[00:02.540 --> 00:04.880]  You're here for a talk about bureaucracies.
[00:05.100 --> 00:06.820]  So you almost be suckers for pain.
[00:06.960 --> 00:07.400]  I'm not sure.
[00:07.800 --> 00:08.960]  I'm thrilled to be here.
[00:09.160 --> 00:13.580]  I saw the post in the 2600 Facebook group about submitting a talk.
[00:13.940 --> 00:18.100]  This topic I've been wanting to talk about for a few decades, to be honest with you.
[00:18.180 --> 00:21.280]  And I saw an opportunity to submit and got accepted.
[00:21.280 --> 00:22.720]  So I'm thrilled to be here.
[00:22.820 --> 00:38.480]  As John said, I'm a U.S. Navy veteran, worked for a few years at Facebook, a few smaller startups, an organization called the Defense Innovation Unit, and always felt my I felt myself a little disenchanted with how big organizations are advertised and then the reality when you get there and you end up
[00:38.480 --> 00:39.780]  feeling like a cog in the machine.
[00:40.380 --> 00:45.640]  So I found different ways to make a difference in big organizations, which is what my talk is ultimately all about.
[00:45.820 --> 00:47.200]  So I hope you enjoy it.
[00:47.240 --> 00:47.860]  Looking forward to it.
[00:51.440 --> 00:53.380]  Started my career in the U.S. Navy.
[00:53.560 --> 00:56.320]  This is the first ship I was on the USS Oak Hill.
[00:56.440 --> 01:00.760]  We're on deployment in Latin America doing counter drug operations.
[01:04.600 --> 01:08.560]  Spent about six and a half years in the Navy, two and a half years at Facebook.
[01:08.740 --> 01:09.940]  I don't have any Facebook pictures.
[01:10.280 --> 01:15.600]  And then this is a fancy video as a part of an organization called DIU, the Defense Innovation Unit.
[01:17.120 --> 01:20.500]  Organizationally, we were a direct reporting unit to Secretary of Defense.
[01:20.700 --> 01:23.220]  That might make you think that we had a lot of pull and influence.
[01:23.560 --> 01:25.720]  The reality was a bit of the opposite.
[01:28.730 --> 01:30.550]  So what is bureaucracy hacking?
[01:30.550 --> 01:32.570]  This is the definition I came up with.
[01:32.730 --> 01:43.350]  A method of exploiting multiple vulnerabilities in organizations and social systems to create new value in a way that reconciles individuals to one another, themselves, and their purpose.
[01:43.850 --> 01:46.510]  The second part of this sentence is crucially important.
[01:46.550 --> 01:48.690]  And I'll speak more to it at the end of my talk.
[01:48.690 --> 01:54.350]  It has to do with something called Pournelle's Iron Law of Bureaucracy and why I disagree with it.
[01:54.350 --> 02:01.410]  And fundamentally, why I think when you join an organization, you need to view the organization you're joining in yourself through a different lens.
[02:04.350 --> 02:08.290]  So why bureaucracy hacking and organizational exploit chains?
[02:09.550 --> 02:12.330]  I think hacking is really freaking cool.
[02:12.630 --> 02:14.470]  Favorite movie of all time is The Matrix.
[02:14.630 --> 02:16.030]  I think I've seen it 27 times.
[02:16.250 --> 02:18.850]  It really impacted my life philosophy.
[02:18.850 --> 02:21.790]  I never got into InfoSec or CyberSec professionally.
[02:22.050 --> 02:25.590]  I took one class in high school learning the Perl programming language.
[02:25.650 --> 02:27.450]  It was the most fun I've ever had.
[02:27.690 --> 02:32.910]  I remember the satisfaction of populating an array and thinking like, this is amazing.
[02:32.910 --> 02:37.270]  So I've always had an appreciation for automation.
[02:37.670 --> 02:43.630]  And if you can automate routine, then you can put your creativity as a human being to use on solving important problems.
[02:45.270 --> 02:49.550]  Secondly, I think there's a strong analogy of finding vulnerabilities in a system that you can exploit.
[02:49.670 --> 02:51.190]  A lot of overlap philosophically.
[02:53.350 --> 03:00.130]  Lastly, I think they both do require thoughtful, strategic, and oftentimes meticulous planning to pull off.
[03:00.130 --> 03:03.770]  I mean, a bureaucrat, that word has a certain emotional ring to it.
[03:03.830 --> 03:06.570]  The idea of breaking through red tape, so on and so forth.
[03:07.890 --> 03:21.550]  Quick definition, you know, for the audience here, you probably know a lot more about exploit chains than I do, but for folks in the audience or beginners who might be interested, exploit chains, also known as vulnerability chains, are cyber attacks that group together multiple exploits to
[03:21.550 --> 03:22.390]  compromise a target.
[03:23.290 --> 03:29.550]  I found a wildly interesting analogy through formal Navy training on risk management.
[03:30.850 --> 03:35.070]  When I was in the Navy, they used what they call the Swiss cheese risk management model.
[03:35.630 --> 03:43.710]  The idea is if there's a safety incident or another kind of incident, then all these safeguards you're supposed to have installed all failed.
[03:44.690 --> 03:47.370]  In this particular example, there's a lot out there.
[03:47.490 --> 03:50.170]  There's a human element, technical management, governance, and risks.
[03:50.910 --> 03:54.270]  What's very interesting is the bottom right, you see vulnerabilities.
[03:54.970 --> 03:57.970]  Well, same lingo as putting together an exploit.
[03:58.490 --> 04:02.130]  So this is a continuance of the analogy, and I think a very powerful one.
[04:02.790 --> 04:06.950]  Beyond this, when it comes to risk management in the Navy, there's what they call a risk matrix.
[04:07.150 --> 04:14.210]  And the idea with the risk matrix is if something happens, you want to put controls in place to lower the impact and the probability.
[04:14.810 --> 04:20.370]  If you're a bureaucracy hacker, you want to maximize the impact and the probability of being able to execute.
[04:20.650 --> 04:24.270]  So it's a very useful framework to just reverse engineer for your own purposes.
[04:25.370 --> 04:27.190]  I came up with a specific framework.
[04:27.190 --> 04:31.450]  I am definitely not the first person to have used the term bureaucracy hacking.
[04:31.730 --> 04:33.510]  My framework is it worked for me.
[04:33.870 --> 04:36.070]  It's like the quote, I think, from Charlie Munger.
[04:36.830 --> 04:38.290]  No, I forget what it is.
[04:38.410 --> 04:39.630]  It's it's it's no model.
[04:39.630 --> 04:41.850]  No model is is perfect.
[04:41.850 --> 04:42.770]  Some are useful.
[04:43.150 --> 04:49.250]  So I'll speak to it one time and then I got feedback from a friend to not dwell on it during my talk because it gets a little academic and dry.
[04:49.950 --> 05:06.610]  My basic framework for putting together an organizational exploit in a bureaucracy is beginning with a specific crisp idea, making sure you've thought through the logistics and execution, making sure you have supporting policy or an individual who's got approval authority,
[05:07.450 --> 05:13.510]  obtaining stakeholder buy-in who might influence who can give you approval, looking at metrics or values.
[05:13.670 --> 05:16.450]  I kind of hate metrics personally, but you need to play the game.
[05:16.590 --> 05:29.450]  And so if there's metrics they're trying to increase or decrease, it's like the stonks meme, you know, make sure they go up when you're telling your story and pitching your idea or appealing to a certain sense of values if there's nothing measurable, removing friction,
[05:29.610 --> 05:31.690]  mitigating risk using a communication protocol.
[05:31.990 --> 05:34.350]  I think there's another interesting analogy with communication protocols.
[05:34.350 --> 05:37.470]  How do you speak the language of your target audience depending on where you are?
[05:37.770 --> 05:40.690]  And then the final approver, or as I like to call the final boss.
[05:42.410 --> 05:49.790]  So my first story is on October 20th of 2016, I walked into Facebook's Global Security Operations Center.
[05:50.230 --> 05:54.070]  When I took that role, it was physical security, my first role out of the Navy.
[05:54.550 --> 05:57.570]  I thought it was just going to be cameras and badges and access control.
[05:57.570 --> 06:02.290]  I was intrigued to find out we did more than just that.
[06:02.630 --> 06:05.930]  And Facebook actually has an Amber Alert system.
[06:06.090 --> 06:10.610]  When the government pushes an Amber Alert to find a missing kid, Facebook does as well.
[06:10.650 --> 06:13.110]  And I was really delighted to learn that when I worked there.
[06:13.350 --> 06:21.090]  One of my life's missions is to reduce the amount of cynicism in the world and to challenge people to look for the good in other people and other organizations.
