In Loving Memory of Ross

This is to preserve cherished memories shared by Ross's friends, students, colleagues, and those who had not met him but learnt lessons through his book. I went through online places to collect all public tributes, and also include private messages through internal emails and handwritten notes with consent.

I believe future generations, including myself, will learn invaluable lessons from these remembrances by gaining a deeper understanding of Ross's vast contributions and how nicely he treated students and colleagues. If you have something to write but have not yet shared it, please reach out to me and I will help archive it.

I remember I first met Ross around 1993 or 1994. I was working as a research engineer in an industrial lab in Cambridge, I was a kind of crypto nerd all excited about PGP, and I heard of this public talk at the University entitled "Why cryptosystems fail". So I went along, one evening, and I think it was the first talk I ever attended at the University of Cambridge. This speaker, of whom I knew absolutely nothing, talked about how banking systems claim to be infallible but in fact make a number of engineering mistakes that enable a variety of frauds. He explained the frauds, not in the abstract but with reference to actual cases, and daringly asserted that the banks made the mistakes but denied the evidence and blamed the victims. Wow, that was hot stuff! I was riveted in my seat. We need people like this to tell it straight, stick it to the man and defend us poor consumers, I thought. Who is this guy? I didn't know it then, but the speaker was just a lowly PhD student, a mature PhD student of computer security pioneer Roger Needham. He had graduated from Cambridge in maths some 15-20 years before and had since worked around the world, from the Far East to South Africa, in a variety of fields, including banking. And then, having saved enough to pay for graduate studies, he had gone back for a PhD, and he had taken to research like a fish to water. This was to become his first high profile paper, officially published in late 1993 but I wasn't able to reconstruct whether he gave that talk in the Babbage lecture theatre before or after publication.

In the meantime, a few years after attending that lecture, I too came to the decision of returning to University to earn a PhD as a mature student. As I looked for a supervisor there and considered various options I found him, by then a newly minted lecturer in the Computer Laboratory, what we would now call an Assistant Professor. He had half a dozen PhD students and had not yet graduated a single one. I had a couple more options on the table but it is largely on the strength of that first impression from his lecture as a mature student that I told myself: if I'm going to do a PhD at Cambridge, I can't miss the chance of working with this guy. This was the summer of 1997; by then he'd been a lecturer for a couple of years, and he did not seem too keen on taking on one more student on top of the ones he already had. I remember an early email exchange in which I mistakenly referred to him as English, to which he promptly and vehemently responded: "I am not a fucking Englishman!". I cheekily wrote back "I'd rather be a fucking Englishman than a non-fucking one". Shortly afterwards I received an acceptance letter as his student.

I started attending the security group meetings, ahead of my official start which would have been the following January, and got to know his other students: Harry, Fabien, Jong-Hyeon and Abida, joined in October by Markus who was at the time completing his Master's course in the US but had already coauthored with Ross in 1996: that paper, "Tamper Resistance: a cautionary note", soon became a classic. Maybe Uli was already there too, or he joined around that time. I started getting invited to the lavish dinner parties that Ross and Shireen frequently hosted for the security group, in their faraway home in the middle of nowhere ("that's the only place I could afford a big house and nice garden even on my lecturer's salary"). There were many more people at these parties than just Ross's students: it seemed he knew everyone and was quite inclusive in his invitations. One of these parties I remember celebrated Shireen's 40th birthday. The food was always delicious but the company was better. When the bulk of the guests had left, a pack of attention-hungry Yorkshire Terriers was unleashed on the remaining attendees who were lounging on the sofas.

Always gregarious, in the old Computer Lab on Corn Exchange Street he was a regular at the afternoon tea hour where he'd make a point of chatting with everyone. It is on those ugly faux-leather green armchairs that I remember discussing exciting ideas with him while they were still being shaped, from the Guy Fawkes protocol (a precursor to the blockchain) to How to cheat at the lottery to the bootstrapping process for the Resurrecting Duckling that later became my first highly cited paper with him. At conferences, too, he connected with everyone. More to the point, he pulled everyone together. On many occasions he served as the catalyst that created a new community that then went on for years, sometimes decades, well beyond his initial involvement as a founder. From the UK-crypto mailing list to the Foundation for Information Policy research, the Information Hiding workshop, the Fast Software Encryption workshop, the Workshop on Economics and Information Security, the one on Security and Human Behaviour and I'm missing out plenty more.

I remember he religiously took notes at every one of our security seminars, whoever the speaker was, building an encyclopedia of knowledge that he then distilled into his book, Security Engineering, which he wrote during the last year of my PhD. I was excited to read his drafts and to send him comments while I was working on my own dissertation and he was doing the same to me. I was over the moon when his prestigious publisher, Wiley, accepted my own book as well, thanks in part also to his influential recommendation. Now his encyclopedic 1200 page book, which he kept updating till his third edition in 2020, is a must read for anyone doing anything in security, and it's amazing that a single person could have so many insightful things to say on so many facets of our field. I'm rambling a bit by now, sorry, it's very sad to see him go at only 67, but I hope I am conveying a little bit of why I chose him, why I was excited at the prospect of working with him, and of why I feel that choosing him as my PhD supervisor was one of the best and most significant decisions in my career. And I had no idea at the time that, after completing my own PhD, I would be appointed to a Cambridge lectureship myself and become his colleague.

Thanks Ross, rest in peace and thank you for everything.

-- Frank Stajano (see more)

Ross broke down barriers. He treated everyone as equals, from the undergraduate intern to the visiting professor. He loved to bring people together from all walks of life. He saw the opportunity to learn from everyone he met. He loved nothing more than a robust argument; the opportunity to debate an issue at length.

There is a huge Ross Anderson-shaped hole in my life. He was a brilliant mentor, colleague, and friend to me and many others. His impact has been considerable in so many ways. He will be greatly missed.

-- Alice Hutchings

Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge.

I can't remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and Information Security. (Okay, he created both - I helped.) It was before 1998, when we wrote about the problems with key escrow systems. I was one of the people he brought to the Newton Institute, at Cambridge University, for the six-month cryptography residency program he ran (I mistakenly didn't stay the whole time) - that was in 1996.

