Next week I’ll be launching www.tailrisk.com as my new home for writing online. The themes of risk in business, technology and geopolitics will be familiar to you, but the format and motivation is different. For anyone who wants a preview, please read and share your feedback:

Momentum in the 21st Century

Ten years ago the debate about stagnation raged in economic journals, on blogs and in op-ed pages, but today there is popular consensus that the good economic times in the U.S. ended some 50 years ago. Public intellectuals, economists and business people like David Graeber, Tyler Cowen and Peter Thiel made strange allies supporting the stagnation argument against the prevailing narrative. Today, holdouts of various forms exist, from those who believe that "growth is just around the corner" to people who claim hedonic adjustments account for the slowdown. Still, the popular mood in the United States is undeniable and the rest of the world has failed to keep up (EU, LatAm and Africa) or is rapidly slowing (APAC). Now that the sickness is acknowledged, we can turn to the effort of diagnosis and treatment, but to avoid wasting time and effort, let's first understand the current state of discussion around stagnation and progress.

Jolts of Progress

When Isaac Newton published Philosophiæ Naturalis Principia Mathematica in 1687 he created classical mechanics, explained the movement of the planets, invented calculus and kicked off the Scientific Revolution, which led to the First Industrial Revolution. Newton's laws codified the observations of astronomers and popularized the inductive method. His second law (F=ma) can be paraphrased as:

The rate of change of the momentum of a body is directly proportional to the net force acting on it, and the direction of the change in momentum takes place in the direction of the net force.

The speed of progress (velocity) is measured by the increase (acceleration) in economic productivity and technological advancement. Progress, like velocity, can be said to be measured with respect to time. If you define "technology as doing more with less," it is synonymous with productivity, which like acceleration, is also measure with respect to time. The third derivative of position is jerk or jolt. The rate of innovation (jolt) is the speed at which you increase technology.

Taking Newton's second law, a two by two matrix can then be constructed with rate of change on one axis (acceleration/deceleration) and direction (reformer/radical) on the other. Reformers are mostly concerned with steadily maintaining the current pace of technology, while radicals believe we need a jolt of innovation.

This framework for discussing progress is useful because proponents and detractors of the stagnation thesis may find themselves in striking agreement with those whose political views they stridently oppose. Graeber, for example was an avowed leftist anarchist, Theil a right-wing libertarian and Cowen a centrist. Having laid out the partisans, my next post will deal with the substance of the debate, what can be done about stagnation, but before delving deeper into the causes and treatments, permit me a brief tangent to explain what Tail Risk is about.

Technological Society and Its Future or: How I Learned to Love Worrying and Stop The Bomb

What does Tail Risk have to do with progress? Who am I to be writing on these topics? Why should you spend your valuable time here? These are all fair questions to ask.

First, Tail Risk is an exploration of low probability, high impact events that was born out of quantitative finance but is applicable across fields such as epidemiology, climate studies and cybersecurity. In many cases the goal is to avoid catastrophic or existential consequences. The potential of such a loss is often given as a justification for not trying something in the first place. The excellent Byrne Hobart and Tobias Huber recently wrote about this problem in Pirate Wires.

When I started my career, the field I entered was called technology risk. Today it is called cybersecurity. Material progress, doing more with less, is about addressing challenges through technology. That does not mean that technology is a free lunch, as economist and expert on progress Joel Mokyr would have it. Technologies solve one set of material challenges and often create others. In the 1850's steam boiler explosions occurred on average once every four days killing 50,000 Americans a year. Until recently, automotive crashes were the leading cause of death for children in the U.S. If we are to believe progress is not only possible, but worthwhile, we must be prepared to address these challenges and the doomsayers.

Things That Happen and Things that Don't; Things that Will and Things that Won't

Cybersecurity is a still young field, being developed at the innovation frontier, which provides the ideal vantage point to observe the interplay between technology and risk. Information technology is one of the the few fields making progress and yet, detractors (often cybersecurity professionals themselves) are quick to point out the risks associated with such progress. When I hit upon this insight, I realized that most of the problems in cybersecurity were economic or political in nature, not purely technological. We know how to make computers cybersecure, but the point of information technology isn't to be cybersecure, the point is to be useful.

One other useful framing of tail risk is to think about power law distributions. Most pursuits engage in achieving or avoiding the possible. Tail risk occupations sit around all day trying to prevent the unthinkable, but power law occupations seek to discover the improbable. These activities are hits driven, like entertainment, pharmaceuticals, fossil fuel extraction and venture capital. Scientific breakthroughs, intellectual awakenings and leaps forward in progress are also power law outcomes.

Over the past two years, my worlds collided as I worked in cybersecurity venture capital, finding, funding and fostering startups. This opened my eyes to the role of agency in outcomes. Tail risks can befall someone that is not prepared, but power law outcomes don't occur unless people battle against the odds.

This experience convinced me more than ever that the goal of progress cannot simply be to avoid risk but must be to unlock potential. Just as great a peril as failing to avoid risk, but less discussed, is the danger that we fall back into primitivism. As to whether my perspective is valuable, you will have to be the judge. I can only hope to prove my worth over time.

Sign Up at Tail Risk

... behold, what innovation it makes here: I am unfortunate in the infirmity, and dare not task my weakness with any more.

- Cassio (Othello,2.3,1171-1173) 

Risk Developments this letter:

• Security M&A

• Cryptovirology

• Insurance Deal of the Future…

• Cyber & Insurance & Credit

• Fundraising Climate

Ideology is What You Buy

Othello is most famously known as a story about revenge and jealousy, and it is true that Shakespeare was a master of depicting emotion, but more powerful than these twin evils are the structural elements which manifest themselves as evils, when these elements are trusted to the wrong people. Revenge is based in innovation and jealousy in reputation. These elements have positive manifestations too, progress and trust, respectively, but what transforms the amoral structural elements into good or bad is character.

The quote at the top of this week’s letter takes place at a critical juncture in the play. For a full synopsis, see the wikipedia link. For our purposes, all you need to know is that Othello, a famous Moorish General has come to save Venice from the invading Turks, and in the process, fallen in love with a Venetian, Desdemona. In making his preparations for battle, he passes over one of his lieutenants, Iago, for promotion and chooses Cassio instead. Iago sets a plot in motion to deceive Othello into believing that Cassio and Desdemona are having an affair. His first moves is to get Cassio into a fight that loses Othello’s trust. To do so, he takes advantage of Cassio’s weak tolerance for alcohol. The “innovation” Cassio speaks of is the trick of peer pressure that Iago uses. In modern language, we would say, “Just one more drink. Everybody else is doing it.”

Before innovation was a buzzword, it was taboo. To create change, to renew, to disrupt the order of things, was a bad thing in a hierarchical world where it was thought that God created a natural order that must be maintained. Cassio is not complimenting Iago’s ploy, but bemoaning the not-so-novel tactic that reinterprets expectations and etiquette in a way that causes Cassio to fail what is expected of him and act in a manner unbecoming of a military leader.

Reputation therefore plays a key role in Othello. Not just Othello’s impressive military reputation as a general (he wins Desdemona with his tales of heroism and hardship), but also Cassio’s reputation for loyalty and faithfulness to his post, his men and his commander. Iago masterfully exploits reputations, both Othello’s, Cassio’s, Desdemona’s and others to set rumors swirling and cause good people to act in bad ways to maintain their reputations.

This is where ideology comes into play. Innovations are always a twist, they are not born ex nihilo. They are a play on ideology, a way of channeling beliefs that exist into a future that does not yet exist. Reputation is key in this channeling, since people seek to maintain their identity or identities and can be compelled to do unnatural things to maintain them. One way to understand people’s ideology is their tolerance for buying certain truths. Iago mastfully works the belief systems of his adversaries, convincing Othello to buy his story of Desdemona’s infidelity, Desdemona to buy his story of Cassio’s victimization and Cassio to buy his story of Desdemona’s power over Othello. Each of these stories has a grain of truth that is embedded in the beholder’s system of ideas.

So too are risk managers observing grains of truth embedded in our own complex web of ideas about how the world functions, what economic truths dictate the behavior of markets and what scientific advances will cause changes in technology. Many projects have failed due to clever stories of innovation that get sold to defend the reputations of honest men (and women). 

Subscribe now

Risk Developments

Lots to catch up on since I last sent out a letter… so let’s get to it!

Security M&A 

The buyout boom continues in security, although it’s hard to say the security industry is exactly consolidating as the rate of new startups continues to outpace exits. Since acquisition targets usually have to reach a certain scale to be of interest, this makes the security startup pipeline kind of lumpy. Still, there is plenty of action taking place.

The biggest deal, at the far end of the pipeline, is a potential $8B merger between the formerly Symantec, now Norton LifeLock and Avast, the European antivirus maker. Given that Avast is U.K. based, this announcement carries a bit more weight, as regulatory filings across the pond are made at a slightly more firmed up stage. Symantec has routinely turned to acquisitions to supplement their R&D, keeping their product competitive in a fast evolving space, but with the footprint of Avast’s European customer base, this is also a way to buy growth.

A slightly smaller deal is Microsoft’s acquisition of RiskIQ for over $500M. RiskIQ’s technology scans publicly available information about websites to monitor phishing, fraud and malware. It’s a nice capability for Microsoft, which has both customers to protect and vested interest in proactively identifying threats before their software becomes a vector for attackers. The recent Microsoft Exchange Server hack, attributed to Chinese affiliates, is just one example of where better outside-in scanning could be helpful. Microsoft is not picking up many new customers, or even much unique intellectual property, so much as a completely constructed machine that they can integrate into their already impressive security suite. Whether for national security or bundling purposes, it’s an acquisition Microsoft can easily afford to make, and probably can’t afford to miss.

Lastly, two XDR (extended detection and response) acquisitions round out our M&A discussion. Rapid7, long time hacker darling, and owner of Metasploit, is acquiring IntSight, an Israeli cybersecurity firm, with capabilities to ingest dark web intelligence alongside more traditional threat feeds, for about $335M. Adding more context and external data to threat and vulnerability scanning tools should help keep Rapid7 at the front of the pack, and with their roots in penetration testing software, they will continue to champion the outside-in approach to cybersecurity. CyberReason acquired empow, another Isreali startup, for an undisclosed amount, but CyberReason, is flush with cash from their last funding round, a whooping $275M. CyberReason competes in the aforementioned endpoint detection space, a highly competitive market. Adding empow’s capabilities to integrate with other IT vendors should increase lock-in and help sell into complicated corporate networks where previous IT choices can create integration bottlenecks and barriers to entry.

Cryptovirology

Excellent political commentator Bruno Maçães has a piece about the weaponization of cryptography. It’s a good look at how secrets are a double edged sword and a reminder that its flip side, convenience, can be equally as destructive.

World Game

The cryptovirology files

Traditionally, cryptography has been seen as defensive in nature. Even in crypto currencies, cryptographic keys are used to secure the network. In reality it can just as easily be used offensively, as ransomware actions have decisively proved. Adam Young and Moti Jung…

Read more

5 years ago · 3 likes · Bruno Maçães

This is true in the case of Morgan Stanley’s recent data breach, a relatively minor incident as most customers were not affected. Still, the tragedy of the commons is a tragedy not because key individuals lack character, but because the many accumulated actions of players that cannot escape their fates.

While on the topic of public goods and fated action, it’s a good time to discuss this article about the demand for ransomware negotiators within the cybercrime ecosystem. As in most industries, the client facing roles grow to take more of the economic pie.

… a typical ransomware attack comprises four stages: malware/code acquisition, spread and the infection of targets, the extraction of data and/or maintaining persistence on impacted systems, and monetization.

The code acquisition piece is simple procurement and a buy/build decision. Infection is the highly value added piece, like finding product-market fit or cracking a tough technical problem. Once that is achieved extraction/persistence is like achieving scale, giving a new meaning to the term “growth hacking.” Finally, monetization is going through an evolution, like when the founder stops doing sales. More middlemen, more sophisticated pricing and a better informed customer are turning this role into enterprise sales.

Payments and Crypto

Plenty of payments and cryptocurrency news of late. Mastercard made big moves by announcing their intent to enable payments with stable coins like the USDC (U.S. digital currency). Not to be outdone, Visa announced that $1B of cryptocurrency transactions have taken place on their systems in the fist six months of the year. In other Visa news, endpoint protection company McAfee announced a partnership with Visa business cardholders.

Payments systems are the arteries of our economic system and like any complex system, a change in one part of the system can cause ripples elsewhere. The advance of cryptocurrencies and cybersecurity will continue to advance together and payments companies, both exposed to risks and best positioned to take advantage of changes have large reputations to defend. Whether they will see their reputations as a liability and innovations as unnatural disorder is up to them.

Cyber & Insurance & Credit

There are a lot of fun combinations of these three words. Cyber insurance. Cyber credit score. Insurance credit rating. etc. This story managed to get all three of these risk topics into one headline. We know that equity analysts are nonplussed about cyber risk, and if you believe most of the value of a company is in locked up in it’s terminal value, as equity analysts often do, this makes sense. Credit, however has yet to determine a consensus point of view. Here’s my glib list of people who care about cyber:

Maybe we should be adding lenders to the list on the left. Ratings agencies don’t make the rules, but they do shape norms…

The Insurance Deal of the Future…

… And always will be. The long anticipated WTW/Aon merger finally got the green light from European regulators, only to be halted by U.S. antitrust efforts.

Fundraising Climate

Clean tech fundraising is on fire with all the big PE funds hitting the circuit to raise mammoth amounts of capital to ride a confluence of tailwinds. The three tailwinds are public sector, technology innovation and industry disruption.

After a though four years, the Biden administration is signaling major investment in infrastructure that might be some shade of green and alignment on international climate norms. Congressional Democrats are looking to boost the profile of FERC (Federal Energy Regulatory Commission).

There is also, of course, technological disruption. As energy companies become more internet connected, risks rise and, because security is a property of a system, the whole thing has to be thought through from first principles. This means both unexpected CapEx and increased OpEx for legacy providers. Bad news for fossil fuels and a potential opportunity for renewables.

The difference between the first Green Bubble and today’s boom is that government led the first and the private sector is leading today’s. The world’s biggest asset manager, Blackrock raised $250M for emerging markets focused climate investments. Private equity giant KKR is partnering with Crossover Energy Partners. Carlyle is launching a renewables energy unit.

When bubbles repeat themselves, it’s usually worth noting. Insofar as innovation is mimicry, the bootstrapping process of creating a new belief system requires the production of reputation out of thin air. That process is usually tragic, always comedic and eventually inevitable.