[06:21.810 --> 06:24.930]  Facebook has, Meta now, has screwed up a lot.
[06:24.930 --> 06:26.490]  And the U.S. government has screwed up a lot.
[06:26.590 --> 06:30.330]  And as someone who deployed overseas, I'm no fan of a lot of aspects of our foreign policy.
[06:30.690 --> 06:35.850]  But I also went on a deployment where we gave a ton of wheelchairs to kids who couldn't get around.
[06:36.030 --> 06:39.210]  And you see the looks on their faces, and we're just humans connecting, trying to do good.
[06:39.370 --> 06:45.370]  So when I discovered that Facebook has an Amber Alert system, it's like, wow, okay, we can use some tech for good here.
[06:45.510 --> 06:49.450]  So we receive alerts from NCMEC, the National Center for Missing and Exploited Children.
[06:49.990 --> 06:56.650]  And that night, we got like five of these for the same little girl getting trafficked up the eastern seaboard.
[06:56.990 --> 06:58.870]  And it's heartbreaking when you see this stuff.
[06:59.710 --> 07:00.930]  I worked the night shift.
[07:00.950 --> 07:01.410]  I went home.
[07:01.430 --> 07:01.970]  I went to bed.
[07:01.990 --> 07:03.130]  I woke up at 11 a.m.
[07:03.170 --> 07:03.810]  reading the news.
[07:04.010 --> 07:08.010]  And I see there's a little girl who got rescued in Memphis, Tennessee.
[07:08.790 --> 07:13.170]  And it was a clinical technician in the hospital flipping through Facebook.
[07:13.250 --> 07:19.270]  She sees this Amber Alert and she walks out of the hospital break room and she sees this little girl get rescued.
[07:20.390 --> 07:30.250]  One of the reasons I'm a proponent for bureaucracy hacking and why I particularly think it's relevant for young people joining organizations is the difference you can make as a beginner.
[07:30.990 --> 07:34.850]  The next day I walked in and I asked my boss, Alex, and I watched the news.
[07:34.850 --> 07:37.730]  I know a little bit about, you know, acquisitions.
[07:37.870 --> 07:41.690]  And I knew we bought Instagram four years before I started working.
[07:42.290 --> 07:47.450]  And I said, Alex, I know here in the GSOC, we push out these Amber Alerts for missing kids on Facebook.
[07:47.610 --> 07:48.070]  And that's great.
[07:48.230 --> 07:51.970]  And this totally rocked my world in terms of seeing the good that can be accomplished with tech.
[07:52.050 --> 07:54.010]  I said, who pushes out Amber Alerts on Instagram?
[07:54.650 --> 07:56.590]  He's like, I don't know.
[07:56.710 --> 07:57.430]  I have no idea.
[07:58.030 --> 08:00.210]  And I asked and asked and nobody had ever thought about it.
[08:00.410 --> 08:02.610]  And I figured we've owned them for a couple years.
[08:03.030 --> 08:06.610]  I don't really know what infrastructure means, but I can make certain assumptions.
[08:06.610 --> 08:10.750]  We've got servers around the world and data centers and push out feeds and data.
[08:11.090 --> 08:13.970]  Can't we use the same thing to get more eyeballs to help with this?
[08:14.450 --> 08:16.270]  And nobody had thought about it.
[08:16.370 --> 08:19.710]  And so this was my experience bureaucracy hacking at Facebook.
[08:19.790 --> 08:22.750]  I was like, well, I'm a knuckle dragon physical security bubba.
[08:22.830 --> 08:26.070]  I don't know anything about design or software, whatever the case may be.
[08:26.110 --> 08:29.490]  But I am full of too many ideas.
[08:30.130 --> 08:34.290]  It's like Carl Jung, the psychologist said, you don't have ideas, ideas have you.
[08:34.490 --> 08:36.070]  I'm possessed by my ideas.
[08:36.210 --> 08:37.330]  And usually I keep my mouth shut.
[08:37.330 --> 08:40.990]  So I'm not the good idea fairy with all the bad ideas I sprinkle across the organization.
[08:41.430 --> 08:43.750]  But I figured we can do this.
[08:43.770 --> 08:44.890]  We can make this happen in Instagram.
[08:45.090 --> 08:47.510]  So I met the team at Instagram, the trust and safety team.
[08:47.630 --> 08:48.710]  I put together a pitch deck.
[08:48.830 --> 08:49.690]  I did market research.
[08:50.090 --> 08:58.310]  I created cheesy little wireframes, just use Microsoft Paint and cut out what it looks like on Facebook and throw it into a picture of a cell phone with Instagram.
[08:58.310 --> 09:00.170]  And there's your wireframe for me.
[09:00.810 --> 09:03.150]  So I put together this whole deck, met the team.
[09:03.250 --> 09:03.710]  They were thrilled.
[09:03.710 --> 09:04.650]  They added it to their roadmap.
[09:05.030 --> 09:06.270]  I left in 2018.
[09:06.270 --> 09:08.110]  They had to keep delaying it and delaying it.
[09:08.230 --> 09:12.390]  But a couple of years later, the PM who I worked with, a press release came out.
[09:12.470 --> 09:13.290]  Her name was Emily Vatcher.
[09:13.890 --> 09:17.530]  And in 2022, this happened.
[09:18.270 --> 09:20.630]  Amber Alerts were launched on Instagram to help find missing children.
[09:20.970 --> 09:27.350]  And so my message for young people about to join a large organization is 100% chance you will get crushed by the machine.
[09:27.650 --> 09:30.090]  And a lot of people will not stand up for your good ideas.
[09:30.090 --> 09:36.430]  But I want to teach people a methodology for bringing those ideas to fruition because they matter.
[09:36.690 --> 09:46.670]  And if you can think about the execution plan and who's going to care, you'll find that there's bureaucrats at the top with a softer heart than you think, but you've got to find a way to reach them.
[09:48.870 --> 09:50.670]  In the Navy, I was on the USS Oak Hill.
[09:50.910 --> 09:52.970]  It was an LSD, a dock landing ship.
[09:53.150 --> 09:56.110]  And the way it works, I've got other pictures later on.
[09:56.110 --> 09:56.590]  I'll show you.
[09:56.770 --> 09:58.230]  You've got a big open well deck.
[09:58.370 --> 10:00.970]  It goes up and down with a ballast system, just like submarines.
[10:01.350 --> 10:04.710]  You can flood this on purpose and craft can go in and out.
[10:04.950 --> 10:11.010]  I was the weapons officer, which meant I was in charge of leading qualifications for small arms, the M9 and the M16.
[10:11.730 --> 10:14.990]  These are my sailors setting up targets, goofing around, having a lot of fun at sea.
[10:15.090 --> 10:16.730]  You see the stern gate lowered into the water.
[10:16.950 --> 10:20.110]  It was a really cool view and kind of freaky, to be honest.
[10:20.570 --> 10:25.290]  And so my experience bureaucracy hacking on this ship had to do with kind of morale.
[10:25.290 --> 10:32.770]  When you're out to sea, like a ship is a floating warehouse with cabling and piping running all over Kingdom Come.
[10:33.210 --> 10:39.370]  And you're understaffed doing maintenance constantly and just keeping ships afloat is a miracle.
[10:39.550 --> 10:42.230]  It's a miracle of human endeavor because of what's required.
[10:42.550 --> 10:45.010]  And so I fell for the marketing.
[10:45.010 --> 10:50.630]  When I joined the military, I'm going to be a junior officer and make a difference and lead troops.
[10:50.650 --> 10:58.830]  And you get there and you're just crushed by the reality of how little authority you think that you have to do anything, to actually inspire anyone.
[10:59.290 --> 11:03.790]  But sometimes a little crack shows up and you exploit the scene to do something cool and exciting.
[11:04.270 --> 11:08.150]  So as the weapons officer and ammunition, it was coming up on July 4th.
[11:08.210 --> 11:15.350]  I had to do these arduous inventories, pen and paper, because of course, nobody knows what digital transformation is in the Department of Defense.
[11:15.350 --> 11:20.610]  And I kept seeing these boxes of, uh, they're called parachute flares.
[11:20.850 --> 11:24.290]  We had hundreds of them, you know, red, white, yellow, green, blue.
[11:24.470 --> 11:27.970]  And the only thing we were allowed to touch was small arms qualification rounds.
[11:28.230 --> 11:29.730]  And I was like, it's July 4th.
[11:30.030 --> 11:32.570]  I want to put on the dang fireworks show.
[11:33.590 --> 11:36.310]  And the wisdom was that you're just not allowed to touch them.
