<http://schema.org/articleBody>
" &amp;quot;Security Princess&amp;quot; is Parisa Tabriz&amp;#039;s official title at Google. Seriously. And yes, you can google that. &amp;quot;&amp;#039;Information Security Engineer&amp;#039; is just completely dry and boring and horrible,&amp;quot; she says of the HR-speak title, which indeed whitewashes what Tabriz does all day, which is to hack her employer\u2014the single most recognizable entity of the Internet age\u2014bad-guy-in-basement style. She came up with the moniker before a trip to Japan because she needed business cards to hand out during the elaborate professional introductions traditional in that country. &amp;quot;A couple of people had &amp;#039;hired hacker,&amp;#039;&amp;quot; she says. &amp;quot;But I like to one-up people. I thought it was cute.&amp;quot; Cute, sure, but it&amp;#039;s also because Parisa Tabriz doesn&amp;#039;t much care what you think about her. Not in a screw-the-man kind of way\u2014she&amp;#039;s too midwestern friendly for that, and, after all, she works for the establishment company of Silicon Valley. It&amp;#039;s more that she prefers not to suffer fools. &amp;quot;Some people in other parts of the industry, they introduce themselves as, like, &amp;#039;vice president,&amp;#039; with all of these certifications,&amp;quot; she says, amused. &amp;quot;I couldn&amp;#039;t give a shit. You could be Code Monkey Number 507, but if you&amp;#039;re doing cool stuff, I&amp;#039;m much more interested in talking to you than to whoever&amp;#039;s senior vice president.&amp;quot; Related: Meet ELLE&amp;#039;s Women in Tech In the world of hacking, Tabriz is basically the equivalent of Glinda the Good Witch\u2014all of the power and skills, none of the evil inclinations or armies of marauding monkeys (just the coder ones). Leading a crew of hacker engineers, she is paid to think like a criminal, to suss out weaknesses in Google Chrome\u2014the world&amp;#039;s most-used Internet browser\u2014that could be exploited by ne&amp;#039;er-do-wells, then ensure that they&amp;#039;re fixed before that can happen. It&amp;#039;s a daily preemptive strike against online identity theft that protects millions of people around the world. Add to that that she&amp;#039;s only 31, one of the rare women in hacking circles, and the furthest thing from the antisocial tech-whiz stereotype, and it&amp;#039;s easy to see why Tabriz is on a rapid upward trajectory. Related: Why We Need Women Who Code Glinda-esque as her job might be, Tabriz appears to wear black almost exclusively. &amp;quot;It&amp;#039;s slimming,&amp;quot; she says, shrugging, not that she needs to worry about that. She has a simpatico face, always worn bare, that could easily elide from one ethnicity to another and a classic Gap-in-its-heyday sleek tomboy aesthetic: dark-wash jeans, clean-line crewnecks, and Chuck Taylors, with the occasional bomber jacket thrown on top. Tabriz might well be the ideal personification of Google&amp;#039;s informal &amp;quot;Don&amp;#039;t be evil&amp;quot; motto, at a time when the company is eager to shore up that image, having been rocked by Edward Snowden&amp;#039;s leak revealing the secret National Security Agency program that gave federal officials unfettered access to tech-company servers (including Google&amp;#039;s) and, by proxy, to users&amp;#039; personal information. The proactive work done by Tabriz and her team is one user-service area that Google can unabashedly brag about. Hackers exist in a constant state of moral purgatory\u2014the line between right and wrong is often murky\u2014but they like to think of themselves in black-and-white terms all the same. Tabriz&amp;#039;s side, the white hats (yes, that&amp;#039;s actually what they call themselves), is made up of people like the Good Samaritan who returns the expensive purse she finds on the subway. The black hats (again, a label worn with pride) think the white hats are suckers\u2014not only do they swipe the Birkin, but they rifle through the crocodile-skin datebook inside to find new victims. Black hats weaponize their knowledge of how to attack a system\u2014a so-called exploit\u2014and sell it to the highest bidder. Tabriz was never going to be a good candidate for the dark side, and in fact, she&amp;#039;s an unlikely pick to have ended up a hacker at all. &amp;quot;I wanted to be Jem. Do you know Jem and the Holograms?