Internet measurement: We're interested in how you can measure the physical aspects of the internet to help journalists and activists understand what is happening. This includes internet black holes (such as protest-related outages), physical links (cellular versus Wi-Fi versus cable) and geolocation.
Novel threats: Through reverse engineering and vulnerability discovery, we're collecting longitudinal data about threats to users that come from the network infrastructure itself, such as censorship, surveillance, man-in-the-middle attacks on vulnerable update mechanisms and other threats that receive less attention because they're aimed at so-called "at-risk" users.
The ecology of malware: We're interested in how malware evolves on different timescales. For example, a phenomenon we're interested in is recombination of malware (such as a filesystem virus that infects an email worm and travels “on its back,” or a macrovirus in a Word document that grabs macros from other macroviruses to create a new macrovirus with new behavior).