[11:36.410 --> 11:37.610]  Those are just like, just in case.
[11:37.770 --> 11:39.210]  And I was like, I think this is nonsense.
[11:39.870 --> 11:42.630]  So in part of my framework, I talk about communication protocols.
[11:42.810 --> 11:44.490]  How do you speak bureaucrat?
[11:44.750 --> 11:50.870]  So here's an example, you know, in, in, in the 21st century, it's not like the Navy of the 19th century.
[11:51.030 --> 11:56.290]  You have to mother may I to headquarters to shoot rounds, even your ship's captain can't authorize it.
[11:56.790 --> 12:00.770]  So I had to send this dang Navy official memorandum format.
[12:00.970 --> 12:07.050]  Every time we had to, you know, make sure our certifications were fresh and request the type and the lot number.
[12:07.210 --> 12:08.850]  And it was this whole templated thing.
[12:09.030 --> 12:12.150]  Mother, may I do what we're supposed to do as an operating force?
[12:12.150 --> 12:13.090]  It was ridiculous.
[12:13.330 --> 12:13.650]  Excuse me.
[12:14.230 --> 12:16.590]  And I have an affinity for other human beings.
[12:16.710 --> 12:17.490]  I'm very extroverted.
[12:17.610 --> 12:21.210]  And, um, I always want to know someone's story and get to know more about them.
[12:22.750 --> 12:26.070]  And on the other side of the email replies, it was always a one word reply.
[12:27.430 --> 12:27.790]  Approved.
[12:29.870 --> 12:30.830]  Who are you, dude?
[12:30.990 --> 12:31.610]  What's N41?
[12:31.930 --> 12:34.890]  It's an obscure office code in a dark hallway of the Pentagon.
[12:34.890 --> 12:37.390]  I wanted to bring this guy a beer and just get to know him.
[12:37.450 --> 12:38.190]  I don't, I don't know.
[12:38.290 --> 12:38.770]  I'm curious.
[12:39.170 --> 12:42.030]  Or if it was rejected, quoting some policy or whatever.
[12:43.490 --> 12:46.370]  So, uh, this is a picture of the flares I was talking about.
[12:46.470 --> 12:47.590]  It's a 40 millimeter grenade.
[12:47.930 --> 12:51.610]  There's an attachment on the bottom of an M16, or it's got a gun you can shoot them out of yourself.
[12:51.910 --> 12:53.050]  And they look so cool.
[12:53.070 --> 12:53.830]  I wanted in on them.
[12:54.110 --> 12:57.170]  This is, this is, uh, this is an advertisement for what they look like.
[12:57.310 --> 12:58.570]  I mean, fireworks, right?
[12:59.610 --> 13:05.010]  So I, uh, talked to my boss and I said, skipper, you can call your commanding officer skipper in the Navy.
[13:05.690 --> 13:08.050]  I said, sir, uh, July 4th is coming up.
[13:08.330 --> 13:11.830]  Uh, we, we were deep in the weeds getting ready for this terrible inspection.
[13:12.050 --> 13:13.070]  The crew was exhausted.
[13:13.590 --> 13:15.410]  You know, you can't bring pizza at sea.
[13:15.490 --> 13:17.530]  You can't bring beer on the ship when you're out at sea.
[13:17.750 --> 13:21.130]  So the start, I'd like to celebrate July 4th out at sea and shoot these flares.
[13:21.290 --> 13:22.430]  And he kind of just looked at me weird.
[13:22.430 --> 13:26.950]  Like when it comes to risk mitigation, I'm not really introducing any undue risk per se.
[13:27.130 --> 13:28.550]  We have the rounds, right?
[13:28.630 --> 13:28.850]  Everything.
[13:28.850 --> 13:29.870]  This could be a thing.
[13:30.250 --> 13:31.610]  I just need the thumbs up.
[13:31.730 --> 13:37.350]  And he's like, well, I'm not putting my name on the line, like go through the process, request it, but I'm not going to stop you.
[13:37.830 --> 13:39.090]  So I did.
[13:39.710 --> 13:46.250]  Uh, normally you have to quote these obscure policy documents, justifying the exact number of people who were allowed to be qualified.
[13:47.630 --> 13:52.210]  I thought it was enough to say celebration of the declaration of independence of our great nation.
[13:52.910 --> 13:55.530]  You know, I was, I didn't even think I'd get a reply.
[13:55.970 --> 13:59.330]  I, you know, I thought he would delete on his keyboard and not even justify it.
[13:59.910 --> 14:10.350]  And, uh, I got my first sentence reply from this obscure bureaucrat hidden in the Pentagon.
[14:10.550 --> 14:12.050]  He said, this is fantastic.
[14:12.250 --> 14:13.750]  Happy independence day to you and the crew.
[14:13.990 --> 14:22.590]  So the message is there are bureaucrats out there and they want to be part of the action as much as we do, but they have a job to do.
[14:22.670 --> 14:24.570]  They have to put dinner on the table at the end of the night.
[14:24.990 --> 14:26.830]  They've been part of the machine for so long.
[14:27.150 --> 14:28.670]  They don't want to challenge the status quo.
[14:28.750 --> 14:32.090]  So don't forget you can inspire somebody else by challenging the status quo.
[14:32.330 --> 14:35.750]  I, this isn't a picture of my ship, but this is kind of, you know, what it can look like.
[14:35.750 --> 14:36.530]  I found this online.
[14:36.810 --> 14:38.070]  It was so damn cool.
[14:38.230 --> 14:43.170]  We were on the bow of the ship as the sunset, just shooting off all these, I'm going to call them fireworks, even though they're parachute players.
[14:45.110 --> 14:47.890]  Um, okay, this is, uh, I'll skip this slide.
[14:47.950 --> 14:50.270]  This is the framework and speaking to the framework I came up with.
[14:51.650 --> 14:55.650]  In government service, there's a term out there called graybeards.
[14:55.790 --> 14:59.690]  It means different things in different sectors, um, of our society.
[14:59.810 --> 15:06.770]  I use that phrase as individuals who have worked 30 years in a single career path, usually active duty.
[15:06.770 --> 15:11.290]  They leave on a Friday, show up on a Monday as a government employee doing the exact same thing.
[15:11.590 --> 15:12.870]  They're great human beings.
[15:13.010 --> 15:15.410]  They know their discipline extremely well.
[15:15.550 --> 15:20.390]  They know the regulations on the back of their hand, but usually they're short, they're terse, they're gruff.
[15:20.670 --> 15:24.510]  The guy sending me the one line email was probably a graybeard who'd been doing it for decades.
[15:25.050 --> 15:28.930]  And so I sort of had this sense of affection towards graybeards.
[15:29.050 --> 15:32.210]  Like you kind of trust what they're saying and you kind of want to impress them.
[15:32.550 --> 15:35.830]  I couldn't find the right picture that perfectly encapsulated them.
[15:35.910 --> 15:42.370]  So here's a few dudes with graybeards and just in your minds, kind of ChatGPT it and imagine what they all look like, blended together.
[15:43.990 --> 15:47.830]  So, uh, as I said, I was in charge of ammunition and this is, uh, the USS Oak Hill.
[15:47.990 --> 15:51.410]  This is a rear view of the, of the stern gate down doing some riverine operations.
[15:51.410 --> 15:52.170]  It was a lot of fun.
[15:52.390 --> 15:53.290]  This is a side view.
[15:53.370 --> 15:55.070]  It's a pretty, pretty big ship.
[15:55.450 --> 16:01.330]  Uh, the windows, which you can't even see because of my low resolution image here, um, are as big as a big car window at the top.
[16:01.390 --> 16:02.370]  So it's large.
[16:02.690 --> 16:09.550]  Um, and so when I was doing ammunition logistics, there were 11 magazines distributed throughout the ship.
[16:09.550 --> 16:13.370]  Uh, it's intended to embark 300 Marines.
[16:13.590 --> 16:18.870]  So you're not only carrying ammunition for the ship's self-defense, you're carrying ammunition for the Marine Corps.
[16:19.010 --> 16:29.170]  So you have a ton of ammunition and it's a sensitive topic because of the hazards of ammunition, the cost of ammunition, the accountability, the reputation, like it's the job that nobody wants.
[16:29.350 --> 16:31.610]  And, uh, it's the job I got.
[16:31.950 --> 16:39.070]  So, um, we were planning, uh, for what's called ammunition on load and off load before every deployment, you get rid of the old stuff and bring on the new stuff.
[16:39.270 --> 16:44.890]  I couldn't find a nice picture of a, of an LSD, um, pulled up to the pier, but here's a destroyer.
[16:45.150 --> 16:51.390]  So we were getting ready for ammunition on load, off load, getting all these boxes off the ship and bringing on all these boxes.
