Tech-Security Official at U. of Virginia Wears Fish Costume to Raise Awareness of ‘Phishing’

When Karen McDowell dressed up in a purple fish costume and walked around the University of Virginia’s campus last month, she got plenty of attention for her cause, even though she had to explain the meaning of her outfit. Ms. McDowell is a security analyst for the university, and her goal was to raise awareness about e-mail phishing schemes, in which con artists send e-mail messages hoping to lure people into giving out their passwords or other personal information.

“Sometimes I introduced myself as a fraudulent e-mail because many people don’t know what a phish is,” said Ms. McDowell (pictured in costume, at right).

In fact, pulling off her plan of dressing up as a “phish” for Cybersecurity Awareness Month was more difficult than she had expected. She could not find a fish costume online, for instance, so she commissioned a local seamstress to make one by hand (setting the university back about $60).

On several days in October, Ms. McDowell visited busy parts of the University of Virginia’s campus and handed out fliers about how to recognize scam e-mails.

Why the costume? “Phishing is not a humorous subject, but there’s some humor to someone dressed as a purple fish, and it lightens the mood,” she said. In the past, university officials — without flashy costumes — had set up tables around the campus to spread the word about phishing, and students rarely showed any interest. But Ms. McDowell said she was approached by curious students who asked her what she was up to, and most would listen to her spiel.

“I wanted to appeal to their imaginations — like, a fraudulent e-mail could come to your computer looking like me, and you don’t want that,” she quipped. “So hopefully when they get e-mails, they’ll think, ‘Oh, what was that lady in the fish talking about?’”

She said college students are particularly susceptible to computer phishing scams because they are generally more trusting than older users. “Students don’t think they’re going to hit by a virus or trojan,” she said. “They think they’re invincible.”

The costumed campaign was just one aspect of the university’s outreach efforts concerning computer security. It also formed a partnership with local schools and organizations to create an information Web site with a series of short online brochures and daily cybersecurity tips. —Jeffrey R. Young