Share

Gratitude

Big thanks to Bruno Maçães, Kelly Shortridge and others for sharing your ideas! 

In a mad world, only the mad are sane

- Lord Hidetora Ichimonji

Risk Developments this letter:

• InfraRansom

• Big Tech & Security is Securities Fraud

• InfraEnergy

• Insurance

• Blast Radius

• InfraGov

Succeed, Succession, Succumb

At the peak of his career Japanese filmmaker Akira Kurosawa embarked on an ambitious project to invert the parable of Mōri Motonari, a 16th century warlord with three loyal sons, by imagining what would happen if the sons were not loyal. Having hit upon the timeless theme of transition of power and succession, he realized Shakespeare’s “King Lear” had many parallels with, Ran, the story he wanted to tell. The result is an impressive retelling of a classic narrative, layered with Japanese subtlety with a modern perspective on a distant era. By making the story his own, Kurosawa pulled off the difficult feat of maintaining the weight and intelligence of Shakespeare while adding Eastern philosophy, modern cinematic drama and an instructive addition that speaks to today’s risks.

The most important lessons are to pay close attention to the troublemakers, don’t expect others to have higher moral standards than you would, and beware of pride. Like “King Lear” the story begins with the handing over of power from the great lord to his progeny, but in Kurosawa’s version it is sons, not daughters that are the heirs, and the lord has an explicitly violent backstory, as opposed to Shakespeare’s Lear, who is more innocent. When the youngest son speak up to criticize his father’s plan to split the kingdom, he is banished along with the lord’s loyal servant who also second guesses the succession plan. Predictably, the two remaining sons turn on their father and begin fighting for the whole of the kingdom. I’ll leave the rest of the plot and the minor characters for you to discover, but it is worth noting that Kurosawa expanded the role of the fool, an archetype we have discussed at some length before.

The lessons above are useful for more than just the personal politics of inheritance, but also geopolitics, technology and business. Success means achieving an elevated position, whether that is economic or military might, becoming the dominant platform or technology standard, or achieving a durable competitive advantage to gain market share and set prices. The corollary of success is that it makes you a target and the skills that help achieve success are not the same that maintain an equilibrium. There is then, the final problem of how to exit gracefully. Some companies manage to dominate a market, generating cash flow for years to fund entrance into new and growing markets. Some countries manage to use growth to transition to higher standards of living and alternative economic structures. Some technological standards persist across centuries despite great leaps in innovation. The norm, however, is that success is followed by failure of succession and leads to succumbing. To avoid the common path, we should take one more lesson from Kurosawa and invert his parable 360 degrees back to Motonari. 

Share

Risk Developments

InfraRansom

Let’s jump right in! Cybersecurity infrastructure firm Kaseya has been hit with ransomware. As a key vendor to many managed security service providers, this incident is notable not only for the brazen continued deployment of ransomware like with Colonial Pipeline and JBS, but also the scale like the SolarWinds hack. Already people are comparing it to SolarWinds, despite the impact and sensitivity of customers seems to be down a notch. 

While SolarWinds is thought to be a nation state attack targeted at major U.S. Government buyers of the software, there is no evidence yet that the Kaseya incident poses similar risks, but as with any infrastructure compromise, the story will likely unfold over weeks, if not months. SolarWinds is itself, still playing out, although most of the facts that can be known seem to be known at this point, but the litigation could take years. 

Here’s cybersecurity board member and industry veteran Amit Yoran on the topic:

Big Tech & Security is Securities Fraud

While we’re on the topic of security related lawsuits, here’s a story about Google shareholders suing the company for not disclosing known security vulnerabilities. Big tech seems to be getting attacked on multiple fronts, hackers, shareholders and regulators are all piling on in what could be the end for one of the most impressive business runs in history.

Here’s a deep dive on how a tech breakup by regulators might play out, and while the first salvo by new FTC Director, Lina Khan, was swatted down, it won’t be the last. The big tech  breakup poses a bit of a problem for U.S. foriegn policy, as Europe and China are doubling down on their national champions. In a technology arms race for AI, quantum computing and cybersecurity, it is precarious for government to bet on yet to be founded startups, while economic rivals have no such qualms about domestic monopolies.

The other big tech news, is of course, the departure of Jeff Bezos at Amazon. Perhaps taking a lesson from Shakespeare or Kurosawa, Bezos has chosen to make his strongest lieutenant, Andy Jassy, the sole leader, which will keep power squabbles to a minimum and chart a path similar to Bezos. Still Jassy faces the enormous challenges of a big tech CEO and will have to compete vigorously against the other cloud giants, all while maintaining a culture of innovation and increasingly feeling the pressure of providing much of the internet’s infrastructure.

InfraEnergy

IT infrastructure and energy infrastructure have many similarities (high capital costs, good gross margins, oligopolistic dynamics) and a few differences (regulatory oversight, direct to customer relationships), but they are both rising in importance politically, technologically and in business.

When Koch industries upped its stake in the IT conglomerate Infor, they were making a bet on the increasing relevance between the two types of infrastructure. Now Infor is spinning off Infor’s enterprise asset management business to another industrials cum information 

infrastructure company, Hexagon.

The energy space is facing a conundrum as money pours into renewables from governments and ESG focused investors, and one way to hedge against that is to bet on IT. Another way is to simply sell some oil assets, as Saudi Aramco is doing with their downstream pipelines, while still holding the critical upstream production assets.

This is all occurring against the backdrop of record renewables energy consumption in the U.S. and a proposed manufacturing tax credit for renewables manufacturing. It has long been a worry that renewables would only be cost effective given Chinese government subsidies making solar and other renewable components cheap and plentiful. American policy makers copying the Chinese playbook is a bit of a head scratcher, but given the large U.S. subsidies of fossil fuels, it may just be leveling the energy playing field. Still, if the U.S. wants to take the lead in renewable energy, it will require innovation, not just subsidies.

The Saudis are keenly aware of this, and in addition to monetizing some of their oil assets, they are investing heavily in alternative energy, with hydrogen power, being a big bet. This makes sense, especially given the synergies between fossil fuels and blue hydrogen. What makes oil so valuable is its fungibility. As a dense energy source with global utility, it can be stored and shipped and consumed with relative ease compared to coal, natural gas or nuclear. It is said that most difficult problem in energy is storage, often meaning batteries, but oil or potentially hydrogen may offer a better natural battery.

Private equity is also aware of these changes, so KKR is teaming up with Crossover Energy Partners to invest in “securing power purchase, tolling, and build-transfer agreements from customers such as utilities, municipalities, and industrial firms.” When a new technological standard is being developed, it’s best to bet on the winner, but if you don’t know ex ante whether it will be betamax or VHS, you can make plenty of money by controlling other points in the value chain.

Exxon’s has been dragging its feet for years on a clean energy strategy, so much so that ex-Blackstone activist investors were able to stage a coup. Despite taking an incredibly small stake, Engine No. 1 has so far succeeded in pushing for changes at the very top, but whether Exxon will have the appetite for renewables that Aramco does, or the foresight to get out of the way that KKR does, is yet to be seen. It’s the classic disruption/succession dilemma.

Insurance

As an industry with a huge incentive to stem the damage caused by global warming, insurance has moved about as deliberately as big oil. It’s surprising that AIG has just this year issued its first ESG report, but with catastrophe losses up 17% this year after years of increases, the industry is taking notice. Part of the reticence to change is cultural, but part of it is also access to plentiful capital.

In other insurance news, the Aon-WTW merger is back on the ropes as U.S. regulators expand monopoly concerns beyond just big tech. Facing tougher regulation, higher losses and a continued low interest rate environment, insurance may have to get more creative. Part of that ties to the ESG story by attempting to control losses. There are, of course, other ways to align insurers and the insured.

The most interesting overlap between energy and insurance may be energy and technical lines. On the one hand, the customers’ ability to pay is determined by fossil fuel consumption, but on the other, fossil fuel consumption drives frequency and impact of losses. Berkshire Hathaway Specialty Insurance, which also underwrites cyber insurance, is moving into the U.K. energy market. BHSI is no stranger to complicated bets and dynamical systems. Incidentally, Berkshire Hathaway also owns one of the seven electricity distribution companies in the U.K.

This setup, with complex causal relationships and back and forth risk transfer is reminiscent of the recent Palantir story about their role in the SPAC market. As provider of private investment in public equity (PIPE) they backstop a company going public via the volatile SPAC vehicle, which may or may not deliver all the capital needed when SPAC investors choose to back a deal. Palantir, in return for capital upfront, locks in customer contracts, essentially paying themselves with part of their investment. 

One way to commit to risk reduction is to pay somebody else a premium to take your risk, essentially buying oversight and a reason to take the risk seriously. It’s a trading corporate control for financial interest. Another way to buy insurance is to sell some equity to somebody else who can do something for you that will increase the value of that equity. If there is technical or organizational risk around large software implementation (and there sure is!) this is another kind of commitment device, just like insurance is supposed to be. For more on this topic, check out Byrne Hobart’s subscriber only post that he made available to everyone.

Blast Radius

While we’re on the topic of insurance and software, let’s talk about the absolutely cratering  cyber insurance market. That smoking hole in the ground is the 67% loss ratio for cyber insurance in 2020. Although it looks grim, there is one saving grace and one piece of good news related to the possible decimation of the cyber insurance market. The first good news (not so good for the insured) is that premiums are up 40%. Insurance is cyclical and buyers always flood in after the fact, so it’s not surprising, but the long term sustainability of the industry may be at risk, so it’s worth noting that premium growth isn’t keeping up with the loss ratio. Still, there’s yet more piece of good news in general, and that is that if losses are correlated with headlines and premiums are responding in kind, we may actually know more about cyber incidents than is commonly believed.

The conventional wisdom is that cybersecurity is an iceberg and there are far more incidents that go unreported or unnoticed, which may be true for the latter, but losses seem to become public if a company is insured. Where the data is lacking, however is in the granularity, and that is an issue even insurers are having difficulty with:

It is yet to be seen whether the Cybersecurity Safety Review Board is more effective, but what we can say is that incidents are less of an iceberg and more of a black box. So far, urging by lawmakers has been pretty ineffective. With few other places to turn, some insurers are taking the view that “if you can’t beat them, join them.” No insurers aren’t hacking back, but some are accepting payment in crypto. 

InfraGov

Lastly, lets’ talk about more about IT as an industry compliment. The first industries to reap the benefits of IT were finance and media, wholly abstractions that lent themselves well to software. Besides industrials and energy, IT is also a growing complement to the public sector. This is part of the reason that a number of large government contracts have been awarded for IT, as we approach the U.S. Government fiscal year end in September.

First there was the L3Harris $3.3B contract for communications equipment to be sold to overseas partners. This may seem like a lot, and while the U.S. military has plenty of leverage in forcing allies to use compatible communications equipment, the contract is firm fixed price. Still a boon for L3Harris, especially since it had no competing bids, but high costs and limited upside belie the real opportunity for IT in the public sector.

Leidos’ $2.5B win at NASA to provide IT support is a much better demonstration of the value and power of IT in the public sector. It is a cost-plus contract with flexibility and potential upside, but selling services does entail hiring people and hiring IT with clearances can be expensive, so the gross margins may not be all that good.

Cisco’s $1.2B deal with the Defense Information Systems Agency is an even better demonstration. Although half the size of Leidos’ deal and almost a third as big as the L3Harris deal, the margins on software are far better and the flexibility on the contract to extend from one to three years provides plenty of upside. When compared to the $2B Raytheon deal for nuclear missile engineering and manufacturing, that stretches out until 2027, it seems that forging the weapons of war is a pretty poor business relative to writing code and maintaining networks. 

When any old regime gives way to a new one, there are sure to be winners and losers, and the key to being on the winning side is not just being young (although that helps), but not being prideful. 

Subscribe now

Gratitude

Big thanks to Amit Yoran, Garin Pace, Byrne Hobart, and others for sharing your ideas! 

Taking one more week to recharge, but I will be back soon! Been stockpiling reads by Plato, Liu Cixin and Robert Caro, for future letters, so please stick with me just a bit longer, if you’re interested in what those authors have to say about risk.

Also, if you need a quick risk fix, check out this interview I did with Elizabeth Blosfield of Insurance Journal’s Insuring Cyber Podcast. Happy Fourth to all my American readers and hope everybody finds some time to relax and recharge this weekend.

Thank you for sticking with me for nearly a year. I’m taking some much needed time off this week and the next. Plenty of risk news to catch up on when I get back, from the U.S.-Russia summit to big tech and beyond, so don’t worry, I’ll address the highlights after a brief respite.

Hope you all get to enjoy some relaxation this summer after a brutal year. Please keep the book recommendations and conversation going. I’ll have access to email, but am checking less frequently so please excuse any delayed replies.

... Progress on a broad front results from the free play of free intellects, working on subjects of their own choice...

- Vannevar Bush

Risk Developments this letter:

• Crypto Political Risk

• AttentionWare

• Uncorrelated Returns

• Federalism

Lone Ranger

Specialization has its benefits. Winning the software engineering tournament can yield a high salary, deep expertise can give you an edge in investing and specialized knowledge (whether in business, technology or international affairs) can unlock secrets that give you an unfair advantage. The flip side of specialization is the lack of optionality. As a highly paid software engineer, there are only a dozen or so companies that can afford you. As an investor, your circle of competence is narrowed to specific industries. As a knowledge worker, it may lock you in to an increasingly irrelevant mission.

From time to time we talk about variousdefinitions of risk. One definition of risk might be, “the inability to walk away from a bad situation.” David Epstein’s “Range” makes the case for generalists, emphasizing advantages such as creativity, agility and the ability to make disparate connections. Being able to cut one’s losses may seem like a counterintuitive key to good risk management, but it is fundamentally the source of real option value.

The setup of “Range” begins by examining the popular 10,000 hour rule and looking at professional athletes, scientists and forecasters at the top of their game. Specialization works well in a static environment, when the inputs, outputs and objectives are not shifting, but Epstein finds that behind many stories of intense focus and deliberate practice are actually divergent thinkers willing to engage in radical self criticism and, most importantly, acknowledge when something isn’t working.

After dispensing with the myth of the single minded savant, Epstein uncovers the benefits of generalists. 

“... The most effective leaders and organizations had range; they were, in effect, paradoxical. They could be demanding and nurturing, orderly and entrepreneurial, even hierarchical and individualistic all at once. A level of ambiguity, it seemed, was not harmful. In decision making, it can broaden an organization's toolbox in a way that is uniquely valuable [255].”

