MIT Cybersecurity Pioneer Srini Devadas on Work, Learning and Living: “Life Is a Vacation”

Life is a vacation. I go to work, it feels like a vacation. You know, You know, Mark Twain, I think, said it right. You know, find a job you love and never work a day of your life. And that's the way I feel about my life. I wish I'd learned how to play a musical instrument growing up. I wish I could sing. Jhumka gira re Bareilly ke bazaar mein. Excellent. That sounded terrible. I'm Lalit Devdas, and I'm very excited to be here to introduce my dad, Shrinidhi Devdas. For all of you, you'll hear a lot about his achievements at work, but I'll tell you a little bit about his achievements at home, namely being that he raised two daughters to become professors of math and computer science. If that doesn't tell you about how much he values scholarship and academia, I don't really know what else does. Since we were kids, we were always his test subjects in figuring out better ways of teaching and what kids were excited about learning. And I think that it's very clear that both of us followed in his footsteps in our careers as well. I had the privilege of also going to MIT for my PhD, where I got to see him at work, and I got to see the way that other people at work talked about him and talked about the way that he teaches. He's co-taught with my advisors and many other professors that I know, and they really enjoy the experience of teaching with him, because they say, not only is he the most energetic person in the room, even when he's often the oldest person in the room, he also also offers both, you know, the insight of a long career of having taught He offers as well, you know, the ability to, he really is an old dog who can learn new tricks, I think. He learned to ski when he was 40-something, after learning to swim when he was 30-something. And he picks up essentially a new sport every time that he gets bored. And I think the same is true of his research as well. If you track his career from his PhD, when he was technically an electrical engineer, and then he snuck into the computer science department at MIT, and continued along working in, you know, Essentially, less and less applied topics just in time for me to arrive at MIT so that we could collaborate together, even though I was working on things that were much more theoretical than the things that he had started in. I've gotten to talk to his students about what it's like to have him as an advisor. And I think that there's definitely a lot of overlap in having him as a parent and that he's really helping you pursue the things that you're excited about, but also maybe telling you that there's a lot of things that are really exciting, in particular about computer science. And the areas of computer science that he studies. I love being able to talk to him about the things that he's excited about because he always has more to say about it than the average person talking about whatever new thing they've read about. He's generally always the one who tells me about new developments in computer science or math or whatever it is because he's constantly reading the news and enjoying all of those things. Welcome to India and Indian News. Our guest today is Srini Devdas. He's a professor at MIT. Everything related with computers, cyber security, AI. And if you read his Wikipedia page, you'll be totally blown away. Things which he has accomplished and about his expertise. Srini, welcome to our studio. Thanks for having me. First, I'm going to start with Devdas, your last name. If you grew up in North India, that Devdas is one of the most known characters who falls in love with a Paro and then nothing works out. So I'm sure that when people hear that you your last name is Devdas that question must be coming to you. I mean it does, it does. I mean first of all Devdas was an alcoholic. Yes, so and it was yeah, well unrequited love maybe But Devdas is my father's first name, and I'm from the south. Now, I have lived in North India, and what you described came up. Not as much in the south as in the north. But the way it works in South India is, you have a first initial, which is your family name, and then you have your name. In my case, my full name is Srinivas. And then you use your father's first name as effectively your last name. Now, at some point, my first initial got dropped, and I turned into Srinivas Devdas. And then when I moved over to the north, it's exactly as you said Upendra, people would say, why do you have Devdas as your last name? And I would go through this explanation. Okay, so now since we're talking about the family lineage, I am also told that there is a very deep relationship between you and India's president, if you can talk about that. So my mother's mother's father was Dr. Sarvapalli Radhakrishnan, who was the first vice president of India and the second president from 62 to 67, as I recall. And he was alive until I was about 11 or 12 years old. And in fact, he'd retired at that point from public life and moved to Madras in about 67. And I was living in Madras. I was a toddler back then. And he passed away in 1975. So I definitely have distinct memories of him growing up. And visiting him on my birthday, his birthday, which is celebrated, as you know, as Teacher's Day, September 5th in India. So really a larger-than-life personality. So my next question is, what is in the genes of your family that you are such an accomplished computer scientist? Your two daughters, one is a professor of computer science, one is a professor of math. And tell us a little bit more about what else is hidden there in your family. So I have to say, Upendra, I don't think it's about genes. I think it's about being motivated to do the things that we love doing. Thank And what I mean by that is, I think there was constantly growing up, I feel like I was told. you You need to be a scholar. You need to try to be a scholar. So I think that's a little bit very of what I think