Chris Butler on the Value of Adversarial Thinking in Product Design and Management

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hello, I'm Matt DeVoe, the CEO of OODA, and you are watching the Oodacast. And joining us today is Chris Butler from Cognizant. And Chris caught our attention based on his multidisciplinary approach to doing product development and product management, where he's introducing concepts of adversarial thinking and randomness and kind of applying what are some of disciplines that we've traditionally associated with cybersecurity or even national security into more commercial endeavors. So, Chris, welcome to uticast.

Thank you for having me. I'm really excited. I've been a longtime listener and I really love kind of the diversity of topics here, and I'm excited to be able to share my work with your audience.

Excellent. Well, as a longtime listener, you kind of understand the format first, give us your background, how did you get started in your career and kind of take us through the career trajectory that got you to your job and the work that you're doing today.

Yeah, I mean, I think a lot of the work that I ended up doing, I mean, just at the surface level, I've been doing product management for a very long time. I've dabbled a little bit in the dark arts of business development as well. But I'd say the things that I've thought about is really how do we figure out the rules of something before we really understand what they should be? And so that if you look at all the titles, I tend to have a lot of hype in the titles that I've taken on. So the idea when we were moving from box software to web, moving from web to mobile into the world of like AI, machine learning, VR, like all this stuff, have been different job titles. And even the job title I have today, which is head of product operations for a group of about 100 product managers and product analysts, where I really PM, the PM experience has been about how do we now think about the process of what we do to help make people as impactful as possible, especially when doing client consulting. I'd say it started way before that, though. Probably the reason why I go after topics like this is really, you know, I'd say two things. One, my dad was always like a big appreciator of military history. And so I grew up with someone who was essentially a historian. And so I have like some Japanese era like epaulettes downstairs. I have like all these weird things. He was definitely a very, very interested in kind of military. Military things in general. And then secondarily, you know, when I was growing up in middle school and high school, I played around with computers a lot. I ended up, you know, no one could teach me how to do programming, so I had to learn from another student. And then I ended up helping teach the high school course in like C programming and Pascal. And so I always kind of was on this cutting edge of just like understanding things that you could do. And that included, you know, some phone stuff that may have been referred to as freaking. Back in the day. I met some of my closest friends actually through a 2600 meeting here in San Francisco back in the day. You know, my. My thing was building out various types of like red and blue boxes when they still worked and, you know, even ran some bulletin boards through, you know, I think, I think it was 9,600 baud was when we got started. We ended when it was about 5,600 and so ended up doing a lot of stuff around that definitely knew a lot of people in the cracking community back then too, as you can imagine, what the board was probably about. But yeah, I guess, like, I've always been interested in just like challenging the norms of why we do something. And honestly, the weird stuff that we end up discovering for platforms end up being the interesting futuristic stuff that becomes mainstream. Right. And I want to just like drop. Another thing to you is that I was a really big fan of things like HyperCard back in the day, and that was probably, you know, got my starting actually in basic programming. I sell my basic programming computer gamebook from back in the day right here. But I think things like HyperCard, those types of computing platforms where everybody could create and develop and distribute things, was really interesting. And so that's why I loved kind of getting into the online world before I think majority of people were online. Yeah.

Excellent. Cool. One of the things I wanted to chat with you about was your approach to using adversarial thinking in the kind of product design and product management. So can you step us through a. The origins of how you kind of thought to take that approach and then how that actually gets implemented in the work that you do?