Being able to maintain multiple realities within an organization not only enables the placing of many bets, but it can also further the ability of those bets to pay off. For example, a great athlete may have to choose between two sports to specialize in, but not only do they have a choice, but their experience in one sport may improve the way they play the other.

In the final third of the book, Epstein provides some actionable advice for developing one’s range. The first piece of advice, mentioned above, is being willing to walk away. The second is becoming a deliberate amateur. Free play and curiosity are far more powerful forces than are often recognized. Finally, he concludes, in a nod to the opening critique of deliberate practice, that what often holds us back from fulfilling our potential is the knowledge of how much work it will take to obtain expertise. Many of the most talented people in the world don’t hit their stride until late in life, after becoming experts in a few unrelated fields. The key is not just to walk away from what isn’t working, but also to keep trying in other domains. Specialization isn’t the enemy, but ego is.

Subscribe now

Risk Developments

Political Crypto Risk

Recently we talked about the spectrum in finance from market to political risk. As Mark Rosenberg points out, cryptocurrency is not a good geopolitical hedge:

Being correlated with political risk, however does not mean that cryptocurrencies are bad news for all governments. For one thing, governments that have already given up sovereignty over currency (those that have adopted the dollar, for example) may find it an attractive hedge. El Salvador made big news accepting bitcoin as legal tender, and although this doesn’t change much for countries with monetary sovereignty, like the U.S. or China, it does provide the potential ability to walk away from the international financial system for countries that have already given up monetary sovereignty.

A related political risk issue in cryptocurrency is the seizing of the Colonial Pipeline ransom by the FBI. Here the U.S. Government proved that cryptocurrencies are not beyond the reach of law enforcement, but for El Salvador, this may be good news. In the short run, it undermines a big, but problematic use case for cryptocurrency, but in the long run the supply of bitcoin remains beyond government control, while regulating its uses for less nefarious activities. The question still remains about activities that one government views as nefarious, but others do not. Cryptocurrency may not be a political risk hedge, but they could be a political risk arbitrage.

AttentionWare

Speaking of ransomware, the White House wrote an open letter on the topic. As insurers continue to raise the alarm about the impact of ransomware on the business community and the insurance industry, look for more attention from the government, both to subsidize insurers and reduce losses.

The fight, however, is far from over. While Colonial Pipeline and JBS got lots of press, another pipeline was hit with a ransomware attack that is not getting the same attention. The perennial question about cyber incidents is whether the ones we know about comprise a significant number of the attacks that happen. My hunch is that most attacks come to light over time, but the frequency and inability to quantify impact make most of these stories fly below the radar.

Uncorrelated Returns

One reason the insurance industry is so fascinating is that under the radar news often does matter in insurance and can have big consequences. Hurricane insurance is a pretty specific niche of the industry, and one that has a vested interest in the slowing of global warming. Compared with the frontal assault on the oil and gas industry, natural catastrophe insurance has been quietly adapting to this risk for decades. A nifty piece of financial engineering called a cat bond (neither bond nor cat related) is a way to securitize catastrophe risks that are too big for any single reinsurer to hold. The news that the Texas Wind Insurance Association was able to double the amount of capital raised with a cat bond is the latest in a story of capital seeking alternative uncorrelated yield. 

Berkshire Hathaway Specialty Insurance is one of the savviest investors looking at alternative ways to generate yield and often find themselves in exotic and esoteric risk markets. Now they are getting into French marine insurance. This story is at the nexus of climate, covid and geopolitical issues with the recovery coinciding with the culmination of Brexit and increased demand as few risk takers want in on shipping risk while climate volatility continues to risk. BHSI, however is a generalist, applying their underwriting discipline wherever possible, making moves like this one something to watch.

In other insurance news, the Aon/WTW merger appears to be one step closer to getting approval as Aon plans to sell off assets to private equity firms. Retirement insurance and benefits businesses are politically sensitive, but ripe for purchasing by dispassionate financial sponsors, which should bode well for both insurance, which gets some breathing room from regulators and private equity, which likes buying stable, cash flow producing, businesses at a good price.

Federalism

Two seemingly unrelated pieces of government news broke last week. First, the State banking regulators’ victory over the OCC for the power to issue fintech charters was overturned. Digital first banks prefer a national charter because they would prefer a national customer base and simplified regulation, but the United States has a peculiar banking industry with lots of regional and local oligopolies, protected by State regulation. Having won round one, it looked as if the industry would stay that way. The downside of greater competition is that fewer big banks means less ability for customers to walk away. This may result in fewer, but more specialized, banks even if there is a short run increase in competition.

The second piece of government news is the Cybersecurity Infrastructure and Security Agency’s new cyber disclosure platform. Biden’s cybersecurity executive order mandates disclosure of breaches and now it is possible. Being able to walk away quietly from cybersecurity incidents has reduced risks for business, while socializing the costs. Now it appears that all companies are going to have to specialize in cybersecurity, or at least centralize that capability in third party providers.

Share

Gratitude

Big thanks to David Epstein, Mark Rosenberg and others for sharing your ideas! 

They say courage is invisible, but I never knew a top player who didn’t have it written all over his face — clear as day.

- Doyle Brunson

Risk Developments this letter:

• Bank Shot

• Crypto Regs

• Crypto Climate

• Super Computing

• Cyber Vigorish

• Cyber-Human Systems

• Soft(ware) Power

The Card Players (1895) by Paul Ceézanne. Museée d’Orsay.

Super Risk

At the turn of the millennium poker had reached new heights of popularity. Propelled by the success of the movie Rounders, the introduction of online poker and the nationally televised World Series of Poker, males ages 13-30 were especially prone to the fad. As a young man in high school, I too was caught up by the Moneymaker effect. For those new to poker, and interested in studying the game, there was one book that was a must read. Often called “The Bible” of poker, Super System, a 605 page tome of poker wisdom and folksy fables was written by Doyle Brunson, a cowboy hat wearing poker pro. The translation from poker skill to risk management is more clear-cut than a lot of what I write about here, but that doesn’t mean there aren’t hidden truths that we can still reveal.

For the purpose of this letter, I focused primarily on Brunson’s advice regarding No-Limit Texas hold ‘em poker, a particular style of game that allows players to risk all their chips on any hand, at any time, even before all cards have been dealt. For a more in depth look at the rules, see the wikipedia link above. What I am primarily concerned with is Bruson’s strategy, not his poker tactics. Bruson intentionally developed and reinforced his reputation for being an aggressive poker player, which acts as a nice foil to the question, “why is society so risk averse today?”

This topic came up in a recent twitter conversation with a former statistics classmate:

Modernity is obsessed with risk management, justification and “resilience.” Perhaps I am part of the problem, writing a newsletter on risk. The issue, as James pointed out, is not so much that we talk about risk, but that the talk is disconnected from, or even worse, obfuscates actual risk management.

Bruson’s strategy can be best summed up as, put constant pressure on your opponent and only let up when they get cocky, then apply even more pressure at the last second. His key insight is, there are four basic setups in a simple one-on-one game:

This bit of game theory leads to a counterintuitive lesson; play weak hands more aggressively and you can get some “free” money that you can use to take real gambles. This creates the appearance of being lucky. There are, of course risks to this strategy. Sometimes you are playing the bully you get steamrolled by a strong hand. The trouble with trying a strategy where you play good hands more aggressively is you don’t get your opponent to risk much when you win. The goal is to be like a bullfighter, waving the flag constantly, and standing just close enough to get hurt, without ever being in any real danger. Easier said than done.

 Brunson explains his approach like this:

The accumulation of all those small pots is the big part of my winning-formula. It’s the bonus I get for playing the way I do… and it’s the “secret” as to why I win.

Experienced traders will recognize this as selling convexity, sometimes colloquially called “picking up pennies in front of a steam roller.” It’s not usually a good idea to make small amounts consistently at the risk of one existential blow up, but in Texas hold’em you see five of the seven cards in your opponent’s hand, so it’s easier to get out of the way, and in no-limit Texas hold’em you can be a bigger bully, which makes the pennies even easier to steal.

That is, it made the pennies easier to steal, until Doyle Brunson published Super System. The book has such an impact on poker that it changed the style of play, especially when people were playing against Brunson himself. I even wrote about these complex systems last week. This brings me back to the earlier point about the proliferation of risk aversion in society and all the cheap talk about “resilience.”

In a naive world, it pays to be a risk taker. The rewards themselves may not merit the risk taken, but the performance of being a risk taker has positive externalities that allow risk takers to keep making big bets. This inverts the selling convexity setup, providing a cushion for a big loss without having to quit altogether. But in a cynical world, you can’t bluff, and it’s bluffing that allows for some degree of risk taking. 

Brunson is famous for what is called a semi-bluff, a bad hand that could turn out well. These marginal hands are the kind of unexpected successes venture capitalists love. If it’s obviously a good idea there’s too much competition, and if it’s not obviously a bad idea there’s too little to gain. But, if it’s not obviously a good idea, the upside is big and the competition is scarce. It’s hard to semi-bluff a cynic, so you end up spending a lot of energy emphasizing both how risk averse you are (my hand must be strong) and paradoxically talking up how little a loss would affect you (and even if I lose, I’ll be fine).

Difficult to say where we go from here. Brunson had to change his style of play and so have risk managers. When rational risk seeking becomes normal, one has to escalate the aggression, just to employ the same strategy. This results in a performative culture of risk, but if acting over-the-top can achieve the same results as taking risk, there is no need to take real risk in the first place. This is the world of meme stocks, cryptocurrency bubbles, hype and performative risk management.  

Share

Risk Developments

Bank Shot

Fintechs continue to commoditize retail banking, challenging money center banks, but not at scale in key markets. What could threaten the large retail banks would be an incumbent in an adjacent space who benefits from commodifying the compliment. Visa is launching just such a digital first partnership.

In related, but not directly connected news, HSBC is getting out of U.S. retail banking and pivoting to its core Asian business. I don’t want to make too much of this news, after all, HSBC is probably making this decision in reaction to the strength of the money center banks, not their weakness vis-à-vis fintech. The bigger risk to HSBC is regulatory risk at home as China tightens its grip on Hong Kong, putting Citi and HSBC on notice for doing business with democracy supporters. The calculus to defend home turf instead of funding foreign excursions is a decision all banks are having to evaluate one way or another.

The corollary for U.S. based banks is in cryptocurrency. A grey area in terms of regulatory jurisdiction makes cryptocurrency an interesting case study. JP Morgan’s CEO is again sounding his concern over bitcoin, while BNY has opted to launch crypto custody services, but in Ireland. It is an interesting hedge to get exposure to the cryptocurrency market, while putting it outside of BNY’s home market.

Bruson warns against taking insurance in poker. If you have ten-to-one odds on a 50-50 bet, you don’t want to give up that upside, unless it would be existential. Brunson isn’t risk averse and figures even if he loses a million, he’ll find a way to bounce back, but if you’re the oldest bank in the U.S., maybe you don’t want an aggressive reputation.

Crypto Regs

Ok, let’s talk crypto and regulatory risk. Fidelity, one of the four biggest money managers, has put up some impressive numbers, attracting $102M to it’s bitcoin index fund in just nine months. Vanguard, one of the other four mega money managers has been the most reluctant to embrace cryptocurrency. BlackRock is somewhere in between, and surely Fidelity’s success is creating some envy, so BlackRock is looking more closely at crypto. There are certain advantages to being the first mover, but there are also drawbacks.

Fidelity’s bitcoin ETF is now on hold in response to increased regulatory warnings. A bitcoin index is apparently one thing, but a tradable security that tracks bitcoin is a step further. The SEC is taking more action to keep cryptocurrency markets in check by suing a ponzi scheme promoter that raised two billion dollars.

This sort of action is actually a boon for the cryptocurrency ecosystem that has long been plagued by these kind of scams, but there is some reputational spillover that may keep more trustworthy players from wanting to appear too aggressive. In an inversion of Bruson’s strategy, the mere appearance of risk seeking behavior is sometimes enough to prevent reasonable risk taking.

Crypto Climate

One such example of reasonable risk taking is the interplay between cryptocurrencies and renewable energy, which we discussed at length here before. Plans to build out a massive solar farm in Montana to mine ethereum are underway and could be signs that the cryptocurrency bubble might fund energy infrastructure projects that would only work at scale in the absence of cryptocurrency.

Byrne Hobart nails the paradox of massive parallelized innovation in his post here. There are precedents in railroads, telecommunications, the internet and other public good network effect technologies, but it’s not just a question of whether there is enough risk seeking capital to get to scale. The other side of the equation are the legacy incumbents.

The shale oil and gas revolution has undercut the renewables market for the last decade, but now legacy oil and gas companies are under assault from within. Dutch Shell is on the receiving end of an unfavorable ruling in the Netherlands and Exxon shareholders managed to stage a surprisingly effective mini-coup, which Matt Levine covered in depth here.

Super Computing

Speaking of parallelized innovations, the supercomputer arms race continues apace. The Department of Energy launched its newest and most powerful standard supercomputer. Meanwhile, the private sector is piling into quantum computing R&D. The question, when it comes to whether the latest wave of enthusiasm for quantum computing, is whether its actual risk taking or performative risk taking.

Past cycles of parallelized innovation have employed Bruson’s self reinforcing strategy of playing aggressively to pick up free money that funds marginal bets with big payoffs, but in a crazy meme stock world, are there too many aggressive players at the table for the cheap pots to be easy money?

Cyber Vigorish

In the early days of cyber insurance there was a lot of “free” premium to pick up. Companies weren’t hacked all that often, and even if they were, they might not know it. Now the hackers are global, the tools are widely available and the skill threshold is lower. Premiums have responded accordingly.

Normally an increase in risk could be offset by an increase in premiums, but all of the noise around hacking may create a positive feedback loop that increases risk faster than the market will bear premium increases. The historical solution for flood or terrorism insurance has been a federal backstop, and it was just a matter of time until the question was raised for cyber insurance too. That time is now.

The continued epidemic of ransomware hit the food supply chain as JBS, one of the world’s biggest meat packing companies, was taken offline last week. It appears that they recovered quickly, but no word yet on whether they paid the ransom or whether insurance was involved.

Cyber-Human Systems

In other cyber news, Fireeye is selling their product unit for $1.2B to focus on their core services business:

Joking aside, it’s tough to run a combined services and products business because one side of the business is always trying to commoditize the other. It may turn out that Symphony, the private equity buyer of the product unit, can realize value by combining FireEye’s products with their previous acquisitions, RSA and McAfee.

