This is a guest blog by Kim Crawley.
I’ve worked in cybersecurity for about a decade, but I’ve been autistic for my entire life. Careers usually start in adulthood, but autism is something children are born with. And contrary to what some people assume, autism doesn’t disappear at age 18. Autism is for life. Unfortunately, once autistic people become adults, services become a lot less plentiful. For each professional who diagnoses autism in adults, there are dozens or possibly hundreds of professionals who only diagnose autism in children.
There exists an entire industry of supposed treatments for autistic children. Some of those supposed treatments are obviously harmful and should be illegal, like bleach-based snake oil (“Miracle Mineral Supplement” or “Miracle Mineral Solution”) to be administered to children orally or... through a different anatomical vector. Others, like Applied Behavioral Analysis, are widely condemned by autistic adults. Righfully so! Forcing autistic children to pretend to be neurotypical doesn’t cure them of autism and will ultimately backfire in PTSD and depression. I suspect treatments for autistic adults are few and far between because there’s little money to be made there. An autistic adult like myself can usually deny consent to a supposed treatment, whereas children usually cannot.
Autistic people need support to manage life in a neurotypical world, and acceptance for harmless traits such as hand flapping and obsessive focus on topics of interest. There are symptoms of my autism that can be difficult, such as my hypersensitivity to the sound of vacuum cleaners and the feel of chalk on my hands, and my dyspraxia (a medical term for clumsiness.)
But my autism comes with many positive traits too. The psychologist who diagnosed me with Autism Spectrum Disorder 1 in April says I have exceptional long-term memory. And when I’m interested in something, my thirst for knowledge is immense. I’m certain that I wouldn’t be a successful cybersecurity blogger if it weren’t for my autism. Research is my life’s work, and I can do so with remarkable intensity. Like most autistic adults, I would refuse a hypothetical cure for autism because if it weren’t for my autism, I just wouldn’t be myself. Everyone on Earth has strengths and weaknesses. It’s best to simply manage my weaknesses so I don’t lose my strengths.
Not all, but many autistic teenagers and adults have a natural talent for computer technology. In fact, an obsession with computers is a part of many autism stereotypes. Computers are logical. If a computer malfunctions, there’s a clear reason for it that can be discovered with proper troubleshooting. Computers don’t demand uncomfortable eye contact unless you’re using iris scanning biometrics. Computers and the Internet are a gateway to a massive and ever-growing collection of knowledge.
Computers facilitate social media, online chat, and email, so you can socialize with other people without their physical presence and without possibly misinterpreted body language. Some autistics, especially those with high support needs, are nonverbal or selectively mute. Many autistic children and adults with high support needs or intellectual disabilities are assumed to lack the ability to communicate with language until they’re given PCs, phones, or Augmentative and Alternative Communication (AAC) devices.
With access to technology as an alternative to verbal speech, neurotypical people in their lives are shocked to learn that autistics who are assumed to be unintelligent because they don’t speak have been capable of sophisticated intelligence all along. Imagine how frustrating it is to not have a means of communication! Computer technology can make it possible. The affinity most autistics have for computers have clear and simple reasons.
The world is going to need more and more cybersecurity professionals as time goes on. As more and more people are discovered to be autistic, it would be great to harness our talents into improving the security of computer technology. I’m one autistic in the cybersecurity industry, but I know many others. And if autistics with both low and high support needs are given the opportunity to learn about cybersecurity and pursue careers in our field, the world will be a better place.
My friend and colleague Kate O’Flaherty explored the benefits of getting more autistic people into cybersecurity roles in a 2018 piece for Forbes:
Mike Spain, director at Cyber Exchange and founder and chair of the cyber Neurodiversity Group thinks ‘neurodiverse’ adults can make a huge difference. The term refers to individuals with ‘spectrum’ conditions including autism, dyslexia, dyspraxia, ADHD and OCD.
Neurodiverse (neurodivergent) individuals have a lot to offer: Their strengths include cognitive pattern recognition, outside-the-box thinking, attention to detail, logical and methodical thinking, focus and integrity, says Spain. ‘Diverse teams are more productive, more creative and more successful,’ he says...
Spain emphasizes the importance of recognizing the commercial benefits of neurodiverse recruitment – rather than treating the area ‘solely as corporate social responsibility’.
He points out that some firms have seen a 50% increase in productivity on certain tasks performed by neurodiverse individuals, ‘which is the kind of figure that makes the board listen’.
And of course, employing neurodiverse young people also has the wider benefit of helping to stop talented individuals from turning to the ‘dark side’ of hacking. ‘I have a strong belief that as a sector we have a responsibility to neurodiverse individuals,’ says Spain.”
