Please read the following before sending me email asking me to be your
Supervisor. Due to the volume of email, I cannot personally respond to all inquiries.
I am most likely to respond to potential students
already in Canada, or who can provide references from colleagues that I
regularly interact with (e.g., I know many security researchers in the U.S. and Europe).
If you send me an email asking me to be your Supervisor
(and to fund you) before reading this page,
my first impression will be that you are not seriously interested.
Taking a few minutes to
explore information available on my web site, directed specifically to
you, provides an indication that you have some basic research skills.
"Will you be my (Master's, PhD) supervisor or post-doctoral host?" and
I supervise students interested in research addressing
practical aspects of computer and Internet security, typically at the
graduate level (some undergrad students distinguish themselves).
For potential grad students,
I have a strong first preference for domestic Canadians or permanent residents,
whom I am particularly interested in for the very pragmatic reasons
that this makes you eligible for major Canadian scholarships, and/or
allows you to avoid very high international tuition fees.
If you are an international student, holding equivalent scholarships
from your home country is
equally valid as evidence of academic distinction.
Due to my inability to otherwise differentiate the many candidates I've
never met in person, another natural but
coarse filter is a preference for students with an A grade average.
Your background (aside from an interest in computer security) should include several of:
data networks and protocols,
human-computer interaction (to support usable security research).
Before asking me to be your Supervisor or for a letter of reference,
please read the following typical questions I get, and act accordingly.
Q1: Can you write me a letter of reference? (I am a student)
If I am personally familiar with your work,
I will be happy to try to accommodate your request.
I can usually do this within two weeks of receiving the
information listed below.
If you require more than one letter, I will write a generic
"To Whom It May Concern" letter. Please provide me details on:
Q2: Will you be my Master's or Ph.D. supervisor?
- the position or scholarship you are seeking;
- the recipient's contact details as you would like them to
appear on the letter header; and
- a hard copy of any instructions or forms to be filled out
(highlight any criteria which those receiving the letter
expect it to address).
I will also need:
- up-to-date copies of your transcripts (undergraduate and graduate); and
- your cv or resume including all degrees, publications and experience
(highlight your experience in software security and applied cryptography).
My objective is to take on the very best students,
and to do excellent work with them;
there are few things that make academic life more rewarding.
While my first priority is to my existing graduate students,
and there are only a fixed number of hours in every day,
I would like to believe that I always have room to take on
additional exceptional students.
However, there are many issues to consider, as discussed under several cases below.
(Of course, if I have never met you, you are from a foreign country,
and we have no common acquaintances, Q2 is a strange question
to ask by email---e.g., how would I verify the integrity of any claims
made by you or any of your references? As a prospective security
student, you should appreciate the irony of such a request.)
Domestic grad students:
If you are a
Canadian citizen or permanent resident of Canada, please
complete this information form,
and then send me email saying that you have done so
AND have also read this advice page.
This will avoid wasting the time of me requesting the same information over
several emails. Your email may outline any unique
background that was not captured on the web form.
Prospective PhD students should mention:
who you worked with (e.g., Master's supervisor), publications,
and your background in information security
(if none, indicate why you think you will succeed nonetheless).
Please note: you typically must apply for major Canadian
scholarships (e.g., NSERC, OGS) 8-12 months in advance of your starting term.
If you have not distinguished yourself academically to date,
tell me why you believe you nonetheless have the potential to succeed as a
security Ph.D. student.
International grad students
Case 1: You are applying for a Master's degree (or are already in our program at Carleton).
Please note that whether you qualify for admission to the university,
for either a Master's or a Ph.D. program,
is not determined by individual professors, but rather by
other university administrators upon reviewing your formally
submitted application package. Any formal offer of admission
will come from the university, not from individual professors.
If you are a truly exceptional international student, and can partially
fund your own studies (see Q4 below), read on;
for all others I recommend that you apply to your local universities,
and I apologize that we are unable to respond to you individually.
Truly exceptional means that you have achieved an A or A+ grade average
and, e.g., finished at the top of your class in your country's top university;
have strong recommendations from someone whom I personally know or trust; or
have excellent industrial experience in security.
To get a response, you must
complete this information form,
which will be read by me and/or the other professors in the
two security labs (CCSL and CISL) in Computer Science at Carleton.
Otherwise, I advise that you gain admission based on your good academic record,
using your own funding, and with no advance promise of supervision.
In your first 4-8 months in the program, distinguish yourself through your
coursework, and acquire a solid background in security, including
attendance at security seminars and talks.
After this time, update me on your progess and continuing interest;
we will then have a basis for discussion.
International grad students
Case 2: You are interested in a Ph.D.
Q3: Can you host me for post-doctoral research in the area of security?
In addition to admission by the university (see above),
a faculty member must agree to be your supervisor before you will be
admitted to Carleton's Computer Science Ph.D. program. To help me
and/or my peer professors in our security labs (CCSL and CISL)
make such a long-term commitment (e.g. 3 to 5 years), we require that
you complete this information form.
