I think that in IT we have a similar stance on many fronts of security, integrity, and identity:  doveryai, proveryai, suditsya, or “Trust, Verify, Litigate”. 

My prediction: although world population growth is slowing, the litigation per person metric will far outpace population growth, and a lot of the reason for that will be the interrelationship of mobility, information, social, and cloud.  New ground for our enterprises, and more work for lawyers.

If someone like Benjamin Braddock were asking me for career advice today, I would replace the word “plastics” with “law”.  Probably even greater job growth than “IT” for sure….

http://www.newburyportnews.com/local/x2053729702/Google-exec-brings-Port-up-to-speed

In particular, this part of the article caught my eye:

After replying to a question about how much Google’s revenue comes from ad receipts (98 percent), he said, “Online ad commerce is a major force. Let’s see a show of hands on how many of you use our advertising tools.”

Not one hand was raised.

“I am surprised,” he confessed.

Keep in mind this talk was in a city that was the premier seafaring port for the young United States. The Coast Guard started there.  The Dreadnaught (one of the fastest tall ships in the 19th century) was built there.  This town has been through more than a few boom and busts, and technological revolutions (sail, steam, auto).  And now its a hub for environmental innovation.

Yet not a single person at the Chamber meeting knows anything about the use of online advertising…..or admits to.  And clearly, this Google exec didn’t do his homework on his audience.

Those of us that spend our time working, playing, socializing on the internet sometimes lose sight of the fact that there is much of the world that hasn’t caught up yet.

Recently my wife and I were dining at a restaurant. We left, reached the car parked down the street, and realized she left her pocket book (with a fair amount of cash and an iPhone in it) back at the restaurant.  I drove her back to retrieve it.  As she was inside, I decided to use the “Where’s my iPhone” App to establish the phone’s location.  Surprise!  That little bouncing blue ball was NOT in the restaurant, but moving up the street about a block away!  I called the cell number – no answer.

I rushed into the restaurant, pulled her out, jumped in the car, and gave pursuit.  All this time we were furiously sending “Play Sound” messages, while she navigated us towards the moving blue ball.  We catch up to it at a nearby intersection, double park, jump out of the car at opposite corners – hoping to hear the phone and grab the thief.

Surprisingly, the regularly spaced 10 second updates had suddenly started clocking up to 30 second, 1, 2, 3 minutes “last updated”.   Someone turned the phone off.  That sinking feeling of lost drivers license, credit cards, cash, and iPhone suddenly started setting in.  What to do now?

After about 5 minutes, my phone rings – caller-id is her cell.  “Did you lose a pocket book?”.  “Yes we did – where are you?”.  “ We’re parked in front of your house”.  When we retrieved the pocket book – everything intact – the person who called explained how they found it on the street, picked it up, looked at the drivers license, and decided to go to the house to drop it off.

Yeah, maybe.  What was clear was whoever took the pocket book from the restaurant didn’t have any intention of returning it.  I suspect they were spooked by the eerie “where’s my iPhone” sound going on continuously from the phone – and either threw the pocket book down, or had a change of heart and called us.

What’s the BYOD lesson?  Now imagine that the Modus Operandi in the event of a lost corporate phone is “call the help desk” – where centralized tracking and/or remote wipe could be initiated.  Some thief would probably be much richer now.

By putting that power in the hands of the user  the responsibility and authority for management of that device became the individual – not a monolithic corporation.   Flexibility and speed of response was key – and delegating management of the device to individuals (not without some monitoring) is clearly where the world is going.  Central command and control is over.   Companies hire PEOPLE with an expectation of commitment and dedication.  Enterprises are, in fact, no better than the trust and commitment that employees bring.  Should there be checks and balances? Sure!  Should employees be clear what their responsibility and authority is? Absolutely!   Unfortunately that doesn’t stop some vendors – and companies- to think “lock down” and “manage centrally” – to the point where they negate any sense of commitment by an employee.  Anything less than an increased emphasis on individual control and authority in the realm of managing personal devices is just a road to disenfranchisement.

That’s why BYOD will succeed, and Mobile Device Management will morph into something less control oriented.

I suppose, in Kurzweillian fashion, we can make a case that the number of new ideas  is a function of man’s continuing integration with machine, amplified by the number of connections we each make because of the increased opportunity for communications.  The average person, in the 1800s could be expected to rarely stray more than 50 miles from home, and the total number of friends that they were on a first name basis would likely be in the 100s.  Teenagers today pride themselves with friend lists in the 1000s.   Yet research has shown a point of diminishing returns to huge friend lists.  And our wanderings, automotive or otherwise, promise to bring down the ecosystem.