Another Brunsonism is that he always plays the man, not the cards. Unless he’s sure that he or his opponent has an unbeatable hand, he’ll get aggressive, pushing out a risk averse player or making a risk seeking player pay up for their gamble. If you have the best unique software solution for a cybersecurity problem, you’re better off just playing your cards, but in all other cases, humanity is the area to focus on. There’s a lesson in there somewhere about humans and computers in cybersecurity.

Soft(ware) Power

Lastly, software continues to eat the defense industry as AT&T wins four DHS networking contracts worth $306M. It’s not so much their physical infrastructure or labor that won the deal, but zero-trust software, a big theme in Biden’s recent cybersecurity executive order.

In related news, the deal to be Boeing’s cloud computing provider is said to be worth $1B dollars and has all the big cloud service providers vying for a win. Given Boeing’s recent trouble with software, it’s likely that the winner will put together an attractive bundle of not just highly-reliable, low-cost infrastructure, but a suite of security and productivity software too.

In other aerospace meets software news, the first report of an attack by a weaponized autonomous drone engaging with a human target was published last week. Whether we like it or not (we don’t) software is going to be playing a bigger role in who lives and dies on the battlefield. That’s one place a reputation for risk aversion might be a good thing.

Subscribe now

Gratitude

Big thanks to James Goss-Dollin, Matt Levine, Byrne Hobart, and others for sharing your ideas! 

It was too difficult for Tetsuo... of course, too difficult for us. And for Akira.

- Takashi

Risk Developments this letter:

• Cyber Insurance

• Crypto Regulation

• Big Bank Crypto

• Political Risk

Extra Systems Perception

The anime cult favorite Akira changed the way the West viewed animation, introduced cyberpunk to the world and influenced a whole generation of artists. Just ask rappers Kanye West and Lupe Fiasco. This anime’s influence is wide reaching and genre defining, but why, and what can it teach us about risk?

To answer these questions we should first pay homage to the artistry and craftsmanship displayed throughout the film. From the score to the backgrounds, the painstaking work to produce 160,000 animation cels and even early computer-generated imagery, this work of art was the most expensive anime ever produced at the time. It’s not just visual and audio experience that is so impressive, however, but also the story. Based on a long running manga, published from 1982-1990, Akira defined the cyberpunk genre.

The basic overview of the plot is of a biker gang getting tangled up in a top-secret government experiment in psychic warfare. Set in the post WWIII, Neo-Tokyo, in the year 2019, Tetsuo Shima, a member of a biker gang, crashes into an escapee who fled a government lab where they were subject to extrasensory perception (ESP) experiments. When Tetsuo is arrested the authorities find out that he has powerful psychic abilities that are reminiscent of the mysterious “Akira.”

The remaining members of Tetsuo’s biker gang join forces with a resistance group to try to break him out. As they break in, Tetsuo’s powers are growing and the other ESP subjects attempt to kill him, fearing that his power is too great. Failing to assassinate Tetsuo, one of the ESP subjects tells him to seek out Akira, who may be able to help him control his powers. Meanwhile, the colonel who runs the ESP lab overthrows the government and marshals all military resources against Tetsuo.

In the final showdown, Tetsuo battles his former gang members and the military at the same time, which awakens Akira. From here things get even weirder and more metaphysical, but I’ll let you watch it and draw your own conclusions. Eerily, this showdown takes place at the 2020 olympic stadium (which were postponed in real life due to the pandemic). This climax is one of the better scenes in cinema, but the rising action is what is more relevant to our discussion of risk.

Part of what makes Akira so relatable is the world building that, despite its outlandish sci-fi elements, feels believable. The film does a tremendous job of rendering a chaotic system, one complete with feedback loops, reservoirs of latent power and flows of energy between these reservoirs. There is of course psychic power that seems to feed on itself, and state power that flows from civilian to military control, and rivalry between biker gangs, as well as a love story subplot, intense interpersonal relationships and existential breakdowns in society, coupled with a message of rebirth and hope.

All of this is to say, Akira is a great lesson in systems thinking. The steady states created throughout the movie are the result of chaotic and unpredictable events like a motorcycle crash. These inflections move the plot along from plateau to plateau, the same way change happens in real life. As soon as you are comfortable with the prevailing paradigm, it often shifts, and because of the interconnectivity of relationships within complex systems, the results are entirely unpredictable.

In risk disciplines, whether they are in finance, defense or technology, we are often confronted with the challenge of sensemaking. Understanding our world can only be done in retrospect with causal stories, but managing risk in real time is an exercise in acting with incomplete information. The lesson of Akira is not to fight the positive feedback loops or try to contain entropy, but to embrace it, ultimately benefiting from these societal phase changes.

Share

Risk Developments

Cyber Insurance

The buzz about cyber insurance is that premiums are up, way up. Standalone policies saw prices jump 28% in 2020, only to be oustriped by a rise in claims of 38% over the previous three years. The U.S. General Accountability Office warned that premiums are likely to increase even more in 2021. This pain may turn out to be short-term, as insurance is a highly cyclical industry, punctuated by catastrophic losses. These losses are in turn followed by an influx of demand and sometimes, hopefully, better methods of cost control.

The biggest news in cyber insurance this past week, however, was not the rise in premiums, which have steadily increased over the last year, but the $40M payout that insurer CNA paid to cybercriminals who were holding the firm’s data ransom in March. This is the largest known ransomware payout to date, and a watershed moment for the industry. If nothing else, it’s also huge cryptocurrency news, alternatingly proving the value of bitcoin or demonstrating that it must be regulated, depending on your point of view.

Crypto Regulation

Speaking of crypto regulation… It appears the honeymoon phase is drawing to a close for the Biden administration. The IRS is getting a long awaited staffing bump to address cryptocurrency, which, despite the pseudonymity of Bitcoin and other cryptocurrencies poses a significant issue for at least one use case. The United States Federal Government seems to be taking the position that cryptocurrencies are ok for breaking Chinese or Russian laws, but not U.S. laws which makes the asset more like high end real estate than gold.

At the same time, Senate Democrat Sherrod Brown is pressuring the OCC on cryptocurrencies. This may create a schism between more traditional fintech and cryptocurrency fintech, but given some big bank enthusiasm for cryptocurrencies and their desire to block competitors from entering their legacy markets, it’s still unclear what stance legacy institutional powers will take in the debate.

Further complicating things is the OCC director’s stern words for fintech charters and big bank risk taking. Michael Hsu may be picking multiple fights at the same time, a difficult position to maintain, but one with the most flexibility. Like any complex system, the outcome is unpredictable, and sequencing will matter, because whichever battle the OCC picks first, win or lose, will create strange bedfellows for future fights.

Big Bank Crypto

Where are big banks falling on the cryptocurrency debate? Goldman re-announced its crypto trading desk this month and was recently considering offering crypto products to its wealth management clients. Wells Fargo is taking the middle path, offering crypto to high net worth clients, but not yet taking principal risk. On the other end of the spectrum, HSBC has no plans for crypto at all.

Part of the reason there is a diversity of approaches is that nobody yet understands where the chips will fall, but other reasons are institutional and business model based. HSBC already does lots of business helping wealthy asian private clients move money around the world. Cryptocurrency is a pretty direct threat to that. Other banks are less exposed to that risk and simultaneously more excited about the volatility in crypto markets. One way to model this might be to place banks on a spectrum of taking advantage of market risk on one end of the spectrum and political risk on the other. 

Political Risk

Political risk is, of course, a massive topic in its own right, and one the effects not only finance, but geopolitics and technology as well. Issues from semiconductor supply chains to energy security are constantly subject to political risks. States (or would-be states) with strategic leverage in these critical markets can often punch above their weight.

Taiwan has been cozying up to the United States and Russia making friends with China. The recent efforts by Putin to play China off against the United States may bear fruit, if Biden follows through on his hawkish China talk, but political risk analyst, Isaac Fish Stone points out that Russia and China have an uneasy relationship of their own to manage. Systems thinking relies not only on the set of options available to actors in the system, but also on the degree to which other actors believe in the strength of those options. This results in continuous testing of willingness to exercise those options, creating yet more feedback loops.

One underrated strategy is to keep off ramps open, allowing actors to back down without losing face. In Akira, we see how committing to action can create an escalatory environment. When many dependencies create a web of interrelated events the outcome can be unanticipated disaster. Sometimes it’s best to go back to the start and wipe the slate clean. Tetsuo learns how to do this with the help of Akira, but in real life we may not get a deus ex machina to save us.

Subscribe now

Gratitude

Big thanks to Alex Danco, Isaac Fish Stone, Anna Gat, and others for sharing your ideas that helped me write this piece! 

The Communist process of ridding people of their old belief system was called colloquially ‘hse nao,’ which literally means ‘wash brain’

- Margaret Singer

Risk Developments this letter:

• Cyber Industrial

• Hack Back

• Chips and China

• Big Budgets

Cults, Coins and Companies 

Is BitCoin a cult or a religion? Is it a belief system or a technology? Is it a bubble or the birth of a new asset? The answer depends on who you ask, but while I’m picking on BitCoin here, these questions can be asked of any fast growing and novel cultural phenomenon, and ex ante the answer isn’t always as clear as we might think. This is the primary lesson of “Cults In Our Midst.” 

Originally published in 1996, “Cults…” mostly details the cult phenomenon of 1960’s and 70’s America, although it also includes section on cults in the workplace, a nod to the 1990’s, Clinton era, business positivity and dot com culture. Besides the obvious necessity of only being able to study the past, the emphasis on the 60’s and 70’s is because those decades were the heyday of cults. The breakdown of social norms and a general mistrust of traditional institutions, hierarchies and values created a vacuum that many people were attempting to fill. Unscrupulous, charismatic and psychologically savvy cult leaders began creating new patterns of living based on a mix of eastern philosophy, interrogation techniques and psychological findings. It was the combination of a vulnerable population and the spreading of improved mind control techniques that led to this cult boom. The framing of the book suggests that cults are ever present, but their earliest incarnations are well known and avoidable.

I’m not so sure. For one thing, it’s getting harder and harder to differentiate a cult from a social movement. “Cults…” defines a cult as  having three factors: an origin story and leader, a power structure and a coordinated program of persuasion (thought reform or brainwashing). This sounds an awful lot like a startup or a political movement to me. To further separate the pegoritive cult from other movements, Singer focuses mostly on the abuse of power and willful manipulation through persuasion techniques. Using Robert Lifton’s eight criteria of totalism we learn to watch for totalizing techniques such as:

1. Milieu control

2. Loading language

3. Demand for purity

4. Confession

5. Mystical manipulation

6. Doctrine over person

7. Sacred science

8. Dispensing of existence

While some of these, “mystical manipulation” for example, may be harder to identify outside of traditional religious cults, Lifton defines it as being persuaded that one is chosen or special. This kind of manipulation is hardly uncommon in startups, investment schemes or other movements. In marketing class we once watched a 60 Minutes segment on Mary Kay. Is it a cult? Hard to say.

What does this have to do with risk? Well despite the obvious cryptocurrency news that we’ll get to later, it is related to the theme from last week, risk does not equal volatility. Risk is a permanent loss, it is the inability to recover. The mass manipulation found in early cults, and perfected today on a wider scale, has the potential to lead to unrecoverable damage.

Startups are notoriously cult-like, but while the company may never recover, individuals can move on to new phases of their careers. Investments in novel means of organizing capital, such as cryptocurrencies (or joint stock companies for that matter) may go to zero, but a portfolio of uncorrelated assets can continue to produce returns under various states of the world.

The challenge then is one of monoculture. When everybody does the same thing and not only are ideological deviations rare, but actively discouraged, organizations, economies and institutions fall victim to their own blind spots. As cryptocurrencies become the norm people will come to recognize them not as odd outsider behavior, but as fully blown belief systems:

Here I’d like to turn to a subject not covered in the book, cargo cults. Here we have cultish behavior without the psychopathy Singer commonly ascribes to cults. Mimicry is a key form of social pressure cult leaders use to cultivate a following, but it is also a spontaneously occurring phenomenon. So what to make of these leaderless cults, or, if you’ll excuse my coining a phrase, autonomous cults?

A power structure with a built in system of persuasion is just a hierarchy looking for a leader. Religions, companies, nations and movements often transition leadership, and one way to understand whether something is a cult is the degree to which one person can gain control over it. Nations can develop cults of personality, company mythologies can idealize and idolize a leader and belief systems can be abused for personal gain. To the extent that something is not a cult, it is because no one person can gain control of the system.

Share

Risk Developments

Cyber Industrial

Last week’s Colonial Pipeline news continues to unfold as the biggest event for the cybersecurity world since SolarWinds, just a few months ago. The difference between reactions to the former, which had effects felt by many outside of cybersecurity, and the latter, which was arguably a bigger deal for those in the industry is stark. Although the effects may have been more psychological than logistical, due to panic buying and a reasonably quick recovery. Still, the idea that cyber can do things in the real world has breached public consciousness, and that’s perhaps the biggest news.

One related industry that has seen a lot of herd-like buying behavior is construction and lumber. It’s a lot harder to imagine how construction and manufacturing get shut down by a cyber attack, but this article about poor security in construction is trying. The key thing to remember about the Colonial Pipeline shutdown is that the flow of oil was turned off by the company because billing was shut down due to the breach of IT systems, not Operational Technology failure. In the part of industrial and manufacturing that typically does spend a lot of time and money on cybersecurity (defense) the billing is discontinuous, opsec is taken semi-seriously and products undergo rigorous testing. It’s much easier for attackers, whether they be criminal or nation-state actors, to go after the weakest point in the system (for more on this see Byrne Hobart’s excellent Diff writeup on cyber liability).

Preying on the weak, as cults do, is a positive selection game. It’s hard to disrupt systems where the good risks willingly walk in the door. One solution that is often bandied about is to go after the bad actor directly on behalf of the victims. The perpetrators of the Colonial Pipeline attack, DarkSide, suddenly disappeared after the attack. Their servers shut down, their franchise program closed and they left debts to their affiliates unpaided. It’s unclear whether this was the action of the U.S. government (official spokespeople do not comment and former advisors deny it as a possibility), a private entity, self imposed or another government. If it is either the U.S. or Russian government, that greatly changes what we know about nation state capabilities and partners. If it’s a private entity, that is interesting, and if it’s self imposed, as threat researchers hypothesize in the article, get ready for things to continue to get worse.

Hack Back

One often overlooked aspect of the hack back argument is that attackers can hack back too. Deterrence in cyber is already hard enough with attribution issues, but escalatory actions would only make things harder. Some asian divisions of the French insurance conglomerate, AXA, suffered a ransomware attack after declaring that they would not pay out insurance claims for ransomware targeting French companies.