I know I was at the first Fast Software Encryption workshop in December 1993, another conference he created. There I presented the Blowfish encryption algorithm. Pulling an old first-edition of Applied Cryptography (the one with the blue cover) down from the shelf, I see his name in the acknowledgments. Which means that sometime in early 1993 - probably at Eurocrypt in Lofthus, Norway - I, as an unpublished book author who had only written a couple of crypto articles for Dr. Dobb's Journal, asked him to read and comment on my book manuscript. And he said yes. Which means I mailed him a paper copy. And he read it. And mailed his handwritten comments back to me. In an envelope with stamps. Because that's how we did it back then.

I have known Ross for over thirty years, as both a colleague and a friend. He was enthusiastic, brilliant, opinionated, articulate, curmudgeonly, and kind. Pick up any of his academic papers - there are many - and odds are that you will find a least one unexpected insight. He was a cryptographer and security engineer, but also very much a generalist. He published on block cipher cryptanalysis in the 1990s, and the security of large-language models last year. He started conferences like nobody's business. His masterwork book, Security Engineering - now in its third edition - is as comprehensive a tome on cybersecurity and related topics as you could imagine. (Also note his fifteen-lecture video series on that same page. If you have never heard Ross lecture, you're in for a treat.) He was the first person to understand that security problems are often actually economic problems. He was the first person to make a lot of those sorts of connections. He fought against surveillance and backdoors, and for academic freedom. He didn't suffer fools in either government or the corporate world.

He's listed in the acknowledgments as a reader of every one of my books from Beyond Fear on. Recently, we'd see each other a couple of times a year: at this or that workshop or event. The last time I saw him was last June, at SHB 2023, in Pittsburgh. We were having dinner on Alessandro Acquisti's rooftop patio, celebrating another successful workshop. He was going to attend my Workshop on Reimagining Democracy in December, but he had to cancel at the last minute. (He sent me the talk he was going to give. I will see about posting it.) The day before he died, we were discussing how to accommodate everyone who registered for this year's SHB workshop. I learned something from him every single time we talked. And I am not the only one.

My heart goes out to his wife Shireen and his family. We lost him much too soon.

-- Bruce Schneier

Ross made a profound impact on me. He was an outstanding mentor who set a positive example of how to be an effective academic and a genuinely good person.

His mentorship style was very effective. He provided plenty of guidance, advice, and feedback. But he also kept a healthy enough distance that helped me grow into an independent scholar. I'll never forget our first meeting in his office. He explained to me that at the end of the first year, I'll have a viva. Until then, he told me I was free "to work on whatever the hell I want", and that we'd figure out if it worked at the viva. Of course, I saw him plenty that first year, and he was always generous with his time when I had questions or needed feedback. But we never had regularly scheduled meetings. Instead, Ross would randomly pop into my office (which was next door to his) any time he had something that he thought might be of interest to me or if he had an idea he wanted to talk through. Those meetings would invariably lead to discussions of what I was working on, and in that way shaped my path.

Ross always sought out opportunities to elevate his PhD students (and really, any junior scholars). I benefited directly. Anytime he was asked to speak, if he had a conflict, he would recommend one of his students instead. That's how I got to travel all over Europe, from Austria to Cyprus, giving keynotes on security economics as a PhD student. It's also how I co-authored a paper with him in Science and a report for the European Commission. And the best part was, I was never just his stand-in. He expected real contributions, treating me as a fellow scholar even before I felt like one. Only later did I realize that by sharing these opportunities he helped make it true.

Ross imparted on me the importance of working on real problems that people care about. He valued collaboration and sought it out at every opportunity. And he was never satisfied with the status quo. He was unafraid to argue for change when warranted. I have done my best to internalize these lessons in my own career, inspired by his example.

On a more personal level, I always enjoyed the times he invited the Security Group to his home in Wrestlingworth. Shireen cooked a delicious meal, and the conversations would go on for hours. During one such visit, Ross broke out his bagpipes. Needless to say, the sound was impressively loud, particularly in a small dining room!

Finally, I really appreciated getting to know Shireen better during Financial Crypto conferences. Shireen, Jillian and "the moms" (my mother and mother-in-law) would hang out at the beach while Ross and I attended sessions. Then at meals and in the evenings and social events we would all come together and enjoy each other's company. I will always cherish those memories

-- Tyler Moore

I remember the first time I met Ross. He was presenting his "Why Security is Hard" manuscript -- which essentially started, or contributed to start, the entire field of research on infosec economics -- at Berkeley in 2002. I was a PhD student there. I sent him an email in the scant hope he could meet with me while at the conference where he was presenting. Incredibly, he did reply, and did find time to meet with me, and chat.

That was the first of many, wonderful interactions I was so lucky to have with him over the subsequent 20 years. And now they seem too few.

Ross fought the good fight. He was relentless in that, and seemingly fearless of the powers he was putting himself against. That was inspirational: wow, I would tell myself, here is a serious scholar who is not afraid of taking very clear positions on critical issues, and speaking truth to the power!

I recall how intimated and amazed by him I was when I approached him in Berkeley in 2002 for our first chat. Over the years (especially thanks to organizing together the Security and Human Behavior workshop), I discovered such a warm, gentle, and incredibly funny side of his personality. And yet that sense of amazement never went away. Over the years, Ross was to me a mentor, an inspiration, a model, and a friend. He will be missed.

-- Alessandro Acquisti

Ross Anderson left us far too soon. I grieve for him and send my love to his family.

Ross was an intellectual giant and an absolute legend in computer and information security, and like any true giant, he was incredibly down-to-earth and friendly.

I first met Ross at the very beginning of my career, when I was a very junior faculty. Having been told of his famously low tolerance for idiocy, and being completely star stuck, I remember being very anxious the first time I was introduced to him. As it turns out, he was absolutely lovely and kind. Perhaps that's because the French and the Scots famously get along (by correctly blaming the English for everything that is wrong in this world), but I was impressed by his congeniality.

You can tell a lot about somebody's character just from the way they talk to higher-ups and people in lower positions. Ross' sharp and acerbic wit was solely reserved to people in position of power that, truly, shouldn't have been there. For those of us that were not -- junior faculty, students -- he was an indefatigable advocate, wonderful and kind mentor, and always had time for us.