Yeah, absolutely. I think where this really all stems from is really my discovery, my personal discovery of John Boyd's work. And so I have always been really interested in understanding decision making and I've started getting more into the idea of tacit knowledge and expertise, especially when we talk about how we train people inside of our world of product management. And so from there, not only was kind of UDA and Boyd and all of the body of work that he built, which again is not very well documented. But I visited the Quantico like archives twice just to be able to read. And I think just as an aside, one of the most interesting things I found there was actually this weird like manila folder that when you open it up it's a Dune quotes on the edge. And when you open it up it's just like one three by five card that has like five Dune quotes, one of which is the Sleeper Will Awaken that was written by John Boyd. So I don't know, I love the fact that he was like into Dune as well as like a book at a series. Really a lot about that idea of, you know, the way that like adversarial militaries will work against like a stand up force, I think is basically doom and miraculous. So anyways, I think there's like a lot of interesting stuff there. But you know, I kind of started discovering his work, reading very high level explanations of the OODA loop, seeing it as something that's very simplistic, but then starting to dive even into like Osinga's glue book around Boyd really started to open up this idea that these are more about mindsets or mentality in the way that we understand the world. Right. Because the orientation step in this, in this loop is really the most important part. And if you get that wrong, if your adversary or if your adversary uses the shape of their force or the way that they make you understand the world in some way, that is where you actually commit the worst kind of mistakes, is misunderstanding the world. And that's where I think a lot of this came in. I mean of course red teaming, there's a lot of stuff around PME or professional military education that have also kind of taken around even the idea of like the difference between doctrine, strategy and tactics and the way that say different. Mostly I've reviewed US military documentation, but the idea of figuring out what is the way that we actually the way this military fights, what's special about that? The Marines in the way that they think about this idea of, I almost call it liminal fighting. We're always talking about these borders between two places where there's a lot of uncertainty. And so that's been something that's really been interesting to me. And so from there I think the Boydian thinking and just discussion Red teaming started to make me wonder about all of the things I was wrong about. And I actually have a talk online where I was speaking at the NYC Product tank, which is product tank is this worldwide community around product managers, but really trying to introduce adversarial thinking and adversarial thinking on multiple levels. So there's kind of internal adversarial thinking where I think this is where a lot of people try to learn about all the different cognitive biases out there. They have that thing on that poster on the wall that's like 150 cognitive biases. They have to sit there and like ponder, oh my, which of these 150 things am I falling into? And I think that's kind of helpful. But, but I found that it's limiting because of, you know, probably the most insidious bias, which is really that, that you don't see your own biases. And so you don't end up actually ever discovering like the most serious biases that you're falling to. And so the next step is then to like build a team of people that have different backgrounds, different beliefs, different kind of ways that they do work so you can start to expose the wrongness within the team. But then you still have things like groupthink, where especially if you have like a well functioning team, people start just kind of assuming things. And that's where there's like another big problem. And then that's why we start to now expand our scope to like user research, research and data science and all these other things around behavioral information is that we then actually understand, well, what is our belief set? How is that different than the way that these products are actually deployed with people and how they use them? And then I kind of say that like the last stage past doing things like user research is really this kind of universe fighting back at you. And so that could be that like you're just failing at whatever you're trying to achieve and so you need to try something else. But I think that's where we started to get in this realm of like randomness where, you know, I've advocated using a lot of different processes that kind of force you to confront the assumptions that you have. And so randomness is a great way to do this because it just honestly, the universe, when it comes to randomness, doesn't care, right? The moment you start to use things like I have card decks that I use, the moment you start to use other types of randomness, it requires you to confront something that you didn't expect you'd have to confront. Because when you are biased about something, when you have even just like basic working assumptions about the way the world works, this means that you're going to automatically say that certain things won't or can't happen. And this is exactly where the reason why red teaming teams come in is because they're another team that is separated from this kind of mentality that the group thing has started to create. And again, I use words like bias and assumptions and groupthink in a way that I wanna also make sure it's clear that it's not just negative, right? Like there are reasons why we make assumptions, there's a reason why we have biases, and there are beneficial reasons. Like if we. It's like the people that have gotten some type of brain injury where they don't feel emotion anymore, they are no longer able to make decisions, right? And so, so a lot of these things that are emotional or kind of based on intuition, even these biases that we end up using, they are a shortcut for decision making. And so I want to make sure that's clear that like there's, there's ways that we can, we can, you know, take the benefits of them, but then also start to apply all these adversarial techniques which then helps us avoid some of the bad cases of bias or assumption making. And so that's kind of what really brought me this route when it comes to kind of not just void, but also I guess an interest in the way that militaries work, the way that decision making is made in really high stress, high important type of situations, which I would say the military, there's a lot of cases like firefighters. I've been diving really deep recently into like naturalistic decision making. And that whole world where I think how do we actually build expertise? Is super interesting for product managers. When I started in my career, I went directly into program management at Microsoft. And Microsoft gives a lot of resources to help upskill people. Mentoring, boot camps, all these things to help teach people. But the reality is that whenever someone's new started, we would say that the program manager wasn't worth anything for the first two years of their life. The reason why was because they had not built up all this tacit knowledge, all this experiential intuition around basically pattern matching and prototype experiences that allow them to understand what they should be looking for. And this whole world of naturalist decision making is really, really interesting, especially just like the way that we start to identify what are the key things that experts start to pull out of a situation. And so anyways, it's taking me on a continuous learning path of new industries, new techniques, new things that at least are new to me. I think that is something that in product management we suffer from is we're always kind of like reinventing new canvases or frameworks to make decisions when the reality is like a lot of the things that have been built over the last hundred years, there's a lot of really interesting things to pull from that that we can use. And so I always like to make sure that that's clear. I'm building everything that I do on top of these giants that come from.

Cool. I did an interview with Jan Chipchase last week, hasn't been published yet, but he gave this great examp when he worked at Nokia. And he's a field researcher, so he goes in the field and actually observes how devices and things are used, particularly in different cultures, different environments, where his field research basically redirected what would become hundreds of millions of devices built by Nokia for illiterate populations. Where was that field research contributed to that redirection within Nokia around the design of their devices? Is there an example, you know, from an adversarial thinking perspective around development of a particular product, where you felt like that thinking changed the direction of the product in some sort of meaningful way, or is it just to try and keep the team kind of in balance or in check with the assumptions and the biases that they're bringing to the table?