&amp;quot; she says, referring to the 1980s cartoon\u2014and Hannah Montana predecessor\u2014about a pink-haired girl rocker with a buttoned-down alter ego. We&amp;#039;re at Google headquarters in Mountain View, California, sitting in a conference room that&amp;#039;s as anodyne as they come\u2014outsiders aren&amp;#039;t allowed into the building where Tabriz works, and lest I spirit away any intellectual property, a friendly PR Sherpa with a nose stud is required to escort me everywhere, including the bathroom. (Google toilets, in case you were wondering, feature high-tech automated Japanese-style bidets that allow for controlled water temperature and pressure.) Growing up in the Chicago suburbs, the daughter of an Iranian-immigrant father, a doctor, and a Polish-American mother, a nurse, Tabriz wasn&amp;#039;t exposed to technology in any big way. &amp;quot;I didn&amp;#039;t touch computers up until college,&amp;quot; she says, or maybe it just feels that way, given how plugged in she is today. Instead, she made a lot of art, played a lot of sports, and competed\u2014hard\u2014with her two brothers. &amp;quot;When I couldn&amp;#039;t outmuscle them, I had to outthink them,&amp;quot; she says. Talented in math and science, she chose the University of Illinois at Ur-bana-Champaign&amp;#039;s engineering program for college. But Tabriz soon discovered her proclivity for computer science, and, in a move that proves guidance counselors the nation over correct about the importance of extracurriculars, she joined a club that changed her life. It met on Friday nights\u2014the college litmus test for seriousness\u2014and was made up of computer-science students bent on understanding the ins and outs of website security. This was the early aughts, when Facebook was just a glimmer in Mark Zuckerberg&amp;#039;s eye. &amp;quot;My website had gotten hacked, so I wanted to figure out why,&amp;quot; Tabriz says. &amp;quot;[The meetings were] nothing formal. Just, &amp;#039;Here&amp;#039;s something cool I did, here&amp;#039;s some idea I&amp;#039;m trying.&amp;#039;\u2009&amp;quot; The club consumed not only Tabriz&amp;#039;s intellectual life, but her social one as well. And was she the only woman in the clique? Tabriz thinks for a moment\u2014&amp;quot;There was another girl for a while\u2026.&amp;quot; Her familiarity with tech&amp;#039;s only-woman-in-the-room dynamic began early. Steganography\u2014the art of concealing a coded message in plain sight, a form of cryptography\u2014helped train the blossoming hackers in the mind-set of someone with something to hide. While most of Tabriz&amp;#039;s practice of steganography was through Web portals, she has learned some of its history. &amp;quot;A Greek emperor would shave a slave&amp;#039;s head, tattoo a message on it, let his hair grow back, and then say, &amp;#039;Go over to that other emperor,&amp;#039;\u2009&amp;quot; she says, explaining the roots of the philosophy still used in the modern day\u2014rumor has it that Osama bin Laden encrypted instructions to his terrorist network by hiding them in images on pornographic websites. Tabriz and her friends encrypted less-nefarious messages to one another in e-mail images of cats. This sense of whimsy is what Tabriz looks for in hackers to this day. &amp;quot;A lot of the people we hire just have this curiosity to try to understand something,&amp;quot; she says. &amp;quot;And maybe a bit of a mischievous slant, to try to do something unexpected.&amp;quot; Complicating her hiring needs, Tabriz has to find people skilled enough to outhack the most brilliant cyber scumbag but strong enough to resist the temptations of big illegal money. The aboveboard way to make a living as an independent hacker is to enter contests sponsored by companies. Many, including Google, hand out cash prizes to anyone who can give &amp;quot;proof of concept&amp;quot;\u2014directions for how to find a bug in a program (Google pays &amp;quot;somewhere on the order of $25,000 to $60,000,&amp;quot; according to Tabriz). But hacking&amp;#039;s marketplace is similar to that of the arms industry: There are sizable gray areas. Hackers can sell information to middlemen, thereby retaining plausible deniability about how their work will be used. (A middleman could sell a fix back to the company that was exploited, for instance, or pass it along to a criminal network.) Governments are in the mix as well, on the lookout for programs that could weaken their enemies&amp;#039; defenses. Small world that it is, all these elements converge a few times a year at conferences, which mix continuing-ed lectures with some good old-fashioned Nancy Drew fun\u2014sniffing out the criminality of other attendees. Tabriz dismisses most of this as gossip but nonetheless spurns certain hackers based on industry rumblings. But as the industry grows, so do its grays, and she has some trepidation about finding upstanding recruits in the coming years. &amp;quot;Neighborhoods are safest when everybody knows each other,&amp;quot; she says. &amp;quot;And that doesn&amp;#039;t necessarily scale as well when you get larger.&amp;quot; Tabriz started at Google in 2007, the tenth to join a small team of hired hackers in charge of software security for the company. Today, more than 250 security engineers protect user data and the company&amp;#039;s online infrastructure. Google&amp;#039;s Mountain View mother ship, where around a third of its roughly 40,000 employees work, reflects the massive growth. It looks and feels like an anywheresville modern college campus\u2014the buildings are mostly glass, a few of them done in a pale pistachio green. There&amp;#039;s a lot of beach grass, and Google bicycle gangs roam the streets, shouting things like, &amp;quot;Yo, hand signals! C&amp;#039;mon, man.