The form will capture your contact information (email address),
university background, etc.
If you have no information security background, you are unlikely to get
a response from us. Please note also that for admittance to our Ph.D.
prorgam, you require not just a Master's degree, but a thesis-based
Master's degree (in Computer Science or Engineering).
I generally expect that before entering a Ph.D. program under my
supervision, you will already have significant practical or academic
background in security (otherwise, there is little reason to believe
that you will be willing to commit 3-5 years of your life to studying this area).
If I find the information on your completed form is promising,
I will contact you by email. I then often ask the following to explore further:
(Determination of common research interests)
Select one of my recent papers which you find interesting and tell me why.
Provide some insightful comments or suggestions for extending the research.
(Funding and financial support)
Of the many possible funding arrangements, tell me your plans
or expectations (see Q4 below). Unfortunately,
it is unrealistic to expect full funding support for cost of living
and the high international tuition fees currently in place.
(Making a long-term supervising commitment)
It is impossible for me to have high confidence that there will be
a good working relationship without having met you,
heard you present (e.g. at a conference),
or seen some of your work (e.g. in a course, a report or research paper).
I typically take on a PhD student only after gaining a high
degree of confidence that they will succeed, e.g.
requiring that they distinguish themselves through course work
(ideally taking a course with me as a Master's student), or someone I trust
recommends them highly.
Reference letters from people whose names I do not recognize
and/or whom I do not know personally are of limited value.
I would be delighted, if there is a good fit. I assume that we have previously met at a conference
or elsewhere (or that I know your current supervisor sufficiently well to
trust their recommendation),
that your research is in an area in which I am active, and
that you will either be bringing with you some base funding
(e.g. NSERC post-doctoral scholarship), or will be interested in
participating in project research to help fund your stay.
Tell me what types of research you do, how it complements my own or that of
our group, and what your funding arrangements or needs are.
If we have never met and I don't know anyone that you have been working with,
then I usually can't do more than wish you luck
(to get things started, I almost always need a recommendation
from someone whom I know, or know of).
If you are a post-doctoral candidate, but your research to date has not
involved computer and Internet security, then I would suggest that you
as I naturally prefer post-docs capable of mentoring my grad students
and contributing directly to my research program.
Q4: What overall costs (international tuition fees, living expenses,
etc.) should I plan for?
To estimate international tuition (also domestic) and other living expenses, see the estimator tool at:
and Fees (for International Students).
The tool estimates tuition for a 4-month term,
and thus should be adjusted for three such terms per year;
in Carleton's School of Computer Science (SCS), grad students typically must enroll year-round to do their research.
For example, the tool indicates that as of Sept 2019,
international tuition for a graduate Computer
Science student exceeds CAD 7,000-8,000 per four-month term (e.g., CAD 24,000 per year)
with a Master's degree typically 5-6 terms (e.g, 2 years), and
a PhD 3-4 years or more.
If one estimates basic living expenses (accommodation and food,
excluding travel) at CAD 16,000/year, annual expenses may then be CAD 40,000 or more.
Realistically, this puts a graduate research degree at Carleton
beyond the reach of many otherwise well-qualified prospective international sutdents,
unless they have quite significant personal or family support (in addition to grant funding from a Supervisor).
For graduate degrees in Carleton's SCS,
in rare cases, international PhD students with exceptionally good marks may be offered
admission with reduced tuition fees (equivalent to Canadian domestic tuition).
Q5: I am currently a Carleton student and
need help with [writing style, English grammar, etc.].
I would like to be your graduate student but I find
English to be challenging - is this important?
A: I recommend you start by consulting a suitable
Writing Tutorial Service (at many universities, such a service is
free to enrolled students) and explore any available courses on
communications skills for science or engineering students.
I believe extreme clarity and precision
in both written and verbal communications is required in order to
be a successful computer security researcher.
Regarding IETLS (International English Language Testing System),
I seek prospective students with an overall score at least 6.5
and preferably 7.0
(borderline component scores of 6.0-6.5 present a
risk to succeeding in my computer security program).
Q6: Cryptography is my passion. My life's dream is to
study this subject under your guidance. I will work day and night to
please you. Is this possible?
Not with me.
For over 15 years now, my research has been in computer and Internet
security---and for this, strong background in applied
cryptography is indeed helpful, but cryptography is no longer my research focus.
Your question is a signal that you have not taken
the time to do background review for something for
which you are about to dedicate
2-5 years of your life (for a Master's and PhD, respectively).
I suggest that spending a bit more time reviewing the research interests,
and publications pages of potential supervisors,
would help make a more convincing case that you are serious.
Similarly, if you ask whether I can supervise you for an engineering
degree---for that you would have to enroll in an engineering department
(I am employed in a School of Computer Science),
but I may co-supervise engineering grad students.
............. Last updated: January 2020