Edge of Chaos?

Ron Donaldson points to some weak signals that complex adaptive systems thinking may well be about to assert itself as the new paradigm [Edge of Chaos - The Ecology of Knowledge].

Ron cites a number of recent examples of fragmentary political action that have evaded the control of the traditional forces of law-and-order. However, different stakeholders will have different ways of making sense of these example.

From a law-and-order perspective, there is a great deal of activity that remains under the control of the traditional forces of law-and-order, and these examples might be regarded merely as isolated failures. The forces of law-and-order will undoubtedly wish to improve their ability to anticipate and manage future incidents more effectively, and will therefore be looking closely at these examples. From this perspective, it would not be surprising to discover some useful patterns in these examples.

Meanwhile, the forces of radical change in society may be looking at these as hopeful signs of future transformation in our sociopolitical systems. From this perspective, the objective would be to identify tactics that were robust, not only against current police procedure but against any future police procedure.

Ron's new paradigm might be based on a belief that there is a fundamental asymmetry that is shifting power away from the traditional forces of law and order, which no amount of police innovation could ever catch up with. But while there are undoubtedly some asymmetries in the modern world that create new demands and challenges for the forces of law and order, history suggests that traditional order is a lot more robust than student activists might wish.

Notes on the Value of Culture

Following my previous post Meeting of Minds, about the cost of meetings and of the "meeting culture", @j4ngis asked "Would you also consider value of meeting culture?"

There is a more general discussion of culture to be had here. Culture is often blamed when things don't go according to a rational managerial ethos. As Oscar Berg blogged yesterday, Did you ever hear anyone shout "culture failure!"?

But an organization without culture - well, it just wouldn't be an organization at all. Culture is what gives an organization its identity - it is a kind of deeper structure that protects the organization from incoherence, instability and inconsequentiality. Culture tells us how an abstract business model is embodied in a particular organization.

Arjo Klamer identifies several ways of talking about the value of culture. In an anthropological sense,

"‘culture’ ... refers to the shared values, stories and aspirations that distinguish one group of people from another (think of a community, an organization, an ethnic group, a nation or a continent). The economic value of culture would be the economic contribution that those shared values make. As the sociologist Max Weber famously argued, the culture of Calvinism may have contributed to the rise of capitalism and the economic growth that came with it. A particular culture may improve economic performance or hinder it. A culture of distrust can seriously hamper the market process. A culture of consensus, such as exists in Japan and the Netherlands, can stifle entrepreneurship but may also be responsible for stability in the event of crisis." [Value of Culture (pdf)]

Edgar Schein identifies three levels of organizational culture - behaviour and artefacts, values, and assumptions and beliefs. [See Wikipedia. See also notes by Ted Nellen.] We can use the VPEC-T lens to unpack and identify these different elements.


An organization has various mechanisms to prevent random changes to the way-we-do-things. Much of the time, these mechanisms are accepted uncritically as part of normal management control - like an immune system that prevents the organization being taken over by destructive memes. @AndreaMeyer calls these mechanisms corporate antibodies. However, when managers themselves want to change things, these mechanisms turn out to be inconvenient obstaces, whose aggregate effect is to suppress innovation.

Vincent Kenny and Philip Boxer describe culture as follows.

"Anyone who works in businesses will have encountered the notion of culture, and the incredible extent to which a culture lives on in a way which defies anyone's attempts to bring about change. It is not only a question of dealing with the issue of anxiety as an individual issue - the whole fabric of the organisation seems to be caught up in the conservation of identity however much change individuals may make." [Economy of Discourses, 1990]

Kenny and Boxer go on to talk about "the levels of extreme inflexibility and 'stuckness' which we witness in large companies" and ask "how can we explain the increasing degrees of rigidity and loss of power for self-transformation evident in the invariant identities and cultures of organisations?"

The reason why leaders struggle with culture is because there is a creative tension or asymmetry between culture and identity on the one hand, and viability (or effectiveness or survival) on the other hand. This is a critical element of the Asymmetric Design lens, which Philip Boxer describes in When is a stratification not a universal hierarchy? (See also the sociological distinction between structure and agency.) This provides a rigorous framework for reasoning about complex structural change.