Yeah, I mean, so the work where I really discovered. So I've tripped over these concepts of randomness a couple different times. And so one of them, where I think I really got started around this was I was living in Hong Kong and working for Horizon Ventures and Digital, which is Mr. Li Kai Sheng's nonprofit VC. We did a lot of work with nonprofit and philanthropic educational services. So he basically donated a lot of money to Shantai University, which is in Guangdong, China. And so we ended up doing a. Basically a hackathon for the students there. We were trying to understand, like, how do we do a better job of teaching engineers and design, how they'll eventually work together. Right. Because they're usually different schools, they're usually completely separated from each other. And so what we ended up doing is we took. We basically stole a page out of something called Ludum Dare, which is a game jam where they'll generate a game topic which is like a mechanism, a theme, and then a couple other things together where then a bunch of people compete to make the best game based on this random set of things. And so we had them actually use not only. And so I'm a big fan of dioramas from back in the Day when I was in school. So we had them create like a bunch of dioramas with Arduino Grove components that were based on kind of descriptions of these things. And so that was the first time that I really saw the power of this, where I'm sure that. And by the way, we also did randomization of teams. So we, we randomly assigned designers and engineers to different teams because what we knew would happen is everybody would just kind of like go back to the team that they knew or the people they knew and they would work on things that they would probably already. And so we found was like the breadth of topics and kind of things that they did were amazing, right? I think the first professional context where I really saw this work was when I was at Philosophy, which is a design consultancy. We used to do a lot of innovation work and in particular we did some work for the intersection between PwC and Google around how do you start to apply, especially to things like field service operations, the way that you could 1 apply G drive and kind of Google Professional or enterprise software towards this idea of maximizing consulting capability within PwC. And so when we focused in on basically field service operations, taking kind of a page out of Jan's, not his book, his literal book was not written yet at that point, but like definitely using About Face, which is another book that talks a lot about things like contextual inquiry where I sat in a truck with an electrician for a gas station for three or four days just watching how they do work. From all this, we gathered a lot of information. We knew that we needed to do things that were focused on machine learning and AI systems. Part of the ideation process that we used, it felt like, well, we were just going to rebuild a dispatcher piece of software. Are we going to just rebuild a job system for the field techs? And through this we started to actually explore things through. You know, we use actually oblique strategies as the card deck. In this particular case, when we do something called Crazy Eights, we end up basically trying to sketch eight ideas in eight minutes. And we do this across the entire team. So you're getting also the fact that there's a bunch of different people there. And what we would do is for every single one of those frames, for each minute we would draw a different card from the deck. And what that starts to do is it starts to not only take like my context, what I understand about the research that we just done, it takes my viewpoint, right? And so I was a product manager. There were designers, there were engineers, there were different Viewpoints that were in that room. And then we kind of apply this like random seed to the idea, right? And the reason why this is fast and so many is that a lot of this crap, like 50% of it is just bad ideas. And we get to, I want to get to like adversarial thinking around bad ideas too in just a moment. But like, but the fact is that we started to actually consider the breadth of how we could automate certain things better based on the fact that these questions and provocations that were coming out of oblique strategies. And so I would say that could I point to one thing that turned out to be way better? Not exactly, but what I could say is that it felt like we explored the space a lot more. And this is what Khan from RAND Corporation always talked about, war gaming is that you're not necessarily predicting the future, but what you're doing is you're understanding the shape of where the future could go based on what you're discussing. Right? And then getting back to like that bad idea thing, like one of the other tools in my toolbox is always to ask what's a bad idea? And this is something I've seen in a lot of like war gaming and red teaming types of groups is like, what would be the worst thing that could happen right now? And how do we understand that? Right. And so for me bad ideas are really interesting because it gets that inside of our heads we have these like value functions that essentially are a bunch of different complicated things all intertwined together. And it could be we're trying to make money, we're trying to be personally successful, trying to build something that's good for someone else. We're trying to like not build something that's like bad for the world, maybe ethically oriented. All these different things are all mixed together. What's with what is good and what is bad? When you ask someone what's bad, right, they suddenly are trying to now like subvert different parts of that system that could be holding back. And so again some bad ideas are just bad. But that's okay. But there's like every now and then, and this gets back to a term called dominant logic, right? Which is dominant logic is this term from Rich Vettis, who was like a management researcher, I think he worked at, I believe it was Ford way back in the day and then came up with an article called Dominant Logic theory in the mid-80s, right. And this dominant logic is that when you are successful you continue to hold onto the mental models and the way you do your work that made you successful previously. And the problem is, is that the environment has changed since then. And so what it's essentially doing is you're not doing it in the OODA loop kind of context. You're not doing any updates to your orientation, but you're continuing to make decisions using that. And so the problem is, is that this is. This is what happens to most successful people that are leaders, right? Is they got to their place by using these mental models, so why should they change? And so there's a bunch of problems that that causes, including, like, reducing the variance of ideas that end up showing up or being allowed to even be experimented on. What that means with that idea is that the moment you kind of like, remove this thing that I have to now fit into this world of whatever the dominant logic is of my organization, I can then come up with things that could be perceived as a bad idea, but if oriented correctly, could be a good idea. And so this is where I think when we talk about different types of tactics, pretending like basically showing your main force could be considered a bad idea, right? Because you want to maybe hide it, you want to reserve it, you want to do all these things, but it could be a good idea in the case that you want to scare someone away, right? And so there's all these things that like. And so one of the things I did during that, like, product tank discussion is I asked everybody, like, what would be some bad ideas for a meetup, right? And they're like, well, what if you didn't advertise it? I was like, well, you're right. If I didn't advertise it, I couldn't just get, like, any random person to come here. But what if it's like an exclusive thing, right? Then not advertising is actually, like, people have to find out about it through their network. It would be something that'd be way more valuable. Or like, you know, another thing is that I could. Could just like, constantly insult the people in the. In the crowd, right? And that could be a bad meetup. But the reality is, like, there are people that go to, like, I remember going to school in Boston, There was a restaurant called Dick's Last Resort where the job of the waiters was to insult everybody at the table. And people went there for the experience, right? So. So I guess what I'm saying is, like, there's. There's all these bad ideas that we get caught up on just saying, no, that's a bad idea. And the reality is, like, that's helping challenge the way that you think about things in some way. And so I don't know. That's. That's like a great question I always like to ask is just like, what's about it is a great place to start.