maybe I've imparted to my daughters, which is. much. Learning is fun. So now what do you guys talk at home when you're having a dinner, your two daughters are there? Lots of arguments. No arguments. I mean, no. No arguments about what? Anything. I mean, just like, oh, you know, who did the dishes? You're not too... You know, why was this particular, you know, technology, you know, invented or who invented it? And, you know, who should get credit for it? And, you know, was this Nobel Prize, maybe it's the Peace Prize, or maybe it's the the Prize in Medicine, you know, deserving, you know, things like that. So, yeah, we're a pretty loud family. I think, you know, all of us, you know, including my wife. My wife's probably the the quietest, but between my daughters and I and my wife. Your wife is Roshana Devdas. That's correct. She's quite active with Shishubharti in Lexington. Yeah, she's the principal of Shishubharti, which is this Indian Sunday school. And she's been the principal for several years. But she's been teaching in the school for 20 years or so. And both my daughters graduated. So it runs from kindergarten to eighth grade in both Sheila and Lalitha. I graduated so now you were explaining earlier the ambience at home about arguments and all those things. What happens when all of you drive somewhere? We get lost because if I'm driving I'm yelling at the kids at the back or my wife to my right and even though the GPS is on you know I don't listen to it because I'm listening to something else or I'm trying to talk over people. I mean, it happened on my way here. I picked Lali up at Alewife and, you know, Alewife to Waltham, I should know how to do this, given that I've lived in Boston for 35 years. I took 95 north instead of 95 south and it all worked out because we were on time. Yeah, you were absolutely on time. So, in fact, I think that was sort of the plan. It was too short a trip and so we argued, so we kind of circled around and then got here exactly 11 o'clock. Now, what happens when you guys go on vacation? Same thing? Yeah, you know, life is a vacation, honestly. Well, that's beautiful to say that. Yeah, I mean, it's, you know, I've never worked a day of my life. That's the way I feel. I mean, it's Mark Twain's famous quote, right? Find a job you love and never work a day of your life. So, yeah, going to work feels like vacation. Vacation, I mean, it's a nice thing. I will say vacations are a little bit different now after the girls have left the house in the sense that we get to see them and spend more time with them outside of calling them once a week or whatever it is. I mean, they rarely pick up the phone when I call. You know, I really love the way you describe life, that life is a vacation, which is fantastic, very profound what you just said. Now, on that note, let us talk a little bit about your work. And as I was reading your bio on the MIT page, as well as also on the Wikipedia and other some of the interviews we watched. Your contribution to computer science and all these AI, et cetera, is absolutely immeasurable. So tell us a little bit about your expertise, what some of our readers and viewers may not be familiar with your work, that, you know, what you have done, what you study, and what you think that industry is moving forward. Yeah. So, you know, Lali mentioned I started out as an electrical engineer. All my degrees are in electrical engineering from IIT Madras and UC Berkeley. And about 10 years into my MIT career, at that point of time, I worked on circuits, you know, building hardware. And I sort of woke up one day. said well these computer scientists in this other building you know seem to be having more fun and you know I'm all for enjoying myself in research and teaching so I decided in about 1998 to change laboratories and move over to where the computer architects and these are the people who Both in the academic realm as well as in industry, build processors. You know, they build the Pentiums and the Apple M4s and so on. I mean, we don't do that in academia, of course. But people who get trained in computer architecture and academia go over to the Apples and the Intel's and build these processors. And one of my good friends, Arvind, who was also a mentor. He unfortunately passed away a couple of years ago, convinced me that I should move over to essentially be his neighbor and work on computer architecture. Arvind, I remember, I've met him, and he was very fond of Thumri's style of singing. He was an amazing gentleman, and I learned a lot from him. But to go back, Sarvanand, then I became... close colleagues. We were always colleagues because we were in the same department in 1998. And I started working in computer architecture at that point and, you know, got into, you know, a different field from what I worked on for a PhD and as a young professor at MIT. And then the next thing that happened was I started talking to Ron Rivest, who was the R in RSA and a very famous professor who's founded, really, the field of cryptography. And Arvind and Ron were really close, their kids grew up together in Arlington, and so Ron got me into the field of computer security. And so here I was, an electrical engineer, knew a little bit about computer hardware, started working in computer architecture, and then I had this... A little insight that really came from Arvind and Ron that, you know, hardware could be something that could play a really a greater role than it had previously in building secure systems. And so that's kind of what I spent the last 20, 25 years doing, which is trying to solve cybersecurity problems. By from the ground up, if you will, by building building hardware that can have the right properties that will allow you to protect yourself from cyber attacks and ransomware and things like that. So before we come back to the cybersecurity, if you can also talk about the application of your research, et cetera, in the business world. Yeah, so, you know, if