I remember in late 2010 seeing a call for a very large grant from DHS. It was a very long shot, but I wanted to apply, and I thought that some of Ross' work was a good fit for some of what the funding agency was looking for. So, I invited him to team up. He accepted, and I wanted to get him to be front and center on the grant given his notoriety. He said that he wouldn't mind if we thought it'd help, but that I (and Tyler Moore, at the time another junior faculty on the grant) should be running the show, not him. Often with senior faculty, that's code for "put my name on this thing, I'll take the money, but don't ask me to do anything." In Ross' case, that meant tirelessly writing entire sections and editing the whole proposal, giving us a lot of advice, and then, stepping back from the limelight. We wrote a lot of that proposal at Financial Crypto in Saint Lucia, in between cocktails and beach time.

We got the grant. It completely changed my career. Later, I heard through the grapevine that Ross was one of my biggest supporters when asked to write evaluation letters. It was incredibly helpful to have such a legend in my corner.

So, I owe Ross a lot, and I am sad that I never will be able to repay him even a fraction of everything he did for me. But, now that I am becoming slightly more senior, I will try to honor his memory by using him as a model in my interactions with junior colleagues.

Thank you, Ross.

-- Nicolas Christin

A beautiful mind has left us. I lost an esteemed colleague, dear friend, and mentor. Ross's influence stretched far beyond his role as a Professor at the University of Cambridge; he was a world-renowned figure whose brilliance and impact resonated throughout information and computer security research, spanning generations of researchers and scholars.

His intellect was unique, his research groundbreaking, and his dedication unbreakable. Ross was able to fuse profound knowledge with an incredible moral compass. He fearlessly championed privacy and information access rights, raising his voice against the misuse of technology and governmental overreach, always advocating for justice and integrity. And his impact is enormous. Beyond his academic fame, Ross was a living repository of wisdom, his mind a vast library of historical knowledge. His influence reaches beyond our immediate community, shaping the broader technology and policy landscape.

I had the privilege of knowing Ross and calling him a friend, and I was deeply touched by his genuine kindness and willingness to lend a helping hand. He embodied the true essence of compassion and generosity, leaving a legacy that will endure eternally.

To Ross's family, I extend my deepest condolences. May you find comfort in knowing that his legacy will continue to inspire countless individuals.

Ross, though you are no longer with us, your spirit will forever reside in the hearts and minds of all touched by your brilliance and kindness. Lastly, I borrowed a snippet from the known poem "Do Not Stand at My Grave and Weep" that I thought fits you well:

"I do not stand at your grave and weep.
You are a thousand winds that blow,
You are the diamond glints on snow,
You are the sunlight on ripened grain,
You are the gentle autumn rain.
....."

-- Ahmad-Reza Sadeghi

Ross was a pragmatic visionary. He critically observed situations, identified how the situation should be, determined what would be needed to get there, and made it happen. He not only applied this strategy very successfully to his own career, but to the careers of many of us, changing our lives for the better. Incidentally, this is also how we met. I met Ross at a psychology conference (SARMAC) in Rotterdam (The Netherlands) back in 2013. He had just received a large grant on deterring deception and attended this conference to scout talent. We were both in the audience when Ross asked the speaker a question about the use of machine learning to tackle her research problem. The speaker completely blanked - it was probably the first time someone mentioned machine learning at that conference -- but I got excited. So after the talk, I introduced myself to the person who asked this question, Ross. We started chatting and did not stop. We went for dinner that evening and he invited me to come to Cambridge, meet some people in the lab. This turned out to be a job interview, which I unfortunately only realised when I was already halfway through my visit. All's well that ends well, I got the job even though I hadn't consciously applied and it changed my life for good.

Ross was truly great at getting bright young minds together who shared his vision and were eager to facilitate change. He was a serial community builder. He founded multiple entire new disciplines and academic communities, including (but not limited to) WEIS on the economics of cyber security, SHB on security and human behaviour, and Decepticon on deceptive and dishonest behaviour.. The latter, Ross and I set up together and is still an active and vibrant research community today. Ross would attend all conferences and religiously take notes for lightbluetouchpaper.org, building an unparalleled open-access security resource.

Ross taught me to not only think strategically, but also to think big. How do we get the key researchers in our scientific committee? How do we get this line of research on the front page of the New York Times? Or even, how can this work lead to a Nobel Prize? He encouraged his students to do cutting-edge and meaningful research and to share these new insights with the wider public.

Ross believed in cross-disciplinary synergy, that one plus one could be so much more than two, especially when the two are complementary. He hired grad students and postdocs with a wide variety of backgrounds, including computer scientists, criminologists, economists, lawyers, and psychologists like me. This led to vibrant Friday lab meetings where security related topics were discussed from a variety of angles, sometimes leading to unexpected insights.

Ross was idealistic. He would only record a MOOC (online course) if it would be made freely accessible to everyone. Same for the papers and books he wrote. He strongly believed that academic information should be open. Private information on the other hand, must be protected. He demonstrated the fallibility of anonymizing sensitive data such as electronic health records and that photos and documents can often be retrieved from a wiped smartphone. Ross dedicated his career to protecting people's privacy.

Ross was famous for advocating his strong opinions. I believe one of his quotes ended up on a wall at GCHQ and he famously send a reference letter comprising one single line: "You'd be a fool not to hire her". But one of the things I liked most about him, is that he always listened with an open mind. He was endlessly curious, read more and about a wider range of topics than any one person could comprehend. But if you disagreed with him and posed a solid argument, he would use this input to update and, when relevant, change his opinion. Ross always gave me the feeling that what I said, mattered.

Ross was a great mentor and friend. He was one of the most generous and welcoming people I have ever met. Ross had a strong influence on the careers and lives of many, mine included. For example, he generously invited me to his home where I not only admired his taste in art, but he also invited me to "shop" furniture in his garage. I had just moved to Cambridge and my apartment was still a bit empty. Ross lent me a beautiful closet that had belonged to a friend of theirs and even brought it to my home. Helped me move it up the stairs. He wanted to make sure Cambridge would feel like home. And the extraordinary thing is that this wasn't an exception. He cared this deeply for many people.

Importantly, Ross did not do this alone. I have seldom seen such a complementary match as Ross and Shireen. When Ross organized a conference at the lab, Shireen would be there to host it. To chat to everyone, make sure they felt seen and welcome. When Ross joined Churchill, Shireen set up new committees and organised events for the partners of fellows. When I felt torn between staying in the UK or moving back to the Netherlands, Shireen would take me to the pub to listen to my worries. And the next morning, Ross would come into my office to pose a solution. "Run an experiment at a Dutch university so you can spend some time at home". Problem solved.

