Connecting Cyber Community with Political Machinery
There comes a point in many storied careers where a single event sits as a professional fulcrum. For Jen Ellis, that moment happened more than a decade ago.
The spark didn’t come from something that happened to her. Instead, it was what she saw her good friend, HD Moore, go through for doing top-notch security research. She was collaborating with the Metasploit creator, running communications for security firm Rapid7 and the firm’s growing body of security research. HD Moore and his team conducted the technical exploration, and she engaged with the broader community and told the world why that research mattered.
Everything was humming along until legal threats from the US Department of Justice (DoJ) derailed his progress. In 2013, Moore was put through a legal crucible and threatened with potential prosecution for the legitimate security research he was doing through Critical.io, an Internetwide scanning initiative that would eventually become Rapid7’s Project Sonar.
Moore was eventually cleared, but the damage was done. After three months of strain, he questioned whether he wanted to continue doing security research at all. Ellis was incensed.
«I got really, really mad about it. Not at HD — I totally understood his point of view. But I was mad that we had ticked every box to say this was legitimate, good-faith research,» she says.
She dug into the Computer Fraud and Abuse Act (CFAA), the Digital Millennium Copyright Act (DMCA), state laws, and more. She didn’t like what she saw. The legal and judicial frameworks were acting in opposition to good guys like Moore. Prosecutions were flying, and so were lawsuits from companies that the researchers were trying to help with disclosures.
«I found out that researchers all over the place were getting threatened by companies, and I was really indignant about it,» she says. «I decided that something needed to be done.»
From PR Maven to Policy Dynamo
It was those big feelings and sense of purpose that spurred her to walk into the office of Rapid7’s then-CEO, Corey Thomas, with what seemed like a pretty audacious request.
«I want to change the law,» she told him, expecting pushback given her total lack of experience in the policy arena.
Instead, he told her to give it a try.
«I can remember looking at him and being like, ‘Are you crazy?'» Ellis says. «I said to him, ‘I’m not a policy person. I’m not a lawyer. This seems like a wildly crazy thing to do.'»
Thomas came back with a simple question: «But is it the right thing to do?»
With her affirmative, he reiterated his green light. After all, he told her at the time, it would probably take up only 5% of her time.
«It was not 5% of my time,» Ellis chuckles.
The so-called side project transformed into a career-defining mission that would see Ellis testify before Congress, forge an unlikely partnership with the DoJ, and ultimately help shape how the US government treats security researchers. And as much as the self-effacing Brit would demur at her professional clout, she has made enough of an impact that it recently earned her high praise directly from the Crown. This summer, Ellis was bestowed the Member of the Order of the British Empire (MBE) honors for her contributions to cybersecurity policy.
And in true Ellis fashion, her LinkedIn announcement was capped off with a joke: «And to my American friends, the answer to your question is yes, you definitely ARE now required to curtsey whenever you see me. Don’t believe anyone that tells you otherwise.»
This is who Ellis is to the cybersecurity community in a nutshell: Someone who’s never afraid to cut up with the best of the jokers while simultaneously doing the serious work of thwarting cybercriminals and keeping white hat hackers from getting swept up in the dragnet.
A Breakthrough Meeting With the DoJ
In 2014, Ellis had what she called her first big breakthrough when she made contact with the DoJ’s Computer Crimes and Intellectual Property Section (CCIPS).
«I thought that they would be polite and sort of usher me out the door,» she admits. «And actually, what happened is they said, ‘We completely get it. It’s a thing that concerns us. We want to make sure that we are doing the right things to support security. How can we help?'»
Among the people she met that day was Leonard Bailey, then the head of CCIPS, who would become a key partner in the years ahead. When Ellis invited him to come to Black Hat to meet security researchers, the initial response was predictable: «The Department of Justice does not attend events in Las Vegas.»
A month later, Bailey called.
«Is the offer still open?» he asked her.
At Black Hat, Ellis assembled a couple dozen security researchers — including Dan Kaminsky — to meet with Bailey. Her instructions to the researchers were to be respectful but honest. She didn’t want them to sugarcoat anything, but she asked that they recognize that Bailey wasn’t the enemy. He had, after all, taken the time to come listen to them.
Getting their buy-in at that time was a feat, recalls Bailey. This was just a year after the death of Aaron Swartz, who faced CFAA charges for downloading academic articles, which many in the cybersecurity world found unfair. It was a time of peak hacktivism and a higher-than-usual amount of bad blood between security researchers and the feds.
The fact that Ellis had built up enough trust and credibility to gather everyone up under that shadow is a testament to what makes her special, Bailey says.
«It was a very charged period,» he says. » And for her in her capacity to take folks and say, ‘We’re going to have a respectful meeting with this guy,’ was remarkable. There’s no way that that meeting or what it produced could have happened without her.»
The meeting ran hot for about an hour, then something shifted.
«We moved on to really what we shared in common,» Bailey recalls, «which was an interest in protecting people, protecting networks, protecting victims, and understanding that that’s what white hat hackers do.»
‘Crazy Two Weeks’
Ellis’s «crazy two weeks» in July 2015 epitomize the early trajectory of her progress following that turning point with Bailey. That summer she was lobbying on multiple fronts, not only helping connect DoJ officials with security community members who could guide the DMCA Triennial review process to give security researchers exemptions to that law, but also fighting against a proposed cybercrime bill that would have made life even harder for security researchers than it already was under CFAA.
In week one of the whirlwind, she testified before Congress on a cybercrime bill — the only witness not «blindingly in favor» of it. At the end of her testimony, Sens. Whitehouse and Graham told her they’d be open to working with the security community on reform. It was the first time anyone in Congress had said they’d engage on CFAA from the researcher protection angle. In week two, Rapid7 went public. Ellis was part of the team that rang the opening bell at NASDAQ.
