CSI: Cyber is getting beat-up by the information security community and at first we went along for the ride. You have to admit it is fun to play cyber bingo, live tweet during the show, or critique the technical inconsistencies, but there is something more here, something very important. The security community has long fought an uphill and losing battle to recruit new talent and educate users about the risks of information security. CSI: Cyber offers the potential to do just that, and on a massive scale. It also has the potential to spread Fear, Uncertainty and Doubt (FUD) and scare the masses, and our lawmakers, into reactions that would be counterproductive.
CSI: Cyber offers the infosec community a tremendous opportunity to raise public awareness, educate, and inspire the next generation of information security professionals.
If you use number of Twitter followers as a rough metric for influence, the leading minds of the information security community average between two thousand and ten thousand followers, a few outliers approach about forty thousand. As a point of comparison, guess how many Twitter followers CSI: Cyber cast member Shad Moss has… more than three million. That’s right, Shad Moss (AKA rapper Bow Wow) and his reformed black hat hacker character, has more followers than the entire top one thousand information security professionals, and Shad Moss is just one cast member.
Children all over the country have been inspired to be law enforcement agents by shows like Criminal Minds, NCIS, Bones, and CSI. Summer camps have sprung up catering to those seeking to learn more, even if the reality is a little more pedestrian than the hipper depictions on the screen. I’m confident that the country won’t face a shortage of crime scene lab techs and associated law enforcement agents any time soon.
With this type of influence comes responsibility. Fear, Uncertainty, and Doubt, long the enemy of the infosec community makes for good television. No movie or television program is immune. We all remember the “fire sale” antics of Live Free or Die Hard. The trick then is to walk the fine line between technically grounded reality and compelling FUD-laced entertainment.
We shouldn’t forget either that many in the information community today were inspired by War Games. Imagine if the infosec professionals of 1983 could have live tweeted during the movie. I’m sure they would have had a coronary. Get off my lawn, there is no way a teenage hacker could have broken into a DoD computer and started a nuclear crisis. As a teenager, we found War Games compelling, even if we didn’t know what we didn’t know. Today War Games and WOPR are enshrined in our lore.
CSI: Cyber’s Hayley Kiyoko reminds her 200,000+ Twitter followers to secure their wifi.
Done correctly, shows like CSI: Cyber can both educate the populace and inspire the next generation of information security professionals. Even if the reality isn’t quite as easy as what might appear on the screen, these shows can help raise the bar on what young people aspire to be. They may even inspire people to lock down their wifi.
When thinking about CSI: Cyber, it may be useful to compare it against House. House ran for eight seasons, racking up 51 awards (including two Golden Globes) and 112 nominations. The show employed a prominent physician (Lisa Sanders, author of the column “Diagnosis” from New York Times Magazine) as an advisor and importantly, according to Dr. Sanders, “three different doctors… check everything we do.” This level of medical realism provided a rich backdrop for stories that ultimately revolved around very real, complex human characters.
CSI: Cyber offers an opportunity for partnership between the infosec community and Hollywood. We can help make the show better culturally and technically, while the actors and the production team ply their craft. There are many talented infosec professionals, I’m sure some would be willing to help. Enabling CSI: Cyber and similar efforts represents a win for both sides. Perhaps even a few of our favorite hackers could get cameo appearances, if not in person, at least their code or some of their music.
We’d like to add that the idea of working with Hollywood to help educate the public on information security is not new, we first heard it suggested as a potential strategy in 2009 by Melissa Hathaway who had just led a 60-day national-level cyber security review. At the time the idea was a valuable insight and we believe this even more today.
With CSI: Cyber the information security community has a rare opportunity, where our discipline is at the forefront of national attention. Despite its flaws when viewed through the eyes of an information security expert, CSI: Cyber is a serious, professional grade effort addressing critical information security issues in front of a global audience. There is no doubt that the recent Sony wake-up call has gotten the media industry’s attention. Ultimately, the final answer may not be CSI: Cyber, but we as a community of researchers and practitioners should learn to partner with those producing movies and television.
This article examined how we could use the current focus of a television show like CSI: Cyber and the momentum behind it to help people care about information security, consider pursuing a career in security, and work towards a more secure Internet. By figuring out how to reinforce and inform the work of the media industry we all benefit. Yes, the shows must entertain to succeed and with that comes the risk of FUD, but it can also inspire and intelligently educate. Properly done, we shouldn’t be jeering at CSI: Cyber and its kin, we should be cheering them on.