Last week, the NSA announced the winner of its first annual Science of Security Competition, an event designed to honor important research in cybersecurity, increase NSA collaboration with academia, and “build the science base of national security efforts.” That competition’s top honoree, Dr. Joseph Bonneau, says he wants to see the NSA “abolished” if serious reforms aren’t put in place.
ANIMAL interviewed Bonneau, now an engineer at Google, after coming across his conflicted responses to the award on Twitter and in a blog post.
You’ve been pretty vocal in your criticism of the NSA after winning the award. On Twitter you said you “want it abolished.” Is that true?
I’d rather have it abolished than persist in its current form. I think there’s a question about whether it’s possible to reform the NSA into something that’s more reasonable.
I don’t really do politics for my day job. I don’t feel like I follow the situation as closely as a lot of people who are writing about what kinds of reforms are needed, or how things might need to change. But my feeling based on what I’ve read is that I don’t want to live in a country with an organization like the NSA is right now.
But I wouldn’t rule out the possibility of reforming the current NSA to a better place. As I’ve said, I think our core problem are political and much bigger than the NSA.
What’s the nature of your work, and the nature of the paper the NSA honored?
My research was about building tools to compare distributions of passwords chosen by two different populations, and the application of those tools through a bunch of big data that I collected while I was an intern at Yahoo. I came to a couple of insights about how different groups of people pick passwords.
So, say you have a bunch of passwords chosen by men, and another chosen by women. Which of these two sets of passwords is actually harder to guess?
They were trying to recognize efforts to bring more hard science, more sound science to cybersecurity research. It didn’t really have a lot to do with anything that’s been in the news recently–nothing to do with surveillance or anything like that.
How did you feel when you first found out that you won?
I had to go sit and think for a while if this is something I wanted to accept. I really considered turning the award down. I talked to some colleagues, some friends, and things like that.
One conflict is that it’s nice to have your work recognized, and most people do academic research because they think the topic is important. Publicity is important for increasing the impact of your research.
Given my beliefs and my thoughts about the NSA, it was bittersweet in that I wasn’t sure of the best thing to do. But I decided that the reason they set up this award was to try to have more collaborations with academia, and be a little less closed off. They probably have a long way to go, but it seemed like there was more value in me engaging with them than in not.
I’m able to express my opinions as freely as i was before. It would be another story if i was taking a research grant or something, or i had some other obligation to them. It was an award. We basically had lunch for the afternoon and met a few people, and that was the extent of it.
Was the event friendly?
Yeah, it was. There were two other researchers there whose papers were honorable mentions for the award, as well as a couple of people who had participated in the selection process, so there were a couple of other academics who were outside the NSA there, and there were some NSA insiders. It was a good time. despite the vast political differences, I had interesting research conversations with the people I met.
Did you actively submit the paper, or did they find it on their own?
They had an academic panel who made nominations for the award. I don’t know who could have nominated the paper. Honestly I never had heard of the award until I found out my paper got picked.