That's good. Yeah. When you talk about getting stuck in a particular mindset, in my experience, there are organizations that are not receptive to new approaches and then there are organizations that have built a culture that don't even allow those new approaches to get surfaced. Right. So it's not even a dialogue that takes place. So those to me are.

I mean, that's why big bang, like organizational transformation usually doesn't work.

Right.

Like, it makes much more sense to kind of try small experiments and actually not even ask for permission a lot of the time. I guess that's what I found through transformation is this idea. When people have done really interesting things, it's usually been because they have actually actively subverted the systems that are around them. So I would argue that the people that are doing the interesting work are the ones that are outliers in some way. And, and yes, organizations do not like outliers because it ends up breaking down a lot of the process. I mean, it's something that I struggle with. Right. Cognizant is not a small company. We have like 300,000 people. And in my group alone, we're part of a large organization that's like 15,000 people. And there are lots of processes that I don't think help us very much. And so part of my job as someone dealing with process on a regular basis is one, to think about what should we be blowing up this process, and then two, what processes do I need to either check the box or be subversive around? I guess I'm not afraid to do that either.

I did want to talk to you a little bit about some of your thinking about the use of randomness. You've alluded to it a couple of times, but you've also written some work that had a fictional tint to it around using randomness to mask patterns. Can you step us through some of your thinking in that regard as well?