&amp;quot; The division Tabriz heads has more than 30 hackers in the U.S. and Europe handling security threats specific to Google&amp;#039;s signature Chrome browser. It&amp;#039;s easy to see why Tabriz has been picked as management material for a segment of tech that she admits has more than its share of &amp;quot;really socially unadjusted people.&amp;quot; She&amp;#039;s commanding but not intimidating, the kind of person who&amp;#039;d speak calmly but forcefully for the group during a hostage situation. &amp;quot;Highly motivated and driven&amp;quot; is how Nikita Borisov, Tabriz&amp;#039;s graduate-school adviser at the University of Illinois, describes her. But, he adds, she&amp;#039;s always been able to connect with others, especially those in the pocket-protector set. Tabriz does a fair bit of globe-trotting to keep tabs on her staff (she also lived in Zurich for a time) and to give &amp;quot;think like an attacker&amp;quot; seminars to the company&amp;#039;s nonhacker engineers. To calcify their hearts a bit, she asks them to devise plans to do such things as rig a vending machine to get free snacks. &amp;quot;There&amp;#039;s a lot of similarities with the know-thy-enemy part of war,&amp;quot; she says, sounding for a moment more like Sun Tzu than NorCal Glinda. During the height of this past holiday season, hackers likely based in Eastern Europe or Russia with suspected ties to organized crime stole the credit-card information of 40 million Target shoppers. Similar malware was found lurking in the computers of Neiman Marcus, turning the shopping sanctuary into a credit-report hellscape for the 1.1 million customers whose credit or debit card information was stolen. That these hacks came in close succession alerted many of us to the relative lack of security of personal information, but massive cyber attacks are nothing new. In 2008, more than 130 million credit-card numbers were stolen from Heartland Payment Systems, a major credit-card-payment processor\u2014the largest such theft on record. But cyber crime isn&amp;#039;t all sophisticated stuff. &amp;quot;Basically all forms of criminal activity are migrating to this world,&amp;quot; says Douglas Salane, director of the Center for Cybercrime Studies at John Jay College. According to annual reports compiled by the Internet Crime Complaint Center, most cyber crimes in the U.S. are simple scams\u2014someone selling a car he doesn&amp;#039;t own, a fake lender duping a homeowner in over her head on payments. Some fraudsters have even posed as hit men, extorting money via e-mail solicitations from their targets. While Tabriz&amp;#039;s team prides itself on daily &amp;quot;silent&amp;quot; updates\u2014&amp;quot;As soon as we fix a security bug, it&amp;#039;s automatically pushed to users, and hopefully you don&amp;#039;t even know that happened&amp;quot;\u2014they&amp;#039;ve had their share of high-profile catches. In 2011, they discovered that the Dutch Internet-security-certificate authority, DigiNotar, had been hacked, affecting hundreds of thousands of Iranian Gmail users. The attack, suspected to have been sponsored by the Iranian government, came in a country where a security breach can be a matter of life and death\u2014Iran&amp;#039;s cyber police have been known to torture and kill those who &amp;quot;misuse&amp;quot; the Internet. And then there are groups like Anonymous, a &amp;quot;hacktivist&amp;quot; consortium motivated by a professed commitment to complete Internet freedom. It has bubbled into the popular imagination, thanks to Guy Fawkes masks and its work crippling entities such as PayPal, which the group attacked in 2010 in retaliation for its suspension of Wikileaks. When Tabriz hears of Anonymous cases, she says her first reaction is embarrassment for the company hit, as in, &amp;quot;Oh, wow, PayPal [had] this weakness in their software.&amp;quot; Which isn&amp;#039;t to say she approves of Anonymous: She compares their acts to &amp;quot;robbing a convenience store.&amp;quot; While growing the ranks of white-hat hackers is one way to at least stem the tide of cyber crime, security experts are also working on new technologies to tighten user defenses. For the memory challenged among us, the news is good: No more passwords. Computers and accounts will soon be accessed through a physical object\u2014iPhone fingerprint identification is only the beginning. There&amp;#039;s a chance that pretty soon smart chips with strong cryptography programs will be embedded in everyday accessories to unlock devices. Some have suggested cell phones for this purpose, but Tabriz is skeptical. &amp;quot;I think phones are designed for men, because they&amp;#039;re big and don&amp;#039;t fit into your pockets all the time. But I&amp;#039;m always wearing a bra. I usually have earrings&amp;quot;\u2014in other words, someday La Perla and Bulgari could be designing their wares with microchip software in mind. Tech&amp;#039;s gender divide has a funny way of popping up where you least expect it, and Tabriz is happy to address it head-on. &amp;quot;If you have ambitions to create technology for the whole world, you need to represent the whole world, and the whole world is not just white men.