[16:51.390 --> 16:52.970]  And it's this arduous process.
[16:52.970 --> 16:58.930]  Like I said, the inventory sheets and the numbers and the lot numbers, and you can't screw anything up or straight to jail is what they tell you.
[17:00.210 --> 17:02.750]  So, um, this is a picture of Yorktown, Virginia.
[17:02.870 --> 17:03.910]  There's a big ammunition depot.
[17:04.010 --> 17:05.330]  You see that there's nothing around the pier.
[17:05.470 --> 17:06.170]  That's by design.
[17:06.270 --> 17:10.650]  Cause if you know, things go bad with ammunition, you want to make sure that you're safe and secure.
[17:11.150 --> 17:13.130]  So I'm planning for this big operation.
[17:13.330 --> 17:16.330]  And I look at this big, beautiful empty well deck on the ship.
[17:16.470 --> 17:17.430]  I'm like, this is perfect.
[17:17.950 --> 17:19.030]  Like I'll get my crew.
[17:19.430 --> 17:20.850]  We'll get all the ammo out.
[17:21.110 --> 17:27.750]  Well, like during the, during the up from Norfolk to Yorktown, we'll stack everything in these neat box in these neat stacks.
[17:27.930 --> 17:28.550]  We'll label them.
[17:28.690 --> 17:30.210]  We'll put labels on, we'll duct tape them.
[17:30.310 --> 17:33.350]  We'll put them on pallets with bands, best operation you're ever going to see.
[17:33.730 --> 17:37.070]  Well, I mentioned it to everybody and they look at me like I have a third eye growing out of my forehead.
[17:37.210 --> 17:37.890]  I'm like, I don't understand.
[17:38.050 --> 17:38.870]  They're like, it's not allowed.
[17:38.990 --> 17:41.250]  You can't break out ammunition per the regulation.
[17:41.530 --> 17:42.790]  I said, I think this is BS.
[17:42.910 --> 17:43.930]  I think you're wrong.
[17:44.230 --> 17:45.730]  Like we can't be that dumb.
[17:45.910 --> 17:51.110]  You know, I don't want to disappoint all the taxpayers in the audience, those of you paying taxes, but that's the reality.
[17:51.230 --> 17:59.850]  And so how does the Navy, you know, the world's best fighting force at sea handle logistics with a, they call it a working party.
[18:00.090 --> 18:03.930]  You make a caterpillar of human beings to move boxes.
[18:04.250 --> 18:12.870]  So this is a food shipment likely or supplies and parts that the helicopter drops a big pallet of stuff and you bring it down to where it needs to go.
[18:12.950 --> 18:15.650]  It's quasi efficient, I suppose.
[18:15.650 --> 18:24.550]  But the problem is if you're moving ammunition around per the regulation, you have to have a firefighting crew with fire hoses in case anything were to happen.
[18:24.770 --> 18:30.850]  So in terms of efficiency as an organization, like no one's allowed to do anything when you're handling ammo.
[18:31.090 --> 18:33.570]  And I, you know, I thought this is, this can't be the case.
[18:33.910 --> 18:43.890]  Um, so in my framework, I mentioned policy, uh, as a junior officer in the Navy, you get handed, you know, good artists copy, great artists steal.
[18:44.110 --> 18:51.630]  Now, you know, the Navy's full of great artists because as a junior officer, you get handed a PowerPoint and the last slide references all these instructions.
[18:51.990 --> 18:53.890]  You don't have time to validate them.
[18:53.970 --> 18:59.090]  You just hope that they're all correct and you just carry on doing it the same way everyone has always done it.
[19:00.170 --> 19:06.510]  Um, so I dug into the governing instruction for ammunition handling, ammunition and explosive safety ashore.
[19:06.730 --> 19:08.210]  Sure enough, it's not allowed.
[19:08.370 --> 19:10.690]  I was like, I still think this is wrong.
[19:10.710 --> 19:12.010]  So I keep digging, keep digging.
[19:12.310 --> 19:13.990]  You'll notice it says ashore.
[19:14.470 --> 19:16.270]  Well, nobody had done their homework.
[19:17.310 --> 19:22.970]  There's a whole different governing instruction, ammunition and explosive safety, uh, flow.
[19:23.910 --> 19:29.370]  And as you know, and we're a day late for deployment and in DOD, that's like the worst.
[19:29.570 --> 19:36.810]  Like there are whole entire staffs of people who do nothing but stare at Excel and the calendar and email you saying, why are you late?
[19:37.070 --> 19:38.410]  Why aren't you gonna make deployment on time?
[19:38.510 --> 19:41.030]  It's our whole job and it can impact your career.
[19:41.150 --> 19:42.370]  So we were already late for deployment.
[19:42.730 --> 19:50.410]  So when it comes to bureaucracy hacking and getting in the mind of my commanding officer, if I can buy him some time and get us out the door quicker, probably gonna be thumbs up.
[19:50.550 --> 19:54.390]  Now I found the policy instruction that authorized that.
[19:54.550 --> 20:00.190]  Turns out the definition of a ship being afloat is once all the lines are off the pier, you're out at sea.
[20:00.370 --> 20:02.870]  Even if you're two feet away from the pier, all the lines are cast, you're good to go.
[20:03.450 --> 20:04.850]  So we, yeah, it's great.
[20:05.770 --> 20:06.170]  Absurd.
[20:06.530 --> 20:12.610]  So, uh, I got permission to stack and pre-stage, uh, all our ammunition exactly as I envisioned.
[20:12.950 --> 20:17.250]  Everyone was on board and the graveyard walks on and sees these beautiful stacked ammunition.
[20:17.430 --> 20:18.310]  He looks me dead in the eyes.
[20:18.410 --> 20:22.930]  And these are the moments I live for as a bureaucracy hackers, that two second window where you've made this kind of a difference.
[20:23.030 --> 20:25.510]  He looks me in the eye and says, this is the best ship I've ever seen.
[20:26.130 --> 20:27.890]  So, uh, that was awesome.
[20:28.290 --> 20:29.090]  Uh, okay.
[20:30.390 --> 20:34.830]  So I spent a couple of years at, uh, an organization called DIU, the defense innovation unit.
[20:35.090 --> 20:45.050]  Uh, it's, I wish I had the time to tell you how this, our sub team, we were a small team hidden in a garage in Silicon Valley, like living the legend, living the story.
[20:45.490 --> 20:47.350]  Uh, it wasn't a commercial startup.
[20:47.450 --> 20:48.310]  It was a government team.
[20:48.450 --> 20:53.170]  And it was with, um, some really good friends of mine who were, um, they were hackers.
[20:53.390 --> 20:56.090]  They did, um, embedded systems exploitation for drones.
[20:56.690 --> 21:00.530]  Our story is mentioned in a book that came out called unit X, really cool stuff.
[21:00.690 --> 21:01.530]  So this is our shop.
[21:01.830 --> 21:03.850]  This is where we worked, um, every day.
[21:04.870 --> 21:16.110]  So, uh, the story here of bureaucracy hacking has to do with a drone detection system that we created, uh, or that we, you know, we created called wind talker, um, wind talker.
[21:16.310 --> 21:18.370]  This is, uh, we had a very small budget.
[21:18.510 --> 21:19.570]  This is the first prototype.
[21:20.250 --> 21:23.010]  Um, I'm sure you can squint and figure out what all the components are.
[21:23.410 --> 21:25.890]  Um, we had budget to build one.
[21:26.150 --> 21:27.590]  In fact, it wasn't even like a plan.
[21:27.790 --> 21:30.630]  One of the, one of our, one of our, one of our guys just built this in the corner.
[21:30.710 --> 21:31.630]  It's like, Hey, look what I did.
[21:32.370 --> 21:35.270]  Uh, and so we built a UI for it.
[21:35.390 --> 21:36.990]  This is our UI called doubting.
[21:37.750 --> 21:39.190]  And it's had to detect drones.
[21:39.370 --> 21:42.730]  Well, we didn't have, we were a government team by policy and law.
[21:42.890 --> 21:44.670]  You can't compete with the commercial sector.
[21:44.950 --> 21:48.730]  Um, for good reason, the U.S. government wants to promote economic growth.
[21:48.750 --> 21:51.950]  So if you're competing with a company as a government, you're putting them out of business.
[21:52.110 --> 21:58.410]  So there's a whole terrible field called tech transfer, which is getting government IP licensed to the big primes.
[21:58.910 --> 22:03.810]  Um, so we had one prototype box and one rough UI.
[22:04.410 --> 22:11.790]  And, uh, in the military, you call them a dog and pony show where you go show off your stuff to people who are never going to make a difference or really care about what you're doing.