Coming back to @j4ngis's question - what is the value of the meeting culture - I guess the key question here is what other cultures (more flexible, less bureaucratic, or whatever) we'd be comparing it with, in what context. What function does this culture serve in the context of this particular organization, and how does it affect the strategic outcomes and energy profile of the organization?



Related posts: Vaccination (September 2004), Meeting of Minds (January 2010), Easier Seddon Done (June 2008) 

Red Queen Effect

The Victorian mathematician and fantasist Lewis Carroll used the character of the Red Queen to parody grotesque forms of reasoning and energy: believing impossible things (before breakfast), running to remain stationary.

Believing the impossible, accelerating and relentless change - these are now among the totems of innovation. The Red Queen has now become an icon for a certain kind of energetic innovation. There is a good summary on the Farnham Street blog (October 2012).

There are several other related terms.

• Running Up the Down Escalator. In 1993, the SEI published a video with this title, presented by risk management consultant Bob Charette. (I haven't seen this video, but I've seen other materials derived from Charette's work that portray the staircase as a corkscrew or helix, spiralling downwards as you try to run up.) In one version of the story, the acceleration control is at the top, so those who are most successful at running up the down escalator get the chance to speed up the escalator, thus increasing the gap between themselves and their competitors (Critical Chain, June 2008).
  
• Continuous Bootstrapping / Perpetual Bootstrapping.
  

Dave Bayless (Evergreen Innovation Partners) has recently propounded a model of accelerating product innovation, which he has also named after the Red Queen. He points out that the compound effect of a 10% annual acceleration in product innovation results in a halving of product life cycle duration every seven years See his blog and video on Innovation, Clockspeed and the Red Queen Effect. See also comment by John Hagel: Product Innovation and the Red Queen Effect.

While this model has some intuitive appeal, there are some interesting complications (or asymmetries).

1. The product is not the technology. A product may be composed from a large number of components, each of which may be subject to technical innovation. Product innovation is not a simple linear function of technology innovation; a product lifecycle can be extremely short, but most of the underlying technology may be moving much more slowly. Or vice versa.

2. The adoption is not the innovation (as John Hagel points out). Innovation includes process innovations as well as product innovations. Hagel suggests that "rapid incremental process innovation combined with aggressive leveraging of third party resources may in fact hold the key to diminishing, if not overcoming, the Red Queen effect."

3. The "device" is not the "commodity". Small incremental changes in the product may result in radical changes in user experience and practice, while radical substitutions on the technology side may simply be experienced as slight improvements in service cost and quality. For example, the consumer experience of innovation in automobiles or electronics or mobile telephones is not based on the rapid turnover of model numbers and versions, but on major (and relatively infrequent) step changes in functionality and performance.

A rigorous model of technology change must articulate these different layers clearly.

---

See also further posts on the Red Queen Effect.

 

Footnote added later

Charette's Risk Escalator is described in Tom deMarco and Tim Lister, Walzing with Bears: Managing Risk on Software Projects (Dorset House, 2003) p 12. I also found a video of Bob Charette presenting the model at a conference in 2012 https://vimeo.com/43479018. The original source appears to be R. Charette, Up the Down Escalator: Managing Risk in an Uncertain World (Part 1), (Software Management, Oct. 1993).

Wash Out 2

The Biblical symbolism of the New Orleans flood is becoming unmissable.

• 40 days for the floodwater to subside (BBC News)
• Widow's Mite: ThinkProgress via Backwards City.
• Intelligent Design: "Security thinking is based on the intelligent design model". (Security Nerd via One Raindrop)

From a security thinking perspective, Hurricane Katrina apparently provides an excellent proof of Intelligent Design. Surely only the most wise and angry God could find a way to destroy such well-engineered flood protection.

The Intelligent Design model assumes that we can build effective security by a top-down process. But the actual state of hurricane-readiness in New Orleans was not determined by a simple top-down process, but by a complex emergent process including large quantities of development in the surrounding area.

Security thinking also assumes symmetry between threat and defence. But Acts of God are often asymmetric. As Security Nerd indicates, there is no competition between an imperfect city and a perfect storm.

---

Previous post: Wash Out

Dividing Risk

Responsibility for security of credit card transactions is divided between credit card companies and merchants. The credit card companies don't entirely trust the merchants, and want to ensure they take every possible precaution against fraud.

