in place clear expectations for the team’s culture. Team members cannot continue to be cynical (this is a job expectation), but this should be pursued through compassion and not correction or performance management.
A side discussion with team members who have drifted too far in one direction is likely to reveal specific stressors that don’t feel resolvable to them. This isn’t the time to lecture someone — it’s time to help the individual and/or the team identify the things that feel unwinnable and find ways to either plan for how to address them, or come to terms with their inevitability (e.g, there will always be more incidents). There’s a lot that can go on here to help — rotations onto different teams if possible, or dropping out of an on-call rotation for a time if staffing allows. I’ve also been encouraging folks to take much longer (3 weeks or more) vacations to truly disconnect, and have recently led by example and taken a 2 month summer leave.
Only as a last resort, when a team member has worked with their manager and both have concluded that the person is irrevocably burnt out, should the conversation turn to how to find them a new role where optimism and their love of the job can begin to grow again. As leaders, we owe it to our team members to help ensure that the team has a healthy attitude and outlook. We also owe it to them to provide the support necessary for that attitude to exist — this is part of providing a psychologically safe workplace! Learning to spot the difference between dark humor, healthy venting, and damaging cynicism is a difficult but necessary part of leadership for any operational response team.
Post-script note: The “Dark humor” referred to throughout this article means jokes and humor about the profession, about the casework, etc. It’s quite hard to define and often falls into the ‘you know it when you see it’ category. I want to explicitly point out that racist, sexist, mean, and biased “jokes” are not dark humor, nor are they humor. They’re just mean and unacceptable in any team.