[22:12.250 --> 22:16.670]  So we were in Augusta, Georgia at this location for a team that we were on.
[22:16.850 --> 22:18.470]  Um, that is Neil deGrasse Tyson.
[22:18.650 --> 22:21.810]  He was part of the defense innovation board, giving a briefing and a demo of what we did.
[22:22.110 --> 22:31.610]  And it's one of these situations where there's all these big wigs hearing your story and they see the, the shiny display and they have all these smart questions and you put, you know, you try to give smart answers.
[22:31.930 --> 22:34.910]  And the reality is like, how are we going to pay for this thing?
[22:35.110 --> 22:36.450]  How are we going to distribute it?
[22:36.530 --> 22:38.530]  How are we going to bring it to bear in reality?
[22:39.050 --> 22:40.610]  Well, there was rumor on the street.
[22:40.770 --> 22:44.690]  We talked to different DOD organizations and one of them called DITRA, Defense Threat Reduction Agency.
[22:45.270 --> 22:47.730]  Um, DOD is so weird.
[22:47.930 --> 22:51.150]  There's these entities with millions of dollars at the end of the budget year.
[22:51.430 --> 22:55.390]  And compared to the budget that gets passed, millions of dollars are called budget dust.
[22:55.570 --> 22:58.410]  And it's like, how do I access this elusive budget dust?
[22:58.530 --> 22:59.350]  I would like some, please.
[22:59.970 --> 23:04.390]  So I heard DITRA had extra funds and we had another proposal in another folder for a DITRA proposal.
[23:04.850 --> 23:06.670]  And like, no one on my team was willing.
[23:07.090 --> 23:08.290]  I'm not trying to disparage them.
[23:08.450 --> 23:09.890]  They were, they were great engineers.
[23:10.030 --> 23:12.730]  And so it was like up to me as the chief cat herder to figure this out.
[23:13.190 --> 23:16.510]  Uh, I was like, well, we don't know how many systems we want.
[23:16.610 --> 23:17.510]  We don't know how much it'll cost.
[23:17.650 --> 23:18.950]  So I just made it up.
[23:19.390 --> 23:24.470]  I found a DITRA proposal with graphs and charts and put smart sounding language with a table and an implementation.
[23:24.710 --> 23:26.070]  Like, I don't know what I'm doing.
[23:26.350 --> 23:31.770]  You know, former physical security bubba, but I can, I can, I can, you know, I've learned some foreign languages in my past.
[23:31.870 --> 23:32.990]  I'll speak bureaucrat.
[23:33.070 --> 23:33.790]  I'll speak DITRA.
[23:33.850 --> 23:43.590]  I put this proposal together and it turns out there are teams in DOD who are burdened with the problem of having money to spend and they don't know how to spend it.
[23:44.290 --> 23:47.730]  You know, you need these advanced contracting vehicles or whatever.
[23:47.910 --> 23:51.610]  So I gave them the answer, making up this proposal and we got funding.
[23:52.150 --> 23:56.190]  And so here's V2, uh, improved ruggedization.
[23:56.190 --> 23:57.930]  We've got airflow in the box.
[23:58.070 --> 23:59.190]  It's got an antenna mast.
[23:59.970 --> 24:01.830]  Kept growing and scaling to a degree.
[24:01.950 --> 24:03.290]  We eventually had to commercialize it.
[24:03.570 --> 24:09.770]  But, um, when the, when the U.S.  hospital ships were responding to COVID, they were using our system.
[24:09.990 --> 24:23.510]  So, um, and, and other sensitive parts of the world, very sensitive parts of the world, we're using our quasi production prototype boxes and we found very suspicious flights and we were able to keep important parts of this world safe as a result.
[24:24.370 --> 24:31.090]  Um, so it turns out, uh, faking it until you make it is viable strategy for technology implementation if you work for Uncle Sam.
[24:32.930 --> 24:33.330]  Okay.
[24:33.650 --> 24:37.250]  Uh, the last topic I'd like to discuss is supply chain attacks.
[24:37.570 --> 24:40.190]  Uh, again, I'm not a hacker, but I read the news.
[24:40.350 --> 24:42.570]  I have a rough understanding of a supply chain attack.
[24:42.790 --> 24:51.650]  The idea is if there's a trusted source of software that gives the stamp of approval, when it gets shipped and you get into the, you get into the pipeline.
[24:51.990 --> 24:53.430]  And so nobody knows where you are.
[24:53.510 --> 24:55.710]  And then it's devastating in multiple ways.
[24:55.850 --> 24:57.570]  A, it's what you thought was trusted software.
[24:57.730 --> 24:58.130]  That's not.
[24:58.210 --> 24:59.690]  B, it's being pushed out at scale.
[25:00.070 --> 25:04.250]  So how do you enact a supply chain attack as a bureaucracy hacker?
[25:05.770 --> 25:06.890]  I've alluded to it before.
[25:06.910 --> 25:13.010]  You just inspire the, you inspire the heck out of a bureaucrat who then you get on your side, who's then fighting your battle for you.
[25:13.410 --> 25:20.930]  My favorite story to tell, if you and I were to go out for a beer tonight and you were to indulge me, I would give you 45 minutes of a single story.
[25:21.650 --> 25:25.310]  My most successful bureaucracy hacking I did when I was 19 years old.
[25:25.610 --> 25:32.710]  I went to a military undergrad, the U.S. Naval Academy, and I really wanted to go train with the army in Vermont.
[25:32.850 --> 25:35.510]  They have a mountaineering school called Army Mountain Warfare School.
[25:36.090 --> 25:43.190]  And beyond hacking and beyond lockpicking, I think the coolest topic in reality that exists is the physics of knot tying.
[25:43.650 --> 25:53.550]  If you, there's different knots out there and you can do, whether you're sailing out at sea or mountaineering, you can do remarkable things with a little know-how and some rope.
[25:54.010 --> 25:56.790]  And so I had to find a way to go to this army training school.
[25:56.870 --> 25:58.250]  And I was, I was less than a nobody.
[25:58.250 --> 26:00.470]  When you're a cadet, you know, you're lower than low.
[26:00.750 --> 26:07.450]  And, um, I got to go, uh, I put together this entire framework that I used, imagine it was twice as long with more detail.
[26:07.570 --> 26:09.050]  And that's the process I got to go.
[26:09.450 --> 26:13.050]  And this is a picture of my workbook covered in pencil scratch.
[26:13.050 --> 26:17.590]  I got to go and I came back and, um, sorry, a quick vignette.
[26:17.730 --> 26:18.970]  I knew I was going to get a no.
[26:19.110 --> 26:21.430]  I was ready for the bureaucrat jujitsu.
[26:21.770 --> 26:22.090]  Okay.
[26:22.150 --> 26:32.430]  I put my entire proposal and plan A to Z, all the research, all the letters, all the documentation in a folder, knocked on the door of this, of this overweight helicopter pilot on shore duty.
[26:32.810 --> 26:34.150]  And it was like two dudes.
[26:34.350 --> 26:36.550]  And they handled the training for the whole student body.
[26:36.810 --> 26:37.570]  I knock on the door.
[26:37.630 --> 26:38.690]  He looks at me, what do you want, Hesh?
[26:39.810 --> 26:41.690]  So I was interested in training with the army this summer.
[26:41.790 --> 26:42.590]  And he just cuts me off.
[26:42.610 --> 26:45.870]  He's like, look, man, people walk in here every day wanting to do this training, that cool training.
[26:46.010 --> 26:48.910]  He's like, do you see this office, this eight square feet?
[26:49.170 --> 26:52.110]  It's two of us planning the schedules for 4,000 of you.
[26:52.190 --> 26:52.750]  It's not going to happen.
[26:52.890 --> 26:54.070]  And I was ready.
[26:54.770 --> 26:55.650]  No problem, sir.
[26:55.890 --> 26:56.210]  Understood.
[26:56.550 --> 27:00.530]  I said, if you don't mind, I'll leave my folder here on your desk by the door.
[27:00.810 --> 27:02.830]  If you have time to take a look at what I've put together.
[27:02.970 --> 27:03.070]  Great.
[27:03.190 --> 27:04.110]  And if not, no problem.
[27:04.410 --> 27:13.110]  I knew when he left that day, he was going to lock his door, see this fat, stupid folder and be like, what did this moron?
[27:13.250 --> 27:17.830]  You know, he's going to, he's going to look just so he can crush my hopes and dreams because he's going to think I didn't do my homework.
[27:18.050 --> 27:19.830]  I came back the next day and knocked on the door.
