Grey Science

Traditional scientific disciplines have a long history of discoveries made by amateur researchers or those with no formal scientific training. The cybersecurity community has many parallels. Papers at serious academic conferences and talks at "hacker" conferences contain surprising overlaps in topics and methods. But academics publish in formal, peer reviewed journals that are often behind a paywall, while non-academics produce artifacts in the realm of ephemeral "grey literature". The incentives for each group differ enough that no serious effort has been put forth to draw them together. How can we create feedback loops between the academic community, cybersecurity operators and underground security researchers who may not even think of themselves as "researchers" in order to work together on important security and privacy topics?