Psychic Hacking: New Threat or Old Remote-Viewing Claims Repackaged?
A new experiment claims psychics can steal data from secured computers. But does the evidence really show that a laptop was hacked?
The laptop had no internet connection. Its wireless functions had been disabled, its screen was darkened and covered, and the machine was kept at a fixed location in Los Angeles. Stored inside it were several pieces of information: a photograph, a four-digit ATM PIN, and a passphrase. A silent video was also playing on the computer, although only the researchers knew this.
People around the world were then invited to describe this hidden information using remote viewing.
Remote viewing: the claimed ability to describe a person, place, object or event that is hidden from view, sometimes at a great distance, without using the ordinary senses or receiving information through normal means. It is generally considered a form of extrasensory perception, similar to clairvoyance.
This is the premise of a recently published paper titled Psychic Hacking: Using Remote Viewing to Steal Computer Data. The experiment involved 146 participants, who produced 584 free-response attempts. The paper reports statistically significant results for photographs, videos, and some parts of the PIN test. It argues that remote viewers may be able to access information stored on computers, even when those computers are protected from ordinary forms of access.
It’s an attention-grabbing idea, right? It sounds like an old Cold War remote-viewing experiment rebuilt for the age of cyberattacks.
However, for this to qualify as some sort of computer security issue or hacking, there is one big question that has to be considered: Did anyone actually steal information from a computer? I don’t think the answer is yes.
Was it really hacking?
The computers were disconnected from networks, and new targets were selected and displayed using automated processes. Neither the participants nor the researcher knew which targets had been chosen at the time the remote-viewing attempts were made.
These measures were intended to prevent information leaking through normal means, and that’s good experiment design. It would be unfair to dismiss the research as nothing more than people guessing a picture while somebody nearby already knew the answer. The problem is that preventing ordinary access to the computer is only one part of the test.
No participant opened a file, broke a password, or gained control of the machine. Instead, they wrote down words, ideas, sensations, and drawings. Human judges later compared those impressions with several possible targets.
This is much closer to a traditional free-response remote-viewing experiment than a cybersecurity test.
The word “hacking” creates an impression of successful access. In computer security, however, a stolen PIN normally means that somebody has recovered the correct digits in the correct, usable order. A stolen password must be accurate enough to work.
A vague impression that contains some related ideas is not normally enough to compromise a system. As such, this is still recognisably a remote-viewing experiment, and calling it “data theft” gives the claim a modern cybersecurity edge, but it does not make the information any more exact or usable.
How the judging worked
The participants did not have to name the exact photograph hidden inside the computer. Instead, they produced free-form impressions.
Three judges were then shown each submission alongside five possible targets: the real target and four decoys. They ranked these choices according to how closely they thought each one matched the participant’s description.
Some kind of judging system is unavoidable here. If participants are producing sketches, sensations, and loose descriptions, the researchers need a way to compare them with the target. However, the difficulty that stands out to me most is that the decoys were deliberately chosen to be unlike the real image which carries some issues.
The paper explains that if the real target showed a horse, for example, the four alternatives would be selected from categories other than animals. The judges might therefore be choosing between a horse, a building, a person, an abstract image, and a landscape rather than between five reasonably similar animal photographs.
This could make broad descriptions look more impressive than they really are. For example, imagine that a participant writes: Outdoors. A large shape. Something natural. Possibly brown.
Those impressions might lead a judge towards a horse if the alternatives were a cathedral, a colourful abstract pattern, a human face, and a kitchen appliance. The same description would be much less useful and harder to count as a success if all images showed large animals outdoors which were brown.
A test is more convincing when the correct answer must be separated from realistic alternatives. Ultimately, the question is not only whether a description can be made to fit the real target but whether it fits that target clearly better than it fits other plausible targets.
But the results were better than chance, right?
This is where the results begin to look rather different than the bold headline claims. Across the complete first round of judging, the judges placed the correct target first 18.43 per cent of the time.
Because there were five possible targets, chance performance would be 20 per cent, so the overall first-choice result was slightly worse than chance! To be fair, the paper reports this openly and argues that its main statistical method also considered the full ranking of all five images, rather than looking only at which image was placed first.
However, then came a second judgement stage which produced rather more dramatic results. Picture, video, and passphrase submissions only moved into this stage if at least two of the three judges had already placed the real target first. PIN attempts advanced if they contained at least two correct digits.
