• Upcoming Meetings
• Meeting Agenda
• Past Meetings
• Call for Speakers

• Other Events
• SD Security Community
• Security Resources
• Tools and stuff

• FAQ
• Mailing List
• Contact Us
• Organizers

How To Form Your Own RIW

Anyone is free to set up their own. The RIW is not a formal organization, so there are no membership requirements. However, we would like to retain credit for the idea, so it's Copyright 2002, Regents of the University of California.

If you do form a Regional Info Watch, let us know, and we'll put a link to your site on our web page. And we'd love to know how it's going, or help if we can. Just send an e-mail to sdriw@sdriw.org.

What you need to get started:

• Get some organizers.

  First, decide who's going to organize it. Yourself, a small group, whatever. Just agree on who's going to do what. Call yourself a committee if you like.

• Meeting location

  Find a space for a meeting. Maybe your employer has an auditorium or a large meeting room. Someplace with a video projector for laptops is best, Internet access is helpful. Pick a time for your first meeting. You'll eventually want to schedule a regular time, but start with a single meeting. We schedule our meetings from 2-4pm, which gives some people the opportunity to avoid having to go back to the office afterwards. :-)

• Schedule the first meeting

  Pick a time for your first meeting. You'll eventually want to schedule a regular time, but start with a single meeting. We schedule our meetings from 2-4pm, which gives some people the opportunity to avoid having to go back to the office afterwards. :-)

• Get a presentor for the first meeting

  If you can, find someone to give a presentation on something interesting. Do one yourself if you can't find anyone else. Or come up with a discussion topic for the group.

• set up web site and mailing list

  Put up a web site (it can be simple) and mailing list for announcing meetings. Our mailing list is moderated, and is used almost exclusively for the meeting announcements, so volume is quite low. We have found that some people rely on the mailing list to know when the next meeting is, and some look at the web site. So it's useful to have both. Put information about the meeting on your web-site, including presentation topic and directions to the meeting. Also include information on subscribing to the mailing list.

• Post info on first meeting

  Put up information on the first meeting on the web site, and also e-mail an announcement.

• Invite people to attend

  Invite people to attend. For people you know, you might be able to get away with an e-mail. But for people you don't know, you might want to pick up the phone and talk to them. They'll take you more seriously. Especially law-enforcement people.

  Who should you invite? Well, start with local companies. Call all the ISPs in town and ask to talk to their security person. Find security consulting firms and invite them. If you've got any colleges or universities in town, find a contact there, and ask them to forward it on to others. Identify companies with large networks and contact their security or network administrators, and/or CIOs.

  Go visit local user groups, like the Linux user's group, and give a five-minute spiel about the Regional Info Watch. If you can, make up a little flyer that you can give out which describes the group, has the meeting time, web-site URL, andailing list information.

  Don't forget government agencies, such as the county or city. They've got sysadmins too, y'know.

  Get some law-enforcement participation. If you don't know any, call your nearest FBI office and ask to speak to an agent who handles computer and/or high-tech crime. Some offices have a squad specializing in that, others just have one or two agents who handles those areas. Call the local police and sheriff's departments too. Some places have people dealing with high-tech crime (we've got an entire task force here)11. Oh, and there's also the prosecutors -- district attorneys, state attorneys, and US attorneys. And it never hurts to ask each of them if they know people at other agencies who might be interested.

Before the Meeting

• Coordinate with speaker

  Be sure to coordinate with your speaker on what technical requirements they have for their presentation (e.g. video projection, Internet connection, audio, microphone), and/or what you are able to provide. And make sure that someone is present who knows how to work the equipment.

• Verify with the speaker

  About two weeks in advance, verify with your speaker that they're coming. Don't rely on the speaker to remember to contact you if they have to cancel, especially if they have something like a family emergency.

• Verify room arrangements

  A week or two before the meeting, verify any room arrangements that you had to specifically reserve, such as A/V equipment, or room reservation. Sometimes these things get lost in the shuffle, and on the day of your meeting when you find your stuff isn't there, it may be too late to fix it.

