Virtual Conferences: Where Do We Go From Here?

The last trip I took in the Before Times was to the RSA Conference in San Francisco. A record 45,000 attendees crowed the cavernous Moscone Center in 2020, packing city hotels and driving nightly rates upward of $600. RSA’s tradition of ever-increasing attendance is a phenomenon going back to 1991. When I landed back home the last day of February, the lockdown had just begun.

My relationship with what is now the RSA Conference began many years ago when it was still known as the NIST/NCSC Computer Security Conference. That year, I submitted a paper for inclusion that was summarily rejected by the conference committee. I was working for the National Computer Security Center at the time (the NCSC in the conference description), so I canvassed the hallways looking for a committee member to seek more feedback. Failing to locate said committee member, I ran into a colleague in a nearby office who has a terminal degree in computer science and years of technical experience. I showed him my paper with the committee markups. (Yes, we still used paper in 1994. You were even able to read the reviewers’ marginal comments penned in red ink on the returned document.) Dr Holloway asked to keep the document for a day so he could read it.

The next day, he appeared at the door to my cubicle and asked to sit in my side chair to discuss my submission. I saw the heavily annotated sheaf in his hand and waited for my pat on the head for trying. Instead, he started by telling me he really liked what I had written and felt the perspective of the reviewers wasn’t accurate given the focus of my paper. He walked me through his comments and made a few suggestions. As he left, he said he knew everyone on the committee and would speak to them about me. A week later, I received a surprise notification my paper was selected for that year’s conference ¹. I was giddy.

That auspicious beginning has turned into decades of conference attendance in spite of several job changes and new roles. I missed a few years here and there, but have now been to a couple dozen shows over the years – from the early ones in Baltimore through the transition to San Jose and ultimately San Francisco. Organizers keep threatening to move the event to the only remaining venue large enough to handle the size of RSA — Las Vegas — but the connection with San Francisco is strong.

Every year, I saw old friends and colleagues and learned about new companies and technology. I spoke, delivered presentations, and attended some sessions, but the most valuable time seems to always be connecting with colleagues, mentors, friends, and new acquaintances. Back in the salad days of information security technology, I was witness to my then CEO, John Thompson of Symantec, trading barbs with Bill Gates on the keynote stage. It was awe-inspiring and set the stage for the year ahead in my chosen profession. Then everything stopped this year.

RSA Conference 2021 will be virtual. I am well aware this is not the only conference moving to 100% remote attendance. Most every such meet-up has been forced to do so in the pandemic year thus far. What we don’t know is how long this will last — even with vaccines rolling out as I type this. The pandemic will have profound long-term ramifications. We just don’t know yet what they will be.

The virtual sessions are talked up by many: you don’t have to waste time traveling! It costs a lot less to attend! No inflated hotel charges! More people can see these sessions! You can show up in your pajamas! What remains unsaid is what is missing.

Let’s start with the obvious losers in this virtual scenario. In addition to the hotels with their inflated rates, you have all the restaurants, diners, cafes, coffee shops, and weed dealers who cannot look forward to the annual springtime bonanza of fly-in attendees dropping travel money all over town. Caterers, taxi drivers, rental car companies, airlines, and shipping companies come up short. Corporate marketing budgets have shrunk perceptibly as vendors can’t send their products, display booths, and technical staff to pitch their technology. Companies are seeking creative ways to reach new customers who are sitting in front of a computer at home wearing pajamas. In the meantime, the sales teams are dialing for dollars.

Industry participants at conferences will be negatively impacted in several significant ways. Vendors and their sales staff have lost a productive and repeatable process to ferret out new clients and cheerleaders for their products. As much as attendees like to gripe about the sales pitches, they are an important aspect of any conference that allows even those giving a passing glance at a booth to keep up on trends and capabilities in technology. Vendor-to-vendor meetings now need to be scheduled on meeting applications and serendipitous meetups are few and far less likely to occur. I can vouch for several such chance meetings that evolved into profitable long-term relationships.

But most of all, the practitioner-to-practitioner meetings, whether scheduled or by chance, will dramatically limit the growth opportunities for innumerable professionals and newbies alike. I have personally met people there who would soon become work colleagues or bosses. But the vast majority of acquaintances were old friends and coworkers of days past. The value in nurturing these personal relationships there was critical. The sinews that connect us begin to wither away as we fail to stay in touch in our new virtual worlds.

Virtual meeting and conference platforms are racing to introduce new features to simulate this in-person experience. They want to set up virtual conference lobbies and hallways in addition to providing vendor demonstration rooms. The jury is out on how effective these new capabilities will be. In the meantime, our industries, and our people, suffer from isolation and remoteness. Where do we go from here?

---

1. In the years following the 1994 conference, that paper has been republished many times and has been translated into at least four languages. It became the basis for my 2004 textbook, Assessing and Managing Security Risk in IT Systems: A Structured Methodology.