This left 92 selected submissions from 548; 23 involved pictures, 18 involved videos, 32 involved PINs, and 19 involved passphrases. A referee then examined those 92 submissions in more detail, awarding points for both concrete and abstract matches.
This bothers me a lot.
The paper refers to this move from first to second stage judging as a “winnowing process” which intended to identify participants showing promise. While this can be perfectly legitimate as a screening exercise where you use one experiment to find unusually successful remote viewers and then invite them back for an entirely new experiment, that is not what happened here.
The second phase returned to the same submissions and the same targets, with a referee awarding points for concrete and abstract similarities. It therefore was not an independent test of whether the promising participants could do it again, it just used the best results from the first stage of judging and discarded the rest.
Remember, across the complete first judging stage, the correct target was ranked first only 18.43% of the time, compared with the 20% expected by chance. Yet after the successful-looking submissions were filtered out, the paper reports highly significant results for the selected picture group.
This second stage of judging feels uncomfortably close to cherry-picking data to create better looking results. That is not necessarily deliberate manipulation, but it is difficult to separate from cherry-picking. That second stage should have involved new targets and new attempts or should not have existed at all.
When an answer can match more than one target
The hidden video creates another difficulty.
Participants were told to describe the photograph, PIN, and passphrase, but they were not told about the silent video. Their picture descriptions were later compared with still images taken from those videos.
Although I can see why this possibility interests the researchers, it also creates a serious testing problem: how far away from the actual target can a description wander before it stops counting as a hit?
One set of impressions could potentially be considered against both the known photograph and an unknown video target.
For example, one video target was a scene from The Shining. A participant reported ideas including blood and a heartbeat. Neither appeared in the short clip used in the experiment, but both were connected with other parts of the film. Another participant mentioned a mother on holiday in a mountain location. Again, this described the wider story of The Shining, but not what appeared in the actual target clip.
The paper suggests that the remote viewers may have followed connections leading away from the target and into the wider film. Perhaps… but there is another, more ordinary possibility. The definition of a match may simply have expanded after the answers were known.
Once judges can count details from the target, the wider film, nearby material, symbolic ideas, and related concepts, it becomes increasingly difficult for an impression to count as a clear failure.
It would be a mistake to assume this immediately means something dishonest or underhand is going on. People are extremely good at finding connections, particularly once they know what answer they are looking for. A vague comment can suddenly appear specific when placed beside the right image or story.
The more flexible the conditions for a match to count become, the easier it is for ordinary coincidence and interpretation to resemble extraordinary perception, and this is something which becomes clearer when we move from pictures to PINs.
The paper reports significant results when participants guessed two or three digits that appeared somewhere in the correct PIN, even when those digits were not in the correct order. There was one attempt containing three digits in their precise positions, but the paper treats this isolated result as anecdotal rather than proof of a reliable effect.
There’s a big difference between finding partial patterns and stealing usable data. As I’m sure you’ve already spotted, knowing that a four-digit PIN may contain three particular numbers may reduce the number of guesses somebody needs to make, but it is not the same as retrieving the PIN, and it still involves more guesses than an ATM would allow. Significantly more, in fact (as anyone else who has forgotten a PIN will be know).
A convincing “psychic hacking” experiment should define success before data is collected, just as any experiment should. For a PIN, that might mean recovering all four digits in the correct order. For a passphrase, it might mean producing the exact phrase or meeting another strict, predetermined standard.
The result should also be repeatable. One striking guess among hundreds of attempts does not show psychics can reliably threaten computer security.
What would a stronger test look like?
A more convincing follow-up would need a clearly registered method and one main measure of success. Every attempt should be included in the final analysis with picture decoys similar enough to test real discrimination, and the rules for deciding what counts as a match should be fixed in advance.
PINs and passwords should be judged by exact accuracy rather than general resemblance. The anonymised responses, targets, rankings, and analysis should also be made available so independent researchers can check the results.
Ideally, the experiment would be designed jointly by remote-viewing researchers, sceptics, statisticians, and computer-security specialists. That would not guarantee a negative result but it would make either result easier to trust.
The study may provide ideas worth testing again but it does not yet show that psychics can reliably steal protected computer data or that cybersecurity professionals need to defend machines against remote viewers.
Before worrying that psychics can breach an air-gapped laptop, we should first focus on making sure ambiguous guesses cannot breach the safeguards of the experiment itself.