I’m not claiming that AXA made the wrong move here, but only that attacker motivations matter. In some ways it’s evidence that insurance companies should take a hard line regarding ransomware, after all, it did seem to bother the ransomware gangs. One option we’ve discussed before is self insuring by holding bitcoin on the balance sheet. Another is for governments to step in and provide subsidies, as it does for terrorism or flood insurance, but because governments can’t print bitcoin, that would just cause the price of bitcoin to climb.

The best move is to improve national cybersecurity defense, but that is a big challenge in many different ways. From chips to trade laws, company incentives and information asymmetries, there are a lot of problems to solve. 

Chips and China

U.S. Senate Democrats are proposing a $52 billion semiconductor production bill aimed at bringing chip manufacturing back to the U.S. Supply chain risks to both logistics and cybersecurity have come front and center over the past year, kicking off an arms race in chip design and production between the U.S. and China. 

The rest of the bill includes $100 billion for basic science research in fields like AI, Quantum computing, 5G and other buzzy topics. The trade focused amendment has been watered down as Biden resists Republican attempts to remove Trump era tariffs and meddle in executive branch decisions about the U.S. Trade Representative post. While the political process is painful to watch, in the U.S. it’s at least still one where nobody is in control. 

Big Budgets

We’ve spoken a lot about cybersecurity recently, in part because that’s where the money is. Gartner’s newly released cybersecurity spending forecast puts the 2021 prediction at $150 billion, up some $26 billion from last year’s estimate, which predicted a slight deceleration due to covid. Clearly that prediction, made about this time last year did not turn out to be correct. Does this mean we’re more cyber secure than we expected to be last year? What is the value of the marginal cyber dollar, is still the most under discussed question in the industry.

Another budget explosion is coming from the insurance challengers, known as insurtech, funded by some $2.2B of venture capital. A similar question arises here. What is the marginal dollar of the VC insurtech dollar? If the pitch decks are to be believed, better underwriting through AI and big data are going to provide a competitive advantage versus incumbents, but if it’s all spent on marketing, we may just end up with the same results for more money. Sound familiar?

Subscribe now

Gratitude

Big thanks to Byrne Hobart, Geoff Lewis, Jeremiah Grossman and others for sharing your ideas!

• Sure, Insurance

• Colonial

• Cryptocurrency

• Gov and the Last JEDI

Jumping In

This week I’m going to change it up a bit and jump straight into things. Honestly, I’m a bit burnt out from writing three long pieces on “Crime and Punishment” and thank you to all the readers who actually stuck it out with me. Also, it was a big week in risk news, so there’s still plenty to talk about! That said, I did want to give you something a bit more timeless. 

One thing I’ve been thinking a lot about is how risk does not equal volatility. In business schools across the world students are taught Modern Portfolio Theory (MPT) and the Capital Asset Pricing Model (CAPM). This theory holds that by diversifying one’s portfolio of assets, risk, as measured by volatility, can be reduced. That is to say, if I want exposure to the booming wireless carrier market, but I don’t want to bet on any one company’s management team, I can buy a sector. The same goes for asset classes. There are unique correlations among asset classes, so by diversifying among uncorrelated assets, one can reduce overall volatility (i.e. when stocks are down bonds are up). This measure of correlation with the market, often referred to as systematic risk, is called Beta. The expected return of any asset is made up of Beta, Alpha and Epsilon. Alpha is the asset’s uncorrelated return above (or below) the market. Epsilon is the error term that captures non-market risk.

This view of risk is clearly wrong, but it has its merits. We have discussed before how “all models are wrong, but some are useful.” The problems with CAPM and MPT are that they make some staggering leaps to demonstrate some pretty intuitive findings. Diversification is good if you don’t know how things will turn out, bad if you do. If you have any advantage, why would you hedge against it?

You wouldn’t. As Michael Keppler points out in this paper, many of the greatest investors eschew MPT. Warren Buffet famously laughs off MPT. His teacher, Benjamin Graham, took the view that financial risk is “a loss of value which either is realized through actual sale, or is caused by a significant deterioration in the company’s position – or, more frequently perhaps, is the result of the payment of an excessive price in relation to the intrinsic worth of the security.” In other words risk is the permanent loss of value. The causes of risk are, fear, fecklessness and greed. This is a fairly romantic view of risk, notably from an era with fewer and less complex systems.

Still, it’s better than the CAPM alchemy that equates risk with volatility. Keppler goes on to point out another definition of risk, one based on liquidity. Robert Jeffery acknowledges that some circumstances may force you to permanently realize paper losses. He defines risk as “the probability not to have enough cash to make necessary payments.” This strikes me as a nice balance between the excessively rational MPT and the romantic view that risk is wholly about character. Risk is not only the idea, as we’ve stated before, that “more things can happen than will,” but also the degrees of freedom one has when put into a difficult situation.

Share The Refractor

Risk Developments

Sure, Insurance

Let’s start with some insurance news. Aon plc and Willis Towers Watson’s seemingly perpetual merger talks moved one step closer by bringing in yet a third mega insurance broker, Gallagher. Aon and Willis, number two and three by revenue would sell off $3.57B in assets, including Willis’ reinsurance brokerage arm, to Arthur J. Gallagher and Co. This effort to appease European regulators would make the combined Aon and Willis bigger, but not number one, the spot currently held by Marsh.

The other big insurance news is all cyber. The Paris based insurance conglomerate AXA, will stop covering ransomware for cyber policies in France. This decision has two advantages for AXA, first, it will not have to pay ransoms (obviously) and second, because cyber criminal organizations often do significant research on their targets, it will make AXA insured businesses less desirable targets. Of course, they will also potentially lose a lot of business, because ransomware has recently become the type of cyber loss with the highest median cost.

Insurers that are staying in the market are doing so at a dear price, with a 35% increase in premiums this year. While this volatility may be an unwelcome surprise for customers, it is a sign that the market is maturing. 

Colonial

One ransomware event we have to talk about is the Colonial Pipeline incident. For those asleep for the last week, Colonial Pipeline’s IT systems (not the actual pipeline) were being held hostage by the ransomware gang known as DarkSide. After shutting down the company, that provides half of the automobile fuel to the East Coast of the United States, DarkSide apologized, worried that they had gone too far and possibly raised the ire of the United States Government, which was threatening to their own government backers, Russia.

Let’s get into the details, shall we? The attackers requested $5M payable in cryptocurrency for the decryption key. 100GB of data were exfiltrated to U.S. based servers on their way to Russia. Private and public sector cooperation stopped some of that data exfiltration part way. There are at least 24 other affected companies suffering from DarkSide’s ransomware attacks. This is because DarkSide is not a single entity, but a franchise model.

These distributed cells are called affiliates and they subscribe to Ransomware as a Service. In return for the software they share 10-25% of their ransoms with the software developer. For an in depth write up with detailed code analysis, check out this FireEye post. The interesting thing about this model is that the revenue share drops significantly at $5M, precisely the amount that was demanded. This, and the apology, demonstrates that the attackers are reasonably rational economic actors.

The response, however, may not have been quite as rational. Conflicting reports differ on whether or not the ransom was paid. Of course, it is in the company and the U.S. Government’s best interest to claim the ransom was not paid, to prevent free marketing for DarkSide’s affiliate program. The reports that the ransom was paid are painfully true sounding, “Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.”

Cryptocurrency

After the Colonial story we’re going to have to talk about Bitcoin, of course. Although Tesla is pulling back on accepting Bitcoin as payment, other corporates are still excited to get in on the action. Palantir is said to be considering holding Bitcoin on its balance sheet, and you know what, after all the ransomware, it doesn’t seem like too bad of an idea. At least you can hedge against future cybercrime, even if you won’t be able to do much else with the cryptocurrency. Another corporation getting into Bitcoin. The bank has announced plans to offer Bitcoin derivatives to customers, and also to risk its own capital with a new cryptocurrency trading team.

While companies might be excited, regulators are understandably less enthusiastic. After the Colonial Pipeline hack, made possible in part by cryptocurrency, there are other reasons that regulators might not embrace Bitcoin. The SEC is telegraphing its sentiments about the possibility of a Bitcoin ETF and they are not overly positive. In addition, the SEC chairman said cryptocurrency exchanges need direct oversight.

There is lots of volatility in cryptocurrency, but that is not the same as risk. Volatility in an upward direction is something most people are pretty happy about. What regulators should be worried about is the probability of permanent loss. As it stands, cryptocurrencies occupy a legal gray area. They are fundamentally pseudonymous, but inherently traceable. This means DarkSide and its affiliates are all on chain, and tracing those payments, should be possible in theory. Whether or not this is good for corporate treasuries, traders and consumer of financial products is yet to be seen.

Gov and The Last JEDI

Speaking of the government, there’s big news from financial regulation to defense and cyber too. Janet Yellen chose an acting OCC head, who is not any of the five previously reported front runners. Michael Hsu, a veteran of the Federal Reserve under Yellen, is said to be focused on climate change and technological change in the banking sector, which puts him at odds with the dominant bitcoin narrative, although in my long piece on cryptocurrency, I allude to why bitcoin should be thought of as an environmental boon, despite its other drawbacks. 

Meanwhile, a U.S. Senate committee voted to increase domestic tech spending and limit American investment in Chinese technology companies. Concurrently, business groups are trying to roll back the Trump era ban on telecommunications technology imports from China. Will globalization come roaring back, or won’t it? One thing is for sure, the volatility of globalization may be up, but the odds of the permanent loss of globalization are zero.

In two last pieces of government news, the Department of Defense’s hotly contested JEDI contract, won by Microsoft after Oracle claimed it was written too specifically as a hand out to AWS, is in jeopardy. Amazon, has deployed a litigation strategy aimed at defeating the deal, even if they cannot salvage it for themselves.

Lastly, I have to mention the White House Cyber Executive Order. This 8000 word order is 11 sections long, although there are only six meaningful ones: information sharing, modernization, software supply chain, cyber safety review, incident response, detection and remediation (Here are my notes by section). The efforts at information sharing and modernization are filled with buzzwords about zero trust and machine readable information sharing, which are not bad ideas, but it’s still hard to pin down what they mean. The most significant section is the supply chain, and a welcome addition. Also helpful is the Cyber Safety Review Board. Incident response, detection and remediation seem like table stakes, but it’s good that they are there. Not sure how many agencies are held up by the lack of directives not lack of budget, but it’s good that it’s there, nonetheless.

Subscribe now

He had dreamed that the whole world was doomed to fall victim to some terrible, as yet unknown and unseen pestilence spreading to Europe from the depths of Asia.

- Fyodor Dostoevsky, Crime and Punishment

Risk Developments this letter:

• GovCoin

• Cyber Coping

• Chips

• Guns Versus Butter

Transcending Risk

Did Fyodor Dostoevsky predict the global pandemic 155 years ago? In the final pages of “Crime and Punishment” Raskolnikov has a frightful dream of a global pandemic. This dream mirrors another feverish dream Raskolnikov has at the beginning of the novel. In the first dream he envisions a horrific scene in which a weak and helpless horse cannot pull a fully loaded cart. The horse’s furious owner takes it out on the horse, beating it to death. These two arresting visions highlight important ideas about imagination, volition and chance in risk.

Let’s begin with the importance of dreams and imagination. In contrast to the utopian rational idealism of Raskolnikov, his actual dreams are all nightmares. We’ve spoken before about the importance of the subconscious and its key like properties. As a literary device, a dream is an opportunity to speak directly to the reader; to unlock a door in the fourth wall. Dreams are where we develop ideas. They are the perception of that which our physical and rational selves cannot yet conceptualize. This means they can both offer warning and hope. Before every theory, there is a dream. It may be to found a company that changes the world, or to create a risk free asset, or to architect an impenetrable network. Raskolnikov’s first dream hints at his great hope, by placing himself in the scene as a child. The young Raskolnikov objects to the treatment of the horse, trying to intercede.

"Finish her off," shouted Mikolka and he leapt beside himself, out of the cart. Several young men, also flushed with drink, seized anything they could come across—whips, sticks, poles, and ran to the dying mare. Mikolka stood on one side and began dealing random blows with the crowbar. The mare stretched out her head, drew a long breath and died. 

"You butchered her," someone shouted in the crowd. 

"Why wouldn't she gallop then?" 

"My property!" shouted Mikolka, with bloodshot eyes, brandishing the bar in his hands. He stood as though regretting that he had nothing more to beat. 

"No mistake about it, you are not a Christian," many voices were shouting in the crowd.

But the poor boy, beside himself, made his way, screaming, through the crowd to the sorrel nag, put his arms round her bleeding dead head and kissed it, kissed the eyes and kissed the lips.... Then he jumped up and flew in a frenzy with his little fists out at Mikolka. At that instant his father, who had been running after him, snatched him up and carried him out of the crowd. 

"Come along, come! Let us go home," he said to him. 

"Father! Why did they... kill... the poor horse!" he sobbed, but his voice broke and the words came in shrieks from his panting chest. 

"They are drunk.... They are brutal... it's not our business!" said his father. He put his arms round his father but he felt choked, choked. He tried to draw a breath, to cry out—and woke up.

He waked up, gasping for breath, his hair soaked with perspiration, and stood up in terror.

This is the process of radicalization. It is injustice that turns the innocent child with romantic beliefs into a cynic who thinks, “if such evil people can do bad things in the name of spite, then why can’t a good person do bad things in the name of justice?” Anytime individuals must struggle against a corrupt system (which is always) there is great temptation to employ the tactics of cynicism back at the system. It is the logic of the bad actor, of the nihilist, the terrorist and the insider threat. Notice that this act of rational will presages the arc of the book, turning Raskolnikov eventually into a murderer.

By the end of the book the arc is completed. Without spoiling the climax, we can discuss Raskolnikov’s second dream in the epilogue, which finds him seeking redemption, having seen the results of both rational will and of chance. The pandemic he describes in the dream is as much a metaphor as it is a literal warning. This is because disease is intrinsically understood by all people and the language of epidemics makes itself felt throughout risk disciplines. Fields as diverse as insurance, cybersecurity, banking, investing and intelligence, all borrow terms from epidemiology like “sanitize,” “contagion,” “virus,” and “exposure.” To address this dream, let us take it in three parts.

He dreamt that the whole world was condemned to a terrible new strange plague that had come to Europe from the depths of Asia. All were to be destroyed except a very few chosen. Some new sorts of microbes were attacking bodies of men, but these microbes were endowed with intelligence and will. Men attacked by them became at once mad and furious. But never had men considered themselves so intellectual and so completely in possession of thetruth as these sufferers, never had they considered their decisions, their scientific conclusions, their moral convictions so infallible.”

