ing but in only a few pages reflected a level of complexity I had yet to consider. Best of all, it was by someone who was firmly involved in writing real operating
systems (Thompson was a co-inventor of Unix), as well
as being a response to a Turing Award. This short essay
validated my interest in “playing” with security and
influenced my career in the years to come.
When I first joined ACM 30 years ago as an undergraduate student at the urging of another of my professors, I wasn’t sure what to expect from my
membership. I soon discovered my subscription to
CACM to be one of its greatest benefits. In part, the
world of inquiry reflected in its articles and columns
(and in some of the SIG newsletters) reinforced my
decision to attend graduate school. CACM revealed
problems and issues that never came up in my classes
but that I recognized as worthy of greater thought. I
wanted to be involved in addressing some of them.
The “positions available” section in each issue also
encouraged me in my annual quest for student loans;
the prospect of a productive career that would (
eventually) pay off those loans was reassuring.
While in graduate school at Georgia Tech working
on a Master’s and then Ph.D. degree in operating systems, I continued to be interested in what was going
on across the discipline, and CACM provided great
exposure to the challenging landscape of computing.
I would often take an issue with me when I knew I
would have time somewhere (at, for example, the
dentist’s office), as it provided more interesting reading than could be found in what was normally left in
the rack. One memorable occasion is when I was
chastised by an otherwise entrancing inamorata
because I evidenced (at the moment) more interest in
those articles than in her arrival after class; I kept all
my CACM issues long after we parted company, so
perhaps it was indeed a harbinger, although we didn’t
realize it at the time.
After graduating with my Ph.D. and completing a
short post-doc in software engineering, I was hired at
Purdue in 1987. I kept up my background activities
in applied security, along with my deep interest in the
assurance problem. Thus, in late 1988 when the
Internet Worm appeared, I was prepared to investigate and write about it, although I was not formally
performing research in the area at the time. Furthermore, it led to my first publication in CACM [ 1],
something I had set as a goal during my undergraduate days when I first became an ACM member.
In the years since then, the Thompson essay
has continued to indirectly inspire portions of my
work. My design of the Tripwire system (www.
tripwire.com) in 1992, my development of the technology underlying the recent offerings by Signacert
( www.signacert.com), and my research, including
with my students on execution verification and forensics ( spaf.cerias.purdue.edu/students.html), all relate
back to the fundamental ideas in Thompson’s essay. It
also influenced some of my work on the Computing
Curricula 91 task force [ 4] and other efforts in education and computing policy. I continue to believe
that everyone working in computing should be familiar with Thompson’s essay, as well as why he won the
CACM as certainly helped shape the thinking and
careers of many in the field over the past 50 years,
myself included. Congratulations on turning 50, and
on the many lives yet to be influenced. c
1. Spafford, E. Crisis and aftermath. Commun. ACM 32, 6 (June 1989),
2. Stoll, C. The Cuckoo’s Egg. Doubleday, New York, 1989.
3. Thompson, K. Reflections on trusting trust. Commun. ACM 27, 8 (Aug.
4. Tucker, A. Computing curricula 1991. Commun. ACM 34, 6 (June
1991), 68– 84.
EUGENE H. SPAFFORD ( spaf.cerias.purdue.edu) is Executive
Director of the Center for Education and Research in Information
Assurance and Security and a professor in the Department of
Computer Science in Purdue University, West Lafayette, IN. He is
also chair of ACM’s U.S. Public Policy Committee.