Eugene "Gene" H. Spafford (born 1956), known professionally as Spaf, is an American computer scientist and cybersecurity pioneer who has served as a distinguished professor of computer science at Purdue University since 1987. Specializing in computer and network security, cybercrime investigation, ethics in computing, and technology policy, Spafford has made seminal contributions to the field, including his detailed analysis of the 1988 Morris Internet Worm that informed early understandings of malware propagation and system vulnerabilities. He founded and directed the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue, establishing it as a leading interdisciplinary hub for cybersecurity research and education. Spafford is the only individual to have received all three major U.S. national awards in computer security: the NIST/NCSC National Computer Systems Security Award in 2000, the ACM SIGSAC Outstanding Innovations in Computer and Network Security Award, and the National Information Systems Security Award. His work emphasizes practical defenses against cyber threats grounded in empirical analysis of real-world incidents and policy implications for secure system design.

Eugene H. Spafford was born in 1956 at Rochester General Hospital in Rochester, New York. He spent his early years in Greece, New York, a suburb approximately 10 miles northeast of SUNY Brockport, where he resided for the first several decades of his life. Spafford's family placed a strong emphasis on education, with his parents making significant sacrifices to support both him and his sister in pursuing higher learning. Extended family members, including cousins, aunts, and uncles, provided additional encouragement and support during his formative years. His interest in computing emerged early in high school around 1971, a period when such engagement was uncommon for students. This early pursuit was influenced by his longstanding enthusiasm for science fiction literature, which sparked imaginative thinking about technology and its possibilities.

Eugene H. Spafford earned a B.A. in Mathematics and Computer Science, summa cum laude, from the State University College at Brockport in May 1979. This undergraduate program provided foundational training in computational theory and programming, emphasizing mathematical rigor applied to early computing systems. Spafford pursued graduate studies at the Georgia Institute of Technology, receiving an M.S. in Computer Science in 1981. His master's thesis, titled "A Mixed-strategy Page Replacement Algorithm for a Multiprogramming Virtual Memory Computer," addressed memory management efficiency in multiprogramming environments under advisor Philip H. Enslow. This work involved empirical analysis of virtual memory behaviors, highlighting reliability issues in resource allocation that foreshadowed broader concerns with system stability.

He completed a Ph.D. in Computer Science at Georgia Tech in 1986, with his dissertation focusing on the design and implementation of the Clouds kernel, a fault-tolerant distributed operating system., where he emphasized empirical studies in software engineering for reliability, including mechanisms to handle hardware failures and maintain system integrity in distributed settings. These investigations revealed systemic vulnerabilities in operating systems, such as inadequate error recovery and fault propagation, which later informed Spafford's shift toward applied computer security amid the emerging threats of the early 1980s computing landscape.

Following his Ph.D. in information and computer science from the Georgia Institute of Technology in 1986, with a dissertation on kernel structures for distributed operating systems, Spafford served as a research scientist at Georgia Tech's Software Engineering Research Center for approximately 1.5 years. In this post-doctoral role, he focused on developing tools for software reliability assessment, including methods for program analysis and fault detection to ensure systems performed as designed.

Spafford's early research built on his doctoral work in reliable operating systems by extending into software testing and debugging techniques, viewing testing as essential for verifying reliability in complex software environments. He contributed to investigations of how software could be engineered to minimize unintended behaviors, emphasizing systematic analysis over ad hoc fixes. This included explorations of execution backtracking and fault localization approaches, which aimed to trace errors back to their origins in code design and implementation.

Through empirical examination of software failures, Spafford highlighted design flaws and human errors in development processes as predominant causes of unreliability, rather than solely environmental or hardware issues. His critiques underscored the need for causal reasoning in identifying root vulnerabilities in software architecture, predating his later security applications by prioritizing preventive integrity checks. These foundational efforts laid the groundwork for understanding systemic risks in computing systems.

Spafford has served on the faculty at Purdue University in Indiana since 1987 and is a Distinguished Professor of computer science. He is executive director emeritus of Purdue's Center for Education and Research in Information Assurance and Security (CERIAS), and founded its predecessor, the COAST Laboratory. He has stated that his research interests have focused on "the prevention, detection, and remediation of information system failures and misuse, with an emphasis on applied information security. This has included research in fault tolerance, software testing and debugging, intrusion detection, software forensics, and security policies."