Ross Anderson

Ross John Anderson was born on 15 September 1956 in Glasgow, Scotland, and educated at the High School of Glasgow before studying Mathematics and Natural Sciences at Trinity College, Cambridge, graduating in 1978. He spent the following years working in industry, including avionics and banking systems work, before returning to Cambridge to complete a PhD in computer science, supervised by Roger Needham, on cryptographic protocols, awarded in 1995.

Anderson joined the Cambridge Computer Laboratory as a University Lecturer in 1995, becoming a Reader in 2000 and Professor of Security Engineering in 2003. From 2021 he held a joint appointment split between the University of Edinburgh and the University of Cambridge. Over his career he contributed to cryptography itself, co-designing the Serpent block cipher with Eli Biham and Lars Knudsen (a finalist in the competition that selected the Advanced Encryption Standard).

Security Engineering

Anderson's best-known work is his textbook 'Security Engineering: A Guide to Building Dependable Distributed Systems', first published in 2001, with a second edition in 2008 and a third edition in 2020 (later made freely available online). The book took a broad, systems-level view of security rather than treating it as a purely cryptographic problem, and is widely regarded within the field as a foundational text that helped define security engineering as its own academic discipline.

Banking, ATM, and Chip-and-PIN Research

Anderson and colleagues at the Cambridge Computer Laboratory carried out influential empirical research into the security of real-world financial systems. In 2010, Anderson, Steven J. Murdoch, Saar Drimer, and Mike Bond published research demonstrating a 'no-PIN' attack against the UK's Chip and PIN card system, in which a device wedged between a stolen card and a terminal could trick the terminal into accepting any PIN.

Security Economics and Community-Building

Anderson was a co-founder of the field of security economics, arguing in his influential 2001 paper 'Why Information Security is Hard – An Economic Perspective' that many security failures stem from misaligned incentives rather than purely technical flaws. This work led to the first Workshop on the Economics of Information Security (WEIS), held in 2002. In 2008 he also founded the invitation-only Security and Human Behavior (SHB) workshop.

Privacy and Surveillance Policy

Beyond his academic research, Anderson was an active participant in UK technology policy debates. In 1998 he founded the Foundation for Information Policy Research (FIPR), a think tank that intervened on issues including NHS electronic health-record data-sharing plans and state surveillance powers, and gave evidence to the UK Parliament in December 2015 on the draft Investigatory Powers Bill.

Death and Legacy

Anderson was elected a Fellow of the Royal Society and a Fellow of the Royal Academy of Engineering in 2009, and was awarded the British Computer Society's Lovelace Medal in 2015. He died unexpectedly at his home in Cambridge on 28 March 2024, at the age of 67, remembered as a founder of security economics and a driving force in establishing security engineering as an academic field.

Timeline

• 1956-09-15Born in Glasgow, Scotland.
• 1995Awarded PhD at Cambridge; becomes University Lecturer at the Cambridge Computer Laboratory.
• 1998Founds the Foundation for Information Policy Research (FIPR).
• 2001Publishes the first edition of 'Security Engineering' and the paper 'Why Information Security is Hard'.
• 2002Co-founds the Workshop on the Economics of Information Security (WEIS).
• 2003Becomes Professor of Security Engineering at the University of Cambridge.
• 2008Founds the Security and Human Behavior (SHB) workshop.
• 2010Publishes 'Chip and PIN is Broken', demonstrating the Chip-and-PIN no-PIN attack.
• 2015-12Gives evidence to the UK Parliament on the draft Investigatory Powers Bill.
• 2024-03-28Dies unexpectedly at home in Cambridge at age 67.