This first section echos the first dream, but on a global scale. The virus of extreme rationalism has taken hold across the world and subsumed all universal notions of truth and value. This is the moment when people believe in the Value at Risk models more than their own beliefs. It is the belief that an empty incident registry is an indication of no risk, not an indication of poor risk management. Risk professional Tony Martin-Vegue put it well in a recent article on decision making support, “If [choice, preference, or information] are missing, there is no decision to be made and, by extension, a risk assessment will be an exercise in frustration that will not yield valuable results.” Understanding the limits of rationality is a prerequisite for rationality. As the dream progresses we can see how this plays out.

Whole villages, whole towns  and peoples went mad from the infection. All were excited and did not understand one another. Each thought that he alone had the truth and was wretched looking at the others, beat himself on the breast, wept and wrung his hands. They did not know how to judge and could not agree what to consider evil and what good; they did not know whom to blame, who to justify. Men killed each other in a sort of senseless spite. They gathered together in armies against one another, but even on the march the armies would be broken and the soldiers would fall on each other, stabbing and cutting, biting and devouring each other. The alarm bell was ringing all day long in the towns; men rushed together, but why they were summoned and who was summoning them no one knew. The most ordinary trades were abandoned. 

Here we see the complete breakdown of order and inability to achieve collective accomplishments. Without understanding and judgement, that come not from a monopoly on truth, but from humility and submission to a cause greater than one’s self, society loses all accountability. Without accountability, warning systems serve no purpose. If you’ve ever seen a risk management system that provides more alerts than can be acted upon you know what Dostoevsky means. Lastly, it is significant that fundamental skills are tossed aside. The pursuit of a craft is not purely an economic rationalisation, but a belief that one’s efforts, however mundane they might be, contribute to society. The final part of the dream results in complete chaos.

Men met in groups, agreed on something, swore to keep together, but at once began on something quite different from what they had proposed. They accused one another, fought and killed each other. There were conflagrations and famine. All men and all things were involved in destruction. The plague spread and moved further and further...”

Supply chains break down. Companies can’t get anything done. Civic institutions fall into disarray and governments fail. This is the extreme endpoint of rational self interest. When risk is viewed from a completely probabilistic perspective, there is little point in deterministic action, and in a world of complexity, it is difficult to differentiate between the breakdown of collective efforts and random bad outcomes. An individual has such little control that even their own deterministic efforts are likely in vain.

This brings us back to the issue of volition and chance. Throughout the novel there are many examples of luck playing a part. Raskolnikov, waking from the first dream in a sweat, swears off his plans to murder the pawn broker, but he happens to overhear a conversation in which he learns that the broker’s younger sister and roommate will be out of the apartment, offering him the perfect window of opportunity to commit the crime. When his poor planning has left him without a murder weapon, he chances upon an axe stored away under a bench with some firewood. Again it is luck that allows him to slip away from the scene of the crime unnoticed as he ducks into an empty apartment while suspicious neighbors run up and down the stairs. In the most improbable stroke of luck, just when he suspects that the police have figured it out, a religious fanatic turns himself in, taking credit for the crime Raskolnikov committed, in an act of desperate self castigation.

By contrast, all of the good acts, mostly done by Dunya Raskolnikov, Dmitry Razumíkhin and Sonya Marmeládova (mentioned in Rational Risk, Part II) are acts of will. How can this be the case, if rational will leads to nihilism and global madness? The important difference is that the good characters are not rational. That is not to say they are irrational. The opposite of rational thought is not irrational thought (an oxymoron), but faith. Dunya serves her family and is prepared to settle for a less than ideal marriage for the financial well being of her brother and mother. Dmitry hopes to start a publishing company, not because he believes himself the arbiter of what is fit to be published, but because as a student and intellectual, he knows what people want to read. Sonya, the ultimate model of self-sacrifice devotes herself to Raskolnikov because she believes in redemption.

A year ago in the New Yorker, David Denby ended his piece on the rereading of “Crime and Punishment” by saying, “We would not lose our individuality, like the poor murderer in his exile. But neither could we escape responsibility for the mess we had made, a mess we had bequeathed to the students, and to all of the next generation.” This echos Camus dire warning to struggle on, as we discussed last week. The pessimistic and regretful tone also calls to mind Girard’s expert dissection of Dostoevsky’s texts, correctly identifying the link between romantic liberalism and nihilism.

Camus connects this idea directly to history by comparing Dmitry Pisarev to Raskolnikov. Lenin was so influenced by Pisarev he quotes him in “What is to be Done?” writing, “My dream may run ahead of the natural march of events or may fly off at a tangent in a direction in which no natural march of events will ever proceed. In the first case my dream will not cause any harm; it may even support and augment the energy of the working men....” Camus then writes, “Pisarev declares war on philosophy, on art, which he considers absurd, on erroneous ethics, on religion, and even on customs and on good manners. He constructs a theory of intellectual terrorism which makes one think of the present-day surrealists. Provocation is made into a doctrine, but on a level of which Raskolnikov provides the perfect example.” Camus observes that the self destructive romantic liberalism we observe in the novel manifests in history just after Dostoevsky died.

What, then does Jünger add to the conversation? His contribution is to guide the dissatisfied and disaffected back towards action, but not through rational self interest.

“Giving this man an inkling of what has been taken from him, even in the best possible present circumstances, and of what immense power still rests within him—this is the theological task. A true theologian is someone who understands the science of abundance, which transcends mere economy… someone who knows—and a knower in this sense is the little prostitute Sonya, who discovers the treasure of being in Raskolnikov and knows how to raise it to the light for him. The reader senses these gifts have been brought to the surface not for life alone but also for transcendence.”

This transcendent action can rise above rationalism and dismiss the cruel vicissitudes of chance. Duty, faith and calling, these are the motivations that sustain and elevate society. Isn’t that what technology, business and geopolitics are really about? Not just managing risks, but transcending them?

Share

Risk Developments

GovCoin

The Cryptocurrency markets have been on an incredible tear that has attracted a lot of attention. It was just a matter of time before the government got involved, as Tyler Cowen makes clear in this excellent interview by Lex Fridman. Just a few short weeks later and it looks like his prediction is coming true. The U.S. Department of Justice has formed a task force to investigate the role of cryptocurrencies in ransomware, which could lead to serious regulation.

The DoJ isn’t the only government body looking at cryptocurrencies, either. The IRS is seeking authorization to summon users of the cryptocurrency exchange Kraken, who may have outstanding tax obligations. Meanwhile, the Chinese government is pushing ahead with its digital currency plans. To which Fed Chairman, Jerome Powell, said, “not... here. [Not] in real time.” It is interesting that he both rejects the notion of a central bank digital currency, with full observability for government, being popular in the U.S. and at the same time insinuates that the U.S. government can in fact fully observe payment flows, just with some friction.

This may be the end of unbridaled cryptocurrency utopianism, but the end of that kind of romanticism isn’t necessarily bad. Now we will see whether the faith in cryptocurrencies can sustain the enthusiasm of the early period without collapsing into a cynical tool for surveillance.

Cyber Coping

The spate of ransomware that provoked the DoJ, mentioned above has impacted corporates, governments and insurance companies. Bank of America CTO noticed a dramatic growth in the pace and rates of attacks this past year, and cyber threat intelligence firm Flashpoint uncovered an Iranian ransomware operation. This raises the question, how are insurance companies coping? 

According to a Managing Director at one insurance brokerage, there are a broad range of answers from co-insurance to sub-limits on ransomware, to higher retentions and even some value-added services (although discussion of what and how those services work was pretty thin. Still, in a market that has broadly been converging on prices and coverage, it’s good to see a bit more diversity. Insurance often follows cycles. The best time to be selling catastrophe insurance is after the last 100 year storm. Of course, cybercrime is a manmade peril, so it is yet to be seen whether anyone can transcend this epidemic of ransomware by shifting the equilibrium. Raising rates and cutting coverage is zero sum, but value added services could raise a hidden treasure to the light.

Chips

More news on the semiconductor fabrication front. Samsung and Intel, numbers two and a distant three, respectively, in the semiconductor manufacturing industry are teaming up on a new microarchitecture. Meanwhile, the EU is exploring setting up their own Alliance between the four major European semiconductor firms. This would potentially provide a counter balance a potential megafab being funded by foreign capital. Intel is not shying away from that potential opportunity, asking for $8B in public funding, and as the only one of the three major semiconductor companies it looks like they have some leverage.

Guns Verses Butter

In the aerospace industry some firms (General Dynamics) had a really good quarter, and some firms (Boeing and GE) had really bad quarters. This is in part due to the dependence of Boeing and GE on the commercial sector, while General Dynamics provides its planes to the military. Despite travel beginning to bounce back, the economic consequences of the pandemic have not been completely ameliorated. 

There is however a bright spot for Boeing. Its diversified customer base includes many countries besides just the U.S. government, including the government of India. The U.S. State Department has given the go-ahead to a deal to sell six P8 Poseiden planes used for signals intelligence gathering to the Indian Navy. As tensions mount with China Boeing will have the opportunity to sell much more to U.S. allies in Asia. On the other hand, India slashed its order by 25%, in part due to their ongoing economic issues, only worsened by the challenge of the pandemic.

Lastly, another competitor, Northro Grumman won a $959M defense contract to develop countermeasures for heat seeking anti-aircraft missiles. After all, with each F-35 costing somewhere between $77.9M and $117M you wouldn’t want to lose one. I’ve been thinking a lot about Peter Thiel’s comment that when you have a growing defense budget there is more room for innovation because in a flat or shrinking budget, all the money is spoken for by vested interests. 

The “science of abundance which transcends mere economy” calls to mind this guns versus butter problem. Did the U.S. defeat the U.S.S.R. because it outspent them on military or because its standard of living was higher? Or was it both, or neither? It is possible the U.S.S.R. collapsed under its own weight and it is also possible that abundance somehow is not the result of ability to spend on guns and butter simultaneously, but the cause of it. That,  as Jünger says, may be a theological problem.

Share The Refractor

Gratitude

Big thanks to Jeremiah Grossman, Tyler Cowen, Lex Fridman, David Denby, Tony Martin-Vegue and many others for sharing your ideas! 

I wanted to become a Napoleon, that is why I killed her...

- Rodion Raskolnikov, in Crime and Punishment by Fyodor Dostoevsky

Risk Developments this letter:

• Crypto Crime

• Swiss Risk

• Cyber Landscape

• Cyber PE

• Rockets, Missiles

• Satellites and Space

Material Risk, Metaphysical Risk

Last week’s discussion of “Crime and Punishment” ended by recounting the third grisly death described by Dostoevsky in the early part of the novel. The alcoholic, failed civil servant and negligent father, Semyon Marmeladov, had been run over by a carriage and trampled by a horse. Comparing this to Rodion Raskolnikov’s murder of the old pawn broker presents an opportunity to investigate the role of chance and will in risk.

Following the action packed first two parts of the novel, the next three parts are intensely social and metaphysical. Rodion and the police inspector engage in a game of cat and mouse. Meanwhile Dunya, Rodion’s sister, attempts to escape her desperate situation as governess to the family of Arkady Svidrigailov, a depraved sensualist, by marrying Pyotr Luzhin, a deceitful and power hungry lawyer. Again, Dostoevsky instructs us in the temperament of these characters through their names. Dunya (short for Avdotya) means good judgement. Arkady is a reference to Pan, the Arcadian god of of wild sexual depravity and the hunt. Pyotr Luzhin recalls both Peter the Great and the Luzha River, where Napoleon met his downfall. 

The phantom of Napoleon looms over “Crime and Punishment” ( he is mentioned 16 times), just as it did over Russia during Dostoevsky’s lifetime. Rodion compares himself to Napoleon throughout and has many clashes with Luzhin. The penultimate fight takes place in front of Dunya, who decides she cannot marry such a cruel and angry man as Luzhin. Rodion’s symbolic victory is short lived as, like Napoleon retreating from Moscow, he abruptly announces to his mother, sister and friend, Dmitry Razumhin, that he must leave and may never see them again.

The final battle between Luzhin and Rodion takes place at the funeral banquet of Semyon Marmeladov. Semyon’s wife, hysterical and haughty, has spent the only money they have on the banquet in an attempt to demonstrate her status, but when the poor and ill mannered guests show up to eat free food and get drunk, she throws a tantrum. At the height of her apoplexy, Luzhin enters the scene to frame Sonya, Semyon’s pious and virtuous daughter, for stealing from him, only to be undermined by Luzhin’s socialist roommate who observed the whole setup.

By this point Dostoevsky has pushed all his chips into the center of the table, and the only thing left is to flip over the remaining cards. The only two unresolved issues are:

• Will Svidrigailov succeed in conquering Dunya?

• Will Rodion’s will give out under constant assault by his conscience?

Girard’s card playing metaphor we discussed in part one is apt, not only because Dostoevsky was a degenerate gambler, but because it is the same metaphor used by the famous sociologist Erving Goffman, which I wrote about at length here. The significance of gambling in our modern age has only compounded since Dostoevsky’s time. Wallstreet Bets,  cryptocurrency, land speculation, alltime high startup funding, even Russian incursions into Ukraine and Chinese tactics in Hong Kong are forms of action in the Goffmanian sense. Goffman refers to risk taking as the presentation of self for the demonstration of strong character traits such as courage, gameness, integrity and composure.

This view of risk stands in contrast to the rational view, that is, Elroy Dimson’s definition of risk as “more things can happen than will” or famed economist Gary Becker’s view of the criminal. In Becker’s famous paper, “Crime and Punishment: An Economic Approach,” he posits a rational actor who calculates the probability of being caught, weighted by the penalty they would face, against the size of the score. He concludes that, since it is cheaper for states to increase punishment than to increase the efficacy of law enforcement, one way to reduce crime is to up the penalty. This theory drew popular support and became known politically as being “tough on crime.” Deterrence, however, has been shown to be fairly ineffective both at the local and international levels. The flip side of this theory is to increase the upside for pro-social risk taking. Larger payouts for entrepreneurs, aligning executive pay with shareholder interests through use of options, stronger IP protections for novel technologies and a slew of other incentives likewise became popular in public policy.

This romantic view of risk, a throwback to gallant knights or cowboy heroes, is a failure to understand the psychology of risk. Just compare the popularity of quintessentially romantic risk takers, Luke Skywalker and Superman to their anti-hero counterparts, Han Solo and Batman. While rationality opens the space for utopian romanticism by dethroning old hierarchies, as in the French Revolution, it ultimately turns on itself leading to unbridaled cynicism or nihilism. Rodion, has discarded sacred rules in favor of rationality, but worship of rationality is worse than worship of the sacred. Without the moral underpinning, the only choice is between the immorality of Luzhin and the amorality of Svidrigailov. Rodion’s desire to be Napoleonic is the ultimate sign of modernity that culminated in the calamities of Communism and Fascism.