you think about things like smart cards, you think about crypto wallets, I think it's a little bit clearer that you have security considerations when you use these little gadgets, right? I mean, you don't want your Bitcoin to be taken away. You don't want your credit card number to be stolen. And fundamentally, there's always been hardware protection mechanisms to protect your secret keys and to protect your transactions. And that's kind of a given. Now, as the attacks have grown in complexity. And sophistication, it's been difficult for designers to keep up. And And essentially what's happened is you have to build defensive mechanisms in hardware to protect your secret key, to stop a bad transaction from happening. And those things can really help with... Protecting individual privacy, protecting people's, you know, bank balances and things like that. So that's the kind of thing that I think is the easiest to explain. Sort of going forward, when you think about running AI agents in the cloud or sending your Sensitive information to OpenAI or ChatGPT, I mean, you're giving your information away. This might be proprietary. You have a situation where you don't want that put on the internet. Good night. I mean, you do trust OpenAI with it, otherwise you wouldn't be using it. But the question is, what is the infrastructure that OpenAI provides that ensures that your information doesn't get leaked to me or mine to you or the world, right? And so these things called confidential computing, which are essentially, think of them as your little machine that really belongs to you in the cloud, and no one can look inside of it. And everything that goes inside of it, you know, comes back to you. Everybody is talking about AI. It is used everywhere. My question to you is this collision between AI and cyber security. If you can just explain that and how this thing is playing out. I mean, I think it's multiple collisions. Yeah, sure. I mean, I alluded to one of them, which is you want to use these AI agents that are being provided by, let's say, an Anthropic or an OpenAI. I mean, you're trusting them with your sensitive data. So you need this type of confidential compute support. I mean, the other side of it is just because humans have written computer programs. And. In the past, and obviously AI is helping with that now, there's always flaws in computer programs. Is it possible in the future using AI and all this technology, somebody sitting in China or England or India? should be able to access bank accounts etc and it's possible now and it's not for the money you know it's it's possible now i mean it's it's it's probably happening at uh at some scale right i think cyber attacks uh in remote cyber attacks predate AI i think what AI is brought to the table is power for of the attacker and thankfully the power of the defenders has gone up really Really exponentially. Previously, it would take many months and many man years, if you will, to find an exploit that hasn't been defended against or isn't able to be defended against. It's called a zero-day vulnerability. And you keep it in your pocket if you're a bad person. And you find sort of the maximal benefit or maximal damage you can cause. And to exploit that zero day vulnerability, maybe you wait and you take down power infrastructure and nation states would do this. Individual I'm attackers would try to do things starting that are more sort of mercenary in nature, right? But I think what's happened is that the power of AI allows you to take a million lines of code and look for a flaw in this line of code, to this other line of code, stitch them together, speak and break the entire system or do the kinds of things that you can do with PHP to shell now. Thank you. and that's sort of the scale and the power that we are giving people because of AI is just ratcheted up enormously. So now from the practical point of how you use the application of your knowledge and So these days we are seeing that a lot of cyber security companies are popping up everywhere, across the globe. Every day new companies coming up trying to solve this cyber security problem. So if you have to give a couple of advices to current and upcoming cyber security companies, how to deal with this current dynamics, what will be your couple of advices to them? That's not an easy question. I'd say the class that I'm teaching this semester is trying to answer that question and so you'd have to take my class to get the full answer. But we teach sound secure system design principles and that goes down to how do you build the hardware? How do you structure the compiler? How do you write application software? What does your web browser look like? containers, which really are a nice way of saying compartments, Upendra, your data should be distinct from Lali's data, or my data. And the biggest issue, I think, is people don't conform to these principles. They take shortcuts. I think so being disciplined about system design is sort of the most important thing that I think I would tell companies. That would be for the defensive side of things. I think the attack side, I would say I want to see companies that do the kinds of things that the PHP to shell attack shows you the benefit of that, which is before bad people figure out what your flaws are, look in the mirror, figure those things out and then fix them. Ideally, maybe it's just a patch, which is a short term, but ideally fix them once and for all and then I think we can really move to a world that's more secure. So I'm optimistic about the use of AI to create a more secure world. Now let us move beyond this academic and the business solving problem. Let's talk about your growing up in India. What are the recollections you have of early childhood, and how was it, and where was it? Right. Well, when you get old, you remember less and less. Okay. So, happy childhood. That's why our interview is at the right time. Ah! Yeah. So, happy childhood. I mean, I