Credit card companies are larger and fewer, so they call the shots. Some elements of risk are unilaterally exported onto the merchant. In case of doubt, the merchant bears the financial burden. This is surely an example of asymmetric trust.

So who is responsible for specifying the security requirements, and designing the security mechanisms? Steven Hofmeyr argues that the credit card companies should leave this as a problem for the merchants to solve. "My suggestion to the credit card companies would be to impose heavy penalties on merchants that get compromised, but not to specify what exactly those merchants should do to make themselves secure." He favours incentives for companies to secure their systems, "without restricting or constraining the way in which they should do so, leaving companies to choose the most effective way", on the grounds that this will encourage innovation in defence, and notes how legislation or regulation often generates such incentives. Hofmeyr's suggestion is endorsed by Adam Shostack.

Given the asymmetry of power, any requirements imposed on merchants by credit card companies are effectively equivalent to regulations. Leaving merchants free to interpret these regulations (and suffer the consequences if their interpretations aren't good enough) may affect the security of the whole ecosystem in some interesting ways.

Firstly, each merchant is faced with fear, uncertainty and doubt. The big companies probably know much more about the possible security mechanisms, and their advantages and disadvantages, but the small companies have to decide for themselves - and woe betide them if they get it wrong. This anxiety effect tends to erode confidence and trust in the network, thus reducing economic efficiency and ethical balance.

Secondly, we may expect considerable diversity of security mechanisms. This diversity may be one of the factors leading to the innovation argued by Hofmeyr. But at the same time, diversity may impede the communication and adoption of innovation, so the effective innovation benefits are not clearcut. Very occasionally, a centrally coordinated development effort may be both more cost-effective and more innovative than a large number of independent parallel developments. So it remains an open question whether the credit card companies should provide more specific guidance, whether they should "own" the security requirements.

Thirdly, the greater the diversity of security mechanism, the smaller the proportion of merchants likely to be affected by any given attack. This appears to be beneficial for the population of merchants as a whole, since it reduces the risk for any individual merchant, and makes some form of mutual insurance viable. Above all, it is beneficial to the credit card companies, whose business would only be seriously threatened by the loss of a significant number of merchants in one incident. However, given the incessant search for new modes of attack, this benefit depends on the collective ability to develop new forms of defence.

In a complex collaboration, a careful division of risk requires detailed analysis, robust negotiation, and attentive governance. Redistribution of risk-responsibility can have a huge effect on the total shared risk within the system, generating both economic and ethical benefits.

Technorati Tags: asymmetry innovation regulation requirements risk security trust

Sic transit gloria Microsoft

originally posted by John in response to Feedback as Regulation

---

Suns set on empires in the end, Egyptian, Assyrian, Roman, Byzantine, British, the roll-call of yesterday’s elites still echoes down the years. And, much to their chagrin, giants have blind-spots where upstarts can sneak by them. Coca Cola begat Pepsi Cola. Xerox begat GUIs. NCR begat IBM. And IBM, at the height of its hubris, dismissing the power of the ‘bunch’ – Burroughs, Univac, NCR, Control Data and Honeywell, giants in their own rights whose total gross revenues Big Blue’s net profit regularly exceeded – begat Microsoft. And, as far as I can see, the answer to Richard’s question ‘Is there really an Authority anywhere in the world that can keep Microsoft in check?’ is that, right now, for countless and well-rehearsed reasons, there probably isn’t. But help is at hand.



Relationships rule. They sustain us all – empire, giant or ordinary man in the street. Trust is at the heart of relationships and Microsoft – except in the sense in which the US has anti-trust laws – isn’t very good at trust. (Scimitar's shadow-side model explains why this is so.) Nor is Microsoft particularly good at relationships, even relationships with empires - with the exception always of the CIA, The Pentagon and the Bush administration of course. (The EU, for instance is due to decide this week whether or not to suspend the sanctions it imposed on the giant for ‘abuse of its dominant position’ in refusing to sell a version of Windows without MediaPlayer. Hardly a clash of Titans, a cynic might fear.)



Shakespeare put his finger on the problem (when didn’t he?) in Measure for Measure when he has Isabella say, ‘O, it is excellent to have giant’s strength but it is tyrannous to use it like a giant’. Worms turn at the margin of power asymmetry and trust becomes self-regulatory. Savvy organizations have been Microsoft averse for a good many years. Likewise savvy emerging economies, still living with painful memories of colonialism and slavery. In the end, trust, the great regulator, will be the authority Richard is looking for.