Today we are faced with a new challenge, not yet described by “Crime and Punishment.” The post-modern world, arriving after the fall of Communism, shares many similarities with romantic rationalism, it is a period of innovation worship and mythologizing of risk takers, but it is insincere, because we are constantly taught about the corruption of utopian schemes in history, in the unrelenting news cycles and the cannibalistic environment of social media, which consumes our modern heroes just as they are elevated to Napoleonic status.

The Napoleons of today are anti-heroes, brash entrepreneurs and autocratic strongmen. The nihilist phenomenon is even apparent in technology as the worship of artificial intelligence takes primacy in our tech narratives. Liberal open societies struggle in the AI arms race against omniscient authoritarian regimes who have the decided advantage in data gathering and surveillance with which to train their models. The proposed foil to AI, cryptocurrency is antithetical to the state and the refrain used to justify its value, that “something has value because people believe it has value,” is just as rationally irrational as the belief that it is ok to do whatever makes you happy because it makes you happy. Again, we are trapped between Luzhin’s immorality and Svidrigailov’s amorality.

Doestoevsky had first hand experience with this conundrum. His early works, sympathetic to socialist utopianism, spoke out against the oppression of the lower classes. He was sent to Siberia for reading aloud a scathing critique of Gogol’s support for traditional heirarchies against the socialist utopian cause. When he returned, he was a changed man. Personally he remained addicted to his vices, but intellectually he was opposed to both amoral hedonism and extreme rationalism. Likewise, those engaged in risk taking, whether in finance, technology or diplomatic affairs, must avoid the temptations to dance while the music is playing or attempt to rationally engineer out all risk.

How this is to be achieved is not exactly clear, but Doestevsky proposes some hints in the last two parts of his novel and his next few works. Mindfulness (Dmitry Razumhin), wisdom (Sofya Marmeladov) and devotion (Dunya Raskolnikov), are the antidote to the extremes of fetishizing rationality and giving up all hope. Goffman’s work is also instructive here. Fateful action, that is, problematic (i.e. soon to be resolved) and consequential (i.e. with a payoff that exceeds the bounds of a specific game) risk taking, is best approached as what Goffman calls a “practical gamble.” The ability to categorize, identify and endure are the hallmark of great risk takers. Mindfulness, wisdom and devotion, or in Goffman’s terms, care, providence and defense are the guardrails on the narrow path between cynicism and nihilism.

As promised in part one, we will turn back to Albert Camus, and in part three address Jünger, who completes “Crime and Punishment” by providing a coda to the movement Dostoevsky left unfinished. Camus, who died at the peak of his intellectual achievements proposes this synthesis in “The Rebel”:

But historical absolutism, despite its triumphs, has never ceased to come into collision with an irrepressible demand of human nature, of which the Mediterranean, where intelligence is intimately related to the blinding light of the sun, guards the secret. Rebellious thought, that of the commune or of revolutionary trade-unionism, has not ceased to deny this demand in the presence of bourgeois nihilism as well as of Caesarian socialism. Authoritarian thought, by means of three wars and thanks to the physical destruction of a revolutionary elite, has succeeded in submerging this libertarian tradition. But this barren victory is only provisional; the battle still continues. 

Share The Refractor

Risk Developments

Crypto Crime

Bitcoin mixing has long been the solution to the non-repudiation feature inherent in the blockchain. While bitcoin derives much of its promise from its anonymity, its solution to the double spending problem relies on the incorruptibility of its public ledger. This poses a problem for those who wish to use bitcoin to avoid capital controls or other illegal activities. Governments may not be able to directly identify a wallet’s owner through signals intelligence alone, but paired with human intelligence they can trace the transfer of bitcoin from a deanonymized source. This means that deanonymizing just one node in a series of transactions can unravel the anonymity of anybody in the chain.

This appears to be what happened in the recent $336M bust of a bitcoin mixing magnate. While this tactic is similar to the approach used in the takedown of Silk Road and its owner, the Dread Pirate Roberts (A.K.A. Ross Ulbricht), it is to my knowledge the first time a government has successfully taken down a large mixing operation. These operations are honeypots because just using a mixer implies that the user has a good (i.e. criminal) reason to avoid deanonymization.

Swiss Risk

The risk management fallout from the Archegos and Greensill incidents at Credit Suisse have already found one victim and may claim more. Chief Risk Officer, Lara Warner was removed from her post earlier this month amid criticism that she had made the risk function too commercial. It’s a tough job running a cost center in any company and that job is only made tougher by the difficulty of attracting top talent, who shrewdly identify cost center jobs as career dead ends. As Matt Levine pointed out, the job of a Chief Risk Officer is not to avoid all risks, otherwise your competitors will get all the juiciest deals and your firm will develop a reputation as a wet blanket.

On the other hand, you can’t just become a deal facilitation department to justify the career ladder required to attract high achievers. Then you’ll end up ignoring multiple red flags and eventually take down the whole bank. The incentive structure just isn’t built for “practical gambling,” but who designs the incentive structure?

Well, in some sense, that’s what a board of directors is for. Now it appears that the director that chairs the risk committee at Credit Suisse is coming under fire from shareholders, and apparently he’s considering stepping down. On the one hand, he’s the chair of the risk committee, it’s kind of up to him (and the rest of the committee) to oversee the risk management system and, if deemed inadequate, design the proper incentives for reform. On the other hand, risk is just an externality caused by the bank’s profit centers, so it’s not like he can tell the Chief Risk Officer, “your job is to only go after good deals and do none of the bad ones.” The CRO doesn’t get to choose the deals, they just get to say “no” to the ones that seem like the worst. What if traders brought nine super risky deals to the CRO and the tenth on was Archegos? What do you say then?

What would really cause change is if the risk management function also got paid for the deals that they got brought but the bank didn’t do. Of course, you can’t run a cost center paying people to not do stuff. They’ll just say “no” to all the stuff. What would help is keeping track of who brought what deals, building a book of counterfactual trades and looking at them on net. Then when a particularly employee brings a new trade, risk management could get paid for saying, “yeah sure, you’ve had some bad ideas in the past, but we like this one,” or inversely “uh no, you’ve had some good ideas in the past, but we don’t like this one.”

Cyber Landscape

The hacking universe used to be populated by romantics. Early internet pioneers had a utopian vision. The internet was conceived of by government and academic institutions as a portal for the free flow of information, a decidedly free speech position in contrast with the Soviet authoritarian model. Whether or not it was a deliberate attempt to undermine the Soviet Union is unclear and irrelevant, what is clear is that the project aligned with U.S. values and goals. The first acolytes, however, were not gmen (and women), but cyberpunks, ex-hippies and counterculture libertarians. This ethos is encapsulated in the essay The Californian Ideology.

By the mid 1990’s the internet was becoming commercialized. Like other frontiers, early settlers were outsiders who fled to escape established hierarchies, but just like other frontiers, they were followed by opportunists seeking social mobility and economic opportunity. This new citizen of the net didn’t always get along with the ex-hippie types, but for the most part the first wave adopted neoliberal values as described in Two decades of the web: a utopia no longer. Utopias only exist in the imagination, so to some extent this was inevitable, but the pace of this evolution, enabled by the lack of physicality of the internet, meant the exploration phase was shorter lived than for most frontiers.

Two successive waves swept the frontier following commercialization, counter-evolution and corporatization. On the one hand, legacy corporations began to adopt digital strategies to prevent disruption, and on the other, a new class of hackers, criminals and civil rights activists fought to maintain the freedoms and permissionless innovation the frontier had afforded.

Cybersecurity, once a backwater of idealogues and national security professionals, became a big business and since then the budgets have grown at an astonishing compounding rate of growth. Bloomberg is predicting total annual cybersecurity spending will exceed $200B by 2024. If cybersecurity were a country, its annual GDP (a better comparison than market caps) would be 51st out of 192 countries in the world, bigger than Iraq and just shy of Greece.

Although it has taken longer than I expected, the growing prominence of the industry is finally drawing the serious attention of legislator and regulators. U.S. Senator Mark Warner is proposing new reporting requirements and organizations to manage this information akin to the National Transportation Safety Board, which was formed in 1967 in response to the growth of the aeronautics industry. As a public good, cybersecurity is non-rival and non-excludable, so it naturally falls to government to provide it, but the problems are now global in scope and there doesn’t seem to be an international body that is interested or able to provide global security.

Deterrence, as discussed above, isn’t all that effective at preventing crime, and the difficulty of attribution online makes this an even greater issue. While more funding and new regulations are helpful, more of the same is unlikely to provide a solution. Greater mindfulness, new wisdom and steadfast devotion will have to be applied to find alternatives as the tools we have today produce lower marginal returns with each additional dollar and every new piece of regulation.

Cyber PE

The ever increasing cybersecurity costs of doing business are not news to private equity companies, which have insight into the income statements across a whole portfolio companies. Buyout giant KKR has held a stake in cybersecurity training company KnowBe4 since at least 2019. KnowBe4 IPO’d recently at a market cap of $3.5B.

Perennial cybersecurity investor, Thoma Bravo, which has also held stakes in SolarWinds, Venafi, Veracode and more, recently completed the take private of ProofPoint, a cybersecurity firm with a long history that has had products in the spam protection, e-discovery and data loss prevention space.

One feature of the cybersecurity industry is that trust, longevity and scale are all strong competitive moats. Venture capital has been pouring into the industry, and while there are plenty of winners, the market dynamics often put superior point solutions at a distinct disadvantage. Meanwhile, mature firms can reinvent themselves, acquire IP and grow their platform to increase revenue, without a substantial increase in fixed costs. An injection of fresh capital and a new strategy is sometimes all they need to do so.

Rockets and Missiles

Another industry that does well in an arms races is, well... arms. As geopolitical tensions rise in Southeast Asia, defense contractors are winning contracts with the U.S. and Australian Navies for long range anti-ship missiles. More long range projectiles require more sophisticated communications networks to produce and manage information. Both defense and intelligence are upgrading satellite communications platforms as phase two of the SatCom rollout begins.

Napoleon, the first military commander to fully embrace projectile warfare, trained as an artillery commander and was also an expert intelligence gatherer and propagandist. When waging long range war, it’s important to have a mental model because you can’t always see your target. Removed warfighting naturally leads to the acknowledgement of propaganda primacy. It’s good to win battles without risking an infantry or cavalry charge, but it’s best to win them without physical expense at all.

Satellites and Space

Maintaining an informational edge, however, is not as cheap as it used to be. Low-latency and redundancy can be a tactical advantage in war, but there are also spillover benefits in civilian technology. Low earth orbit (LEO) satellites provide both faster uplink times and are cheaper to launch. Now these benefits are coming to satellite internet consumers as the FCC approved Starlink’s low orbit satellites.

Finally, another type of space is opening up, 175 million long dormant IP addresses owned by the Pentagon suddenly sprung to life this year, and nobody knew why. The mystery hasn’t exactly been solved, but the DoD answered some questions, including providing a rationale. In an effort to prevent unauthorized use of the IP space the Department claimed it had handed over the addresses to be managed by a previously unheard of company.

Subscribe now

Gratitude

Big thanks to Stephen Lyng, Matt Levine, Doug Madory and many others for sharing your ideas that helped me write this piece!

“When reason fails, the devil helps!” he thought with a strange grin.

- Fyodor Dostoevsky

Risk Developments this letter:

• MasterIdentity

• Optionally Unmanned Intel

• Chip Shortage

• Ransom Notes

• DevOops

Inaction In Action

On a bitingly cold day in December 22,1849, on Semyonovsky Square in St. Petersburg, Russia, a collection of authors, soldiers, translators and civil servants were sentenced to death for involvement in discussing, reading and distributing a letter from literary critic Vissarion Belinsky to author Nikolai Gogol. The first three, of sixty men, were tied to stakes in the square opposite the firing squad. The executioners raised their guns, aimed them at the doomed men and held them there for a full minute.

Next in line for execution was Fyodor Dostoevsky, who by that time was already the critically acclaimed author of “Poor Folk” and “The Double.” He had spent months in prison for his role reading the letter at gatherings and potentially planning to set up a publisher to distribute it. Why was a simple letter deemed such a threat to the state? In the letter Belinsky rebukes Gogol for harboring slavophile, christian and autocratic views, despite the widespread impression that Gogol’s critique of Russian social and political ills made him favor socialism and Western revolutionary ideals.

After waiting an agonizing sixty seconds, teetering on the brink of death, a drum roll sounded, signalling military retreat, and the executioners lowered their weapons. A representative of the Tsar announced that their sentences had been commuted and instead of death, they were to be exiled to Siberia where they would serve a sentence of hard labor. Following his time in the labor camps, Dostoevsky served in the military in Siberia, where he married his first wife. Upon being granted permission to return to European Russia, he fell deep into debts from his gambling addiction, had an affair with a cruel and haughty woman and outlived both his wife and his brother. In desperate need of financial, metaphysical and romantic recovery Dostoevsky wrote “Crime and Punishment”.

It was a smash success, attracting more than 500 new subscribers to the periodical it was published in and furthermore, led to Dostoevsky’s own recovery and falling in love. Why was “Crime and Punishment” at turning point for Dostoevsky, for Russia and for world literature and philosophy? What does this story have to say about risk, innovation and modernity? We will come back to these questions in future letters of The Refractor, but for now we will discuss the structure of the novel (minimal spoilers) and how it is situated in history.

“Crime and Punishment” is laid out in seven parts, two of which we’ll cover today, with seven main characters. In part one we meet the protagonist, Rodion Raskolnikov, a law school drop-out, working on a rationalist theory. His theory said that exceptionally strong and intelligent individuals have not only the right, but the obligation to commit moral and legal transgressions. Here it is helpful to know a bit about the Russian language and history. Rodion is a Russian name derived from Greek, roughly meaning hero or song of a hero, and he’s not the first Hiro we’ve discussed here. Raskolnikov comes from the Russian word for schism, and refers to the 17th century break in the Eastern Orthodox Church between the reactionary reformers and the old believers (raskolniks). 

