| We’re Out of Balance Posted: 06 Jan 2014 08:31 PM PST I've had several items cross my social media feeds, along with email, in the last few days that prompt me to write this. As a first post to this blog in 2014, I think it is a good topic to address. It has to do with imbalance and bad behavior in the overall field of cybersecurity: the low percentage of women, and how they are sometimes treated. Computing, as a field in the USA, has had a low and almost constantly decreasing percentage of women going into the field and staying. (The US is the primary focus of this blog entry; I believe the problem is similar in Canada, the UK, Australia, and others, but don't have the data. Also, there is a corresponding problem with other traditional minorities, but that's not what prompted this post and I hope to visit it later.). There are many reasons posited for this, many of which are likely somewhat to blame; there is no single, dominant reason, apparently. Many studies and reports have been conducted, experiments tried, and programs put into place, but few have made any measurable long-term change. The problem is almost undoubtedly rooted in social behaviors and expectations because there are other cultures where the ratio of women to men is about 1:1, or even has women in larger percentages. Cybersecurity is little different, and may be worse. I regularly speak at conferences, companies, and agencies where the room will have 30 men and one (or no) women. At events where there are speakers or panels, all the speakers and panelists are men. The few women attending often are simply the ones there processing registrations. And there are a nontrivial number of reports of women being groped and harassed at professional meetings (see, for instance, this). Also bad, women are frequently abused online as well as offline, and not only in security and computing. Many are reluctant to publish email addresses or contact info online because of unwanted, inappropriate content sent to them — no matter whether they're 8 or 80. (Right now, if you are thinking to yourself that there isn't a real problem, that things are fine, and it is all a problem of some women who can't take a joke, then you are part of the problem, and you need to shape up. Worse, if you think that women shouldn't be upset about this status quo, instead they should get back to the kitchen, then you are so out of touch that I don't know where to start. In either case, try telling that same thing to women doctors, pilots, police, firefighters, or better yet, to our many women in the military — especially when your safety is in their care. Then come back when you've healed up. If nothing else, at least keep in mind that there are legal reasons to treat people equally and with respect.) Assuming you are actually living in the 21st century, let me assure you that the overall situation is a HUGE problem for us. As a field, and as a society this is bad because we have a shortage of talent that is getting worse with time. We also have some rather skewed and limited ideas of how to approach problems that might benefit from a more inclusive pool of designers and practitioners. And as human beings we should be concerned — especially those of us who are sons, brothers, fathers, and husbands — people who could be (and sometimes are) our mothers, sisters, daughters, and wives are being mistreated and demeaned. That simply isn't right. Computing, security, privacy, creativity — those are all traits of the mind. Minds exist in all kinds of bodies, including those with other colors, more or fewer curves, different masses and volumes, varied ages, and some have less physical abilities than others. But that doesn't change what is possible in their minds! We should embrace (figuratively) and applaud ability, dedication, and imagination wherever we find it. Discouraging women (or anyone with ability) from pursuing a career in computing, abusing them online, and groping them at conferences are all counterproductive to our own futures. Cybersecurity and privacy are key areas where we need more insight and creativity — we should enhance it rather than diminish it. I'm not going to go through a longer litany of problems here, or try to analyze the situation further. I've been working with various women's groups for over 20 years and I still don't pretend to be able to understand all of what is happening. It is complex. However, I see the problem continuously when I look at our student body, when I visit professional meetings, and when I read reports. I know it is real. What I can do, is offer some advice to those who care. For Men Here are some general tips that should be common sense. Simple: be aware. Help others be aware. Don't limit your involvement to this, but everything else flows from this. Encourage your children and their friends to consider computing in school. Be supportive of anyone trying the field. Be positive and not condescending. If you are a teacher/professor, don't let the male students bully or harass the females. You are there to create a learning environment for everyone. Generally speaking, many women are less quick to respond to questions as they think about how to frame the answers, and they tend to let others speak without interruption; males generally are the opposite. Don't let anyone be interrupted when speaking, and ensure that everyone gets a chance. At a conference or professional meeting? Don't assume that the women are in less important roles than then men there! Address everyone equally. No one should be invisible. Would you want people to ignore you or trivialize what you had to say if you looked different than you do? Address the person, not the appearance. Don't ever touch a woman, without her clear uncoerced permission, in any manner that you would not touch a male authority