Yeah, absolutely. This was a piece that I ended up writing for the Mad Scientist blog, which is the army kind of innovation group. It's like the Krulak group, I guess, equivalent for the Marines. And you know, they. The first part is about a thousand word story about a soldier who's really a gig worker that's in some type of hypothetical place that where there's a lot of resource kind of resources in Contention. And I guess the premise there was like, what if Netflix was a military contractor? And so from that perspective, I think I'm not going to give away the story or kind of the things that go on there. I'd love for people to read it and give me thoughts on that. But the article then accompanies with it. That's a couple more thousand words just talking about the idea of randomness. I think it really is, it's about counterintelligence. The problem is that once we start to be able to have sensors everywhere, once people try to collect all this information, I think there's some downfalls to this too. We can think that we know more than we actually do with a lot of this stuff, but once you start to do that, we then start to look at how behavioral patterns within people, we actually fit the mold of whatever we are a lot of the time. There was an MIT study that showed that once you could look at where someone's home, if you just followed the patterns of where they were going, it was a high, high ability for you to predict where they were going to go again. Right. Because usually people go home or people go to work or they stop at certain places. Right. Now I want to be very clear that there's kind of a place where knowing the future, because things are complex, adaptive systems can be very hard. So I don't think necessarily we can predict everything about a person, right. But I think that there's this idea of, you know, and this was what the piece was really trying to argue is that there is a certain amount that through behavioral observation, there's certain things we can try to start to tell about people and it'll be wrong, but they're also going to like when it comes to something on the battlefield or in a war like situation, what could go wrong is that if you can be kind of legible, right, if people can understand what you're doing, they can understand what you're trying to go after, they can do things to actually harm you. Right. And that puts people in harm's way. And so the other way to deal with that is to actually make things less legible. And so randomness is a really great way to do that. And so I think a lot of the inspiration for some of the early parts of that story is really coming from like the world of poker, where people bluffing in poker end up using a lot of different ways to decide whether to bluff or not. And so if people can start to understand your tell, right, then they'll use it to their Advantage because they've now gone inside your kind of capability. And so one of the things that poker players have used is that they'll have a watch and they'll look at the second hand and if the second hand is in a certain quadrant versus another, they'll decide to bluff or not. And so what this does is that unless you know what my rule is for that day, which I probably am rotating through, unless you see exactly what's on my wristwatch, unless you are able to actually tell the moment that I'm doing this, it creates a random seed that is very hard. Like not the equivalent of a one time pad, but it's getting close to that, right? There's still a rule that's related to this, but I think what you start to get to is you get to the world of being less legible. And so counterintelligence. Counter, counterintelligence, Counter, counter, counterintelligence starts to get into like a very weird kind of how are we always like trying to observe and understand what people are doing more and more? I think there's a limitation to this though as well, in that usually an objective is well known by both you and the enemy. And so that's where I think it gets tough, is like how you achieve that objective in some way ends up being dependent on a couple things. One surprise in the way you achieve that objective, right? And so achieving objective in a surprising way. There's lots of different ways you can do that. There's like reducing, like changing the shape of the forces you use so that it's not known. Randomness is another one. Like using random actions. Like the idea of if you wanted to guard somewhere, having set routes when you're guarding somewhere is like the worst thing you can do. What you should be doing is you should be having like every guard do something that is random, right? Like, like if you want to be able to like create something that's truly secure. And so beyond that fact that, that then you know another way to now be surprising in trying to achieve your objective is to redraw your system in some way. And so I've taken a lot from kind of cybernetics, soft systems, methodology, complex adaptive systems, to think that like, I think a lot of the problems that people have ends up being that they draw on the system boundary incorrectly. Right? And this is especially true in the work we do at Cognizant. Like a lot of the time we're given because we're very well known for like execution, delivery, type of work we're given Like a task list. And it's just like, go build this. And we don't want to talk to you about why we're doing it. We want to give you, like, whether you've achieved it or not. We just want to want you to do it. Right. And the problem there is that if you like, when you start to apply what I believe is the product mindset, which is really about understanding uncertainty, right. You then start to think about all the different possible system boundaries that could, if you were to redraw at that breadth or at that offset, you start to be able to find better solutions to things. And so the reason why this, I think, applies to military is that, you know, everything that we saw, you know, with the idea of like, disinformation as a way to achieve an objective was a different way to think about what is the objective of say, disrupting a country's capability, right? And so I won't get into this whole, like, argument that's going on inside of the military world around like, grand strategy and strategy and who should set it and all that type of thing, but I do think that a lot of strategic thinking ends up being benefited by thinking about what are the different lenses or framings that you can use, or system boundaries, right? I don't think that. I don't think any. I would argue that anybody that just always uses the same system boundary is most likely to actually be subverted, right? Whereas by understanding many different levels, including being able to move up in larger system boundaries or smaller ones, you end up being much harder. Like in the article I referenced the Colonel Blotto game, which is something you start to learn in like kind of game theory where there's say two or like, let's say there's three different battlefields, there's two players with a certain number of resources, and then depending on where you apply those resources, whoever's the most resources on that battlefield wins. Now, with when you have, say, a small n number of battlefields in this case, right, the person who has the most forces will usually win because they can distribute them in such a way that they'll at least win a majority of the battlefields. The problem is in today's world, like, especially when it comes to the idea of terrorism crime, anything to do with this idea of not adhering to rules or boundaries that are set by the protector, which is exactly what red teaming is supposed to get at, you then have a Colonel Blotto battlefield set of infinity. And so from there the larger force will not necessarily always win because they don't choose the battlefields correctly. And so I think there's just like a lot of interesting things. And I think this gets down to actually we talk about like product management, right? Product management is not necessarily, I think it's very rarely about a competitive space where it's like this company versus this company.

Right.

When you get large enough, it starts to feel that way. But in a way that there's like, you know, superpowers and proxy wars is probably the right way to think about it. Right. Like the way that Apple and Google and Amazon and all of them kind of like deal with each other is really more like that where there's proxy wars around all this different stuff. But the reality is like when you're a startup or you're like a mid sized company, like it's very rare that you actually have a direct competitor. I mean I would say like some of the examples would be like Uber and Lyft in the beginning of like that whole thing around kind of drivers inside certain markets.

Right.

That was your direct competitor at that point. And maybe there's another competitor which was like your legacy, the legacy of like taxicabs. Right. But honestly most of the time for product managers is that people just don't care about what you're building. And that is the biggest problem is it just no one cares. And so when we talk about how you need to be adversarial, rethinking what your framing is about, what matters is probably very different than what your customer thinks of. And that's why frameworks like job to be done frameworks around what is the problem you're solving, Outcomes over outputs. Those are all trying to get at this fact that a lot of the time when we just start building something that we think is going to be perfect and shiny and new, it's usually not the thing that people actually, because people live in like a messy world that they model through. And so I know that that's, I think the way that I start to apply these types of lessons to product management. Yeah.

Well, do you think that there's a potential downstream that people might use bots to inject randomness into kind of their social stream or an example that you know, been tracking. And I want to talk a little bit about adversarial thinking around design principles for the Metaverse or what I'll call kind of the connected metaverse, the real world and how that interrelates with our metaverse lives. One thing that's a little bit interesting about the Metaverse technologies obviously is it Gives a level of sensory feedback that we previously have not had. When I'm browsing the web, you can collect metrics around what I'm hovering over, how I'm scrolling over the page, but you can't exactly tell what I'm looking at or if you have an experience in the metaverse. I have a pair of goggles that can track my eye movement. Did I hover on that? Building on that advertisement on that person to develop these really detailed dossiers about you? It seemed to me one mechanism for defending against that is to just have systems that introduce randomness, that provide improper feedback of what you're looking at or what has your attention as almost a defense mechanism for the granular level of connection and connectivity that people are able to achieve around your behavior online. Any thoughts in that regard? And then I'd love to talk a little bit about the metaverse, specifically.

