Back in (Dan) Geer

After a two-and-a-half-month hiatus following his ouster from @Stake, Dan Geer has a new job. Geer, the former CTO at @Stake, was fired after publishing a paper that was extremely critical of Microsoft, one of @Stake's clients. Now he's vice president and chief scientist at Verdasys, a startup in Waltham, Mass., that focuses on digital rights management. (He was an adviser to the company for a year previous to this.) Geer says he has no regrets about publishing the paper, and he still has plenty of opinions on information security. CSO caught up with Geer the day he was introduced as chief scientist at Verdasys, or as he called it, "My day to remind everyone that living well is the best revenge."

CSO: What are your thoughts on "l'affaire de white paper" two months later?

Dan Geer: It still disappoints me. Four years of dog labor. I was the hardest-working person there, frankly. No one works that hard when they have to

only when they want to. I wanted to work hard there. That's why I'm disappointed.What's different about your new job compared to the last one?To me, chief scientist is about figuring out what the future holds, whereas when I was CTO of @Stake, I was deciding what products to bring into the world.What does the future hold?At the moment, I'm interested in figuring out how we learn to measure security in every sense. It's easy to say and hard to do, and nevertheless essential. It's clear to me that some things are easier to measure than others, and we should start there, with what we can do, and work toward the harder measurements.What are some of the measurements we can do now?Take the Financial Services ISAC. [Geer's a member.] It seems you'd want to share your sanitized intrusion logs with other companies. There's no way to know if you're a target of choice or a target of chance unless you measure yourself against others. We've got that data. Now we've got to measure it.What else are you thinking about?Well, in relation to what Verdasys is doing, in the last 10 years, we've gone from protecting the Internet, to protecting a domain like .mil, to protecting a company, to protecting a machine. The perimeter has been closing in. Now it surrounds only the individual file. I think this is about the right level for the perimeter, and it's what Verdasys addresses with digital rights management. Plus, the founders here came from a biotech firm that had an incident with digital rights management. I like working with security people who are sadder and wiser.But that technology is about controlling people's behavior onlinefor example, by not letting them copy and paste. It seems intrusive.Well, the technology doesn't say you can't have the file or the data in it, it says you're accountable for what you do with it. We cannot prevent those who are truly dedicated to stealing a file from doing it. But we can keep honest people honest, even if we can't make the dishonest honest.What do you think about the potential class-action lawsuit against Microsoft?I would love it. If the genie were in the room and granted me one wish, I would ask for one tiny, little change in the liability system. That is, if your failure to protect your systems affects me, why can't I have a beef with you? That's a change I'd like to see.

Copyright © 2004 IDG Communications, Inc.

Get the best of CSO ... delivered. Sign up for our FREE email newsletters!