I'm frequently asked if I'm admitting new PhD students. The answer is yes, I am; I very much want to work with students. But..
But? Unfortunately, I can only admit one or two new students per year; I just don't have the funding to support more people. Even when funding isn't an issue (that happens on occasion), there's my time to consider: if I have too many students, I can't devote enough time and attention to any of them. My funding is very tight for fall 2019; it's not clear that I will admit anyone. And if I do, remember that each year, about 50 applicants to the PhD program indicate an interest in security.
I am working on a number of projects, focusing primarily on security for large-scale systems. This covers a wide range of topics, including privacy, usability, and the systems aspects of encryption, plus the related public policy and legal questions.
Before you apply, think carefully about which faculty members have interests that match yours. Most of my work is rather practical or focused on the legal aspects of technology; if your interest is in proving theorems, I'm probably not the best choice of advisor.
If you're interested in working with me on a PhD, apply here. Make sure you check my name and/or an interest in security. If you do that, I promise I'll read your application. But reading and evaluating applications is a difficult, painful, and time-consuming business; I can't review resumes ahead of time. Repeat: I cannot and will not evaluate your resume, CV, etc., ahead of time. It's not worth your while to send these to me. Please note the department's admissions deadlines.
I am probably not admitting any PhD students for Fall 2020, though that might change.
MS students are encouraged to participate in research. This can be done directly on a faculty member's project, or it can be done as an independent study project as COMS E6901. I'm willing to supervise such projects; see below.
Funding is more problematic. There are MS graduate research assistants in the department; except under extremely unusual circumstances, I will not offer such a position to an incoming MS student. I simply do not have the funding. Come here, take a course or two from me; after that, we can talk about specific projects. Again, I am not making any promises about money.
There is an MS track in Computer Security; see http://www.cs.columbia.edu/education/ms/computerSecurity. For admissions information, see http://www.cs.columbia.edu/education/admissions#ms.
I have no way of knowing who might qualify for admission to the MS program.
Undergraduate or Graduate Independent Study
I'm happy to supervise student research, generally as COMS W3902 or COMS W4901 for undergraduates or COMS W4901 or COMS W6901 for graduate students. If you're interested in working on a project, come talk to me first. You have to be self-motivated and have some idea of the field you're interested in working in.
I strongly urge you to read Brian Kernighan's excellent advice on independent study projects before you approach me or any other faculty member.
Please note the following requirements from the W6901 description, which I think should apply to any of these courses:
Before registering, the student must submit a written proposal to the instructor for review. The proposal should give a brief outline of the project, estimated schedule of completion, and computer resources needed. Oral and written reports are required.
In other words: I insist on a 1-2 page written proposal. This is, in effect, a contract: I assign a grade based on how well you accomplish your plan. In other words, I want to know the scope of the project and the deliverables: code, a written description, a draft research paper suitable for submission, etc. But there's another, equally important role: it lets me judge the scope of the project, and lets me point you to resources and prior work.
Expect to meet me weekly for about an hour, at a mutually convenient time. Generally, these meetings are in my office; on occasion, they're via phone or the like.
For major projects, e.g., theses and ones where the goal is a published paper, I want to see a final draft no less than three weeks before the end of the semester. This will give me time to provide you with feedback, and for you to make appropriate revisions.
I do not hire students from other schools as summer interns. Don't bother sending me your CV; I won't read it.
Per the above, I cannot predict anyone's odds of admission, nor will I try. If you ask me that question, at best you'll receive a pointer to this answer; more likely, I'll delete your mail without bothering to reply. (If I were nasty, I'd reply asking you why I should bother admitting someone who doesn't take the trouble to read my web page on the subject; fortunately, I'm usually not that nasty.)