would say carefree, honestly. Lots of ping pong, lots of cricket. Lots of my mom telling me to study, a little bit of yelling to tell me to study. I remember getting into building radios and remote controllers. So, you know, little... So, how old were you at that time? Twelve. Twelve, huh? Twelve. So, I remember that. I would go use some pocket money to go buy transistors and hook them up. And I remember my aunt telling me... Show me this radio from last week and I'm like oh I dismantled it because I only have so many components and I go build this other thing, right? So a lot of fun, really. Yeah, I have no complaints. And your education in India? So my father worked for the Indian Railways which meant that about every three years or so we would move from one city to another. So, I went to this school system called Kendriya Vidyalaya, which basically translates to Central School. And what that meant was, in the middle of the semester, middle of a term, we would move. And I would go from, let's just say, Madras, now called Chennai, to Bareilly in Uttar Pradesh. And I would see the same syllabus. Now it would be a little bit off, but, and then people would be speaking Hindi as opposed to Tamil, but it was pretty seamless, I would say. So I enjoyed, I think, living in different parts of India. So out of all the places you lived in India, which was your favorite place? I mean, I would have to say, I think of myself as really having grown up in Madras, which is Chennai. And then part of that is because I went to IIT Madras for several years. But I did like Bareilly a lot. I mean, I was old enough to appreciate the differences between North India and South India. I mean, I can still speak a little Hindi. Don't test me. Okay. Since you mentioned that, do you remember that famous Bollywood song about Bareilly? You know, maybe do the thing that I'm worst at, which is trying to say. No, I think you sounded very good. You're the first one to say that. Can you say a couple of lines? Jhumka gira re Bareilly ke bazaar mein. Excellent. That sounded terrible. At this time, it looks wonderful. So now. Yeah. So during your teenage years, you really went in different places. Do you remember you had any special crush when you were growing up at that time? You mean like, uh, uh, girls. I can't say that. I mean, you can't. I mean, this is like, uh, statute of limitations. No, I mean, fifth amendment. I don't know. Oh yeah. What can I say? Okay. So you have no recollection? I mean, yeah. Okay. So I, I, uh, this was way before I met my wife. Okay. Sure. Of course. Yes. Yeah. I was 19. I remember going to, uh, uh, the Tata Institute Institute of Fundamental Research. As an intern, and this was in Bombay, close to Bombay, and there was this, you know, beautiful girl. And what I remember of that, I don't remember very well, but my good friend tells me that I bought him lunch. In order to, you know, pay him for telling me what her name was. Okay, oh, so you went through quite, you took some... Yeah, so I had, that was a big crush. That was a big crush. I had forgotten her name, but yeah. Sure. How do you, but Faith, I hope you still remember. Yeah. Good. Now, how did you meet Sulochana Devi, your wife? Well, we had an arranged marriage. Okay. I proposed to her about 30 minutes after I met her. And that was in India? That was in India. So, now, what brings to U.S. and where do you come in the U.S.? So, I did my schooling up until the undergraduate degree in India, IIT Madras, as I mentioned. And then, you know, about a few weeks after I turned 21, I started grad school at Berkeley. And then, a few years after that, I came to MIT and 38 years later, you're living here. Yeah, we are talking. So, I've just lived in universities and schools all my life. That is excellent. What a wonderful journey and we are looking forward to more exciting stuff coming from you and we will, we are going to follow you now since we now know a little bit more about you. Thank you. Great. Now before I let you go, I want to ask you one more thing as your daughter mentioned that you have this craziness in you of learning everything new from time to time. You talked about All these things, you know, so how do you get inspired to learn new things after a certain time? Well, I think I just get bored with the old things. I mean, I think it's really, it comes from a lack of attention span and boredom. I think I get good at certain things and I'm like, get blasé about them and then say, well, I'd like to do something that I'm not good at. And it's just sort of so much fun getting better, right? And so you don't know how to juggle. One summer, I decided I'd learn how to juggle. And I think I did succeed. See, um, And it was just painful at the beginning. But then I got to the point where I could juggle for five seconds and was just like, yes. And then eventually I learned how to do it. And it just keeps happening for whatever reason. I will say that, sadly, I'm getting worse at things as I've gotten older. So now this is my last question. Yeah. So what a wonderful career you have. Great, successful family. Everybody's doing great. My question to you is, if today God comes to you and says, look, ask for one thing and your wish will be fulfilled, what is that one thing you will ask him, Ahar? I wish I could have sung that song much better. Okay. Okay, so... Music, music. Music. Yeah. I wish I'd learned how to play a musical instrument or I wish I knew how to sing. So why you didn't focus on that? You can still learn, though. I'm not sure about that. I don't know. I mean, it just didn't feel important at the time. And then I think as the years went by, I mean, there's too many things to do. Yeah. So, I mean, if I could switch over, I don't know, learning how to ski versus learning how to play the piano or something, I would. Excellent. On that note, Srinivasan, thank you so much. It was a pleasure talking to you. And we will see you on November 14th. Thank you.