• Send out announcement a week in advance, at least

  Send out a meeting announcement to the mailing list at least a week in advance. Include the time and date, location, directions, and a description of the talk. If you want, send out a (short) reminder the day before, too.

Holding the meeting

• Have a meeting agenda prepared.

  See our standard agenda for suggestions.

  Also, make a list of things to talk about: news, new vulnerabilities/exploits, tools, etc. Don't rely on your audience to supply information -- anything that they do is a bonus.

  One agenda item for your first meeting is to set a regular time for future meetings. We have found that a consistent meeting time is helpful (ours are currently the 2nd Monday of the month). People tend to set aside the time when they know when the meetings are, and they remember a regular time better. Get some consensus on the time -- more people show up that way.

• Show up early

  Plan to show up for the meeting at least a half-hour early, so that you can be prepared and greet people as they show up. You may have to assist the speaker in getting set-up. Put the meeting agenda (see above) on a white-board. Also put up the URL for the web-site, subscription information, and when the next meeting is (once it is determined).

• Double-check facilities and equipment

  Before the meeting, make sure that whatever you need for the meeting is in-place and working (chairs, video projector, whatever). It's not a bad idea to have a tech on hand in case you have an A/V problem.

  If necessary, put up signs showing people where the meeting is.

• Have someone to greet and escort the speaker to the meeting.

  Have some goodies for the speaker if you can. We give 'em mugs and mouse-pads. If you don't have anything on hand, maybe you can get a company to donate something.

• Press the flesh

  Use the social hour as an opportunity to thank people for showing up and get feedback from people on what they liked/didn't like. You may find that people volunteer to help, or volunteer to speak.

Once you've got started:

• Keep lining up speakers

  The hardest part about doing this is rounding up speakers. Sometimes you get volunteers quickly, but often you have to do a little convincing. Sometimes when somebody tells us about something they're working on, we ask them if they wouldn't mind talking to the group about it. Occasionally we pick a topic and find somebody to speak on it. Other times, we seen a presentation elsewhere and invite the speaker to give the same presentation to our group.

  We emphasize that the talks can be on a wide range of topics, 20 to 40 minutes, and can be low-level or high-level. In this way we have a forum that attracts both beginner and expert-level people.

  And we try to have a balance between technical and non-technical presentations. As it turns out, the legal/law-enforcement people are often very interested in the technical presentations, and the geeks are interested in the legal presentations.

  But we strongly discourage presentations by vendors who just want to do a sales pitch. We allow product vendors who wish to do a technical presentation on their product -- how it works and what problem(s) it solves. But in our case, some members of the audience are quite savvy and quick to tear apart a product that is smoke and mirrors -- and we point this out to the vendor. Since our mission is to be educational, there's no value in our "members" learning about a tool that is not effective.

  Also, see if you can get volunteers to give presentations at upcoming meetings, at the least for the second meeting. We pitch our meetings as a "friendly audience," a way to try out a presentation before giving it elsewhere.

Sundry tips and tricks

• If applicable, on the day of the meeting inform your receptionist(s) about the meeting so they can direct people to it.
• If you have to change a meeting from it's regularly scheduled date/time, send out extra announcements making it clear that it's not at the usual date/time.
• Remember to provide directions and parking information. No use having a meeting if people can't find it.
• The meeting date/time has a big effect on who shows up. Some people do better with mornings (law enforcement), some better with afternoons (geeks). Some people prefer after-hours, but others want to be home with their families (or don't want to miss the latest episode of "Buffy the Vampire Slayer12"). Friday afternoons are probably the worst day for a meeting, as many people take off early Friday to do weekend stuff, or are caught up with end-of-the-week tasks that they need to finish.
• Consistency and continuity is important. Keep the meeting cycle going. If once a month is too much, try once every two months, but keep it steady. If your meetings become too irregular or infrequent, attendance will taper off drastically.