Wyatt Starnes and the business of knowing what changed

Wyatt Starnes had a career that could accommodate both semiconductor testing and a proposed online game called Piggyland. The second project sounds like an unusual preparation for selling security software to institutions with serious stationery. Yet the path between them was shorter than it first appears. An online world needs rules. It also needs some way of noticing when somebody has quietly rewritten them.

Starnes and Gene Kim were working on immersive multiplayer gaming before they built a company around Tripwire. Their security subsidiary was intended to protect games and similar systems. The security business soon became the more promising enterprise. Piggyland offered a place to go; Tripwire offered a way to check what had happened after you got there.

The company they formed in 1997 gave commercial life to software with academic roots at Purdue. Kim supplied the technical continuity; Starnes became founding president and chief executive. His contribution belongs in that meeting of engineering, customers and organization. A useful program still needs people who can explain why anyone should pay for it.

That is the thread worth following through his working life: a willingness to turn a precise technical question into a business that other people could use. He kept returning to verification, whether the object under examination was a chip, a file or a computing environment. Trust, in his working vocabulary, needed something you could measure.

The test bench came first

Born in Atlanta on October 13, 1954, Starnes grew up largely in Walnut Creek, California. He graduated from Ygnacio Valley High School in 1972 and earned an associate degree at the Control Data Institute. His route into computing was direct and practical, beginning well before cybersecurity became an ordinary item on a corporate agenda.

An elementary-school science project involved a photocell sensor. By 1973 he was working at Data General in Sunnyvale. His early work included semiconductor testing and programs that checked whether chips behaved as intended. Memory and microprocessors might have been new territory for the industry, but they still had to pass a test before anybody could sensibly rely on them.

He went on to Monolithic Memories and Maruman Integrated Circuits, then joined Megatest in 1978. At Megatest he moved from technical work into management, sales and marketing, eventually becoming a vice president. He also spent two years as president of Megatest Japan in Tokyo. The test engineer was learning how to take a technology into another market.

His subsequent Portland career included Trisys, Eclipse Technologies and Infinite Pictures. At Eclipse he spent four years running a company before selling his interest. At Infinite Pictures he met Kim. By then, Starnes had experience on several sides of the same transaction: making something work, explaining its usefulness and finding the people who needed it.

A file leaves a fingerprint

Tripwire began as a research project involving Kim and Purdue professor Eugene Spafford. Its original releases circulated in source-code form through the early internet. In 1997, Kim and Starnes licensed the name and software from Purdue and formed the Portland company. The first commercial version followed in 1998.

The central idea is approachable even if the machinery underneath it is mathematical. Record a reference for a file. Measure it again later. Compare the two. A changed measurement tells an administrator that something deserves attention. The software does not have to watch an intruder wearing a striped sweater carry the file away.

That kind of checking addressed a difficulty with computers: their outward appearance is a poor guide to their internal condition. A screen may look familiar while an important file has changed. Integrity monitoring gives the operator another form of evidence, one that depends on recorded measurements rather than reassuring appearances.

For the people responsible for keeping systems running, this made an invisible event discussable. A changed file could be examined, explained and compared with an authorized update. The comparison supplied a starting point for investigation. It gave the administrator a narrower question to answer than whether an entire computer seemed safe.

Commercializing the program also meant extending it to environments beyond its original setting, including Windows. The distinction matters in Starnes’s biography. The research idea preceded his company. His work with Kim helped turn it into a product business, taking something that specialists could obtain and making it available through a commercial organization.

In Senate testimony, Starnes described Tripwire as operating on hundreds of thousands of critical systems worldwide. He brought the concerns of a business leader and an information-security practitioner into the same discussion. The subject was the reliability of infrastructure that governments and companies were already depending on. A missed change could have consequences far beyond one untidy machine.

The next question was harder

Finding a difference leaves another question unanswered: was the starting point trustworthy? In 2004, Starnes founded SignaCert, pursuing verification through reference information about legitimate software. A photograph of a room can tell you what moved. It cannot, on its own, tell you whether the wrong person was already sitting in the chair.