Byzantium, Constantine the Great’s peerless empire, began in the year 330 of the common era and lasted until the 29th of May 1453. As for Bill Gates's empire, the world won’t have to wait as long until sic transit gloria Microsoft.

Playing the trust card

originally posted by John

---

Political leaders in trouble frequently play the trust card in the hope of getting out of jail free. With great humility, they play it talking over the heads of their captive audience to the country at large via the TV cameras. The deeper the trouble, the more exuberant their claims become that trust is the solution to the country’s – and the party’s - individual and collective woes. Everything will be fine, the leader says, when there is trust. Trust makes great sound bites. Don't trust him, trust me, see how 'umble I am, says the political wolf in Heep's clothing.


I’ve just been watching a report on Channel 4 News of Michael Howard’s trust-focused speech to his party’s Bournemouth conference this afternoon. Personally, I’ve never had much sympathy with him or with the politics he’s been involved with over the past twenty-five years or so. Today was no different. But he, more than anyone in the country I reckon, must know that he’s talking through his hat.



British politics is an adversarial, zero-sum affair. For all involved, it runs on publicness, comfort and asymmetric power. And whatever trust is, however it is defined, by Michael Howard or anyone else, it is none of the above.



Immediate concerns determine behaviour in adversarial politics, leaving no space for trust. Trusting behaviour is punished. And worse, the more the trust card is played, the more adversarial the politics becomes. And so the spiral spins down. Ego, not trust, is what’s needed to play zero-sum games.

Symmetry is a choice

originally posted by Aidan in reply to post on Asymmetric Trust

---

Richard,


This is an interesting place that clearly confuses people’s radar. I am proposing that the benefits of trust come from trusting behaviour. You are absolutely correct that most corporate businesses are incorrigibly asymmetric in their dealings with individual customers. My point is that that precludes trust. If they want the benefits of trust they have to personalise their dealing to a point where it is clear that the person dealing with a customer has complete latitude to meet the demands of trust in that relationship. I claim that it is their choice that they do not do this.


The point about other ways of achieving symmetrical power, even if this is specific to a local set of circumstances, is that it shows that the shadow side of that symmetrical trust relationship is always just beneath the surface and that it is always hubris to claim otherwise.

Asymmetric Trust

Our experience of trust starts at the human level: between parent and child, or between neighbour and neighbour. This can be symmetrical, because both sides are people.



As soon as we treat corporations as if they were people, we start to get into difficulties. I may have warm feelings about some of the companies in my neighbourhood, especially those that have been around for a long time; but any trusting relationship between myself and a company is essentially asymmetric, because a company is not a person (legal fiction notwithstanding). I may trust the shop where I buy my groceries, and I may have little choice but to trust my bank, but these are not symmetric relationships.



Similar difficulties arise in relationships between companies and trade unions, and between nations and other organizations. Aidan writes of negotiations between terrorists and the USA government. But such negotiations (if they take place at all) are inescapably asymmetrical, because the two sides are of different types. Terrorist leaders typically have the power to inspire violence; but when they instruct their followers to lay down their arms, the most likely outcome is that a proportion of them will switch allegiance to other leaders (previously unknown) who want to carry on the fight.



If we pretend that AlQaeda is like a conventional army, or a conventional nation state, we are likely to get into worse trouble. We cannot create symmetrical trust by pretending that different entities are of the same type. (Aidan talks about "the amount of skin in the game", as if it was simply a game of cards with high stakes and we can find a system frame in which these stakes are equal in some sense. But it's not GWB or OBL whose skin is at risk, and the balance of power is an illusion.)



We can only create symmetrical trust by forging genuine relationships between entities of the same type – people to people, community to community.

---

Previous Posts on Asymmetric Trust: Fearful Asymmetry, Identity Cards, State of Trust 2, Who Needs Symmetry?



More on Asymmetry.

Who needs symmetry?

originally posted by Aidan in reply to post on State of Trust 2

---

Richard,

What does it mean to say that something doesn’t work – as in the assumption of symmetry? It means presumably that if you use that principle to conduct your analysis and understanding of the situation, then you end up not being able to control or influence the situation in the way that you would like. What doesn’t work is the attempt to explain and interact.