And then there is this maxim: “Sending a message does not necessarily mean it was received”.  This is as true for verbal and physical communication as it is for electronic.  It’s the rule that launches millions of therapist sessions. So we try sending again, and again… and again.

Our organizations, with some degree of infatuation with technology, continue to throw solutions against the wall to see if communication “sticks”.  Today, we may find the same thought, idea, post in multiple forums, multiple media, often just copied.  Let’s see, should I post this to my distribution list in email? on my wall on facebook? maybe at the group in linked in?  Oh – don’t forget the wiki, or the current darling of legacy windows info-sharing: SharePoint.  Maybe even it’s barefoot half-cousin: Lotus connections. Naw – let’s edit it down to fit Twitter.  Or create a video on YouTube.

As marketers continue to refine how to amplify the amplification, and generate more messages, one can only wonder when the whole trend will hit critical mass and collapse into a new dark age.

So maybe the real challenge is to determine appropriate use?  Or the goal of a smart organization is to limit choice, and message media, in the pursuit of profit?  Focus on effective channels, not ALL channels?  Just a thought.

My choice was a blog post.  Let the amplification begin.

Message received?

So, I thought, what if we used standard trending analysis to determine what the worst case growth scenarios for breaches were?

So I ended up with three scenarios – and my basic question was “When would 100% of current US population be exposed by a breached health record?”

Scenario One: Exponential growth.



I can’t make an argument that we would expect anything near exponential growth in breaches; but as compliance reporting increases, the family-relations effects magnify, and bad guys get PHI on their radar, it is not outside the realm of possibility.  This graph shows that growth, based on the 2 year history to date.  Expected date when 100% of the current US population has its PHI in the wild?  June 1 2013.

Scenario Two: Straight line growth

More realistic, this straight line growth reflects the full 2 years of history.  100% breach would be May 1 2047, but 50% of the US population would be living with exposed records by June 1, 2025.

Scenario Three: Straight line growth based on the last 4 months of data

The argument can be made that the breach trend has increased significantly over the past 4 months – and that the prior 18 months reflected a startup phase (for both reporting, and bad actors).  Using 4 months worth of data as a basis, the date at which 100% of the US population is dealing with breached health care data is  April 1, 2024.

What can safely be said is that we don’t know of any initiative that will properly safeguard health records – in fact, it’s almost impossible to completely and with certainty safeguard your PHI.  This is true even with GRC efforts (as described in one of our recent Gartner reports by Trent Henry:  ”IT Governance, Risk, and Compliance Management Solutions“)

Maybe this plays into my colleague’s (Bob Blakley’s) Maverick research about the death of authentication.  Or maybe this is just another indicator of lies, damned lies, and statistics.

Admittedly, this isn’t scientific, nor peer reviewed by any means.  It reflects a static population at 307 Million.

But it is troubling.  Should the  political concern about Medicare bankruptcy shift to health data insolvency?

It’s that time of year when parents and school systems start publicizing “Turn off TV” month.   Our local paper ran a piece on it – and in some cases it has been extended to ALL electronics (TV, radio, video games, computers).

Hmmm. Sure: when my kids were growing up we would turn off the TV for a month (I can see them snickering as grown adults when they read this: “Sure we did, Dad…”) and focus on family time, school work, and book reading.  Or at least we valiantly tried.

Oh what a world we live in – that quaint 1980s custom can’t possibly cut it now.  It would be the equivalent of living in a middle age monastery where the requirement was total silence, 24X7.

I only wonder whether the popularity of such an effort presages a Luddite reaction to technology. Certainly, frustration over security, identity theft, hackers, social engineering, equipment failures, UI angst, even password change anger could lead us down the road where sledge hammers come down hard.  A few more thousand point drops of the market, and watch the blame fixed on program trading – not the programmers, or the CEOs, or even the investors.  Blame the computers! Blame technology!

Consumerization, Democratization, an iPad in every pot, a Facebook post on every page.  We’re (Gartner) even beginning to use gaming as an archetype for rethinking how we manage business process and events; and we are looking at the start of the total disappearance of print media (probably within half a generation) – joining the scrap heap with vinyl records and wax cylinders.  The kids know it, apparently the adults don’t.  And rather than focus on interaction, quality, and lead the way with critical thought skills, some communities decide that it’s the technology’s fault.

Think this commentary  is a stretch?  Then you are not in a position, like some of us at Gartner, to see how many companies react to new technology options – like social media. Luddites? maybe. Ostriches? definitely.