figure. That is, would you touch your boss/professor/policeman in the same manner — without getting slugged/fired/arrested? Thus, shaking hands, fine. Catching someone if they stumble, fine. A greeting hug? Let her initiate it. Grabbing their butts? Definitely no. Use the same rule of thumb for language. Would you proposition a male policeman you just met? Be polite to everyone. Manners matter, even if it doesn't seem that way some times. Don't treat any group differently than any other. This includes not making jokes about people to others, staring, etc. That's maybe the norm in 3rd grade, but not in a professional context. If you see someone else being gropy, rude, or otherwise inappropriate, speak up. (And "Attaway, bro!" is not the thing to say.) No, you are not defending someone weaker — you are chastising someone acting unprofessionally. That is because you should also do the same for anyone acting rude to someone in a wheelchair, wearing a turban, with brown skin, with a missing limb, a lisp, or simply standing there. "Different" is not an invitation to be abusive or rude. Report it to event organizers or management, too. If you are invited to speak or appear on a panel at an event, ask who else has been invited. If they don't seem to have invited (m)any women, suggest some and don't agree to speak until they filled out the roster a little more. I have heard one good rule of thumb (which I try to follow) is not appear on a panel unless at least one woman is also on the panel. Help give other voices a chance to be heard. Can't think of any? Then either you aren't paying attention. Here's a partial list of some of the better known women in the field, all of whom I hold in great regard (and my apologies as there are many more I could list — these are off the top of my imperfect memory): Anita Jones, Dorothy Denning, Mary Ann Davidson, Window Snyder, Jean Camp, Elisa Bertino, Rhonda MacLean, Deborah Frincke, Melissa Hathaway, Chenxi Wang, Terry Benzel, Cristina Nita-Rotaru, Jeannette Wing, Cynthia Irvine, Lorrie Cranor, Cathy Meadows, Harriet Pearson, Diana Burley, Rebecca Herold, Shari Pfleeger, Shafi Goldwasser, Barbara Simons, Erin Jacobs, Becky Bace, Radia Perlman, Nuala O'Connor Kelly, Wendy Nather, Linda McCarthy, Angela Sasse, Susan Landau, Mischel Kwon, Phyllis Schneck, Carrie Gates, Katie Moussouris, Ronda Henning…. There are literally thousands more who are less senior but are likely to have interesting things to say. Simply look around. In a professional setting, don't exclude the women because you think they'll be "offended" or that they're "too sensitive." They aren't china dolls that are easily broken! Include them as part of your team and make them feel like part of it. If you're concerned that jokes or activities might be offensive, then maybe those aren't the right kind of team-building experiences you should be having. (For example, you don't need to go out for beers to the strip bar on Friday to build team presence; going out to a nearby Irish pub or a restaurant will accomplish the same thing if what you are after is a social experience.) Do the same with students if that is your context. The basic idea here is really #6. Be thoughtful and don't treat anyone as substantially different Instead, relate to every person as a professional. But most of all, speak up if you see someone getting picked on or treated badly, or if they aren't getting encouragement they should. It's like security and privacy itself — an attack on any link is an attack on the whole, and if a link falls we are all diminished. For Women There are a number of resources available to help you, professionally. Not all are likely to fit your own particular needs and interests, so check them out. If you know of some I have missed, please let me know so I can add them here. ACM-W is generally for women in computing, world-wide, and provides community and resources. There is a long list of organizations for computing in general at the Ada Project that I won't try to duplicate — I suggest you look at it. The Anita Borg Institute. The ABI sponsors the annual Grace Hopper Celebration conference, which is worth attending, plus they do a lot more in events and activities. The National Center for Women & Information Technology (NCWIT) has quite a few resources and activities. The Computing Research Association's CRA-W is devoted to women in computing research The Women's Society of Cyberjutsu is a security-focused organization for women. Both the (ICS)2 and ISSA are organizing women's groups. I have spoken with organizers at both, but am unsure of the status of either at this time. The Women in Cyber Security conference will be held in April in Nashville. I know nothing about it other than what is on their web page, but it looks like it could be a great experience. Parting Thoughts From a professional point of view, being a member of ACM and ISSA might be good idea for anyone, based simply on the value of the organizations. Both promote professionalism, community, and personal growth, and there are a variety of other benefits to membership. Society has a lot of problems with cybersecurity and privacy. New flaws show up, and old flaws don't really get fixed. Parties ranging from individual criminals to nation-state organizations are all seeking ways to penetrate our systems and mess with our information. We need every good person we can get on board and working together if we hope to make progress. Or think of it in these terms: if you can't be trusted to protect and empower those within our own community, why should anyone trust you to protect anything else? If you have any additions or corrections to the above lists, please send me private email. Also note that, as usual, anonymous or abusive feedback to the blog may not be published as is, if at all. |