If we assume that war is between nation states (and of course in international law it is) then we find we are at war with Al Qaeda then we find we are a bit hamstrung, by our assumptions, by our linguistic framework, by our laws, by our governance mechanisms and their rules. Probably it is worse than that, and our desire to find someone to be at war with as if by proxy will cause all sorts of extra problems.


These problems exist because of the attempt to use frameworks, like lines on a map in Africa, for things that they cannot support. When we try to keep our conceptual map tidy by forcing observations into the existing frame, we will have lots of confusion like this.


Trust works inside out however. The trusting disposition as a basis for the development of collaboration and shared perception is as old as man. As a basis it does not know about frameworks but is designed to allow the exploration of commonality and difference. When Gen Powell insists on national action in a situation where nation doesn’t support that, the first things he does is to create the shared perception amongst non-American interested parties that Americans come from another planet and cannot be trusted to understand.


Where trust development is the purpose, the symmetry of trust must be created. That is, the power of the more powerful party must be placed in a context where the amount of skin in the game is roughly equal. This is why terrorists can negotiate with the US government, because they can find a context in which their power in the moment is balanced with that of the superpower. Where there is good will and humility, the positive rather than the negative game can be played. The positive game can develop useful conceptual tools and frameworks that are of the moment and the issue, not some relic of a previous set of problems.

State of Trust 2

In his last post, John describes some geopolitical and constitutional aspects of trust.



John is scornful of the entities in which we are supposed to invest our trust, and questions the legitimacy of these entities. But the problem goes deeper. These entities are symbolic or imaginary entities – they simply don't reflect political reality.



The British constitution is a symbolic façade, which has very little to do with the true distribution of power and influence. Similarly, the African political map is a series of imaginary lines, historically imposed by colonial powers, which do not adequately reflect the identities and affiliations of the people who live there.



Nation-state dealing with nation-state is an example of the assumption of symmetry.



Symmetric trust assumes that trust can be managed through symmetric relationships between entities of the same kind (albeit different quantities of power).



Military strategists now increasingly recognize that the assumption of symmetry doesn't work for warfare, in which the primary threat doesn't come from nation states but from sources of a different kind – hence the interest in asymmetric warfare. The assumption of symmetry doesn’t work for demand either – hence the interest in asymmetric demand.



And it certainly doesn't work for trust. Hence Asymmetric Trust.

Trusting Words

John’s recent posts refer to the relationship between trust and language.



People often use words in a deceptive way, to conceal truth or intention. When people choose their words carefully, this may be because of a strong desire for accuracy and clarity, or it may be quite the opposite. Obviously this is (among other things) a trust issue.



But words can also be misused or misleading without any conscious intent to deceive. To the disappointed, it may make little first-order difference whether I'm disappointed by accident or design. But it makes a big second-order difference. (And in any case, the POSIWID principle suggests that Nothing Happens By Accident.)



People talk nostalgically about handshake-based trust or eyeball-based trust. But these trust mechanisms assume a shared and unambiguous language and culture, and may not work in a heterogeneous (asymmetric) world.

Fearful asymmetry

originally posted by John

---

For me, warrants, by their very existence, resonate with asymmetrical power. And doubly so when new technology is involved. For example, if the techno-equivalent of a finger-tip search of a suspect's property could be carried out surreptitiously and without the use of actual finger-tips (and the human beings they're attached to) then a warrant for it becomes entirely a power statement. Whereas with the old technology the warrant effectively permitted the searchers to enter the property and the search to be made,with new technology it is more likely to be post facto notification that the search has been made. This most certainly alters the geometry of the risk.


In a perfect world a warrant would be seen as the rule of law's light shining into murky corners. Maybe like Hans Blix's boys searching, on behalf of the world, for WMD in Saddam's Iraq. Warrants always seemed blunt-weaponish things to me and technology makes them blunter. Today's warrants are wrapped in the Patriot Act and the Prevention of Terrorism Act.


Uncertainty is anathema to power. One of new technology's roles is to reduce uncertainty and enhanced certainty inevitably leads to new power agendas outwith regulation. Powerful people and powerful organizations do things simply because they can do them. Warrant or no warrant.