Yeah, I mean, I think, like, with my time at Facebook, I was working on the portal device, which is the video calling device for your home. And so in that time, diving really deep into the questions about identity, especially identity online, I think is really applicable. And I'm actually writing a piece right now that I'm hoping to get published the next week or two around identity in the metaverse. And the problem is that with you and I as individuals, we will have many, many different pseudo identities that are part of our own identity. So I have an identity with my job, I have a home identity with my family. There's a bunch of hobbies that I have. There's groups like friend groups that I'm part of. And all these things are not. Not about me as one central identity. That's. That's, I think, a mistake that a lot of people make is that, like, I'm one fully formed identity when the reality is, like, I'm actually a point that has all these different circles that are overlapping with it. And so this gets exacerbated and I think is actually a really huge problem to solve specifically for the metaverse. Because when we talk about immersion, right? Like. Like the idea of all the data that's collected about you, and I think we can go into all the different things on privacy, security, the idea of regulation of this type of data. But it becomes really, really tricky when the reality is, like, I do not actually want necessarily one company to have all of my data, right? And even today, even if we just said that, like, yes, you have, like, you know, Google has, like, one identity of you, but Facebook does as well, right? Apple does every other Major organization that's out there has some type of, of identity around you. And, and I would say that there's like, there's a long tail of these things too. So like, every website that you've ever logged in on with an email and password has a separate identity understanding of what you are. Right. So I think the metaverse, like, and again, you know, I hope it's not the dystopian thing that we're all. We read in like the fiction books about it. But like, there is, there's a point that when we talk about, and I think like there was a Twitter feed that I think really nailed it is that the truth is, is like what the metaverse really is, is like, when do we do a majority of our interactions using the Internet, right? Because today we still do a lot of interactions in person. I mean, less so with like pandemic and shutdowns and things like that. We are still doing a lot of things that are with kind of what is considered to be our more core identity, which is like my face here on like a video call is like the identity that I use in a lot of different places. I may be wearing different clothes than I would at those times, different places. But I think that that, that whole fact that the identity that I have is not as. Is maybe it's not fragmented from my point of view, but when I talk about all the services that I need to interact with, it is incredibly fragmented online. And once you start doing a majority of your interactions via online in a way that is. Is like you prefer to do things in that way, right? Like, so the fact that people have maybe wanted to do less shopping in person and more online, right? I think, I think the whole thing about delivery and restaurants is I did a restaurant startup for a while. People don't think of restaurants as like just food and sustenance, right? Like, like middle of the high end restaurants are all there because people want experience, right? And so that's, I think something where we get into the immersion aspects of this, right? Like, how do you actually provide more context and so for a social environment. And so that's why I think like identity is one of those things that, that right now it's in a really bad place because of the fact that there are some really huge victims of identity that assume you're just one person. So like the idea that you may go online onto something like Facebook and you have your true identity and then they're now doing all the work to try to back away from the fact that when I'm in this group. I can have one identity. And this. This was like a big kerfuffle with the Oculus, Like, Oculus users where they were now required to connect their gamer tag to a Facebook identity. Right. And so that's going to get worse and worse because there are going to be plenty of times where, you know, if I'm, you know, doing something in my local assembly meeting, I do not want the fact that I play online poker to come up as, like, a piece of that fact. Right. And so this gets to the world of kind of, like, privacy. And, you know, I definitely really love the work of Nissenbaum, who, you know, she wrote this book, Privacy in Context, which proposed a framework called contextual integrity, which is really about kind of where there are privacy violations is not so much about the fact that there's, like, the private, public dichotomy of information, but that it's actually more about the fact that I care about where my information flows depending on the circumstance. And so it's perfectly acceptable for my medical information to go to a doctor. Right. It is not perfectly acceptable for the doctor to then send me their medical information, and vice versa. Like, I wouldn't want that medical information to go somewhere. So usually the problem is when the sender sends some type of information to a receiver that then uses that in combination with other data that we didn't know about to create a different reputation. And so that's where almost every single privacy violation ends up happening. But it's all regulated by things that are very amorphous, which is human norms. Right. And human norms are. Are constantly renegotiated. There are things that are unsaid. There are things that computers don't understand. And so that's why I think there's something really interesting about how do we build better context in some ways, but how do we also respect that we won't understand the context of others, especially for these types of devices. Right. I've been trying to rethink about this idea of, like, how do we redesign the video doorbell that actually appreciates privacy, but also tries to give the security that people want or the people. And there's some really great authors online that have been talking about this type of thing.