SignaCert gathered measurements associated with software of known origin. Its Global Trust Repository brought together reference data across vendors and platforms. Administrators could compare what they found on their systems with known software records. This made the provenance of the reference part of the job, alongside the comparison itself.

The business attracted institutional backing. In April 2009, it announced an $8.8 million Series B round, with participation from existing investors DCM, Intel Capital and SmartForest Ventures, and additional investors including In-Q-Tel. It also hired Scott Campbell to lead global sales. Campbell had previously spent six years as a regional sales director at Tripwire.

That personnel connection makes the second company feel less like a clean break. Experience travelled with people, including knowledge of customers and the unglamorous work of selling enterprise software. The new product asked a different question, while drawing on relationships formed around the earlier one.

Harris announced its agreement to acquire SignaCert in May 2010. Starnes joined Harris in a senior cyber technology role and later served as vice president of Advanced Concepts. The transaction placed his verification work inside a company serving government and commercial customers. He retired in 2012.

His engineering involvement continued alongside management. A patent for verifying the integrity of virtual machines names William Wyatt Starnes with Ronald James Forrester and Frank A. Tycksen Jr. The technical setting had changed again: software could now be packaged into machine images. The familiar problem of checking what was actually there followed it.

Taking the argument to Washington

Starnes also worked on the public side of computing. At NIST, he chaired the Visiting Committee on Advanced Technology’s information technology subcommittee. Its 2007 membership included Vinton Cerf, Gary Floss and David Spong. Their remit ranged beyond individual security products to the reliability, measurement and long-term usefulness of information technology.

The subcommittee considered questions such as preserving digital information so future users could still interpret it. It also examined growing computing demands and the need for common measurements. These were questions for institutions expected to outlast a product cycle. Starnes’s work had moved from checking particular components to helping assess the systems around them.

He appeared before a House subcommittee in October 2009 as SignaCert’s founder and CEO. In 2011 he joined the TechAmerica Foundation’s CLOUD2 commission, charged with recommending approaches to cloud deployment and innovation to the Obama administration. Computing was moving away from machines an organization could keep under its own roof.

For a customer, that raised a familiar concern in a new location. How much confidence could an organization place in a service operated elsewhere? Starnes discussed trust as an obstacle to cloud adoption, with security considered alongside availability and service performance. The vocabulary changed, but the demand for evidence remained.

A different kind of reference

In Oregon, Starnes co-founded RAINS, the Regional Alliances for Infrastructure and Network Security, to connect public and private efforts around security technology. He also became known as a mentor. Those activities sit naturally beside the company-building: each involved bringing people with different responsibilities into a conversation about a shared problem.

His life outside work had its own recurring destinations. He married Kirsten Cowden in 2005 after a ten-year courtship and helped raise her two sons. He travelled, played golf through Oregon winters and enjoyed escaping to Manzanita. There he served as a lead driver in the Fourth of July parade. Even a career in verification can leave room for a parade.

Starnes died on May 10, 2014, aged 59. His family asked that a memorial fund support early-stage entrepreneurs. Later that year, Lindsay Nelson, co-founder and CEO of Theme Dragon, became the first recipient of the Wyatt Starnes Memorial Award, receiving $3,000 and a year of access to Oregon Entrepreneurs Network educational programming.

The award gave a practical form to remembrance. A younger founder received money, access and a community at a stage when all three can matter. Later versions invited Oregon colleges and universities to nominate entrepreneurs. His name became attached to the beginning of somebody else’s working story.

There is a pleasing symmetry in that. Starnes spent much of his career building ways to compare a system with a dependable reference. The award asks a different sort of comparison: which new entrepreneur shows the enthusiasm, persistence and willingness to take risks that people remembered in him? The measure is human, and the result is another chance to begin.

“My reward comes from the special opportunity to do something important that (hopefully) leaves the world a better place.”Wyatt Starnes