[27:19.930 --> 27:22.790]  As soon as we made eye contact, his eyes got as big as saucers.
[27:22.870 --> 27:26.990]  And he said, dude, I had no idea the amount of work you put into this.
[27:27.090 --> 27:28.550]  I just needed one signature and I got to go.
[27:28.610 --> 27:29.530]  The school had already approved it.
[27:29.750 --> 27:30.730]  He was like, this is awesome.
[27:30.870 --> 27:32.150]  It's like, don't screw it up.
[27:32.850 --> 27:44.470]  Um, there's, there's a, uh, there's, uh, in the early 20th century, a Navy Lieutenant stationed in China who saw how the British adjusted, uh, the elevation of their guns, which we weren't doing.
[27:44.590 --> 27:45.530]  His name is Lieutenant Sims.
[27:46.150 --> 27:47.850]  It's a crazy, interesting story.
[27:48.290 --> 27:54.130]  He was writing reports and how we needed to up our game, sending the reports to Washington and getting no reply.
[27:54.190 --> 27:55.230]  So he's like, screw this.
[27:55.330 --> 27:59.090]  I'm writing a letter to former secretary of the Navy Roosevelt, President Roosevelt.
[27:59.490 --> 28:02.770]  Uh, he got a reply or the Navy leadership got to reply.
[28:02.950 --> 28:04.850]  I said, put this Lieutenant in charge of all Naval gunnery.
[28:05.150 --> 28:06.910]  If he fails to perform, cut off his head.
[28:07.270 --> 28:13.610]  So, you know, sometimes the senior bureaucrat gives you top cover, but you are on the hook to perform.
[28:13.730 --> 28:14.030]  So I did.
[28:14.130 --> 28:14.570]  I graduated.
[28:14.630 --> 28:15.610]  I came back the next year.
[28:15.710 --> 28:17.670]  I said, sir, I had a great time.
[28:17.670 --> 28:20.070]  I would love to run the training and selection program.
[28:20.070 --> 28:23.090]  If you'll give me permission to, to get 10 more slots.
[28:23.210 --> 28:24.910]  He said, already beat you to it.
[28:25.030 --> 28:26.770]  You already have 10 slots next year.
[28:27.090 --> 28:27.650]  Don't screw it up.
[28:27.650 --> 28:30.990]  So that's a supply chain attack when it comes to bureaucracies.
[28:32.170 --> 28:34.610]  A couple quick, uh, now we can dive a little bit into the framework.
[28:34.790 --> 28:35.870]  Just some thoughts to think about.
[28:36.050 --> 28:40.890]  If you work in a bureaucracy, I'll just cut, cut, you know, cover each of these specific idea.
[28:41.050 --> 28:42.530]  What makes you come alive?
[28:42.710 --> 28:44.030]  When do you feel most energized?
[28:44.250 --> 28:45.610]  What's so obvious of an idea?
[28:45.890 --> 28:48.530]  You think surely there must be a reason it's not been implemented already.
[28:48.910 --> 28:50.410]  You might be the only one with the idea.
[28:50.630 --> 28:53.770]  I'm thinking of the Instagram Amber alerts, uh, finish this sentence.
[28:53.970 --> 28:58.050]  It would be amazing if our team lead approved our insane idea to blink.
[28:58.570 --> 28:59.490]  What frustrates you?
[28:59.610 --> 29:01.990]  If you were the CEO or the commanding officer for a day, what would be different?
[29:03.590 --> 29:04.450]  Logistics and execution.
[29:04.650 --> 29:08.470]  You've got to have a plan put together to make it easy to visualize how this is actually going to happen.
[29:08.610 --> 29:10.810]  It's the who, what, when, where, how, and resourcing.
[29:10.950 --> 29:13.230]  Of course, it's always resourcing time, money, and items.
[29:14.270 --> 29:15.190]  Policy and other permissions.
[29:15.490 --> 29:21.010]  Have you done your research to see if there's policy that might actually support, like the, like the ammunition documentation nobody had looked into.
[29:21.530 --> 29:23.350]  Um, does another team have policy?
[29:23.350 --> 29:26.030]  So we use this in the counter UAS or the drone detection world.
[29:26.390 --> 29:32.810]  Um, the Department of Homeland Security did not have authorization to put up sensors where they wanted to put sensors, but we did.
[29:33.010 --> 29:37.670]  And they could sign a memorandum of understanding or memorandum of agreement with us to get access to the data.
[29:37.850 --> 29:43.570]  So that's how you squirm around these big behemoth organizations to, to do everything above board and legal.
[29:43.850 --> 29:45.970]  Can you get a waiver or an exception to policy?
[29:46.070 --> 29:47.050]  We leverage those as well.
[29:47.050 --> 29:49.010]  And can you influence new policymaking?
[29:50.250 --> 29:51.070]  ID stakeholders.
[29:51.490 --> 29:54.750]  You know, the, that the boss is going to have deputies that he trusts.
[29:54.850 --> 30:00.590]  If you've got a good relationship with those deputies, then that's, uh, you know, how you can build that snowball of momentum.
[30:00.750 --> 30:02.030]  Who do you have the best relationship with?
[30:02.230 --> 30:03.330]  Who's the most open-minded?
[30:03.470 --> 30:04.710]  They might, may or may not be the same person.
[30:05.170 --> 30:08.530]  Who's closest to the boss and who stands most to benefit from your idea?
[30:08.650 --> 30:09.510]  Who might be on your side?
[30:10.930 --> 30:11.870]  Metrics and values.
[30:12.370 --> 30:13.310]  Bureaucrats love their metrics.
[30:13.550 --> 30:14.870]  So, um, play the game.
[30:14.870 --> 30:22.870]  What numbers can you move up and to the right or down if they're trying to reduce things like churn or drop off or abandon carts online or whatever the case may be?
[30:23.030 --> 30:25.210]  And then what values can appeal, can you appeal to?
[30:25.470 --> 30:38.550]  When I finally got that one sentence reply for shooting the, uh, flares, uh, spoke, I think, to a deep sense of, uh, wanting to, you know, see something cool and impactful happen to improve crew morale around July 4th.
[30:40.110 --> 30:41.550]  Remove friction, mitigate risk.
[30:41.750 --> 30:48.930]  I could give a whole lecture on these, but basically when you're talking to a bureaucrat, it's like, it's like, uh, in the wilderness, no sudden moves.
[30:49.210 --> 31:00.370]  It's like, don't do anything that could impact their rank, their reputation, their revenue, and do as much as you can to not inhibit their time, their energy, their effort, and their ego.
[31:01.030 --> 31:05.390]  Usually in bureaucracy hacking, you have to kind of subdue your own ego, make it sound like it was their idea.
[31:05.470 --> 31:08.910]  But if you're doing something you believe in that's bigger than yourself, you can do that.
[31:10.790 --> 31:12.170]  Uh, oh, this is a repeat.
[31:12.350 --> 31:12.910]  I covered that.
[31:13.050 --> 31:14.030]  Uh, decision maker.
[31:14.190 --> 31:15.930]  What are their fears, concerns, and priorities?
[31:16.070 --> 31:20.010]  It's easy to get angry at the boss who pooh-poos everything, but he's a human being.
[31:20.090 --> 31:20.910]  He or she is a human being.
[31:21.150 --> 31:24.530]  And they do have real fears, concerns, and priorities they might not even be expressing.
[31:24.990 --> 31:26.710]  Like I said, they've got to put food on the table.
[31:26.850 --> 31:33.230]  They, if they're in an organization, um, they might have less career mobility than you might believe that you do as a young person.
[31:33.310 --> 31:35.950]  And so they have to follow the rules or they think they do.
[31:37.570 --> 31:39.010]  What are the core values that can be appealed to?
[31:39.250 --> 31:41.070]  When they're, who are they, when they're at their best?
[31:41.270 --> 31:43.070]  And how can you approach them from that assumption?
[31:44.110 --> 31:47.170]  When they're at their worst, how do you avoid, you know, bringing the dragon out of them?
[31:48.730 --> 31:52.070]  Risk across safety, budget, reputation, ego, resourcing.
[31:52.190 --> 31:53.990]  How do you think through all these before you present an idea?
[31:55.210 --> 31:55.850]  Communication protocol.
[31:55.950 --> 31:57.690]  I think this is a very interesting parallel as well.
[31:57.950 --> 32:00.390]  You know, if you're, if you're in the Silicon Valley, it's a pitch deck.
[32:00.550 --> 32:02.090]  If you're in the military, it's a memorandum.
[32:02.430 --> 32:05.030]  Uh, if you're at Amazon, I know they go buy white papers.
[32:05.530 --> 32:06.290]  What's the tone.