In 2015, at the end of the grant, I left Cambridge to move back to the Netherlands. Ross through me a goodbye party at the computer lab, serving pink prosecco. I loved it. Since then, Ross and I have visited many conferences together and each time we did, we had such a wonderful time. In addition to hearing the ins and outs in the field, we would go for walks and visit art museums. Walking with Ross through the Smithsonian's National Air and Space Museum was remarkable. He knew everything about everything and talked about it with so much passion that I started to regret studying psychology instead of aerospace engineering. Ross would be the one I turned to when in need of some serious life advice, for example when dealing with my parents who turned ill or when having trouble finding suitable education for my daughter. Ross always inspired me to solve the problem and think big if needed. "If there's no suitable school, start one". Because problems are there to be solved.

The last contact we had was the day before Ross passed away. We were planning to meet up during his next visit to the Netherlands. I was already looking up art exhibitions, wondering which one he would like best. With Ross' passing, academia lost a great mind, society lost an advocate for human rights, and we all lost a truly great friend who will be missed dearly.

-- Sophie van der Zee

Inviting me to help found WEIS changed my career in such a fundamental way. He created this pathway and ways forward that changed my trajectory. And now I am reading that he was did that to so many people, where a single interaction with him was a life inflection point.

I suppose he told you his bagpipe social engineering story: he discovered as a student on the continent that if you were in a given range of people in Germany they would drop some coins in your case. So he would march around playing of his many bagpipes in the train station, walking just close enough to people to engage the social contract - with a bagpipe - , and have enough to student the day away. He told this story to me and my younger child, who played brass in band, at FC by the ocean.

I posted this when I heard, "Ross Anderson cared deeply about the human outcomes of security & policy. He did not focus his brilliance on amassing tech wealth but instead on the hardest challenges, using nuanced technical insights in fighting to protect the vulnerable."

He was one of kind. And now I suppose I will never understand the differences between the Scottish and British enlightenments.

-- Jean Camp

I just want to note here just how important Ross Anderson was, not just within the UK digital community, but globally. He was the model of a politically and socially involved computer scientist -- when I first heard of him in the 90s, he was doggedly trying to point out that the then security protections against ATM (cashpoint) fraud were too weak, and that the banks were blaming customers for leaking their PIN codes when in fact, those codes were eminently crackable.

After that, he was /the/ key figure in fighting restrictions on cryptography in the UK, putting together a coalition of CS experts in founding the Foundation for Information Policy Research, and then becoming one of the key (informal) advisors to the Labour party. As a gruff, Scottish socialist, Ross was tailormade to act as a counterbalance to the United States' heavy lobbying of the Blair administration to tow the line on making usable crypto illegal outside of the United States.

That had a global effect: opposition in the UK, at the time the US's strongest ally in many policies, limited the ability for the crypto restriction regime to spread. (After many years, it's notable that the main countries passing crypto restrictions during this period were those /furthest/ away from US support, rather than closest -- France, Russia, etc.).

FIPR and its successes spawned a strong, and experienced digital rights community in the UK early on. It was Ross and Caspar Bowden (who also sadly passed away far too early) who were crucial in encouraging this group to work with others in Europe to form EDRi, which remains the core of digital rights advocacy in Brussels. If you've ever wondered why the EU occasionally comes up with good cyberlegislation, it's because of the influence of EDRi -- and that coordination came from Ross and Caspar recognising that the real decisions were being made not in the UK or the US, but in the growing work of the European Union.

But at the same time as doing this political work, Ross was also building the foundations of a serious cybersecurity approach. He applied political, economic and social aspects to computer security models: his early writing on /where/ to put the liability for computer security flaws are still influencing approaches to legal liability now. He drew deeply from the actual use of technology: my favourite memory of him is him explaining how the Irish Republican Army actually passed around secrets under the nose of the British Army to a somewhat amazed BBC journalist.

Ross' high reputation allowed Cambridge University to lure Microsoft funding for their infosec department. The results of that collaboration indirectly led to CHERI, a capability-based security system designed by some of the brightest minds in the UK and beyond, and still for many of us the great hope for truly robust digital security.

Recently, Ross was still working on the cutting edge: the other week, Cory Doctorow pointed me to a paper he co-authored recently on how ML models might collapse in the face of ingested ML-generated content. When I devoted a chunk of a lightning talk to him at EthDenver, a prominent Filecoin ecosystem participant came up to me afterwards to thank me for highlighting Ross' work, as he had been instrumental in supporting her early career. Ross was grumpy, unforgiving, a blistering writer of flaming emails, and sometimes oblivious of the effect his disapproval could have on others. But he pursued and achieved singularly useful advances in the field of information security, and in the wider, messier world of digital rights and global politics. He was mad at Cambridge for forcing him to retire at 67, and he was right -- not just from a political point of view, but from the truth that he still had so much to give. He died too soon.

-- Danny O'Brien

When I started my PhD in Germany in 2003, I did not know anything about security, but was determined to learn. So I put the 2nd Edition of Security Engineering on my night table, and systematically read through it for several weeks every night. Some years ago I realized that everything I know about security originates from his book.

I met Ross personally much later, in 2017 on the Security and Human Behavior Workshop, und he was incredibly and unexpectedly kind to me. It was a tough time in my professional life, and I felt protected when he was around. Just so. He was also, to my great surprise, interested in my research and helped with advice and connections.

I liked most his unique humour, and especially his smile. It illuminated his face and surroundings like sunshine. Thank you, Ross.

-- Zinaida Benenson

Ross was a force of nature: full of ideas and thoughts on how to implement them, combined with inexhaustible energy. Ross could be a cyclone when you disagreed with him -- full-force winds in your face at upwards of 90 miles an hour -- but also willing to listen once he realized you had a point. Ross's mastery of cryptography, security, and the underlying policy issues that impeded implementing good security showed a command, at a deep level, of multiple fields and a rare capability to work within them. His ability to weave this knowledge into narratives that were both compelling and comprehensible to the lay person was a remarkable skill; it will be sorely missed by the security community. So, too, will Ross's energy and his boundless intellectual curiosity.

