Please read the following before sending me email asking me to be your Supervisor. Due to the volume of email, I cannot personally respond to all inquiries. I almost always am able to respond to potential students already in Canada, or who can provide references from colleagues that I regularly interact with (e.g., I know many security researchers in the U.S. and Europe).

If you send me an email asking me to be your Supervisor (and to fund you) before reading this page, my first impression will be that you are not seriously interested. Taking a few minutes to explore information available on my web site, directed specifically to you, provides an indication that you have some basic research skills.

"Will you be my (Master's, PhD) supervisor or post-doctoral host?" and related questions

I supervise students interested in research addressing practical aspects of computer and Internet security, typically at the graduate level (some undergrad students distinguish themselves). For potential grad students, I have a strong first preference for domestic Canadians or permanent residents, whom I am particularly interested in for the very pragmatic reasons that this makes you eligible for major Canadian scholarships, and/or allows you to avoid very high international tuition fees for Master's students (tuition is reduced to about domestic levels for international PhD students). If you are an international student, holding equivalent scholarships from your home country is equally valid as evidence of academic distinction. Due to my inability to otherwise differentiate the many candidates I've never met, another natural but coarse filter is a preference for students with an A grade average. Your background (aside from an interest in computer security) should include several of: operating systems, data networks and protocols, programming languages, web programming, and human-computer interaction (to support usable security research).

Before asking me to be your Supervisor or for a letter of reference, please read the following typical questions I get, and act accordingly.

Q1: Can you write me a letter of reference? (I am a student)
If I am personally familiar with your work, I will be happy to try to accommodate your request. I can usually do this within two weeks of receiving the information listed below. If you require more than one letter, I will write a generic "To Whom It May Concern" letter. Please provide me details on:

1. the position or scholarship you are seeking;
2. the recipient's contact details as you would like them to appear on the letter header; and
3. a hard copy of any instructions or forms to be filled out (highlight any criteria which those receiving the letter expect it to address).
   I will also need:
4. up-to-date copies of your transcripts (undergraduate and graduate); and
5. your cv or resume including all degrees, publications and experience (highlight your experience in software security and applied cryptography).

Q2: Will you be my Master's or Ph.D. supervisor?
My objective is to take on the most promising students, and to do excellent work with them; there are few things that make academic life more rewarding. While my first priority is to my existing graduate students, I would like to believe that I always have room to take on additional exceptional students. However, there are many issues to consider, as discussed under several cases below. (Of course, if I have never met you, you are from a foreign country, and we have no common acquaintances, Q2 is a strange question to ask by email---e.g., how would I verify the integrity of any claims made by you or any of your references? As a prospective security student, you should appreciate the irony of such a request.)

Domestic grad students: If you are a Canadian citizen or permanent resident of Canada, please do send me email. While not essential, it may help to also complete this information form, and also indicate that you have read this advice page. This will avoid wasting the time of me requesting the same information over several emails. Your email may outline any unique background that you have. Prospective PhD students should mention: who you worked with (e.g., Master's supervisor), publications, and your background in information security (if none, indicate why you think you will succeed nonetheless). Please note: you typically must apply for major Canadian scholarships (e.g., NSERC, OGS) 8-12 months in advance of your starting term. If you have not distinguished yourself academically to date, tell me why you believe you nonetheless have the potential to succeed as a security Ph.D. student.

International grad students Case 1: You are applying for a Master's degree (or are already in our program at Carleton).

• If you are a truly exceptional international student, and can partially fund your own studies (see Q4 below), read on; for all others I recommend that you apply to your local universities, and I apologize that we are unable to respond to you individually. Truly exceptional means that you have achieved an A or A+ grade average and, e.g., finished at the top of your class in your country's top university; have strong recommendations from someone whom I personally know or trust; or have excellent industrial experience in security. To get a response, you must complete this information form, which will be read by me and/or the other professors in the two security labs (CCSL and CISL) in Computer Science at Carleton.
• Otherwise, I advise that you gain admission based on your good academic record, using your own funding, and with no advance promise of supervision. In your first 4-8 months in the program, distinguish yourself through your coursework, and acquire a solid background in security, including attendance at security seminars and talks. After this time, update me on your progess and continuing interest; we will then have a basis for discussion.

Please note that whether you qualify for admission to the university, for either a Master's or a Ph.D. program, is not determined by individual professors, but rather by other university administrators upon reviewing your formally submitted application package. Any formal offer of admission will come from the university, not from individual professors.

International grad students Case 2: You are interested in a Ph.D.