A leap of faith

Guest post by John

---

I see clear connections between these issues. At the heart of the connection is ownership of knowledge (or ‘supposed to know-ness’ as I’m coming to think of it now) and the twenty-twenty hindsight that goes with it. Whatever I call it, it has little to do with trust. It ultimately requires a leap of faith into publicness. Consider:


The west learns that Pakistan has been peddling WMD technology and know-how to the ‘axis of evil’ for the past decade or so. We only learn this when the guy doing it publicly confesses. Instead of asking what our ‘intelligence’ services have been doing while all this has been going on we’re fed the hindsight view of what it means and how and why it happened.


An aeroplane crashes into the Red Sea killing scores of returning holidaymakers and shattering countless lives forever. It later comes to light that the carrier – Flash Airlines - is banned from certain European airspaces as a result of failed random safety checks in the recent past. This knowledge however remains with its owners until it enables twenty-twenty hindsight to kick in with its 'gotcha' payoff.


The dot-com bubble bursts and shortly afterwards Enron share price plummets from tens of pounds to single figure pence overnight. Millions of small investors are left penniless. It’s then revealed that Enron’s owners, their analysts, their brokers and their advisers have long since bailed at ceiling prices. The business press provides chapter and verse hindsight on the what, why, how and when of it. Nobody does anything apart from Eliot Spitzer NY state attorney general who tries to hold the SEC to account and gets Merril Lynch stung for damages in court. The SEC promise to tighten up their processes.


Closer to home, two zillionaire investors, fearing that Manchester United plc could have an Enron-like future, set out to protect their stake by getting their hindsight in first. For the small shareholder though, as with Enron, share price is all the information there is.


Crudely, trust in share price has two dimensions: a faith-in-brand commodity trust dimension offering the choice buy, sell or hold; and an authority trust dimension (and here comes the leap of faith) offering WYSIWYG assurance. Whether Man Utd or the Murdoch empire, this assurance is brought to you by the non-executive board members. So the question becomes can you make the leap of faith necessary to think these guys have your interests at heart (and the only Murdoch non-exec I can recall is Norman Sinjin Stevas).


The trust relationship between the executive and the intelligence services is similar to that between Murdoch as chairman and Lord Stevas as non-exec. As well as being entirely asymmetric in power-terms and dominated throughout by publicness and authority trust, I reckon a close look at POSIWID is what is really needed if a richer relationship is to be defined. Hence my contention that Richard and Aidan would do a better job than Lord Butler. But don’t get me started on the POSIWID of the ‘intelligence’ services: start by taking a look at its riverside palaces. Kublai Khan eat your heart out.

Metacommunication and Trust

The speech act "Trust Me" often conveys the exact opposite of its literal meaning. This is an example of metacommunication, as analysed by Gregory Bateson and his associates.

When an agency (whether the Home Office or Police, Inland Revenue or Customs and Excise) behaves mistrustingly towards the population, the rational and symmetrical response may be to regard the agency with equal mistrust. However, the actual response is often an asymmetrical one -- to regard the agency with elevated trust.

And when a technology puts forward a claim that it can perfectly detect fraud or impersonation, the rational and symmetric response may be to regard the technology as the fraudulent one. However, the preferred response is sometimes to wrap the technology in a sociopolitical casing, so that it becomes impervious to purely technical criticism. Notions of fraud, fallibility and repression are no longer amenable to technical judgement, but are under political control. This politically encapsulated technology is what is sometimes called a black box. We trust these black boxes because we have no choice.

Building Dynamic Coalitions (Jane Angelis)

Identity Cards

The identity card is seen both as a mechanism for Government agencies to provide citizens with some set of services (in a reliable and secure manner), and as a mechanism for Government agencies to perform some set of mandated controls over the citizenry. These objectives naturally conflict, and this is part of the reason for the distrust mentioned by Aidan.



Furthermore, there is a common pattern of service providers distrusting their users/customers. Banks assume all their customers are engaged in money laundering or some other fiddle, while Insurance companies assume all their customers are in a perpetual state of moral hazard, and that all claims are potentially fraudulent.



And yet service providers expect their customers to trust them absolutely - trust them and their staff and their overseas contractors and their extremely complex computer systems. Government agencies are no different in this respect from any other service provider.



This is an example of Asymmetric Trust. See also Finance Industry View of Security.