-- Susan Landau

This is sad news. I met Ross for the first time at Cambridge in 2008. His magnum opus "Security Engineering" had been published a few months earlier. I knew some of his articles.

But what really impressed me when we met was his energy and his desire to make a difference in the world. Security was not a purely academic topic for him. It was his tool to make the world a safer place.

He stood up for the victims of cybercrime, fought against injustice and feared no opponent, whether from government or industry.

The WEIS conference series, which he co-founded, was for me the most influential series of events ever. It is the place for people who wanted to understand why security works or doesn't work in the real world.

The last time I met him was at WEIS 2023 in Geneva. He was making plans for his retirement and still had so much to do. Things that can no longer be done by him. But we should not forget that he educated and inspired a whole generation of security engineers who are now working in research, academia and industry. He was the giant.

To Ross's family, I extend my deepest condolences. We will miss Ross very much.

-- Boris Hemkemeier

Ross Anderson died unexpectedly in his sleep last Thursday, leaving a large group of us devastated. He was one of those unforgettable people - fabulously erudite, generous with his knowledge and friendship, fiercely independent, and fearless. He had a kind of flinty integrity that was wholly admirable, which meant that he was often a thorn in the side of university, governmental and academic establishments, who discovered that he was no pushover.

He was a Fellow of the Royal Society and a recipient of the British Computer Society's Ada Lovelace Medal. He was a world authority on computer security, cybercrime and cryptography. He was Professor of Security Engineering at Cambridge, and leaves behind a remarkable cohort of PhD students who were lucky enough to have him as a supervisor.

Many people found him formidable and indeed sometimes forbidding. He didn't do small talk. And yet when you were lucky enough to get to know him (as I was) he was great company. He and I used to walk round the '800' Wood near Cambridge with his two lovely dogs, deep in conversation about the sordid ingenuity of cyber-criminals, the short-sightedness of academic administrators, the intrusiveness of national security agencies, as well as about Celtic folk music of which he knew a lot. (He was a piper and shared my interest in Uileann piping.)

I learned such a lot from those conversations. Ross changed the way I looked at computing, and alerted me to the political economy of the technology which has shaped my thinking ever since. He always spoke his mind - which is why when an email from him would arrive at 8am on Sunday mornings I knew that he had read my Observer column and had something to say about it, and accordingly braced myself before reading further.

The last time I saw him was a few weeks ago, when we both snuck into a talk given by Matt Clifford (who has become Rishi Sunak's go-to man on "AI Safety"). He had been invited by a student group, and Ross and I were the only two grizzled veterans in the room. Before Clifford embarked on his boosterish talk, I got out my pen to take notes, and then noticed that Ross had opened his MacBook. So I put my pen away. He always took the most detailed and accurate notes of any event he attended, and I knew that if I needed to check something later about Clifford's performance, Ross's record would provide the evidence I needed.

Ross was furious about Cambridge University's remorseless determination to force academics to retire at 67, and he had been mounting a campaign against the policy. At 5pm on the day he died, he had an email conversation with one of his colleagues, Jon Crowcroft, about the possibility of harnessing generative AI to add spice to the campaign. Ross sent Jon a link to a song he had just prompted suno.ai to create.

As Jon observed afterwards, it could almost serve as an obituary.

Ross's death marks the passing of the last of the five computer scientists who made Cambridge such a pioneering centre of research in the field - Maurice Wilkes, Roger Needham, David Wheeler, Karen Sparck Jones and Ross.

May he rest in peace. We were lucky to have known him.

Frank Stajano, one of Ross's colleagues in the Computer Lab, has written a lovely tribute to him in the blog that Ross and his colleagues have been running since 2006.

-- John Naughton

Professor Anderson was a giant of the field. Yet he often took the time to drop me a note of appreciation when he liked something I published. It meant a lot to me, especially as a junior scholar. I corresponded with him just last week. This is a complete shock. RIP Ross

-- Arvind Narayanan

RIP Ross J. Anderson, who died on March 28, at 67 and leaves behind a smoking giant crater in the fields of security engineering and digital rights activism. For the former, he was a professor of security engineering at Cambridge University and Edinburgh University, a Fellow of the Royal Society, and a recipient of the BCS Lovelace medal. His giant textbook Security Engineering is a classic. In digital rights activism, he founded the Foundation for Information Policy Research (see also tenth anniversary and 15th anniversary) and the UK Crypto mailing list, and, understanding that the important technology laws were being made at the EU level, he pushed for the formation of European Digital Rights to act as an umbrella organization for the national digital rights organizations springing up in many countries. He also was one of the pioneers in security economics, and founded the annual Workshop on the Economics of Information Security, convening on April 8 for the 23rd time.

One reason Anderson was so effective in the area of digital rights is that he had the ability to look forward and see the next challenge while it was still forming. Even more important, he had an extraordinary ability to explain complex concepts in an understandable manner. You can experience this for yourself at the YouTube channel where he posted a series of lectures on security engineering or by reading any of the massive list of papers available at his home page.

He had a passionate and deep-seated sense of injustice. In the 1980s and 1990s, when customers complained about phantom ATM withdrawals and the banks tried to claim their software was infallible, he not only conducted a detailed study but adopted fraud in payment systems as an ongoing research interest.

He was a crucial figure in the fight over encryption policy, opposing key escrow in the 1990s and "lawful access" in the 2020s, for the same reasons: the laws of mathematics say that there is no such thing as a hole only good guys can exploit. His name is on many key research papers in this area.

In the days since his death, numerous former students and activists have come forward with stories of his generosity and wit, his eternal curiosity to learn new things, and the breadth and depth of his knowledge. And also: the forthright manner that made him cantankerous.

I think I first encountered Ross at the 1990s Scrambling for Safety events organized by Privacy International. He was slow to trust journalists, shall we say, and it was ten years before I felt he'd accepted me. The turning point was a conference where we both arrived at the lunch counter at the same time. I happened to be out of cash, and he bought me a sandwich.

Privately, in those early days I sometimes referred to him as the "mad cryptographer" because interviews with him often led to what seemed like off-the-wall digressions. One such led to an improbable story about the US Embassy in Moscow being targeted with microwaves in an attempt at espionage. This, I found later, was true. Still, I felt best not to quote it in the interests of getting people to listen to what he was saying about crypto policy.