[32:06.490 --> 32:13.010]  When I first called the mountaineering school, I took a huge risk because like I said, I was lowering lower in rank than anybody.
[32:13.470 --> 32:19.790]  And I purposely introduced myself using my first name because it's ran by special forces, green berets, and they're a guard unit.
[32:19.850 --> 32:29.510]  So I figured if you're a guard unit and your special forces and they, you know, because they're a higher level of training, they tend to be a little more relaxed and you're in the mountains of Vermont, where you get fresh maple syrup.
[32:29.570 --> 32:31.230]  We got fresh maple syrup every day during this training.
[32:31.230 --> 32:32.770]  I was like, you're probably easy going.
[32:32.930 --> 32:41.930]  And there's two types of people in the military, people who play the game because they believe in the purpose or people who, um, live by the organization at the expense of the purpose.
[32:42.130 --> 32:45.310]  And, and they'll both give you a no if you don't approach him properly.
[32:45.310 --> 32:46.930]  So I was casual with him and it worked.
[32:47.110 --> 32:50.670]  I got him on my side and that's how I began building that case to go.
[32:51.650 --> 32:56.010]  Um, so this is, let's revisit the definition, the second part of it.
[32:56.230 --> 33:05.110]  Bureaucracy hacking, a method of exploiting multiple vulnerabilities in organizations and social systems to create new value in a way that reconciles individuals to one another, themselves and their purpose.
[33:05.610 --> 33:09.410]  Well, if you're into etymology and word history, cilia is eyelashes.
[33:09.710 --> 33:12.790]  So to reconcile is to become face to face again.
[33:13.250 --> 33:16.250]  And so, um, I don't know too much about Jerry Pournelle.
[33:16.350 --> 33:26.310]  I know he was a sci-fi writer and maybe, um, here at HOPE 16, I should know more about him, but he was also an industrial psychologist and he's got this iron law of bureaucracy.
[33:26.310 --> 33:32.310]  And, um, from what I've learned about hackers is if you tell them there's a system they can't get into, they'll get into it.
[33:32.670 --> 33:39.750]  And so if you're going to give me a law that says bureaucracy has an iron law that cannot be defeated, well, let me read it to you first.
[33:39.850 --> 33:42.110]  In any bureaucratic organization, there'll be two kinds of people.
[33:42.450 --> 33:46.770]  Those who are devoted to the goals of the organization and those dedicated to the organization itself.
[33:47.270 --> 33:53.690]  In every case, the second group will gain and keep control of the organization at the expense of the former is the implication.
[33:54.570 --> 33:57.270]  At first this appealed to me because of my experiences.
[33:57.450 --> 34:08.210]  And then I realized this is a toxic principle in my mind, because if you join an organization later in its life cycle, what is this saying about who you are and the difference you can make?
[34:08.270 --> 34:08.910]  I don't like that.
[34:08.930 --> 34:18.170]  And I refuse to let anybody, uh, control or influence what I'm allowed to imagine or hope for or try to bring to fruition in reality.
[34:18.450 --> 34:29.150]  And so the way we keep these systems fresh and do the right thing and keep their purpose, uh, keep people close together and aligned for something that matters is bureaucracy hacking.
[34:29.590 --> 34:37.150]  It's staying connected to the reason and using these different levers to exploit the system, to repair the system and to not let it go to waste.
[34:37.290 --> 34:38.930]  So I believe in this stuff.
[34:39.850 --> 34:40.790]  Thank you very much.
[34:40.870 --> 34:41.470]  This is my email address.
[34:41.470 --> 34:42.190]  Love to talk further.
[34:42.290 --> 34:42.750]  Anybody interested?
[34:44.150 --> 34:44.350]  A
[34:49.650 --> 34:49.970]  question.
[34:50.410 --> 34:58.870]  Um, I know you talked about a little bit about, uh, knowing, uh, what they are at their best and what they are at their worst.
[34:59.390 --> 35:00.270]  However, many...
[35:00.270 --> 35:01.190]  Can you use the mic?
[35:01.630 --> 35:02.390]  I can't hear you.
[35:02.670 --> 35:03.630]  Can you use the mic please?
[35:06.420 --> 35:07.040]  All right.
[35:07.320 --> 35:07.620]  Better?
[35:08.200 --> 35:08.460]  Thank you.
[35:08.740 --> 35:09.200]  All right.
[35:09.360 --> 35:15.460]  So, uh, you talked about, uh, knowing people, uh, you know, the superiors, especially their best and their worst.
[35:15.740 --> 35:19.760]  Um, however, in many organizations, you don't have that visibility.
[35:20.120 --> 35:27.760]  So how do you find out about how people, uh, what, what their goals are and what their vision is and what, what they are at their best and worst?
[35:30.660 --> 35:44.880]  Your question, let me make sure I get it right, is if you're too far removed from the individual who's has the ability to approve or deny your idea, but they're too far away, how do you... How do you read the room?
[35:44.980 --> 35:45.780]  How do you read the room?
[35:46.440 --> 35:52.880]  Um, for the most part, this is a process that I think requires time and strategic planning.
[35:53.020 --> 35:54.640]  It's not something you can do very quickly.
[35:55.160 --> 35:59.980]  Um, so typically you have other individuals who maybe have been rejected for their ideas.
[36:00.140 --> 36:02.720]  And so you ask them, what was your experience and why did you get a no?
[36:03.380 --> 36:05.940]  Um, or he has maybe a trusted lieutenant.
[36:06.160 --> 36:12.480]  I saw this over and over again, and it's hard not to get cynical, but there's extraordinary bias.
[36:13.240 --> 36:25.220]  And if he de facto trusts one man or woman and doesn't trust another, you need to get in with the person who he trusts because he will listen to their idea and someone else who might be perfectly qualified.
[36:25.620 --> 36:32.220]  If he's not listening to them and your idea matters, you need to find a way to navigate the organizational chart to get to him.
[36:32.580 --> 36:43.560]  So it's doing research with other folks who've talked with the boss, him or her, and learning if their ideas worked or didn't work and why, and who you can reach, who can be an advocate for your idea.
[36:49.050 --> 36:50.190]  I'm hoping to any other questions.
[36:50.350 --> 36:53.490]  Otherwise, I really appreciate your time and willingness to listen.
[36:53.770 --> 36:54.710]  Again, there's my email address.
[36:54.990 --> 36:56.970]  Uh, and we got, looks like we got a question coming up.
[36:56.970 --> 36:57.830]  Let's turn the mic now.
[36:58.990 --> 36:59.350]  Oh, this one.
[37:00.210 --> 37:04.720]  I might need to... Hello?
[37:05.480 --> 37:05.800]  Is it working?
[37:05.960 --> 37:06.080]  Okay.
[37:06.980 --> 37:07.660]  Um, hi.
[37:07.860 --> 37:08.020]  Yep.
[37:08.680 --> 37:09.940]  Thanks for the talk.
[37:10.280 --> 37:18.080]  Um, it occurred to me that like, it sounds like that, that idea, it has to have like this, like values alignment with someone in that organization.
[37:18.440 --> 37:23.720]  But like, I'm sure there's people that have ideas that don't have that alignment, or they can't see that alignment.
[37:23.960 --> 37:25.820]  Like, what's your advice to, to them?
[37:26.020 --> 37:28.080]  And like, or how would, has it happened in your life?
[37:28.200 --> 37:29.660]  And like, can you give us an example?
[37:30.720 --> 37:32.120]  I don't know if this answer your question.
[37:32.220 --> 37:36.280]  You tell me, um, you've got to believe that your idea is bigger than yourself.
[37:36.440 --> 37:41.840]  So you have to present it in a way where you can really deescalate your own ego and you have to Trojan horse it there.
[37:42.120 --> 37:44.300]  I just wanted to go run around the mountains with the army.
[37:44.440 --> 37:56.780]  But if you read the proposal letter that I put together, it used all the flowery language, joint operations, joint training, quoting policy and doctrine on the, you know, the joint force and how this is a boon for the Navy.
[37:56.860 --> 37:57.740]  And it's a boon for the Navy.
[37:57.740 --> 37:58.460]  It was not about me.
[37:58.520 --> 37:59.820]  I just want to run around the woods with these guys.
[38:00.160 --> 38:02.900]  So you have to present, you have to present your idea.
[38:03.160 --> 38:04.340]  You have to couch it in language.
[38:04.520 --> 38:09.680]  You have to hide it in the Trojan horse of how do you make it look good for the organization or the boss.
[38:09.740 --> 38:11.040]  And I'm not trying to be cynical about it.
[38:11.120 --> 38:11.660]  It's true.
