Ross Anderson, two years gone

It’s been nearly two years since Professor Ross Anderson died, and a recent conversation with a friend nudged me to finally write what I kept in my head since then.

I got to the Security Group at Cambridge thinking I was a star, only to find that I was the dumbest person alive. My PhD supervisor was the brilliant Markus Kuhn, but my side hustle was finding vulnerabilities with banking-related hardware, which was more of Ross’s passion. I ended up writing a number of papers with Ross, and colleagues from the group, about banking security whilst I was researching for my dissertation on ‘FPGA security’.

Ross was a one-of-a-kind larger-than-life intellectual and communicator, and many, more qualified than me, have written about him, his abilities and achievements. I will focus here on two aspects of my interactions with Ross.

⁂

Once you were accepted into the group, Ross also accepted you as an academic family member, no matter how you ended up performing. As I slowly built my confidence back, often saying and writing silly things, I never got any sign of frustration, disappointment, or anger from Ross. The worst I remember is him crossing out paragraphs in paper drafts and writing that “obide isn’t a word!” Embarrassing. He championed my work to external people even though it wasn’t all the way ‘up there’ and I knew that he helped others who struggled even more than me.

He didn’t know it, but I clung onto that acceptance. I was unnerved, but also thrilled, when he appeared in my office to field new thoughts, even though I was just there to listen and nod… fearful of mumbling something incoherent1. It gave me hope that maybe maybe I can make it through after all, if someone like him uses me as a sounding board. This was good leadership (even though our group did not have hierarchy, and he wasn’t my supervisor).

As an immigrant in the UK, this familial feeling made me certain that if I ever got in trouble, he’d be the first person I could call and leave it with him.

⁂

Ross was an unbelievably gifted author. He consumed a lot of literature, digested it, and it seemed to me that what then yielded through his fingertips was already the final version. No drafts, no revisions. I still can’t even imagine how that’s possible. Whilst I’m not even remotely close to being able to convert my thoughts to paper like that, some things rubbed off on my writing style.

What I keep recalling as I write is to replace statement qualifications and caveats with the word ‘may’. (I still remember Ross crossing out text and saying “may” in his Scottish accent.) The temptation is to make a statement and then qualify it to the level of tightness such that reviewers can’t ding it as inaccurate or false. The problem is that this adds fluff on the way to the main point of the article… so just saying ‘may’ preempts any possible objections. It’s super effective and I loved it!

Here’s an example from our Chip and PIN is broken paper:

For offline transactions, the issuer will not be contacted until after the transaction has been completed, so has even less ability to detect the attack. Some cards may refuse to authorize an offline transaction without having successfully verified the PIN.

We don’t go and spell out all the different ways cards authorise transactions… they ‘may refuse’… and we move on to the bigger point.

⁂

Of course there’s a lot more: a trip to Canary Wharf to cut a banking authority down to size; TV appearances and interviews; courtrooms; demoing to Nick Clegg; and dinners at Shireen and Ross’s place.

I’ve recently learned that the third, and latest, edition of his seminal book, Security Engineering, is freely available. Please have a read through some of the chapters, even if you’re not into security, just to enjoy the accessible writing, and the breadth and depth of knowledge that Ross had, and that is certainly already missed; I’d particularly would have loved to hear his takes on the current state of AI.