My favorite Ross memory, though, is this: one night shortly before Christmas maybe ten years ago - by this time we were friends - when I interviewed him over Skype for yet another piece. It was late in Britain, and I'm not sure he was fully sober. Before he would talk about security, knowing of my interest in folk music, he insisted on playing several tunes on the Scottish chamber pipes. He played well. Pipe music was another of his consuming interests, and he brought to it as much intensity and scholarship as he did to all his other passions.

Ross J. Anderson, b. September 15, 1956, d. March 28, 2024.

-- Wendy M. Grossman (see more)

I am deeply saddened by Ross's passing. To me, he was a great mentor, a caring elder, and a close friend.

Being admitted as his student was the most fortunate event for me. In the months before I arrived in the UK, from visa processing to accommodation and other life matters. Ross actively offered me help and advice. Upon my arrival, he cared about my living and study situation all the time; we together explored and decided on research plans. Although we knew each other for a shorter time compared to his other students and colleagues, Ross was the closest person to me in the UK.

I am deeply grateful for his belief in my potential and his willingness to guide me. His erudition and rich experience were key factors in my decision to pursue a PhD here. I will always remember our first dinner at the High Table in Churchill College.

His visits to Edinburgh were not frequent, but we corresponded by email almost daily, and we met during the online meetings on Mondays, Wednesdays, and Fridays. At the University of Edinburgh, Ross was one of the most respected professors, benefiting both faculty and students from the interactions with him. His guidance, wisdom, and kindness have profoundly impacted my life and the lives of many others.

Please accept my heartfelt condolences during this difficult time. I am grateful for the opportunity to have been a part of his academic journey. I will always miss him.

With deepest sympathy.

-- Lawrence Piao

I had just been talking to Ross Anderson a few days before I got the shocking news from a friend in Cambridge about him passing away unexpectedly. I could hardly believe it. Ross and I had been discussing a guest lecture I gave for his computer security course at the University of Edinburgh. He was his usual ebullient self, full of life, energy and passion. He spent a lot of time over email and Zoom to help me prepare and properly pitch the lecture. I am sure it would have been a lot less effort for him to just give the lecture himself, but he cared deeply about giving the students the best possible education, so for him a lecture about silicon level security from someone in industry was an important part of the students' education. He told me he was especially keen to impress upon the students the guest lecturer was a fellow Scotsman. Ross and I both come from Glasgow.

This level of passion, drive and "giving a damn" typified how Ross approached the many things he cared about in life, including playing the bagpipes. I took the photograph above on 14 March 2009 and I recall just how good the bagpipes sounded when played masterfully with great skill. Few of the songs that night were traditional Scottish tunes, most were pop songs amazingly transliterated to the bagpipes and they sounded wonderful.

I first came across the intellectual juggernaut Ross Anderson in a professional capacity, along with Saar Drimer, in Cambridge to discuss the security flaws in the chip and pin credit card system (Chip and PIN is Broken). However, we quickly bonded and became friends, due to a mutual interest in food, drink, music, technology and a similar "Glasweigan" perspective on the world.

I was surprised he would give the likes of me the time of day to talk deeply about silicon technology, security, banking, and the social aspects of security at a high bit-rate that I could hardly keep up with. I quickly realized that he was not a man of airs and graces, and treated everyone he encountered as equals. I very much admire and respect that quality. He could be fiery and intense, brutally direct and blunt, and loud and emphatic. He was that way because he cared.

As a broadly educated man he had the capability to intersect technology with economics and how people behave to understand the weak points and failings of technology. A phenomenally important role he played was holding to account the world of finance when it wrongly accused customers of giving away their PIN numbers, when they were actually stolen with "man in the middle" attacks from handheld chip and pin readers. The fact that he had worked in banking before he moved to academia no doubt greatly strengthened his hand.

The UK Post Office IT scandal reminds us how the big and powerful continue to cover up their failings by wrongly blaming innocent individuals. Big corporations entirely control the development and deployment of machine learning technology which will increasingly make inscrutable judgments about our lives, and us. Politics and government is attempting to make some inroads to try regulate AI. However, the world needs many more Ross Andersons in academic positions where they have the platform to speak truth to power, and fight for the ordinary person, to stamp out injustice, and fight for what is right and decent.

This is a picture of the last time I saw Ross in person, in January 2024 at Fin Boys restaurant in Cambridge, here shown with our mutual friend Sanjay. Anyone that knew Ross understood the depth of love and commitment he had to his family. Beyond that, he was a galus friend.

-- Satnam Singh (see more)

I may be one of the most junior people here to speak about Ross. As one of the last students advised by him, I may not have known him for as long as some of you have. Our connection began over four years ago when he, along with two other professors, interviewed me for a research assistant position at Cambridge. When I started my PhD on cybercrime with Alice in early 2022, I was fortunate to have him as my advisor, and since then, we have worked closely together.

Ross was the first person to take me for a walk around the building and outside on a sunny day when I arrived in Cambridge. We discussed various topics, and my initial impression was that he knew everything while I knew nothing. Indeed, he knows things very well. We had around six months together before COVID-19 disrupted our social contact, after which I had to return to my home country for over 1.5 years.

I was forced to return to the UK in late September 2020 to renew my visa. At that time, I was staying in a room far from the lab, and restrictions prevented me from going outside. Ross kindly came to help me collect and scan all necessary documents, not just once, but twice. When I expressed concern about the risk of infection and suggested waiting until after my self-quarantine to renew my visa, he reassured me: "Don't risk the visa, though. I can handle hazardous materials. Look, I pick up dog poo every time I take the dogs for a walk. I can't imagine that your passport is more hazardous!". I deeply appreciate his care for me, and I'm certain he cared deeply for others too.

The next time I met him in person was in late 2022 when I returned to Cambridge as restrictions were lifted. I started my PhD soon after, and since then, as we worked closer together, I could much better feel his endless energy. I admire him not only for his vast contributions to science in many ways, his enthusiasm, and his inspiration - as others have mentioned - but also for how he treated students and colleagues. For me personally, he always found opportunities to push me forward and introduced me to those he thought could help. He encouraged me to attend SHB this year and connected me with his former student in Singapore for an invited talk. He intended to connect me with some others too, but sadly never got the chance.