I’m really glad I managed to get into the cybersecurity field without a black hat phase. I would strongly dissuade the idea of engaging in actual cyber attacks (as opposed to consensual penetration testing) as a means to a cybersecurity career. You’d likely get caught and do prison time without being offered professional opportunities upon release. The era of entering cybersecurity like Kevin Mitnick did is a relic of the late 20th century. So if we can get autistic hackers to only hack for the good guys, we’ll all benefit with more secure endpoints, applications, and computer networks.
A few years ago, WIRED’s Kevin Pelphrey identified how employing more autistic people in cybersecurity roles is a... “special interest” that our industry really needs:
“The common prejudice is that people with ASD (Autism Spectrum Disorder) have limited skills and are difficult to work with. To the extent that's true, it's a measure of our failure as a society. Almost half of those diagnosed with ASD are of average or above-average intellectual ability. And we have clear evidence that job-focused training and support services, especially in the transition to adulthood, can make a huge difference, leading to higher levels of employment, more independence, and better quality of life...”
More than three-quarters of cognitively able individuals with autism have aptitudes and interests that make them well suited to cybersecurity careers. These include being very analytical and detail-oriented as well as honest and respectful of rules. And there are many other areas in which these talents could quite literally be employed.
A few innovative firms, including Microsoft, SAP, and Freddie Mac, already have pilot programs for hiring people with autism to fill sophisticated IT jobs and other positions. The Gates Foundation, the Milken Institute, and the Hilibrand Foundation have also funded valuable employment and research programs.
But given the coming tsunami of adults with autism, a much broader effort will be required. We need a national strategy, coordinating the efforts of public agencies, companies, and organizations, to bring these valuable minds into the workforce.”
As an autistic adult with a well-established cybersecurity career, I have unique insight as to how to get autistic people in our field and how to keep us employed and productive.
Parents of autistic children and teenagers should be informed of how cybersecurity careers can help their offspring become independent and successful adults. This can be done through public schools and through specialists who treat autistic children and adults. Does your child spend hours on PCs, phones, and tablets with obsessive hyper focus? Encourage it, as long as it doesn’t interfere with other parts of their lives. Has your child taught themselves impressive computer skills on their own? Let them know that a career in cybersecurity can be an option for them.
Colleges and universities could establish scholarships for autistic teenagers and adults to pursue computer science and information technology pathways to cybersecurity careers.
But getting autistic people interested in cybersecurity is only half of the battle. The other half is to keep them in cybersecurity-targeted educational programs and professional employment.
Assess the sensory sensitivity needs of autistic students and employees. If fluorescent lighting disturbs them, consider replacing it with incandescent lighting. If autistic students and adults are hypersensitive to fragrances, ban perfume from schools and workplaces. Sensory needs can vary greatly from one autistic person to another. The only way you can be certain of what they are is to ask autistic people about them directly.
Help autistic students and employees with their executive dysfunction. Executive function is the ability to make and execute plans and tasks, and my brain is weak in that area. My executive dysfunction is one of the ways I’m most greatly disabled. It was a factor in why I dropped out of school. Now as a cybersecurity blogger in my adulthood, I’ve found ways to cope.
I make countless research notes in Google Keep. Evernote and similar applications can be used as well. Notes can be set with their own timed alarms! For instance, if one of my editors wants a draft for a blog piece by a particular date, I can make a note about it and have it notify me at a time when I must work on it. I also keep track of what work I must do by keeping emails from editors in my inbox and reviewing my inbox when I have a feeling that I must work on something. If there are particular times that companies I work for, such as AT&T Cybersecurity, would like to have a phone call or online meeting with me, I always mark the time in my Google Calendar and set many notifications on it. Computer technology can be harnessed to help me compensate for my executive dysfunction! It can work for other autistic people too.
Autistic people are often bullied and harassed at work and school due to ableism - the prejudice against disabled people. Policies and their enforcement must be set in place to discourage bullying and harassment. Bullying is the other reason why I dropped out of high school, and I’m very lucky that I was able to succeed despite of that. Other autistics might not be as lucky, so take bullying and harassment seriously in order to keep us in school and work.
And here’s my final word of advice. Make sure you communicate clearly with autistic students and employees. Our brains don’t work very well with sarcasm, figures of speech, vagueness, or metaphors. Do you know a meeting is supposed to start in three hours? Tell them the exact time the meeting is supposed to start, rather than saying “we have a meeting later on today.” Instead of saying “it’s raining like cats and dogs” or “the boss will kill you if she finds out about this,” say “it’s raining very heavily” or “the boss would get upset if you did that.” Instead of sarcastically saying “Nice work, buddy!” say “You didn’t do a very good job, I’ll explain how you can improve.”
We can get more autistic people into cybersecurity careers and keep them there. The future of cybersecurity depends on it.
