Please read the following before sending me email asking me to be your Supervisor. Due to the volume of email, I cannot personally respond to all inquiries. I am most likely to respond to potential students already in Canada, or who can provide references from colleagues that I regularly interact with (e.g., I know many security researchers in the U.S. and Europe).

If you send me an email asking me to be your Supervisor (and to fund you) before reading this page, my first impression will be that you are not seriously interested. Taking a few minutes to explore information available on my web site, directed specifically to you, provides an indication that you have some basic research skills.

"Will you be my (Master's, PhD) supervisor or post-doctoral host?" and related questions

I supervise students interested in research addressing practical aspects of computer and Internet security, typically at the graduate level (some undergrad students distinguish themselves). For potential grad students, I have a strong first preference for domestic Canadians or permanent residents, whom I am particularly interested in for the very pragmatic reasons that this makes you eligible for major Canadian scholarships, and/or allows you to avoid very high international tuition fees for Master's (but not PhD) students. If you are an international student, holding equivalent scholarships from your home country is equally valid as evidence of academic distinction. Due to my inability to otherwise differentiate the many candidates I've never met in person, another natural but coarse filter is a preference for students with an A grade average. Your background (aside from an interest in computer security) should include several of: operating systems, data networks and protocols, programming languages, web programming, and human-computer interaction (to support usable security research).

Before asking me to be your Supervisor or for a letter of reference, please read the following typical questions I get, and act accordingly.

Q1: Can you write me a letter of reference? (I am a student)
If I am personally familiar with your work, I will be happy to try to accommodate your request. I can usually do this within two weeks of receiving the information listed below. If you require more than one letter, I will write a generic "To Whom It May Concern" letter. Please provide me details on:
  1. the position or scholarship you are seeking;
  2. the recipient's contact details as you would like them to appear on the letter header; and
  3. a hard copy of any instructions or forms to be filled out (highlight any criteria which those receiving the letter expect it to address).
    I will also need:
  4. up-to-date copies of your transcripts (undergraduate and graduate); and
  5. your cv or resume including all degrees, publications and experience (highlight your experience in software security and applied cryptography).
Q2: Will you be my Master's or Ph.D. supervisor?
My objective is to take on the very best students, and to do excellent work with them; there are few things that make academic life more rewarding. While my first priority is to my existing graduate students, and there are only a fixed number of hours in every day, I would like to believe that I always have room to take on additional exceptional students. However, there are many issues to consider, as discussed under several cases below. (Of course, if I have never met you, you are from a foreign country, and we have no common acquaintances, Q2 is a strange question to ask by email---e.g., how would I verify the integrity of any claims made by you or any of your references? As a prospective security student, you should appreciate the irony of such a request.)

Domestic grad students: If you are a Canadian citizen or permanent resident of Canada, please complete this information form, and then send me email saying that you have done so AND have also read this advice page. This will avoid wasting the time of me requesting the same information over several emails. Your email may outline any unique background that was not captured on the web form. Prospective PhD students should mention: who you worked with (e.g., Master's supervisor), publications, and your background in information security (if none, indicate why you think you will succeed nonetheless). Please note: you typically must apply for major Canadian scholarships (e.g., NSERC, OGS) 8-12 months in advance of your starting term. If you have not distinguished yourself academically to date, tell me why you believe you nonetheless have the potential to succeed as a security Ph.D. student.

International grad students Case 1: You are applying for a Master's degree (or are already in our program at Carleton).
Please note that whether you qualify for admission to the university, for either a Master's or a Ph.D. program, is not determined by individual professors, but rather by other university administrators upon reviewing your formally submitted application package. Any formal offer of admission will come from the university, not from individual professors.

International grad students Case 2: You are interested in a Ph.D. Q3: Can you host me for post-doctoral research in the area of security?
I would be delighted, if there is a good fit. I assume that we have previously met at a conference or elsewhere (or that I know your current supervisor sufficiently well to trust their recommendation), that your research is in an area in which I am active, and that you will either be bringing with you some base funding (e.g. NSERC post-doctoral scholarship), or will be interested in participating in project research to help fund your stay. Tell me what types of research you do, how it complements my own or that of our group, and what your funding arrangements or needs are. If we have never met and I don't know anyone that you have been working with, then I usually can't do more than wish you luck (to get things started, I almost always need a recommendation from someone whom I know, or know of). If you are a post-doctoral candidate, but your research to date has not involved computer and Internet security, then I would suggest that you apply elsewhere, as I naturally prefer post-docs capable of mentoring my grad students and contributing directly to my research program.

Q4: What overall costs (international tuition fees, living expenses, etc.) should I plan for?
To estimate international tuition (also domestic) and other living expenses, see the estimator tool at: Costs and Fees (for International Students). The tool estimates tuition for a 4-month term, and thus should be adjusted for three such terms per year; in Carleton's School of Computer Science (SCS), grad students typically must enroll year-round to do their research. For example, the tool indicates that as of Sept 2019, international tuition for a graduate Computer Science student exceeds CAD 7,000-8,000 per four-month term (e.g., CAD 24,000 per year) with a Master's degree typically 5-6 terms (e.g, 2 years), and a PhD 3-4 years or more. If one estimates basic living expenses (accommodation and food, excluding travel) at CAD 16,000/year, annual expenses may then be CAD 40,000 or more. Realistically, this puts a graduate research degree at Carleton beyond the reach of many otherwise well-qualified prospective international sutdents, unless they have quite significant personal or family support (in addition to grant funding from a Supervisor). In May 2020, it was announced that for international PhD students who do not receive support from a government or agency, tuition fees at Carleton will effectively be reduced to the level of domestic tuition, as of September 2020---details are on this page.

Q5: I am currently a Carleton student and need help with [writing style, English grammar, etc.]. Or: I would like to be your graduate student but I find English to be challenging - is this important?
A: I recommend you start by consulting a suitable Writing Tutorial Service (at many universities, such a service is free to enrolled students) and explore any available courses on communications skills for science or engineering students. I believe extreme clarity and precision in both written and verbal communications is required in order to be a successful computer security researcher. Regarding IETLS (International English Language Testing System), I seek prospective students with an overall score at least 6.5 and preferably 7.0 (borderline component scores of 6.0-6.5 present a risk to succeeding in my computer security program).

Q6: Cryptography is my passion. My life's dream is to study this subject under your guidance. I will work day and night to please you. Is this possible?
Not with me. For over 15 years now, my research has been in computer and Internet security---and for this, strong background in applied cryptography is indeed helpful, but cryptography is no longer my research focus. Your question is a signal that you have not taken the time to do background review for something for which you are about to dedicate 2-5 years of your life (for a Master's and PhD, respectively). I suggest that spending a bit more time reviewing the research interests, and publications pages of potential supervisors, would help make a more convincing case that you are serious. Similarly, if you ask whether I can supervise you for an engineering degree---for that you would have to enroll in an engineering department (I am employed in a School of Computer Science), but I may co-supervise engineering grad students.

............. Last updated: June 2020