• In addition to admission by the university (see above), a faculty member must agree to be your supervisor before you will be admitted to Carleton's Computer Science Ph.D. program. To help me and/or my peer professors in our security labs (CCSL and CISL) make such a long-term commitment (e.g. 3 to 5 years), we require that you complete this information form. The form will capture your contact information (email address), university background, etc. If you have no information security background, you are unlikely to get a response from us. Please note also that for admittance to our Ph.D. prorgam, you require not just a Master's degree, but a thesis-based Master's degree (in Computer Science or Engineering). I generally expect that before entering a Ph.D. program under my supervision, you will already have significant practical or academic background in security (otherwise, there is little reason to believe that you will be willing to commit 3-5 years of your life to studying this area).
  
  If I find the information on your completed form is promising, I will contact you by email. I then often ask the following to explore further:
• (Determination of common research interests) Select one of my recent papers which you find interesting and tell me why. Provide some insightful comments or suggestions for extending the research.
• (Funding and financial support) Of the many possible funding arrangements, tell me your plans or expectations (see Q4 below). Unfortunately, it is unrealistic to expect full funding support, given the cost of living aside from tuition fees.
• (Making a long-term supervising commitment) It is impossible for me to have high confidence that there will be a good working relationship without having met you, heard you present (e.g. at a conference), or seen some of your work (e.g. in a course, a report or research paper). I typically take on a PhD student only after gaining a high degree of confidence that they will succeed, e.g. requiring that they distinguish themselves through course work (ideally taking a course with me as a Master's student), or someone I trust recommends them highly. Reference letters from people whose names I do not recognize and/or whom I do not know personally are of limited value.

Q3: Can you host me for post-doctoral research in the area of security?
I would be delighted, if there is a good fit. I assume that we have previously met at a conference or elsewhere (or that I know your current supervisor sufficiently well to trust their recommendation), that your research is in an area in which I am active, and that you will either be bringing with you some base funding (e.g. NSERC post-doctoral scholarship), or will be interested in participating in project research to help fund your stay. Tell me what types of research you do, how it complements my own or that of our group, and what your funding arrangements or needs are. If we have never met and I don't know anyone that you have been working with, then I usually can't do more than wish you luck (to get things started, I almost always need a recommendation from someone whom I know, or know of). If you are a post-doctoral candidate, but your research to date has not involved computer and Internet security, then I would suggest that you apply elsewhere, as I naturally prefer post-docs capable of mentoring my grad students and contributing directly to my research program.

Q4: What overall costs (international tuition fees, living expenses, etc.) should I plan for?
To estimate international tuition (also domestic) and other living expenses, see the estimator tool at: Costs and Fees (for International Students). The tool estimates tuition for a 4-month term, and thus should be adjusted for three such terms per year; in Carleton's School of Computer Science (SCS), grad students typically must enroll year-round to do their research. For example, the tool indicates that as of Sept 2019, international tuition for a graduate Computer Science student exceeds CAD 7,000-8,000 per four-month term (e.g., CAD 24,000 per year) with a Master's degree typically 5-6 terms (e.g, 2 years), and a PhD 3-4 years or more. If one estimates basic living expenses (accommodation and food, excluding travel) at CAD 16,000/year, annual expenses may then be CAD 40,000 or more. Realistically, this puts a graduate research degree at Carleton beyond the reach of many otherwise well-qualified prospective international sutdents, unless they have quite significant personal or family support (in addition to grant funding from a Supervisor). In May 2020, it was announced that for international PhD students who do not receive support from a government or agency, tuition fees at Carleton will effectively be reduced to the level of domestic tuition, as of September 2020---details are on this page.

Q5: I am currently a Carleton student and need help with [writing style, English grammar, etc.]. Or: I would like to be your graduate student but I find English to be challenging - is this important?
A: I recommend you start by consulting a suitable Writing Tutorial Service (at many universities, such a service is free to enrolled students) and explore any available courses on communications skills for science or engineering students. I believe extreme clarity and precision in both written and verbal communications is required in order to be a successful computer security researcher. Regarding IETLS (International English Language Testing System), I seek prospective students with an overall score at least 6.5 and preferably 7.0 (borderline component scores of 6.0-6.5 present a risk to succeeding in my computer security program).

Q6: Cryptography is my passion. My life's dream is to study this subject under your guidance. I will work day and night to please you. Is this possible?
Not with me. For over 15 years now, my research has been in computer and Internet security---and for this, strong background in applied cryptography is indeed helpful, but cryptography is no longer my research focus. Your question is a signal that you have not taken the time to do background review for something for which you are about to dedicate 2-5 years of your life (for a Master's and PhD, respectively). I suggest that spending a bit more time reviewing the research interests, and publications pages of potential supervisors, would help make a more convincing case that you are serious. Similarly, if you ask whether I can supervise you for an engineering degree---for that you would have to enroll in an engineering department (I am employed in a School of Computer Science), but I may co-supervise engineering grad students.

............. Last updated: June 2020