It’s too late.  Pandora (not the music service) has left us a box and we have opened it.  The backlash – like in factories in the late 1800s – is just underneath the surface; it’s eruption is inevitable.

Mobility:  Up;  Multiplicity of IT Options: UP;   Versatility of IT roles: UP;    …and  (most importantly) Volatility: UP UP UP

So break out the sledge hammers.  Tear down the walls.  and Windows. and iPads…

It was pretty clear to me, especially as a CIO, that an undue amount  of “influence” was often targeted at me by vendors.  “Influence” came in many ways:  attention, perks, gifts, fake friendships, free offers, private plane rides….the list is endless.  In fact, I am just now working through the last of my vendor shirts and t-shirts – many in the painting clothes drawer.

The attention was at times annoying– and a good reason to hold the high watch for ethics – my ethics, my staff’s ethics, the department’s ethics, and the company’s ethics.  Even tchotchke from a trade show I viewed with a healthy dose of ethical skepticism – and when those tchotchke included $100+ dollar tickets to Cirque, well…

What I didn’t know (but clearly suspected) is an observation that I have been making in this quasi-vendor role.  Yes – I’m in the demilitarized zone between vendor and client.  My job is to work for the Gartner customer – think first “what’s right for my customer, regardless of our revenue goals” – yet,  I am still (in sheep’s clothing) a vendor now.  In this role I see a behavior,  especially in vendor organizations, that (at the least) is disturbing, and reflects what I always knew, but didn’t dwell on.

The egregious behavior that irritates me can be summed up simply as:  “Get the CIO”.  Get her mindshare, get her on your side, get her to be a friend, get her to be a strategic partner, get her to come to your briefing.  Get her to sign the contract! Whatever it is GET HER (or him).

That can get manifested in annoying phone calls, emails, invitations, etc, etc.  And its all certainly part of the game – the Social Network.  The latest iteration of this game is “get connected to her with Linked In”.

But focusing solely on the CIO, or the euphemistic “IT leader”, is a flawed strategy. And it’s an insidious sickness.  You, as a vendor, may not even know you have it. But you do.  It’s falling for the “Decision-maker Delusion”  – that hope that one mind, one person, can make all the difference.  And sometimes they can – like hitting the lottery can make all the difference.  But you don’t want to base your financial planning on it.

“DD” is present when you hear “we have to talk to the CIO”, “ I can’t get any traction with the CIO”, “How do I get past her admin for an appointment?”,  “How will this play with her?”.  Why is it a delusion? Because it treats everyone else in the organization as a cog, a stepping stone, an obstruction – rather than the thinking, intelligent human beings they are.  It ignores the contributions, influence, and responsibility that practitioners – front line staff, middle management – can have.

DD leads to classic top-down thinking; push, rather than pull.  Whole marketing and sales budgets are predicated on DD: Get the CIO.  Yes, regrettably, even research.  Is strategy for CIOs only?  DD thinking says yes.  Is advice for managing employees for CIOs only? Another DD  trap.  Governance an exclusively  CIO topic? You bethca – if you are D-Delusional.

Social networking, crowd sourcing, anytime/anywhere access, faster career turnover, job discontent.  These are all signs, at the practitioner level, that DD approaches are failing – and that engagement on every topic, at every level in the organization is the antidote to DD.  I recently heard an off-the cuff definition of creating an architecture (I’m paraphrasing): it’s organizing (a building, a system, an enterprise, a workforce) so that the  <building, system> will carry a greater load.   Simple, and broad.  And architecture has to take into account DD – both in how we architect, and how the final architected solution operates.  The practitioner is a part of the solution.

Do practitioners have a role in setting strategy or architecture? If you have DD, then the answer is clearly NO! Can I create my own strategy/plan/roadmap before my boss (Manager/CIO/CEO) does?  If you have DD, NO! Can I, as a practitioner, be fully engaged in my company.  If you have DD, NO! Should I sell to all levels of the organization that are impacted by my product?  DD sez NO! NO! NO!

The Gartner IT Professional/IT1 approach is anti-DD.  And if I piqued your interest, read our Professional Effectiveness research – Mike Rollings, Chris Howard, Elden Nelson, and myself.  Upcoming topics focus on fighting DD thinking, with titles like “Becoming a Contextual Strategist”, or the newly published “Storytelling: Tips for IT Practitioners to Persuade and Influence” .  Even past research like “Mastering Influence and Communication” or “The Future of IT Work”,  help shoot down Decision-maker Delusion – by vendors, by staff, by management, and -  yes – even by research firms.

For practitioners – reading this research is the first step in someday becoming a CIO… and to be Professionally Effective.