[38:12.300 --> 38:14.820]  So it's all marketing and branding and positioning.
[38:14.820 --> 38:15.740]  So you have a vision.
[38:16.160 --> 38:18.620]  You need to make sure you achieve your vision.
[38:19.200 --> 38:29.200]  Um, but how can you frame it in different ways to, um, yeah, I'm happy to speak to a specific example if you have a specific idea in mind, but, um, otherwise...
[38:29.200 --> 38:36.780]  I'm just thinking about like, um, like, you know, you want to get something done because the organization has resources, right?
[38:36.980 --> 38:42.440]  And, and, and it does connect to a bigger purpose, but maybe not the purpose that you could find in that organization, right?
[38:42.520 --> 38:45.280]  You might find people that like could help you along the way.
[38:45.600 --> 38:49.580]  But I don't know, like, are there some ideas that you can't get done in certain organizations?
[38:50.180 --> 38:53.080]  I mean, I would never want to admit that because I believe in the impossible.
[38:53.560 --> 38:54.260]  Probably true.
[38:54.620 --> 38:55.740]  Do you have a specific example?
[38:56.140 --> 38:56.500]  Hmm.
[38:57.700 --> 38:58.960]  Not that comes off the top of my head.
[38:59.160 --> 39:00.660]  I was hoping that maybe you might have a thought.
[39:00.960 --> 39:01.240]  Yeah.
[39:01.520 --> 39:01.760]  Yeah.
[39:01.940 --> 39:07.980]  I mean, in general, it's just how you position it and how can you, maybe, maybe you can add other ideas to it that serve the boss.
[39:07.980 --> 39:13.460]  So he approves one part of the idea at the expense of, you know, and allows another part of the idea because it serves his agenda.
[39:14.780 --> 39:15.140]  Thanks.
[39:15.480 --> 39:15.600]  Yeah.
[39:15.740 --> 39:16.000]  Thanks man.
[39:16.260 --> 39:16.480]  Cool.
[39:16.540 --> 39:17.940]  You have a question online?
[39:18.480 --> 39:27.760]  As part of your physical security work, how often did you see simple people-based bureaucracy attacks like tailgating, following someone through a door after they've already used their key card?
[39:28.860 --> 39:29.380]  Sure.
[39:30.840 --> 39:31.800]  Tailgating is pretty common.
[39:31.920 --> 39:34.820]  And I think that's that convenience versus security idea.
[39:35.340 --> 39:45.280]  And I think behavior change in a population is like the most important part of security, physical or cyber, and the hardest to accomplish.
[39:45.860 --> 39:47.900]  So there was lots of tailgating.
[39:48.180 --> 39:54.540]  And the hard part with Facebook is it was like, appropriately so, security was an HR function.
[39:54.700 --> 39:58.980]  You wanted people to feel a certain way, but you really weren't allowed to be particularly confrontational.
[39:59.080 --> 40:05.300]  So if someone was tailgating through a door, you might radio a guard to coach them not to do that.
[40:05.380 --> 40:10.680]  But it depends 100% on the priority of security to the organization.
[40:11.340 --> 40:13.300]  And I think we could have done a much better job.
[40:13.300 --> 40:18.060]  And I think you make people realize that the impact on them is real.
[40:18.720 --> 40:22.260]  If someone's tailgating, they just got to get to their computer to get the project started.
[40:22.400 --> 40:27.060]  But they don't realize that if somebody is tailgating, who's like an active shooter, then that's a problem.
[40:27.180 --> 40:32.860]  And so it's all about the culture and how do you elevate the security culture to make people realize we all have a role to play.
[40:33.020 --> 40:36.920]  So I saw it a lot and it was discouraging to be honest with you.
[40:42.430 --> 40:43.010]  Is that it?
[40:43.550 --> 40:43.910]  Awesome.
[40:44.130 --> 40:44.310]  Thank you.
[40:44.310 --> 40:45.250]  Oh, wait, wait.
[40:45.410 --> 40:45.530]  Nope.
[40:45.710 --> 40:46.190]  I'm sorry.
[40:46.310 --> 40:46.550]  I'm sorry.
[40:46.870 --> 40:51.690]  If there's others in the audience, come up, come up to the mic so I don't catch you off if you're... I had to like think about it.
[40:51.830 --> 40:59.230]  So I work in public education and I am finding I'm in the position where I have ideas I want to implement.
[40:59.870 --> 41:02.710]  I usually can get my admin on board.
[41:03.190 --> 41:05.670]  My issue is dealing with my peers.
[41:05.970 --> 41:10.150]  There's a lot of people, other teachers are saying like, you can't.
[41:11.790 --> 41:20.130]  I guess if you can speak to your experience about when you're not, you can get support of the bureaucrat, but not your peers.
[41:20.670 --> 41:22.890]  How do you have any advice on how to reconcile that?
[41:22.990 --> 41:23.570]  How to deal with that?
[41:24.050 --> 41:24.290]  Do you?
[41:24.470 --> 41:26.550]  Can your peers poopoo your idea?
[41:26.910 --> 41:27.510]  Can they influence it?
[41:27.790 --> 41:27.950]  Yeah.
[41:27.950 --> 41:29.370]  They're like, that's not going to work.
[41:29.450 --> 41:31.330]  And I'm like, yeah, but you've never tried it.
[41:31.710 --> 41:36.750]  Well, so I understand they can like disagree with it, but can they actually get in the way of an idea that you're trying to implement?
[41:37.110 --> 41:39.250]  Do they have the ability to... Can you give your example?
[41:40.190 --> 41:50.750]  So one of the things I want to do is make sure my students have access to being able to use sensors to collect their own data.
[41:51.110 --> 41:56.350]  And there've been a lot of people that are like, we're never going to get funding for it.
[41:56.410 --> 41:57.430]  How are you going to get access?
[41:59.290 --> 42:00.090]  But yeah.
[42:00.710 --> 42:01.030]  Sure.
[42:01.530 --> 42:06.890]  So what I'm hearing you say is like, you have a brand new idea that no one's ever done and people are just discouraging of the idea.
[42:07.290 --> 42:07.390]  Yeah.
[42:08.810 --> 42:09.690]  First of all, screw them.
[42:11.290 --> 42:14.530]  No, you deserve your ideas to come to fruition if you're looking out for young people.
[42:15.170 --> 42:19.510]  And I would say it depends on... I mean, it really gets down to the brass tacks.
[42:19.650 --> 42:20.950]  Like, do you need funding?
[42:21.270 --> 42:22.490]  Where's the hardware coming from?
[42:23.750 --> 42:24.930]  What's the implementation plan?
[42:25.090 --> 42:28.850]  Do you have time in your schedule for the year?
[42:29.030 --> 42:31.070]  Like, you know, I assume that you've got that all worked out.
[42:31.210 --> 42:37.010]  And if you do, again, it has to come down to like, the opinions of people don't matter.
[42:37.130 --> 42:37.850]  So screw them.
[42:38.410 --> 42:42.070]  The ability for someone to thumbs up or thumbs down your idea completely is what matters.
[42:42.390 --> 42:42.510]  Yeah.
[42:42.630 --> 42:46.170]  So you want to be focused on who can actually get in the way of implementing your idea.
[42:46.350 --> 42:48.990]  And for people like that, you want to look for precedent.
[42:49.510 --> 42:50.910]  Are others... Have other schools done it?
[42:50.990 --> 42:53.290]  Have postgraduate institutions done it?
[42:53.330 --> 42:54.830]  Have after-school programs done it?
[42:54.890 --> 42:55.930]  Where have they gotten their funding?
[42:56.110 --> 42:57.550]  Where have they gotten their hardware?
[42:57.670 --> 42:59.130]  What does an outcome look like there?
[42:59.730 --> 43:01.970]  You know, what are the data privacy rules and regulations?
[43:02.070 --> 43:05.030]  And can you adopt a system that somebody else did?
[43:05.270 --> 43:07.050]  So precedent matters big time.
[43:07.230 --> 43:09.690]  And then finding a way to couch in something that will serve them.
[43:10.050 --> 43:20.030]  You know, the principal maybe has a vision for next year and it's whatever the vision is, you know, Trojan horse, the sensor idea for your class into what the principal wants.
[43:20.030 --> 43:21.270]  And then they're going to give you a yes.
[43:21.530 --> 43:23.530]  So ignore the haters and then execute.
[43:23.530 --> 43:24.050]  You're going to do great.
[43:24.310 --> 43:24.730]  Thank you.
[43:25.250 --> 43:25.710]  For sure.
[43:31.820 --> 43:32.580]  Well, thanks y'all.
[43:32.720 --> 43:33.500]  Have a good rest of your day.