When you can’t do awesome things, because of crushing bureaucracy

I’ve sometimes bumped into people who bemoan their broken company cultures with varying degrees of self-awareness. Around 2007, a then-customer heard we were heading to Vegas to speak at BlackHat and said:

You guys are so lucky.. my company won’t let us go to anything like that

At the time I bristled. We worked for months on that research, dedicating many nights and burnt family time before we could stand up and talk. For sure our company celebrated those wins, but it irked me that someone who spent his free time tearing up backroads in a 4x4 felt we were gifted access to BlackHat.

In the intervening decade+, we’ve encountered genuinely broken work cultures. I’ve looked at some of the brokenness and wondered how on earth those environments would ever lead to awesomeness in the face of all of the obvious impediments?

And then, fortunately, I started reading “Skunk Works” by Ben Rich. (I'm not quite finished but so far it's been excellent.)

(Awesome on Audible too)

The book is an amazing account of a pivotal invention in modern warfare: the creation of stealth jets. It’s filled with tiny lessons for any company wanting to build innovative things, but for this post, I want to focus on just one of them: supposedly being crippled by your org / bureaucracy.

Ben had just taken over the running of Lockheed’s Skunk Works from its illustrious founder Kelly Johnson. Knowing he had to perform, but without the halo of his vaunted predecessor, he had to cross his t’s and dot his i’s. A Skunk Work's mathematician (Denys Overholser) brought Ben a 10 year-old paper from a Russian scientist (Petr Ufimtsev) to predict the radar reflectivity of a geometric shape.

Denys convinced Rich that this was the key to radar stealth and they began testing their theories. His famed predecessor, who had built Skunk Works and had a track record of incredible judgement, was against the idea and regarded stealth largely as a waste of time.

Bucking all of this, and still delivering on existing contracts to keep the group alive, they proceed to develop “Have Blue” which turned out to be almost miraculous (and then went on to spur a revolution in the design of bombers, and later fighter jets).

The Original "Have Blue"

There’s an interesting snippet in the book, once the the initial concept had been proven, and it was time to build production stealth aircraft:

(It's a short 59s listen, and describes Skunk Works bureaucratic oversight that was starkly at odds with the core stealth mission.)

While reading that, an arresting thought hit home. It's easy to assume that the famed Skunk Works meant that its employees had a free reign to get the job done. Innovation with no boundaries and an open cheque-book. (There's a thread of research which strongly suggests constraints aid creativity; folks often incorrectly assume the opposite (i.e. to be creative you need unconstrained)).

Bringing it closer to (the infosec) home, you won't search for long to find examples of such incorrect reasoning when discussing success stories.

Taviso finds a boatload of bugs, but it isn’t because he works at Google - Project 0 and is “given” the time to.
He was finding boatloads of bugs when he was bug-hunting for free on open-source projects.
Assigning extra weight to the org, lightens the burden on us. We could be taviso too if we were in P0. Tavis’ disclosure timelines show that this just isn’t true:

(http://taviso.decsystem.org/)

Taviso finds boatloads of bugs because he’s Taviso, and he’s worked like hell to become Taviso.
Ben Rich didn’t build the Stealth because he had no constraints. He built it in spite of the constraints, because he was Ben Rich. If you aren’t managing to “build your stealth fighter”, it’s probably not just because your organization is a bureaucratic nightmare. It’s because you're not Ben Rich.

Postscript: There is an important point here that needs to be made. As a company leader, it’s still the smart thing to do, to remove friction for your people wherever possible. This isn’t a get-out-of-jail free card to stifle your people. After all, Kelly Johnson managed to recruit a Ben Rich, and then trained him for 3 decades to make him Ben Rich.. If you don’t have any Ben Richs’ maybe it’s because you aren’t a Kelly Johnson ;>

Post Postscript: Of course this post isn't about being Ben Rich, or Tavis, or inventing a billion dollar business, but it is about knowing yourself, and the excuses we make for not making an impact.