Lorrie Cranor’s Unexpected Journey into the Computer Science Industry

By Ellen Glover

Tuesday, February 27, 2018

Nothing in Lorrie Cranor’s life has really turned out like she expected.

“I never wanted to be a computer scientist, let alone a computer science professor,” says Cranor before her talk earlier in the month. She now teaches computer science at Carnegie Mellon.

But, she had always been interested in math and science. As a child, her father worked as a biomedical engineer at Bethesda Naval Hospital, so he had access to all the latest research computers, meaning Cranor could learn about them and study them from a young age.

When Cranor started high school, she had the opportunity to participate in a math and computer science magnate program.

“There were not very many girls in the program, but it was really amazing to be in classes with students who were so interested in these STEM field,” remembers Cranor. “One of the reasons that I don’t think I really liked computer science is that, back then, to do your computer science homework, you pretty much had to go to the computer lab to do it. So, I would go after school to the computer lab and often I would see I was the only girl in the computer lab. And there were all these guys in the room who brought their coke and Doritos and were planning on camping out there all afternoon. These were not my people. I kind of associated, if you’re going to be a computer scientist, you have to like that sort of thing, which wasn’t what I was into. So I really ruled out the idea of being a computer scientist.”

When she started her freshman year at Washington University in St. Louis, Cranor still maintained that she had no intention of majoring in computer science. But, for convenience sake, she wound up earning a minor. Then, she got a master’s in computer science so the school would pay for her to earn her PhD in engineering and public policy.

After earning her degrees, Cranor planned on staying in academia. But, when she heard about AT&T Labs’ new public policy research department, she sent them an email and told her she was interested in a job with them. After an interview the following week, they offered her a job on the spot.

“I went off to New Jersey, which was not a state I had planned to move to at all,” says Cranor. “I had notplanned to work for a company, I had planned to work in academia but, you know, things don’t always work out the way you planned.”

While she was there, she shared an office with Paul Resnick, who now works at University of Michigan’s School of Information. He offered her a chance to travel to Washington D.C. and work with the World Wide Web Consortium, W3C, to work on new privacy standards for the Internet.

“The thing was, I knew very little about privacy or standards but I said sure,”says Cranor. “I agreed to work on this and I thought this is a few months, this will be fun. What I didn’t realize is that I would spend the next seven years working on this. I also realized quickly that I was going to need to be an expert in privacy.”

After seven years, Cranor and her colleague had developed the Platform for Privacy Preferences, P3P.

“The idea behind the standard is that its’ an XML language for privacy policies,” explains Cranor. “So websites can convey their privacy policies in this computer readable language. Now, instead of humans having to real these long privacy policies, which nobody reads, your computer, and more specifically your web browser, can read it for you.”

The standard got the attention of several companies, including Microsoft. Although, through talking with them, Cranor found that the system wasn’t user friendly at all. So, after going to her boss, she helped to develop Privacy Bird, a tool that tells you what websites will do with your information.

“I did a lit review and there was nothing on HCI for privacy,” says Cranor. “So this whole idea of HCI means security and privacy was just not happening. So I realized there’s a need for this, people should belooking at this. That became my inspiration for this research area I want to get into.”

It was around that time that Cranor decided to leave the corporate world behind and return to academia, the place she had been wanting to be all along. She got a job at Carnegie Mellon and proposed a research vision for them that centered around usable privacy and securit

“I didn’t fully know what it was something but I made up something that sounded pretty compelling and I got a job at Carnegie Mellon school of Computer Science and I became a computer science professor,” says Cranor. “It was really funny, to me anyway. This is not at all how I expected things to turn out. I’m really happy about it, but this is not the path I had planned.”

During her time at Carnegie Mellon, Cranor has spear headed an entire research department that looks at usable privacy and security. Part of the uniqueness of her research, besides the fact that it is a field that is only just now becoming popular, is that a lot of it combines art,something Cranor has always had a passion for.

She recently did a study where she had participants of all ages draw pictures of what they thought of when they hear the word privacy. She and her grad students have been coding for the kinds of pictures that have been drawn so they can determine the public’s understanding of security as it pertains to their online presence.

“We thought, maybe if we see what types of icons and drawings people make, that will give us ideas on how to better communicate about privacy and security and these tools,” explains Cranor. “But, separately from that, we've been looking at what other concepts we see here. Because these are the things that are on the top of people's minds and I think this gives us good insights into what people are thinking and what people of different types of backgrounds are thinking.”

One of Cranor’s most popular projects is one she did when she was on sabbatical.

“I spent my sabbatical doing art because that was what it meant to me to be able to relax and have that intellectual restorative experience,” says Cranor, who enjoys quilting and other fiber arts. “I had no idea what I would do but my dean said I have a sabbatical. Part way through the year I was like 'oh yea, I said I would do something about security and privacy.' So I did start thinking about doing some privacy quilts and I made a couple of privacy related quilts. Then, one of my friends said 'you need to make a security blanket.' Like, of course!”

Cranor’s privacy quilts, particularly her one centered around passwords, became a big success. The school even held an art exhibit to display it. When Cranor realized she had nothing to wear to the exhibit’s opening, she decided to make a privacy dress, a tailored knee-length dress with bright,neon covering it. Since then, Cranor and her dress have been featured on a number of national news outlets and, when she went to D.C. to give a Congressional briefing on security, she was asked specifically to wear the dress.

Cranor has continued to do interesting research. Right now, she is working on a project that is quantifying some of the benefits and issues with the various methods of monitoring and limiting a teenager’s use of the internet.

“There’s this growing group of people at CMU who are interested in usable privacy and security,” says Cranor. “We have this critical mass there which has been really fun. I think, arguably, we have the largest usable privacy and security group anywhere, certainly the U.S.”

However, Cranor says that there is still a lot of work to be done in the computer science industry in terms of female representation. “I have been to computer security conferences where you look around and it’s like 10 percent women. I was actually at a conference a couple of years ago wherethere was an evening program that involved a stripper.”After reporting the incident, Cranor actually found that the issue was addressed and there were more conversations being had about making the industry more inclusive.

Now, she is finding that there are more and more women expressing an interest in fields like her, so she is hopeful.

“I'm doing graduate admissions right now,” says Cranor. “We're seeing more and more female applicants every year. Really strong female applicants who will get into our programs, and that's really good to see.”

Cranor visited Indiana University Bloomington on February 8 to talk about her journey. An archived recording of Cranor’s talk can be found HERE.