Elie Bursztein

Early Life and Education

Born in 1980, Elie Bursztein pursued his academic training entirely within French institutions before moving into international research. He earned a computer engineering degree from EPITA in 2004, followed by a master's degree in computer science from Paris Diderot University and ENS in 2005. In 2008, he completed a PhD in computer science at École normale supérieure Paris-Saclay, with a dissertation titled Anticipation Games: Game Theory Applied to Network Security.

Early Career and Stanford

Following his doctorate, Bursztein joined Stanford University's Security Laboratory as a postdoctoral fellow, where he collaborated with Dan Boneh and John Mitchell on web security, game security, and applied cryptographic research. His work during this period produced several notable firsts: the first cryptanalysis of Microsoft's DPAPI (Data Protection Application Programming Interface), the first systematic evaluation of the effectiveness of private browsing modes, and significant advances in CAPTCHA security and usability.

During this period he also identified and helped remediate hundreds of vulnerabilities, including weaknesses in Twitter's frame-busting code, a method for exploiting Microsoft's location service to track mobile device positions, and flaws in the Apple App Store's encryption that could allow password theft and unauthorized application installation.

Career at Google

Bursztein joined Google in 2012 as a research scientist. In 2014 he founded the Anti-Abuse Research Team, and in 2017 he became lead of both the Security and Anti-Abuse Research teams. In 2023, he assumed the role of Google and DeepMind AI cybersecurity technical and research lead.

His contributions at Google span more than a decade of high-impact research and engineering:

• 2013 – Strengthened Google account protections against hijackers and fake accounts.
• 2014 – Redesigned Google's CAPTCHA system, resulting in a 6.7% improvement in human pass rates.
• 2015 – Completed the first large in-the-wild study on the effectiveness of security questions, demonstrating they were both insecure and had low recall rates, leading to their deprecation at Google.
• 2017 – Led the team that found the first full SHA-1 collision, a landmark result in cryptographic security.
• 2018 – Conducted the first large-scale study on the illegal online distribution of child sexual abuse material, in partnership with NCMEC.
• 2019 – Invented Password Checkup, Google's privacy-preserving password breach alerting service, enabling billions of users to check whether their credentials had been compromised. Also developed Keras Tuner, which became the default hypertuner for TensorFlow and TFX.
• 2020 – Developed a deep-learning engine to block malicious documents targeting Gmail users.
• 2022 – Created the first post-quantum resilient security keys.

Recognition and Awards

Bursztein has received numerous awards across both academic and industry venues. His academic honors include distinguished paper awards at USENIX Security (2019, 2021), a best paper award at Crypto 2017 for the SHA-1 collision research, a CHI best paper award in 2019, and multiple S&P and WWW paper awards. Earlier recognitions include an S&P best student paper award in 2011 and a WISPT best paper award in 2008.

On the industry side, he received the BlackHat Pwnie Award in 2017 for the first practical SHA-1 collision, was named one of the 100 most influential French people in cybersecurity in 2019, and received the IRTF Applied Networking Research Prize in 2015.

Philanthropy and Other Interests

In 2023, Bursztein founded the Etteilla Foundation, dedicated to preserving and promoting the heritage of playing cards, and donated his personal collection of historical playing card decks and tarots to the organization. He is also an accomplished magician and shared weekly magic tricks on Instagram during the COVID-19 pandemic.