Boyd on CyberWar

The hacking (cracking) attack on Google et al has caused a phenomenon that actually puts those companies and even countries at risk. Over the last year, the response by companies and countries to these cracking episodes has been to lock down their intranet/internet systems, filtering content and making access more restrictive. As an example, the Air Force Material Command, even after relenting on bans with certain types of social media, still enacts a robust filtering policy that continues to restrict blogs, wikis, and the like. Australia is even considering filtering incoming internet traffic echoing China and other totalitarian countries.

The giant risk of this fortress mentality is that it actually makes the organization less secure because it makes the organization less nimble. By enacting more security, an organization inevitably enacts more bureaucracy which creates friction and slows reaction ability to a grinding halt. This phenomenon is captured well in the Starfish and the Spider (I synopsize it here) and was a central tenet in John Boyd’s discussions on how armies win wars. I propose that rather than locking down access to the internet, organizations relinquish control and let employees, partners, and other supporter’s route crackers and malcontents via an organic set of decentralized tactics (this may already be taking place). Twitter is indeed mission critical. In cyber operations, observing, orienting, and acting faster than the adversary is the only way win.

One Man's Poison...

One of the fundamental beliefs of the process-centric, best-practices-oriented worldview (such as Hammer’s Business Process Reengineering concept) is that imitation is the highest form of performance.

I’m not saying this is necessarily what the theory recommends, at least not explicitly. It’s just what happens when the theory is put into practice. When the organization’s highest values include compliance and conformity, when the organization rewards following best practices rather than discovering new ones, then creativity, imagination, accountability and initiative are stifled, no matter what the theory says.

The late Michael Hammer described BPR as an “antidote” to chaos and conflict. If chaos and conflict need an antidote, I guess that makes them a poison. And sure, in excessive quantities, they probably are. So is alcohol. On the other hand, an absence of chaos and conflict might not be the right answer either, anymore than prohibition was a good idea. Dee Hock, the wildly successful founder of Visa, talks about “the chaordic organization,” which is a combination of chaos and order. Not a balance, necessarily, because how do you “balance” chaos? Rather, it’s a harmonious coexistence between chaos and order. There's no room for such harmony in BPR.

As for conflict, Jerry Harvey argues that our main problem in organizations is not how to handle conflict, but how to handle agreement. Specifically, how to handle disingenuous agreement, in which people go along to get along and end up on the road to Abilene. Let me say this clearly: Dr. Harvey is right. Dr. Hammer is wrong. Conflict doesn't need an antidote. Neither does chaos.

So, I’m deeply disinterested in driving out conflict and chaos (or administering the antidote). In fact, in the kind of work I do, I insist that there be some chaos, some conflict, some confusion. These strike me as essential elements for discovery, creativity and rigorous performance.