«I flew back to Boston on the private jet,» she says. «I remember sitting there with a glass of champagne saying, ‘Well, I’ve peaked. This is it. You might as well just end it now. It’ll never be as good again.'»
Praise Abounds
Ellis’ first milestone came in 2016 when the work with Bailey bore out a policy that required federal prosecutors to consult with CCIPS before bringing any charges under the CFAA. More years of work from her and others at the Electronic Frontier Foundation, I Am The Calvary and more, eventually yielded a 2022 landmark directive from the DoJ discouraging prosecutors from pursuing good-faith security researchers.
Ellis is far too humble to take direct credit for these changes, but she will say she has been honored to take up the bullhorn for a security community full of super-smart people.
«I am only a product of the community,» Ellis says. «I am only capable of doing what the community enables me to do. I am here to give the community a platform for its voice, and when it can’t or doesn’t want to use its own voice, I am here to take that message forward.»
But those who have worked with Ellis are pretty unequivocal: They say she has well earned her position of influence.
«She’s wicked smart,» says Bailey, who has since retired from the DoJ and now teaches at Georgetown University. «She is an independent thinker. She’s creative. She’s a realist. She’s a pragmatist. And she’s always been willing to put the work in.»
Katharina Sommar, head of government affairs at NCC Group, was one of the people who nominated Ellis for her MBE. She first met Ellis at CYBERUK in 2018, connected by someone who noted they were both working on legal protections for security researchers.
What has always impressed her about Ellis is how she gives security researchers a voice. These are people who are affected by government policy but are too heads-down in their work, too intimidated, or too disconnected from the political machinery to know how to have their views heard.
«She has an uncanny ability to bring other people up, make them feel clever, special, and like they can take on the world,» says Sommar. «She creates opportunities for and connections between people. I have been introduced to so many awesome people by and via Jen, I’ve lost count.»
Sommar was delighted that the MBE honors came through for someone who never does things for self-aggrandizing reasons.
«Jen does a lot of things not because she thinks she’ll get kudos for them, but because she believes they’re the right thing to do,» Sommar says. «Someone else had to give her the recognition she deserves.»
What She’s Working on Now
After moving back to the UK to be with family during the pandemic, Ellis eventually left Rapid7 and founded NextJenSecurity, shifting her focus to the global stage and policy influence in the UK and the EU. After years of connecting American researchers to their own policymakers, it became a running joke: Would she, as a Brit, like to meet some of her own lawmakers?
They made good on that, and she has certainly built her network up since then. Ellis serves on the UK Cabinet Office’s Government Cyber Advisory Board, and she’s a fellow of the Royal United Services Institute. She also stays connected with her US colleagues through a range of work at think tanks and industry groups like the Institute for Security, the Center for Cybersecurity Policy and Law, and the Rapid7 Cybersecurity Foundation.
A decade since that formative moment in Thomas’ office, her work has expanded far beyond marketing and PR. She says her consultancy gigs tend to center around three main areas: policy development and influencing, community engagement, and communications strategy. They’re all oriented toward the same goal.
«Policy to me is a means to an end, not an end in itself,» she says. «What we’re really trying to do is reduce risk at scale.»
Throughout her career evolution, Ellis has never lost her self-deprecating humor or her sense of purpose. She related being at a conference recently with high-ranking generals walking about in their crisp uniforms and medals, wondering with a laugh, «Do they know I eat my crayons?»
«I find it crazy. There’s a part of me that looks around the table and goes, ‘I should be at the kids table coloring.’ But there’s another part of me that kicks in and asks, ‘Why are we still talking about these things? Why haven’t we got to action yet?’ And I swoop in to say, ‘These are the things we should do,» she says. «Of course, then people look at me like, ‘Who is that incredibly bossy, opinionated woman?’ And I remember about the crayons.»
PERSONALITY BYTES
What many security folks don’t know about her: «I’m a high-functioning introvert,» she says. «My mom is an extrovert, and so she raised her children to appear to be extroverts—and she did it very successfully. I’m shy. But my stage persona is definitely not shy.»
A humbling time in her political advocacy career: Her first three trips to D.C. were «the best baptism by fire,» as each time, legislators were preoccupied with consequential crises. The first time was during the turbulent launch of Healthcare.gov, the second during an immigration crisis, and the third during a major Ebola outbreak.
«What this taught me was we like to be really flippant about policymakers and say that they don’t get it and they don’t care. But the truth is they’re working on enormously disparate topics. Very life and death,» she says. «It gave me good empathy for what they deal with.»
Career highlight: Testifying to Congress in 2015. «That was a career highlight for me. I absolutely loved doing it.»
How her industry colleagues talk about her: «Jen is awesome, she sometimes forgets she is, and it’s brilliant she’s now got an MBE to remind her when she does forget,» says Katharina Sommar, head of government affairs at NCC Group
Favorite hobby: Talking to other people about theirs. «I’ve never really been that person that had a good answer to this question because I’m not sporty and I’m not musical, and I don’t write copious amounts of fan fiction, although maybe I should. I’m just wildly interested and curious about people and the things that they do and what they care about.»
What she does as a policy influencer: «I talk to people, and I get what they’re thinking about, what they’re worried about, what they’re concerned about, and I pull it in. I am trying to harmonize it and make that into something pragmatic that policymakers can take forward.»
Este contenido de ciberseguridad nos ha llegado de: DarkReading
Puedes encontrar la noticia original en el enlace que sigue: https://www.darkreading.com/cybersecurity-operations/jen-ellis-connecting-cyber-community-political-machinery
