‘It Is an Act of Faith’

In high school, I liked math and was good at math and thought that I was going to be a mathematician: a weird thing to want to be as a teenager, but there it is. There were a lot of mathematicians who meant a lot to me; Andrew Wiles, with his proof of Fermat’s Last Theorem, loomed very large for me. I was also fascinated by a lot of older mathematicians; I did a research project on Madame Du Châtelet, who had translated Newton’s Principia into French.

But I went to college with some people who were a lot better at math than I was. It was a new experience for me not be the strongest student in the class. I started to understand if I worked as hard as I possibly could, maybe I could major in math, but I was never going to be a great mathematician.

I was good enough at math to appreciate and enjoy it, but I wasn’t good enough to come up with original math. It’s like the ability to appreciate great classical music while also knowing that you’re never going to perform it at that level.

In theoretical math, the thinking is we’re going to perfectly prove everything—there will be no exceptions. In some ways, cybersecurity’s the opposite: there’s no way to actually finish this job. Instead, we’re going to perfectly prove how secure this encryption algorithm is, and then we’ll implement it … but then someone’s got to manage the encryption keys, someone else has to install the update … and 1,000 things are going to go wrong.

The question I’ve found most interesting about cybersecurity research is: How do you marry the rigorous technical part with the imperfect human part? How do you characterize accurately what happens in that combination, and do that in a way that’s not all about blaming humans?

When you conduct research, you start by trying to figure out what your research question is going to be. Then there’s a period where I’m doing interviews, I’m collecting and reviewing documents. And then there’s the—often lengthy—writing phase.

My favorite phase is in the middle, when you’re emailing a million people and trying to set up interviews and trying to get access to the documents you need. I love having that clear roadmap of what I’m doing today and tomorrow. And the writing has its ups and downs, but again, there’s a pretty clear sense of what you need to do.

Where I’ve always struggled most is at the beginning of the process, in settling on the research question. In making that choice, it means I have to trust that if I spend the next two, three, four years working on this, I’ll come out of it with something to say.

In the back of my head, I always have that question, “What if I don’t?” It’s a muscle you have to build up, to be able to say to yourself, “Well, Josephine, you’ve done this a few times, and you always have something to say at the end of it, and you will this time, too.” But it is an act of faith, to believe in the research process, as well as in yourself, that, in the end, you’ll have something that will be worth having done.

I think a lot about what it means to do research in a field that’s changing really rapidly. How do you write a book about cybersecurity that doesn’t seem totally out of date three years—or even one year—later? You do a lot of guesswork. You say to your students or your readers, “This is a direction in cybersecurity policy that you’re really going to want to pay attention to. The decisions we make about this in the next five to ten years are really going to matter.”

My father is an historian. Historians have a very clear sense that what they do is they write about the past, of course. I think all of us write about the past; I just write about the nearer past. I say to my students, “I’m teaching you what has happened because I cannot teach you what will happen.” If I can use that either to make some predictions or recommendations or to generate some ideas about what the future should look like, then perhaps that’s useful and interesting and productive. But part of the value is understanding what has happened and accepting that that can be valuable in its own right.

It’s not that I’m not striving for relevance—I always am—but I think that part of how you understand, say, whether or not a cybersecurity regulation is a good one is through analogies to the past. Part of what you do is say, “Look, I don’t know what the future is going to look like, but there are going to be a lot of things that will probably look pretty similar to some of the stuff we’ve seen before, and if we have a good handle on that, it can perhaps help shape a little bit what we do next.”

That’s not to say I’m an historian. I’m very much not. But understanding that what we do is to a certain extent studying the near past, I’ve found that helpful.

My father and I talk about our research a lot. He would tell you that part of doing research is believing that you’re engaging in a great and ongoing conversation. This idea that there are generations of people who have written about this before you, and there will be generations after you, and you are trying to make some small contribution to that—that’s much more natural to historians than it is to people in my field. But it’s been a helpful framing for me.

Part of my career has been about coming to terms with the fact that I was not going to be, as the great mathematicians are, perfect in that very specific way of ordering my thoughts rigorously, carefully, and beautifully. I still think mathematical proofs are beautiful, but I’ve come to enjoy solving other kinds of problems.

At the same time, I’ve realized that one of the things that I should be doing is thinking about some of these messier pieces of life, where that kind of rigor and that kind of structure is not necessarily as productive or as applicable. There’s a lot that’s interesting and valuable in the parts of life that are not as perfectly ordered and as completely provable as Fermat’s last theorem—and there are great problems to be solved.

—Josephine Wolff, professor of cybersecurity policy and associate dean for research, The Fletcher School; professor of computer science, School of Engineering; and director of the Hitachi Center for Technology and International Affairs

Our Tufts is a series of personal stories shared by members of the Tufts community and featured on both Tufts Now and Instagram.