Ross also cared about my family as much as he cared about me. In mid-2023, my uncle was diagnosed with craniopharyngioma, and once Ross learnt about it, he tried everything he could to connect me with the best surgeons in Cambridge and India. Unfortunately, my uncle didn't get to travel, but Ross's help meant so much to me and my family. He was very generous, always spending his time and patience correcting my mistakes, not only in research but also in my English. He often told me, "Your English is broken," but the good thing was that he also explained why it was wrong and how it should be corrected. He gave me compliments when I did good work, even just small ones, and that encouraged me very much. I really felt reassured having him by my side.

The last major thing we did together was moving his bookshelf to the new office as Cambridge forced him to retire. He of course did not like that. When I saw him carrying things around, I offered my help, and he accepted. It took us a few weekends to sort everything out. He told me he had been in the old office for almost 30 years and would miss it. He hoped he could stay in the new office for another 20 years. I wished the same. He showed me a card his mom and dad gave him long ago when he was a kid, and with his great smile, I knew he cherished it very much. I always wanted to have a picture with him when I graduated, and I promised to give him a copy of my PhD thesis later this year. Sadly, I will never have that chance.

Our last interaction was just before he passed away. I looked inside his office and saw him editing his webpage to make all the chapters of his book available for free. He had always wanted to do it, but copyright restrictions had prevented him until now. He also mentioned he might write a new edition when he had time, which I was eagerly anticipating. Later, he knocked on my door - as he always did to say goodbye before heading back home when we were both working late in the lab - and told me he would be in Edinburgh for a few days and would see me after Easter. Sadly, it was the last time I saw his smile.

I know nature is cruel, and that death is a part of life's beauty, but it has been incredibly heartbreaking to lose him so early and so suddenly. He passed away close to Good Friday, and I believe he has now risen to heaven with God. His life was very well-lived, and his vast contributions will never be forgotten by many generations of students, colleagues, and friends.

And yes, he had a strong passion for folk music. Here are some (rare) videos of him playing the bagpipe, recorded by me around one year before his passing. I miss that.

-- Anh V. Vu

Devastating to hear this. Ross corresponded regularly and was tremendously encouraging. He made me feel like there was somebody else out there who understood the gravity of the work we do.

Ross has been one of the precious few who understood my thoughts about civic cybersecurity and how true national security is an ordinary daily attitude. That every grandmother and schoolchild deserves basic digital security, privacy and autonomy in their online life. That it is all our responsibilities to step up to the task that Apple, Google, Microsoft and our governments cannot handle alone unless we lead the way.

My cybersecurity courses and indeed my own security thinking have been profoundly shaped by his work. The idea of "Security Engineering" as a serious, measurable, reproducible discipline lay in his hands.

Ross was never anything but generous with his time and honest with his opinions. His open publishing stance (to have complete copies of his older texts online, which he skilfully negotiated with Wiley. is an example to all academics.

His work leading the Cambridge team in doing interesting, socially relevant security work in a world of so many dry, inaccessible papers on cryptography and protocols was a refreshing beacon of light.

We planned to meet in Edinburgh one day and share some good single malts. I feel lost at this news. Sincere wishes to all Ross's family.

-- Andy Farnell

It's only been a week but still struggling with this genuinely massive loss to all that we are doing in this field.

Ross was generous and funny. But most of all authentic. He did not suffer fools. Especially jumped-up pseudo-authorities and those who use cybersecurity as a way to try to bamboozle and dominate others. Ross had a vision of computer security for the people, which I share and will not allow to fade.

There needs to be a Ross Anderson Memorial "Truth To Power" Award. Please, make everything you do courageous in his honour.

-- Andy Farnell

I saw the sad news yesterday, via Alec Muffett that Ross Anderson had passed, which is an enormous loss the the IT security community (and the industry more widely).

I didn't know Ross very well, so the obituary from his friend and colleague Prof Bill Buchanan OBE provides a much better summary of his work and impact. What follows are just a few personal reflections.

Ross did a great deal to shape my work and my career path, and I'm thankful that I got to meet him a few times along the way. I've previously described 'Security Engineering' as "the bible of infosec", and through that work Ross was impacting the world I worked in before I ever heard his name.

I got to meet Ross for the first time at one of his Workshops on the Economics of Information Security (WEIS). That series of workshops came about from Ross's prodigious talent for picking up different lenses to look at the world of security through -- in this case the lens of economics, leading to his seminal paper 'Why Information Security is Hard -- An Economic Perspective'. My first encounter with Ross was a little prickly, as he had a huge distrust of banks, and by extension the people who worked for them; but I kept going back to WEIS, and over time our conversations became more collegiate*. My favourite memory of him was after WEIS 2010 in Cambridge MA where he invited anybody hanging around to join him for dinner, bringing together a wonderful slice of the community to talk shop over giant sushi boats. I wish I had a photo, as the happy relaxed Ross that evening was Ross at his best.

Through WEIS I got to know folk like Allan Friedman and Tyler Moore who are leading efforts to make us all more secure.

A few years back I found myself meeting a CISO for the first time and spotting a copy of Security Engineering on his bookshelf. I knew we'd get along just fine.

I'd hoped to see Ross again, and maybe chat to him about the Horizon scandal. I'd have also wanted him by my side as an expert witness if I ever got entangled in any legal trouble to do with computers. He'll be sorely missed; though it's a sign of the quality of his leadership that there are so many people that will continue his great work.

RIP Ross.

* After a conversation with Ross and Hal Varian about side channel attacks I recall thinking of an attack against pre-emptive execution in CPUs (like Meltdown or Spectre) which I dismissed at the time thinking the geniuses at Intel and Arm would have everything under control. Never assume -- verify.

-- Chris Swan

WHEN A CRYPTOGRAPHER PASSED AWAY

When a cryptographer passes away, one feels an inscrutable sense of disorientation, a loss that only the memory of him might soothe; yet, you realize that nothing in his absence can decipher that state of the soul which, we mortals, call nostalgia.

When a cryptographer dies, you reflect on our diminished capacity to solve existential riddles, puzzles that only a mathematician as an artist could have dared to desire to unravel.

Upon the death of a cryptographer, it becomes apparent that the world has lost a piece of the broader mosaic in which each one of us strives to fit, and you understand that he, perhaps, was on the verge of grasping how the mosaic and the piece are equivalent.