If you check out that book, you know, one thing that's popping through my head was just this contextual identity. So it sounds like she hit on that, because that's similar with my experience. If I just look at Twitter, you know, I have my main Persona, but I have other accounts. I've set up. And it's not that I have, you know, an alt that I'm trying to run. It's because I use it as a specific research tool around different topics. So, you know, might have. Since my main account is so cybersecurity focused, I might have one that's more focused on entrepreneurship or an account that's focused more on blockchain and cryptocurrency and investments. And if I start to get cross pollinization between those identities, it reduces the value for me. I obviously don't want cybersecurity recommendations and the account that I'm using to monitor blockchain or entrepreneurs or things of that sort. I can see that. And it gets even, even more convoluted the more centralized our identities become. Which is one of the reasons why I'm hopeful for some of the blockchain technologies and potential for decentralized identities and even digital self sovereignty, which I think is really tough to achieve given the current market conditions. But for me helps to alleviate that. Where you basically have permissive identities where you grant little elements around your identity to different providers of information or different entities that you interact with with. How would adversarial thinking play into, you know, how you would think about designing for the metaverse or the connected verse?

Yeah, I think the things that are going to be toughest there is really like what are all the possible ways that this can go wrong? Right. Like between these different identities I think is really the issue that we start to see and I would also argue, argue that there's going to be a real reckoning for a lot of organizations in the way that they collect this data today. Because it's not only the fact that for example, you know, like GDPR versus CCPA versus whatever and then also like individual states, lots of different individual states are doing different types of regulatory.

49 of them.

Yeah, exactly. Well, and that's the thing too is like, like when like facial recognition is an interesting right because you know, Illinois sued Facebook over some of their facer like, like the face recognition stuff for individual photos that were on that work. But also Texas and Washington and maybe Oregon are also doing things like that. Right. There's consent law issues like especially I think the thing that like a lot of people just forget is like children use technology services and like in, in for example like the GDPR, it's like 18 I think I believe it's 18 and up. But then each, sorry, 16 up. But each individual nation state can decide a different consent law that's above that. And so Same thing with like Copa here with 13 versus CCPA of I believe 16 again. But that like this, the problems here are that like a lot of the data that these corporations and organizations have collected over time will probably not be legally tenable over time because of the consent that was used there. And I think like in the world of a lot of this stuff is like what is consent when it comes to using services online, right? In the metaverse in particular, like especially when we talk about immersive technologies, right? When I move from inside my house to outside my house, did I now consent to a different set of rules, right? There are different norms that are behaving there. But did I suddenly consent to my neighbor across the street that has a video doorbell to take my likeness and to log it through somewhere? And there's actually a case in the UK where I believe Amazon is being sued because of their ring doorbells capturing someone across the street. And so I think this is like a, this is like a real kind of thorny problem that I think will be at the center point of identity, right? For each of these identities that I have with different services, which are the ones that are appropriate to show how do we not commingle the data there? And then even if we don't commingle the data, what is that data allowed to be used for? And so gamer tag, like my gamer information may be very different than my local government information, right? And we start to get into this world like where we talk about what is actually a currency, right? A lot of the time is I think that the running definition is like what you can pay your taxes with is basically what a currency is or sorry, that's money. And then I think currency is something different. But like regardless of that, what I'm trying to say is that, you know, there are identities and more and more identities being associated with say local versus state versus national governments as well as the intersecting of all these different services. And so it's going to become trickier and trickier. And I think this idea of like self sovereign identity, something I've been trying to get more up to speed on, especially like did and all these, these things around kind of no central authority of identities, right? I've been diving into this one project called urbit, which is really interesting project about reinventing computing with peer to peer networks at its core. And what's really interesting about that is that I think the concerns that people have about what is done with my information there, there are some things that I think it will help with, right? Like So I can decide who is in my network and I can decide if I want to, you know, remove myself from a network. I can decide to like, change the rep. Like the way that reputation systems work end up being based on my interactions across the network, basically. And that's really interesting in some ways I would say that there's, you know, like, I don't know if you read Cory Doctorow's down around the Magic Kingdom. It's a. It's really great book about like this. I guess the core concept is really around waffle, which is this idea of like a social currency that allows for people like, based on their reputation to just like get what, you know, get what they want based on that. And what's always funny is that like, I think a lot of people end up referencing like the Metaverse from Ready Player One and Snow Crash. The Metaverse is like this thing that we should talk about. Waffle is something that like, is that great? It's a reputational currency system. But no, it's not, because it meant that the people that were doing things that were like, kind of off the beaten path were really bad. And Cory Doctorow constantly talks about this where he's like, this took the wrong lesson from this piece of work.

Right.

And so I think there's something really interesting about that though. I do believe that this combination of like overlapping identities is the way that human beings actually are. So I think there's something valuable there. The question becomes, what are organizations like big corporations versus more grassroots one. What are they allowed to do with that information is going to be a really interesting part.

Long term, that's going to be the key question. And then as our identities bleed into platform where I have home in the metaverse, I have work in the metaverse, I have social in the metaverse. And being able to apply some different expectations of privacy in those different domains I think will be key.

