Steven M. Bellovin—Studying Security With Me

Columbia University has one of the top security research departments anywhere. There are several faculty members—myself, Suman Jana, Simha Sethumadhavan, Tal Malkin, and Sal Stolfo — whose primary focus is security. Several others, including Roxana Geambasu and Henning Schulzrinne, do a lot of security-related work.


I'm frequently asked if I'm admitting new PhD students. For a variety of reasons, I am generally not admitting PhD students at this time, though I'm open to co-advising. List someone else as a prospective primary advisor and request that they contact me.

I am working on a number of projects, focusing primarily on security for large-scale systems. This covers a wide range of topics, including privacy, usability, and the systems aspects of encryption, plus the related public policy and legal questions.

Before you apply, think carefully about which faculty members have interests that match yours. Most of my work is rather practical or focused on the legal aspects of technology; if your interest is in proving theorems, I'm probably not the best choice of advisor.

Reading and evaluating applications is a difficult, painful, and time-consuming business; I won't review resumes ahead of time. Repeat: I cannot and will not evaluate your resume, CV, etc., ahead of time. It's not worth your while to send these to me. Please note the department's admissions deadlines.

Repeat: I am not admitting any PhD students at this time.


MS students are encouraged to participate in research. This can be done directly on a faculty member's project, or it can be done as an independent study project as COMS E6901. I'm willing to supervise such projects; see below.

Funding is more problematic. There are MS graduate research assistants in the department; except under extremely unusual circumstances, I will not offer such a position to an incoming MS student. I simply do not have the funding. Come here, take a course or two from me; after that, we can talk about specific projects. Again, I am not making any promises about money.

There is an MS track in Computer Security; see For admissions information, see

I have no way of knowing who might qualify for admission to the MS program.

Undergraduate or Graduate Independent Study

I'm happy to supervise student research, generally as COMS W3902 or COMS W4901 for undergraduates or COMS W4901 or COMS W6901 for graduate students. If you're interested in working on a project, come talk to me first. You have to be self-motivated and have some idea of the field you're interested in working in.

I strongly urge you to read Brian Kernighan's excellent advice on independent study projects before you approach me or any other faculty member.

Please note the following requirements from the W6901 description, which I think should apply to any of these courses:

Before registering, the student must submit a written proposal to the instructor for review. The proposal should give a brief outline of the project, estimated schedule of completion, and computer resources needed. Oral and written reports are required.

In other words: I insist on a 1-2 page written proposal. This is, in effect, a contract: I assign a grade based on how well you accomplish your plan. In other words, I want to know the scope of the project and the deliverables: code, a written description, a draft research paper suitable for submission, etc. But there's another, equally important role: it lets me judge the scope of the project, and lets me point you to resources and prior work.

Expect to meet me weekly for about an hour, at a mutually convenient time. Generally, these meetings are in my office; on occasion, they're via phone or the like.

For major projects, e.g., theses and ones where the goal is a published paper, I want to see a final draft no less than three weeks before the end of the semester. This will give me time to provide you with feedback, and for you to make appropriate revisions.



I do not hire students from other schools as summer interns. Don't bother sending me your CV; I won't read it.

Admission Chances

Per the above, I cannot predict anyone's odds of admission, nor will I try. If you ask me that question, at best you'll receive a pointer to this answer; more likely, I'll delete your mail without bothering to reply. (If I were nasty, I'd reply asking you why I should bother admitting someone who doesn't take the trouble to read my web page on the subject; fortunately, I'm usually not that nasty.)