But, at the metaphor's end, we all now know that if the cryptographer dies, it is for three days, and then he rises again, ready to solve the secret paths that lead to enlightenment.

In memory of Ross John Anderson, who passed away on March 28, 2024.

-- Roberto Garavaglia

That is sad news for the security community. I have only just read that Ross Anderson, an inspiring author and security expert, has passed away. I read his book, Security Engineering, many years ago and often referred to it. I found it to be an excellent resource when starting out in Security Engineering. It's no surprise that I still say it's a must-read book for anyone interested in the field.

We lost a prominent community member, but his legacy will live on. Prof Bill Buchanan has expressed our loss beautifully in a fitting blog post. You can read his tribute to Ross Anderson here.

Rest in peace, Ross Anderson.

-- Steven L.

22+ odd years ago I emailed Ross out of the blue. At the time I was working at a small startup attempting to build mobile banking infrastructure for rural poor in South Africa and elsewhere. I was after a copy of a paper he had mentioned in a talk and Ross replied with a blunt to the point email about how hard he thought the problem domain we were trying to tackle was (along with a pointer to the paper I had asked about). I remember being slightly annoyed by the initial tone of his response, but it got me thinking - then thinking a lot more. There were some very well thought out reasons behind his arguments. I replied a few days later with a detailed list of how we were addressing his concerns along with some others he hadn't mentioned but also acknowledging the areas we needed to dig into further. I didn't really expect an answer, after all, I didn't know him, but he had got me to think hard on key problems and I wanted to acknowledge that.

We got a lot more than a simple reply. We got his focused feedback, constructive criticisms, pointers to other work he thought was relevant, general support, some key follow up conversations on the phone, followed by introductions to folks he knew in industry who he thought could help (who would have never entertained us at that stage otherwise). While the startup eventually didn't make it, many of the ideas we worked on did. Of the folks that we met through that whole adventure, Ross was one of the standouts. Yup, he was very good people indeed and will be sadly missed!

-- ptrott2017

In Memory of Professor Ross Anderson: A Titan of Cybersecurity and Digital Privacy

Today, we mourn the loss of Professor Ross Anderson, a pioneering force in the realms of cybersecurity, digital privacy, and smart card technology. His groundbreaking work has left an indelible mark on the field of computer science, shaping the way we understand and implement security in an increasingly interconnected world.

Key Contributions

- Co-invention of the Needham-Schroeder protocol, enabling secure communication across global networks without prior identity knowledge.

- Significant advancements in smart card technology, enhancing the security of devices we use daily, from credit cards to passports.

- Development of APIs with a focus on security and privacy implications, contributing to safer software applications for all.

- Authorship of "Security Engineering", a seminal text in security studies, and vocal advocacy for privacy rights in the face of global surveillance.

Recognitions

- Elected Fellow of the Royal Society (FRS) and the Royal Academy of Engineering (FREng) in 2009 for his pioneering contributions.

- Awarded the prestigious BCS Lovelace Medal in 2015, highlighting his extensive contributions to the IT industry and academic research.

Professor Anderson's work transcends academic accolades, impacting policy debates on security, privacy, and human rights. He established security economics as a critical academic discipline and tirelessly worked towards a world where technology serves humanity's best interests.

As we reflect on his remarkable legacy, let's continue to push the boundaries of what's possible in cybersecurity, inspired by his vision and dedication. Ross Anderson's influence will undoubtedly persist, guiding future generations towards creating a more secure, private, and equitable digital world.

Rest in peace, Professor Anderson. Your legacy will not be forgotten.

-- Rafael Narezzi

Our paths occasionally crossed, mostly by "electronic means" as has been the way society has turned these past three decades.

Ross had a passion for the well being of people against those that would seek to do them harm. Thus had a very real interest in their privacy and security in the changing face of society and economics the technology brought.

From memory our first direct contact was back in the early 1990's over the use of RF to force free running logic circuits to become synchronised (injection locking). Thus opening a doorway to other attacks on the likes of Smart Cards.

As part of it I pointed out that the use of RF was a two way street, not only injecting signals in but also for pulling them out (which I'd demo'd on pocket gambling machines and electronic wallets). Back then the general assumption was "TEMPEST" was sufficient and if it did not radiate then it was secure. As PC's were mainly steel boxes with few cables entering or leaving thus approximated faraday shields many thought they were secure.

This was not true as I'd found by independent research that by "illuminating a current carrying conductor" you could get it's waveform to be carried away by an RF carrier a considerable distance.

As I mentioned to Ross back then the keyboard cable was the easiest cable to attack with RF. It also had the advantage of being at "the users fingertips" input interface. Thus was an especially useful attack vector as it would reveal passwords and other secrets (a fact not lost on later developers of hardware "key-loggers").

Ross was kind enough to put me in contact with another researcher in Belgium who was investigating injecting pulses of energy into chips via "pico-probe" coils.

Ross had a reputation amongst some of possessing "a sharp tongue" and both a wry and dry sense of humour. The latter I saw pop out from time to time but the sharpness of tongue only on those really deserving of rather more due to the injustices they inflicted on others.

Like many others I always found Ross to be approachable and gentlemanly in a way seldom seen these days, and he would often go out of his way to not just help but inspire people a rare quality the world could do with a lot more of.

Less well known is Ross had an interest in music and actively researched it. So for Ross, Highland Cathedral played by "The Phantom Piper". In memoriam Ross, rest in peace.

-- Clive Robinson

Professor Ross Was one of my teachers at the Computer Lab. I had frequent emails with him even years after I left the lab. His strong desire for security really put it even more into me.

Once in class we were discussing vulnerabilities in vehicles, this was about 4 years ago. He asked "whats the worst attack one could do", he got super annoyed that we didnt have a good answer, banged his hand on the table, full-red faced shouted "No, the worst attack is to remote compromise the cars, lock all the doors, increase the heat, put them drive and kill everyone". Well, he was right, that was the worst attack. You could see from his face he was dissappointed his students did not realise, maybe he felt bad of his teaching, but his teaching was phenomenal.

It is really a sad day, the world has lost one of the worlds best security professors ever. He will be dearly missed.

He taught me the tricks he used to get people in power to listen, advice I would never forget.

-- Anonymous