Well, let me just like add one more thing about this too, because I think when we look at the long arc of computing, computing is either going to get very close. So it started with the idea of the mobile phone where we could take with us anywhere. It was a very personal computing thing. Talk about immersive computing. AR and then even the idea of neuralink. Long term, there's some devices that are getting closer and closer to our face that are more and more personalized. Immersion is the ultimate personalization because you're taking all of my senses and you're making me feel like I'm somewhere else. But then what we're Also doing is when we talk about the idea of ambient computing, IoT smart homes, all of those different trends, we're pushing computing to the edges of the world for us, right? So I don't necessarily want to be carrying around devices to turn on the light, to be able to turn on my tv. I want these things to be around me so I can enjoy them with other people, right, that are here with me right now versus this idea of immersion, the people that are not here right now. So I think the questions end up being like, like during those cases, what is the appropriate context? In the case of immersive technologies, it's much more straightforward, right? Because you have like, you're logged into something, probably you are in a world that you probably decided to join. And so that means that you're probably in some small sliver of your identity in the cases where you're moving technology out to the world, right? The idea of my Google Home hub or my Apple TV or my light switch, right? What context am I in in that moment? Is a really hard thing to discern, right? I think that the idea of like the who, what, when, where, why and how questions end up helping do this. But like the room I'm in right now, right, is actually a child's bedroom, but also could be a guest room and is right now, you know what we're doing this discussion, right? So what time of day, who's in this room, what's happening? Those are all things that help kind of decide whether it would be appropriate. And if I say I had like a digital picture frame here or what photos should be shown on the digital picture frame and what type of notification should show up there and what things should be able to interrupt us right now, right? And so I think you get into, like, that's the hard part and that's why, like, I've been doing this work. I did like a three article series with O'Reilly around kind of what I call communal computing. And so I think there's the thing I'm trying to push back on and maybe be more adversarial around is like, who are we including in this discussion about what happens in this thing, right? The video doorbell is not just about me and my family. It's also about my guests. It's about people across the street. It's about the UPS delivery person. It's about all these people, right? And so if we do not include those kind of like, it's almost again, I like using the term ecosystem, right? Because these technologies exist within an ecosystem that is actually intermediate in other human beings. And so if we can't in some way. Like one exercise that I'll use for a lot of this is looking at not only organizations, but also for like, I have a. A workshop accepted into south by Southwest that's called like, what does the Roomba really feel about Dog shit? And I don't know if I'm allowed to swear here, but like, using this idea of role play and then looking at the network of how these different systems interact with each other end up helping us really understand how they should work. Right. Because the truth is, if you can't tell me how this technology will impact someone in this entire ecosystem randomly, then you can't really tell me kind of what is. What is the true goal of that technology, I think. And then same thing with strategy, right? When we talk about strategy, the idea of planning any of these things. OKRs, right? Which is something I do a lot of work as part of my billable practice. But if you can't tell me how this strategy is supposed to be applicable to every person in your organizational chart, If I just pick like five random people that I don't feel like you actually have a strategy that's valuable because. Because if that person can't contextualize it, it's just a talking point, right? It's fluff. So I think that's where we get into a lot of trouble. So we don't try to allow other people to orient to the strategy or the goals that we have.

I think the dog chit transformed the Roomba from a janitor to an artist. It's been a great conversation. So I do like to close as we hit the top of the hour, recording. What is one book that you would recommend to the listeners that is impactful for you, that you've read recently or even historically?

I mean, I think the number one book I always recommend to people for the last couple of years has been why Greatness Cannot be Planned. And it's by Lehman and Stanley and it's really more of a machine learning book where it's a collection of papers about this discussion of how. So they created something called Pick Reader, which is. Is a machine would randomly generate like nine images and then human beings would select one through a web portal which one they liked the most. And there was no discussion about what fitness meant in this case, which is like most interesting to the person. And then it would use genetic algorithms to basically evolve this through thousands of generations. And by the end of this, they started getting to like, really interesting photos that look before it was like blobs and then it starts reading like butterflies and cars and skulls and all this other cool stuff. Right. And so his only point about this is that that when we are truly doing innovation, we don't know where we're going to get with it. The idea of a bacteria ending up as a human being, there were constraints that were applied to the system. Whether or not you believe that there's a divine intervention there, but there were constraints that were set that bacteria never understood that it would turn into something else. Same thing with a vacuum tube to a computer. The vacuum tube inventors didn't think of computers. Eventually I think I really use this a lot and I've done some talks about product mindset, setting uncertainty, but I think it really helped form my understanding of that. You know, we are, and this is analogy they use in the book that we are trying to get from one side of the lake to the other and we're trying to follow a path of stones that are taking us there, but it's incredibly foggy and so all we can see are the next couple steps. And so their argument is that going after novelty based search approaches is way more valuable than going the exact direction that you think is the right way. And so that's been a really, really important book to me and really, I say is a great product management book even though it's not a product management book.

Excellent. Well, as always, we'll include a link to that in the show notes for this. So thank you so much. I enjoyed the conversation and the perspective. So thanks for reaching out and thanks for agreeing to come on the oodacast.

Yeah, thanks Matt. It's been really great to talk about all these topics. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.