A Tribute to Scott Krulcik

Yesterday morning, I read a news article that my former student Scott Krulcik had died. Surely they’ve got the wrong guy, I thought.

Scott on an apple-picking trip that he helped organize.

Almost comically wholesome, Scott was what probably every parent dreams their kid will grow up to be. He was the kind of person who remembered not just your birthday but also your dairy allergy and made a dairy-free dessert in celebration. Not only did Scott cook many of his own meals (an impressive feat for a college student!), he also carried around his own silverware to minimize his impact on the environment. Scott’s stories of fertilizing his lawn by hand and fixing things with his toolbox impressed us so much that we came to call him the “Dad” of the research group, despite the fact that two other members of the group were actual fathers.

It’s very confusing when someone who has no business dying dies. And Scott, in particular, should have had absolutely no business with death. This was supposed to be the beginning of everything for Scott. We had celebrated his graduation from Carnegie Mellon just seven months ago. He recently moved into his first post-college apartment in the West Village. He seemed to be excelling at the transition to the working life, spending his spare time running, exploring restaurants, and reading books at the wooden desk he had built for himself the summer after graduation. Days before the news, he sent me a picture of the holiday lights he and his roommate had just put up in their apartment. It was supposed to be the first of many iterations of his holiday decorations.

Scott at a Thanksgiving dinner he helped organize, with
the turkey he made.

The best way to describe Scott is that he was a really, really great person. (The past tense is still a shock here.) I met him because he was enrolled in the security course I was teaching with Matt Fredrikson spring of 2017. As part of the first assignment, Matt and I had asked the students to email us introducing themselves and telling us why they were taking the course. Scott had a particularly memorable self-introduction. He talked about trying to be a good human who wants to help other humans and explained the connection with computer security. In his words, if he’s producing software that helps people in some other way but leaves them vulnerable to identity theft and blackmailing, then the software isn’t really helping people. Here, I thought, was a student who really got it.

Scott presenting his senior thesis project as a poster.

Over the course of the semester, it became clear that Scott was both incredibly committed to doing good and preternaturally adept at seeing connections. The day we taught the class about information flow security, he discovered and reported such a bug in Instagram that leaked people’s private photos. (The other students became more motivated to pay attention after they learned of his success with Facebook’s bug bounty program!) After he emailed the course staff observing similarities between reference monitors in computer security and repair proteins he was learning about in biology, I asked him if he had thought about writing a senior thesis. Scott showed up with admirable requirements: he needed to be able to explain the importance of the project to his mother, who was nontechnical and whose opinion he cared about deeply, and he needed to work on a project that could really help people. After exploring a breathtaking range of topics, ranging from using programs to model history (Scott loved military history) to detecting bugs in Facebook access policies, we finally settled on an idea that Scott came up with himself, combining ideas from my prior research with the work he had been doing at Google as an intern. The project was so compelling that even before it was finished, he was already attracting attention from people in industry.

Scott celebrating success in building the movie screen.

Once I got to know Scott, I discovered that he brought an equivalent level of effort and creativity to make people’s lives better in an immediate way. Scott’s positivity and energy was infectious in our research group and beyond. When our French group member asked about Thanksgiving, Scott insisted that we have a group Thanksgiving dinner complete with a turkey. I told him we could have a turkey if he took the lead on it, fully expecting him to let that requirement drop, but Scott got instructions from his mother and executed beautifully on brining, roasting, and carving the bird. When another group member suggested we host a Lindsay Lohan movie night, Scott took my somewhat joking suggestion that we should build our own movie screen and ran with it, showing up with his “Dad” toolbox and corralling fellow group members to work late into the night to realize his vision. (Perhaps unsurprisingly, The Parent Trap was one of his favorite movies.) One of my favorite memories of Scott is when he convinced me that, as a faculty judge of the CMU hackathon TartanHacks, I should come push the snack cart with him at midnight, citing how happy tired hackers are to get refreshments at that hour. The reactions across campus when people saw us approaching with clementines and cookies surrounded by a cloud of bluetooth-powered ice cream truck music confirmed that Scott knew just how to make people smile.

With Scott’s passing, the world has lost someone with enormous potential for using their capabilities for good. It is sad enough to lose Scott as a former student and friend. On top of that, I am also sad that the world will lose a rare software engineer who is deeply thoughtful about the process and purpose of software. After Scott graduated, he became a significant source of interesting reading for me: I regularly received notes and articles from him about software engineering or cybersecurity. He was thinking hard about how people should create robust, secure software. He was thinking hard about what it meant to build things that would help people. He was a protector of people’s personal information and was critical of processes and practices that seemed irresponsible with data privacy. And his ideas were spot on: he had an understanding of ecosystems and the implications of different approaches far beyond what I could say of myself at that age. In many respects, I saw Scott more as a peer than as a mentee and would seek his insightful feedback on ideas and drafts.

If life were one of the movies that Scott loved, we would not have lost him so early. This would have been the point in the story when he faced the first obstacle, only to overcome it swimmingly and go on to defeat all the bad guys and save the entire world. The group “Dad” would have gotten the chance to become an actual father. He would have become known for helping people in some big way while maintaining an impressive level of humanity and making the people around him happier. But real life doesn’t play by these rules, and Scott is gone.

Since hearing the news, I have been thinking a lot about one of my favorite books, Virginia Woolf’s Mrs. Dalloway. In the book, Clarissa Dalloway’s views are shaped by having watched her sister get killed by a falling tree. From that moment onward, Clarissa no longer believes in any higher order and instead lives her life to make things better in small ways each moment. I found her reaction to senseless tragedy inspiring when I first read the book and even more inspiring now. The least we can do to honor Scott is to remember to leave things better than we found them. Without Scott, it’s on us to carry on the legacy he was just starting to build.

With thanks to Jacob Van Buren for collaboration and Aliza Aufrichtig for edits.