Which makes me think of this fictitious dialogue excerpt:

But, Herr Gutenberg, if you are able to use your new technology just think of all the income we lose from pilgrims traveling to monasteries.  Lost lodging revenue, religious trinket sales, fees from the library access vetting process, revenue from monk help desk calls and apostolate buddy systems.  People won’t pay for access to our thousands of manuscripts.  They may even be able to get to just one manuscript and no others! Deo Gratis – heaven forbid they may be able to take it home.

If the history of technology’s affect on media has one lesson, that is the dis-integration of content.  iTunes is the big winner in the music business over the past 10 years – because of the ability to easily sell singles in a relatively new form factor (other than 45s).  99 cents a pop.

Music run times shorten, so do movies.  Where once the 3 hour stay at a Cinerama was the norm, now it’s the 2 minute You Tube on your 60 inch TV, In a new form factor.  3.95 per  room access to new releases, or Netflix monthly unlimited fees of $10.

Even higher ed is in the act, as books, dis-integrate into chapters or excerpts for classes – partially in response to the high cost of academic texts.  Wikipedia entries become an option – not unlike CliffsNotes.

The trend is obvious.  Tell me again way we can’t find a way to make money in this new world order?  Oh, but wait! We are!

Creative destruction at work – or is it creative dis-integration?

This was really important to us; you see, when Gartner bought Burton and renamed that product line IT1, we kept the team – and mission – relatively intact.  The idea was that the traditional Gartner product does well with the senior IT staff (directors, VPs, CIOs), but wasn’t getting any traction with the rest of IT (practitioners).  So it was important for us to see that the majority (or almost at 49%) of attendees considered themselves practitioners, and less than 25% were senior IT staff.

The trends and concepts that we presented are covered extensively in our research.  In particular:

From Mike: Business-Integrated Planning and Execution, Improving Cross-Competency IT Effectiveness
From Jack: The Future of IT Work, IT/OT Convergence and Implications
From Chris: Architecting the Future: Innovation, IT, and the Technologist
From the Team: 2011 IT Professionals Planning Guide: The Cloud, the Individual, and the Path for IT

So it was good to see that what we are focused on had some semblance of relevance to our core constituency. In fact, almost 70% noted that the trends and implications of our research was having an impact (versus the 33% that said the trends are there, but resulting in little change).  Every company is different, but it was good to see such a broad base of acceptance to our research agenda.

This was the crème de la crème. : the relative career maturity of the audience.  Surprisingly, 28% didn’t have an opinion (or – more accurately – weren’t sure).  Those that viewed the externalization trends we spoke to (outsourcing, cloud, etc.) saw them as mostly an opportunity (by a 2:1 margin), but practitioners that view them as a threat were still a significant minority (23%).  Although our research falls squarely in the opportunity camp, having a fair amount of skepticism (and as Andy Grove points out: paranoia) is probably a good thing.

I have been told more than a few times that I am good looking, and people always stop me for autographs.  Sorry, I am married. (BTW, only one of these statements is true)

So now that I am past introductions, I am hoping this blog post throws off all the facial recognition efforts on the planet.

It’s funny; in the space of 24 hours, the universe seems to have sent me messages – which is why I am writing this.  The first was about our new small town policy of placing cameras on every street corner to watch for crime (crime in these parts usually means dropping a cigarette butt, spitting on the street, walking on the grass, or not walking in the crosswalk.  But, hey, cameras and internet access are cheap these days).  Someone asked me if it worried me, to which I answered (while mooning the camera), heck, why not?

The second message was this tidbit from the Blackhat conference.  Did it surprise me that one can go up to someone on the street and surreptitiously take their picture, then get everything about them?  Geez, I have been using Google Image search for a while now. It works well. Even on faces (like tagging in Picasa).  OK I get it. and of course the major media sites are picking up on this (Friday’s WSJ, for instance).

So it all combines for a new world of privacy – or lack of it.  Coupled with (message number umpteenth) the debates about being anonymous versus using real names on the web.  Maybe physical world privacy is all but dead, and the only thing we CAN control is virtual privacy – from anonymity to limited sharing to full sharing.  No answers here, and unlike my cohort Bob Blakley, I am not a privacy guru.

But I am more worried about something like this:     which could constitute the greatest privacy and security breach potential of all time.  With the number of workers and executives using planes for an office, more than a few times I could nosily look at inside information (if I wanted).  Or better yet, surreptitiously video/picture what’s on a screen two or three rows ahead of me.  But I don’t.  Yet for some, I bet it beats voicemail hacking….