On consulting

I made a promise to answer a reader's question about consulting. In particular:

How do you get started in consulting? Do you wait for someone to approach you, or to you actively advertise your interest in taking on consulting work?

Dear reader: a good question, but not the most important one.

If you would like consulting work, and you are not already being offered consulting work, then yes: you need to advertise your interest. But that's not enough to actually attract the consulting work you want. To attract work, there is something essential you must do, and something helpful you can do.

The helpful thing is for you to advertise your interest in consulting to people in a position to send consulting work to you. This is how I got started, myself: I mentioned my interest to the right person, who was willing to put me in touch with a previous client.¹ I, as another example, get offered a consulting opportunity about every three months or so. Conflict-of-interest considerations preclude me from taking these opportunities, interesting as they may be, so I tend to refer them to other people. And I can't refer them to you, dear anonymous reader, because I don't know who you are. So if you want consulting work, you can speed things up quite a bit by tapping into your network and advertising your interest to people in a position to send it your way.

But that is neither necessary nor sufficient. What is necessary, however, is to establish yourself as a natural and/or worthy candidate for consulting work in some domain. And that's true even if you advertise yourself to me as discussed above. By referring you, you see, I am vouching for you. And I'm not likely to risk my credibility for you unless

1. I know you very well already, or
2. You have a track record of real-world (i.e., non-academic) accomplishments which make you a safe bet.

And honestly, that second bullet is the more important one. If you can put together enough real-world accomplishments, you won't need me. People will be seeking you out to do the kinds of things you've already done. When you want consulting work, it helps to be able to point at the successful consulting work you have already done. And if you don't have any prior consulting work to point at, then you need to ask yourself a few painful questions.

First, why should someone hire you? What would they get out of it, specifically? It is not enough to say, "I'm smart." No one needs "smart." It isn't like gasoline-- it's not a need in and of itself. It is a means towards an end; a prerequisite for what people do want: solutions to their problems. So you really need to ask yourself: what real-world problems can I solve? And once you answer that, you need to ask yourself: what evidence can I muster to show I can solve these problems?

The chances are that the answer to the second question is 'not enough.' If you already had a lot of evidence on your side, you probably wouldn't be asking me how to get consulting work. Given that you are, however, you can probably can use some tips on how to bolster your case as a prospective consultant. And really, all the suggestions I have come down to one: solve a problem, for free or near-free, in public, and for the common good.

If you are a world expert on something important, write a book on it.² See some software you can write? Create an open-source project to write it, and follow through. Think your academic field has some useful things to offer the real world? Organize a conference where you bring academics and interested non-academics together.³ Invented some new algorithm that seems important? Push it through the standards bodies. Do something-- anything!-- which uses your expertise and makes life better for people. Do it for free, and do it in public. When you've done this enough, clients with relevant problems will come to you.

Having said that, I'd like to harp on the 'standards' suggestion a little bit. (I am at an IETF meeting right now, after all.) One of my two big frustrations with academic cryptography is how near-universal it is that good and useful cryptography is abandoned as soon as the CRYPTO presentation is over. I don't know for sure why this is, but I suspect a combination of two things:

1. Tenure committees do not reward tech transfer, and
2. That academic cryptographers actually believe that their part of the job is done.

To put that last point another way, I suspect that academic cryptographers regard the deal as thus: "If the crypto we invent is good enough, other people will be motivated to clarify the IP situation, standardize it, build reference implementations, and test vectors, and so on." No, no they won't. No crypto is good enough for all that to result from a mere paper. If you want that to happen, you need to get the ball rolling yourself.

Now, you may not care if any of this happens. That's fine. And as I said, your tenure committee won't reward you for this. But we're not talking about tenure here, we're talking about consulting. And getting your crypto into a standard is a great way to make the kind of name for yourself that you need to attract consulting.

Let me even go one step further: if you are going to try to push your crypto as a potential standard, the IETF is the place to go. It's a very open organization, it welcomes new participants at any time, and though the process can be convoluted it is always transparent. And there's even a particular place in the IETF I would suggest you go: the [Crypto Forum Research Group._⁴ It is expressly chartered with being a venue for academic cryptographers to bring new ideas, and for non-cryptographers to come for cryptographic advice. If you think your crypto is worth considering, they⁵ are the first people outside CRYPTO who should consider it.