Well, it didn’t take long for me to become embroiled in controversy in the infosec world, in fact it took just one panel discussion. I considered for some time whether I should respond to the comments made on twitter about the CFP panel discussion at BSides Liverpool, or whether I should leave well alone and just let it die down and I may yet live to regret the  decision to write this piece, but here goes.

It all started with this tweet:

There is no getting away from the fact that there were four white males on that stage but what this doesn’t explain in anyway shape or form is the reason there were four white males on that stage nor, in my opinion, does it completely address the concept of diversity. I’ve kept quiet for a long time about the latter and maybe I should continue to do so but being personally involved has made me speak up and share my thoughts. As I say, I may live to regret that decision.

Multiple speakers pulled out in the lead up to the conference and if I have my figures correct from the closing comments, around 20% of the people who bought tickets couldn’t make it because the rail system suffered a critical incident that caused the cancellation of numerous trains. 

This was my second conference, my second conference ever. I had presented on the rookie track earlier that day and I was asked fifteen minutes before the panel if I would join them as a rookie representative. Do you really believe that any conference organiser would intentionally leave it that late to make up the panel, or is it possible that they had very little choice? Did the person making that post even know that this was the case or were they instantly outraged at the site of four men dressed in black simply because they will take any and all opportunities to highlight a gender gap without any context?

I have no idea if the organisers asked any of the other rookies at all, but if you check the schedule there were three rookies, Ian, Tom and Chrissi – Ian and Tom were the two that had spoken prior to the panel, two white males. It would have been more difficult for Chrissi to comment fully having not completed the experience yet, and Tom’s talk was due to finish as the Panel was due to start, that leaves yours truly.

Let’s look at the other two panel members, both experienced in the infosec community and both experienced speakers, could one of them have stepped down and was there someone who could have taken their place? Look at the list of speakers… how many female speakers were there? How many experienced female speakers were available to talk about submitting a CFP and speaking at a conference? Remember this was being put together at the very last minute because of several people cancelling and a major incident on the railway that had affected attendance… all the best laid plans…

Given that the best they could do was a panel of three white males and a white male compere let’s look at diversity for a minute. Let’s consider it in the context of this panel where the subject material was CFP and Conference speaking. Diversity doesn’t come just from culture, race or sex. Diversity can exist in opinion, experience and background, its a less popular and politically correct use of the term but nonetheless is an accurate one. Three white males can still deliver diverse opinion, maybe not in the context of the gender gap or minority representation but this was a panel about CFP Submission not the gender gap or diversity in infosec.

So who made up the panel? There was a rookie at only his second conference, a conference organiser (or at least someone very experienced and involved with an alternate BSides) and an experienced Keynote speaker. As far as backgrounds went , one has a 36-year background in IT across multiple industries, one was a musician and one, I believe, was previously a hacker. It is likely then that there wold be some diverse opinion and the experience levels and backgrounds were definitely not the same…

It’s clear that the tweet was aimed at the sex and ethnicity of the panel and this is confirmed if you read replies further down the thread.Given the account that it came from which is clearly focused on highlighting the gender gap that’s not surprising, but would there be similar outrage if there were four white males but they were part of the LGBTQ community, or if one or more of them was registered disabled? Do you know that they aren’t? Are we only interested in visible diversity because it looks good and we can show we are making a difference? There is a gender gap in infosec, but that is not the fault of the organisers or the participants and vilifying them because the panel was all men will do very little, if anything, to change that gap.

Clearly infosec would benefit immensely from a more diverse range of people but they have to want to come along, it’s not something that you can force and on that note I would offer a word of caution. An experience, which many concerned won’t have lived through. Be careful that your efforts don’t stray from positive action to positive discrimination, I’ve lived through the latter. I’ve seen the results of legislative quotas, of people being appointed to tick that box rather than being the most capable. I saw this happening throughout the 70’s and into the 80’s and it is toxic. It does nothing to promote and support the very people you wish to assist, in fact it has the very opposite effect bringing resentment and hatred and creating truly vitriolic workplaces. Thats why it is now illegal for businesses to do any positive discrimination.

I am lucky enough to have had a wide and varied career. I have done many things in my life and worked with some amazing people. I’ve seen first hand on a daily basis the different thought processes of men and women in the military, in education and in tech. I’ve seen how they tackle the same problems in different ways. I’ve seen my disabled family and friends overcome challenges in ways I would never have even have thought possible. We absolutely should be working to promote and improve the gender gap, the pay gap and make sure that we develop the ethnic, cultural and experience diversity that is necessary to do what we do in the best way possible, but there has to be a better way to do this than the public humiliation of four innocent people all of which were unpaid volunteers doing something they love simply because they wanted to help.

There was absolutely no malice intended on the part of the BSides Liverpool team nor any of the participants. In fact, I think it was exactly the opposite. All they wanted to do was complete the schedule they had arranged in very difficult circumstances.

Finally, the point of this panel was too encourage people to join in, to be part of the community. If we concentrated on what was being said and less so on who was saying it, maybe we would find more people joining us and some of those would be women, but the message got lost in the controversy and outrage.

I don’t care what gender you are, how you identify, whether that gender has changed. That is your business not mine. I’ll openly admit I don’t understand the concept of non-binary gender, but I doubt I am the only man in his fifties in that situation! Nonetheless, and I cannot stress this enough, you would be welcome. If I have learnt one thing over the past six weeks it is that BSides is a community. People came from London and Leeds to help Liverpool make this a success. However you identify, however the panel is configured, whatever your particular interest, experience, background, age, gender, race, creed or colour Bsides is a community conference. I’d be astounded if you weren’t made to feel welcome.

I for one will be back next year and if you ask me on the panel, I’ll be there again, but if you have been thinking of submitting a CFP – do it now, don’t wait, get it done. You may be terrified, you may have weeks of sleepless nights, but it was the best decision I made since joining this industry. That was the message from the panel.

Thanks for a great con Liverpool and well done on your first go.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.