&amp;quot; Google has faced its own set of problems when it comes to the advancement of women. In its engineering divisions, employees must nominate themselves for promotion rather than counting on managers to do it\u2014a system that practically seems designed to be discriminatory; as Sheryl Sandberg, former Google vice president of global online sales and operations, has noted, women tend to be &amp;quot;more reluctant to apply for promotions even when deserved, often believing that good job performance will naturally lead to rewards.&amp;quot; That said, when Google alerted its workforce to an internal study concluding that, indeed, female employees were 20 percent less likely than male to put themselves forward, women&amp;#039;s &amp;quot;self-nomination rates rose significantly,&amp;quot; according to Sandberg. (Google declined to make its current leaders available for an interview about its gender climate, though Nancy Lee, director of People Operations\u2014think HR\u2014e-mailed: &amp;quot;One of the most \u2028important things we can do is to celebrate the contributions of women in technology.&amp;quot;) Tabriz doesn&amp;#039;t perceive gender as a negative for her, though she thinks she &amp;quot;may be a little more pushy than the [female] stereotype.&amp;quot; Among the young women she mentors, some continue to struggle to navigate Google&amp;#039;s at times Darwinian environment, she says, where &amp;quot;you kind of have to demonstrate \u2028authority without explicitly having it.&amp;quot; Heidi Shin, a former Google employee who worked closely with engineers, is more blunt. &amp;quot;You talk to male engineers, they&amp;#039;re really focused on the product idea, and they explain it in a way where they were the runners, and they were the leaders, even though the project could have been collaborative.&amp;quot; And what do women say? &amp;quot;\u2009&amp;#039;This was a group project, and I did this together with the other engineers, and a lot of other people were involved.&amp;#039;\u2009&amp;quot; When and how\u2014or even whether\u2014women will reach parity with men at Google and elsewhere in tech are open questions. Because fewer women study science, technology, engineering, and math, fewer become tech engineers; because there is a smaller pool of female engineers to hire from, not many women get in on the ground floor of the next hot start-up; because only a handful of women make bundles of money from a hot start-up, few can become angel investors who pour money into future ventures. It&amp;#039;s a snowball effect that some worry could end up replicating the male-dominated Wall Street culture. Planet Granite, a rock-climbing gym a few miles from Google&amp;#039;s campus, might be the best place to witness Peak Parisa. It&amp;#039;s a Monday after work, and she climbs high and by herself, anchored from the ground by her neuroscientist boyfriend. She&amp;#039;s lead-climbing, clicking her carabiners into place, in charge of securing herself from a fall as she methodically scales the faux-rock face. It&amp;#039;s a steady, rhythmic act, almost balletic: Clip, leg up, straighten. Clip, leg up, straighten. Soon she is four or five stories up in the air, a slight figure in black amid the canopy of ropes and the confetti of rainbow-colored footholds marking trails to the ceiling of the warehouse space. Lots of the other climbers here are Google employees\u2014it&amp;#039;s a favorite pastime of the type-A software engineers who litter the area, which makes sense given that wall routes are called &amp;quot;problems&amp;quot; and solving them is a largely solo endeavor done in midair. And it&amp;#039;s funny to see how normal they all look, standing around in their Patagonia gear, these people who brought us now ubiquitous street maps and excellent e-mail design, and, however inadvertently, helped usher in a jarring new reality about privacy. They seem so nice, so trustworthy, as they work the ropes for their climbing friends perched on high precipices. And we have trusted them almost wholeheartedly up until recently, because they seem to have the best of intentions. But who&amp;#039;s to say they always will? What, for instance, keeps Tabriz from hacking into an ex-boyfriend&amp;#039;s e-mail? &amp;quot;Just because you can do something doesn&amp;#039;t mean you do do something,&amp;quot; she says simply. Is it chilling or heartening that it comes down to plain old trust in your fellow man? Google and Facebook and all their predecessors have transformed this valley from edenic orchards into a Prius-clogged suburban corridor on the backs of the wild horses of innovation. But there&amp;#039;s no way to hack a lack of good faith. At the very least, Tabriz trusts herself to keep us from harm. And 50 feet off the ground, calmly straddling a precarious spot where the planes of two walls converge to a sharp point, where she is caught literally between a rock and a hard place, she seems like exactly the right woman for the job. This article appeared in the July 2014 issue of ELLE magazine. "^^<http://www.w3.org/2001/XMLSchema#string>
<http://www.elle.com/culture/tech/a14652/google-parisa-tabriz-profile/>