Following Rodion, we learn he plans to test his theory by murdering an old pawn broker, and on the way back from scoping out her apartment building, paralyzed by the inner conflict between his extreme rationalism and lack of will, he stops by a tavern for a drink. Inside he meets a drunk, Semyon Marmeladov, who continually impoverished his family with his drinking, to the point of forcing his daughter Sonya into prositution. Later we learn of Rodion’s own family drama, as his mother (a widow) has spent everything they had to put Rodion into law school, and is now forced to marry off his sister, Dunya, who has been working as a governess for a creepy old married man. Outraged at his sister’s sacrifice, his own inadequacy and the injustice of the world, he summons the will to commit murder, but in such an agitated state, he makes many mistakes while attempting the crime. After gaining access to the apartment, he kills the old lady with an axe, but forgets to lock the door, and while pilfering the pawned items, the old lady’s mentally handicapped half-sister walks in. Rodion, in a fit of uncertainty, kills her too and flees the scene haphazardly, almost getting caught as he runs down the stairs and out of the apartment complex. With a mounting illness and in a feverish pique, he returns home and clumsily covers his tracks before falling asleep.

The next day, Rodion is summoned to the police station by his landlord for unpaid debts, where he overhears discussion of the murder and faints. Having aroused suspicions, he leaves and, on a whim, visits his old university friend Dmitry Razumikhin (whose name roughly translates to “Mindful Demeter devotee”). After several days of delirium, Rodion wakes to a conversation between the doctor and Dmitry about the news of the muder case. Dunya’s fiancee interrupts the conversation and Rodion intentionally offends him and then kicks everybody out. He then sneaks out himself to revisit the scene of the crime and further draw attention to himself. As he wanders the streets pondering a confession, Rodion encounters a scene. The drunk from the tavern Semyon Marmeladov was run over by a carriage, and Rodion, taking Semyon in his arms comforts him as he dies and asks for forgiveness from his daughter Sonya.

There are still five parts of the novel left, but most of the action has already happened by this point, and the title itself almost tells you how things will play out. While we are discussing the implications of language here, it is also worth mentioning that words “crime” and “punishment” are rendered, in English, from different, Latin roots than their Russian equivalents. The slavic roots of “crime” and “punishment” are to “over step” and to “tell upon” respectively. That gives the title a flavor more like “Transgression and Made an Example of.” Not as succinct, but more direct in its instruction.

Returning to the big questions above, about risk, innovation and modernity, we can already see the answers taking form. One big reason to read Dostoevsky, and “Crime and Punishment” in particular, is how frequently it is mentioned by other great writers. Both Albert Camus and Ernst Jünger cite the novel specifically (more on this later), and Rene Girard compulsively mentions Dostoevsky. In “Deceit, Desire and The Novel” he compares Proust and Dostoevsky:

The reader is ·supposed to recollect; it is not the author who does the remembering for him, as in Proust. The de­velopment of the novel can be compared to a game of cards. In Proust the game proceeds slowly; the novelist constantly interrupts the players to remind them of pre­vious hands and to anticipate those to come. In Dostoyev­sky, on the contrary, the cards are laid down very rapidly and the novelist lets the game proceed from beginning to end without interfering. The reader must be able to remember everything himself. (246)

Already we can begin to make out the implications. “Crime and Punishment” is a study in the extremes of rationality and the limits to scientific thought. It is this same psychological hubris that created “risk free” collateralized debt obligations and brought down the financial system in 2008. The sick innovation of a theory of rationism that permits murder is the equivalent to technology that can be used to dehumanize and destroy lives. The Kafkaesque bureaucracy (written two decades before Kafka was born), crushing student debt, strict system of social rank, urban-rural divide, information technology advancement (lithography) and ideological rebellious atmosphere all feel very modern. In the next two letters, we will discuss the five remaining parts of the novel and what we can learn about business, technology and geopolitical risk.

Subscribe now

Risk Developments

MasterIdentity

MasterCard is acquiring digital identity firm Ekata for $850M. Ekata is not your traditional startup, but one that was spun out of WhitePages.com, a dotcom era startup founded as a side hustle. WhitePages was built by scraping phone numbers and selling ads against a searchable database. Often a new institution is built on a founding murder. Scraping unlimited business data you license for $5000 a month and selling ads against it isn’t exactly murder, but it’s at least a stab in the back. Still, it wasn’t always easy for WhitePages. When institutions are built on an original sin, sometimes a second founding murder occurs. When WhitePages’ two biggest customers cut their spending by two thirds, the founder mortgaged his home to buy out his investors and rebuilt the business model around fraud prevention.

With a trove of personal data, WhitePages could offer identity verification services to enterprises concerned about fraud. By using the mobile phone numbers they had collected as universal unique identifiers (UUIDs), they could sell a fraud prevention product that turned out to be a much more sustainable business than advertising. Eventually the business was split into two (actually three) parts, consumer identity verification (and caller ID) and enterprise identity verification. Now MasterCard is buying the enterprise identity verification business called Ekata. Its customers include big names such as Stripe, AliPay, Microsoft and AirBnB. 

It seems like a good outcome for the founder, who made a gutsy call and took a big risk, but  what about for Ekata and MasterCard? Ekata was already facing mounting lawsuits as data privacy laws increase, and their pivot away from an ads based model was a step away from sharing everybody and anybody’s personally identifiable information (PII) for free, but selling PII is only marginally better than selling ads. Being in the business of giving identities green or red lights is better yet, and as it turns out quite valuable. Now we’ll get to see whether it’s more valuable as an internal asset for MasterCard or as a stand alone business.

Optionally Unmanned Intel

BAE systems and General Dynamics have both submitted designs for the U.S. Army’s M2 Bradley tank replacement, a optionally manned fighting vehicle (OMFV), a $4.6B program over the next six years. Not all of that will go to defense contractors, but it’s still a pretty significant investment, and perhaps even more significant is the wide net the Army is casting when it comes to ideas for the optionally manned vehicles. One issue with innovation in the defense space is that legacy costs and coalitions eat up a big share of the budget, so innovation can really only be made with the marginal dollar added to the budget. With $2.32 billion (over the next 20 years) being awarded to Northrup Grumman for minuteman missile maintenance recently and $13.3 last fall on a system to replace the aging nuclear missiles, other defense spending on risky new ideas might not get as much support.

Still, defense budgets are up substantially and the OMFV numbers are pretty big, especially for the concept stage. Unmanned, if not autonomous, weaponized vehicles, are an exciting advancement, but also potentially terrifying. Thinking through the implications of a war without boots on the grounds seems both utopian and dystopian at the same time. The recent Armenian-Azerbaijani conflict may be the closest we have to a case study in unmanned warfare. One must be careful not to apply an overly rational lens to such a war, imagining a return to pitched battles between drones.

One good reason not to be overly optimistic is the importance of an integrated attack and the use of the information space. Not only did Azerbaijan control the skies with drones, but they effectively coordinated attacks using legacy hardware and managed to fend off information warfare attempts by Armenia. While Armenia was clearly unprepared for kinetic action, the information response blunted the damage, and the real winner was their historical ally, Russia, who positioned peace keeping forces and claimed a diplomatic victory.

Turning back to autonomous vehicles, maybe the real story is in the information space. Just a few days after news broke that BAE had submitted its design, Twitter users began to piece things together, summarized in the article here. Between cheap open source intelligence and the the equalizing effect of information warface, those legacy defense budgets may not prove as big an advantage as some hope. It’s almost just as Rodion experienced, the physical violence is the easy part, but getting away with it is harder.

Chip Shortage

The chip shortage continues to play out in slow motion, and in a way it feels like a (much less awful) repeat of watching the pandemic unfold in slow motion. So far the financial impact on  big tech has been minimal, in part due to the priority chip manufacturers place on their best customers. In operations class in business school you learn about the bullwhip effect, the phenomenon where imperfect forecasting along long supply chains results in systematically over and undershooting. This is a consequence of complexity, where each stage assembles a product that requires inputs that they have to accurately forecast as well, compounding forecasting errors.

When protective equipment was scarce in the early stages of the pandemic, there was a brief panic followed by a pretty strong response by the market. Unfortunately for the semiconductor industry, chip manufacturing is among the most complex human endeavors ever attempted, making both the number of dependencies high and the number of firms that can bring a product to market low. All of this has resulted in only marginally increasing output, despite some rather impressive efforts.

One lesson here is that in a complex enough domain, process knowledge, institutional inertia and know-how can be an effective moat, even if rationally it may appear that any smart and well funded competitor could enter the space, given a big enough incentive. The other lesson is that if complexity is your advantage, it could also prevent you from capturing the upside. As Rodion found out, it’s not just the plan that is necessary, but the courage to carry it out.

Ransom Notes

Perhaps not since the ransom of Julius Caesar has there been such a failure of the ransom markets to clear correctly. Illegal though it might be, a sort of equilibrium is usually found throughout various periods of ransom. During the crusades ransom was so common that a set of norms developed around the practice. Modern kidnapping and ransom insurance, while not as big and stable a business as property and casualty, has found a pricing equilibrium that offers insurers a favorable loss ratio of 34%.

Cyber insurance on the other hand may have to take more dramatic steps to curb the recent spate of attacks or suffer the continued losses. Apple supplier Quanta was recently with a $50M ransom and balked at the payment. Now the attackers are threatening Apple. The combination of third parties and a wild ransom market is especially pernicious, and Quanta isn’t the only recent victim. Japanese manufacturer Hoya also fell prey to ransomware recently.

This and other recent attacks have prompted the U.S. Department of Justice to form a taskforce. With attribution so difficult in cyberspace, making an example of the perpetrator through punishment doesn’t seem likely. They intend to “pursue and disrupt” the attackers, which makes it sound like they’ll attempt to hack back. This poorly thought out strategy does not seem any more promising than attacking an old pawn broker. There’s plenty of internal work that the DoJ could be doing to make sure our own house is in order, and the cyber insurance industry is going to play a key role in driving that change, but will they be able to without the DoJ focused on the equivalent of car chases on the information superhighway?

DevOops

Lastly this week, another software supply chain breach is posing correlated risks across customer networks. CodeCov, a code testing software company, was hacked in January and some of its 29,000 customers could be affected. As with physical supply chains above, complexity kills, and the number of third party libraries, tools, applications and suppliers is a structural feature at this point. Cynically, one might just write off security as a cost center and try to survive long enough for the headlines to pass, or naively one might hope to only have good suppliers. Realistically, all organizations are going to need to be a lot more mindful about software supply chain security.

Share The Refractor

Gratitude

Big thanks to Michael Gibson for providing the motivation to finish “Crime and Punishment,” Helena Schrader for an interesting tangent about ransoms during the crusades and Jon Hawkes, Damian Ratka and Ronkainen for the open source intelligence.

Risk Developments this letter:

• Testing Positive

The Risk Dance

On the island of New Guinea off the coast of Australia, deep in the rainforest, exist a species of birds with brilliant plumage that perform elaborate mating dances. Millenia before economists coined the term signalling the 1970’s to describe education credentials and the job market, or even before Thorsten Veblen described the Conspicuous Consumption in 1912, these birds-of-paradise had figured out the importance of signalling. In a resource rich environment, with few predators, males spent more and more resources to demonstrate their evolutionary fitness and win the sexual selection game. Once you understand the concept, you begin to see it everywhere.

Education, employment and mating are just a few areas that signalling commonly comes up, but anytime there is an information asymmetry, signaling can be useful. Other areas the topic is relevant includes in person work, financial risk, and security. The pseudonymous blog post, by an information security professional, titled “They want us to be compliant, not secure” complains about the challenge of interpreting signals in security. It is explicitly the job of auditors to assess the signal not the underlying system, as pointed out in this thread of responses on Hacker News. This may seem like an extreme statement, but you see it all the time in the accounting world, where auditors sign all opinions with the disclaimer that their beliefs about the company are contingent on the good faith of management.

The difficulty here is that professional signal assessors are not fraud detectors. For a great blog on what dishonest signals look like in accounting, see Francine Mckenna’s writing at The Dig. A system that relies too heavily on signals can build an elaborate edifice, like the dancing birds-of-paradise, but this signalling arms race can increasingly siphon off resources from purposes with real utility.

One reason birds-of-paradise can afford to spend so much energy on looking good and dancing is that there are few natural predators of the adult birds. Species that can’t afford to spend energy on signalling are constrained by their environment. They either face many threats or have fewer resources. One reason dishonest signals, known in business as fraud, or in information security as spoofing, is so effective is because the previous signalling regime works so well. As Byrne Hobart pointed out in “The Right Amount of Fraud” (subscriber post) there is was a tradeoff between expediency versus exactness of the Paycheck Protection Program. Some fraud was, in a sense desirable in one round of the game, but since society is structured as a series of repeating games, the stability of signalling is destabilizing.

The difficulty is that in a resource rich environment, there is little natural selection by what biologists call viability, and lots of selection on fecundity. That is, signalling dominates survival as the main selection mechanism for passing on genetic material. Going public used to be a reliable bellwether for a startup that had matured, but Nikola’s ill fated reverse merger managed to slip through. Being able to raise lots of capital is usually a high fidelity signal for future startup success, but Theranos proved that capital and board members aren’t always the most reliable signal. The business world has been a resource rich environment for well over twenty years, and the continued low interest rate policy isn’t changing anytime soon.

Coming back to signalling in information security, is it easier to be secure or to “take security seriously?”

In a previous letter, we discussed Equity Funding Corporation of America, and how they perpetrated accounting fraud using information technology. Eventually the ponzi scheme got too big to conceal and law enforcement caught on. Dishonest signals can sometimes grow to be too expensive to maintain, but security signalling is unusually cheap. For those more interested in security than signaling there are only a few solutions:

• Reduce competition - lessening the pressure on the signaling arms race

• Increase enforcement and penalties - driving up selection by viability

• Create more credible signals - providing alternatives for good faith actors

These three solutions align with the three schools of International Relations thought (realism, liberalism and constructivism), covered by this letter before, and like the three schools they are not mutually exclusive. Reducing competition in the signalling arms race may work for naturally oligopolistic sectors like finance and government, and it helps explain why those industries can afford to pour so much money into their cybersecurity programs, but monopolies/oligopolies impose other large costs on society. Liberalism puts more faith in rule of law and norms to regulate or self-regulate bad actors who may harm the whole system, but this solution has its drawbacks as well. First, it presupposes omnipotent, competent and scrupulous legislative, regulatory and administrative bodies. Second, it will force some otherwise good companies out of business for bad cybersecurity. The last option is the most appealing, but the hardest to conceptualize. What would more credible signals look like? Perhaps software guarantees, submitting to significant voluntary oversight or greater transparency through open source, bug bounties and other methods of reducing information asymmetry.

Ultimately, signalling, as with the birds-of-paradise, will be a part of the security world for a long time to come. The issue is not compliance or security, but how can compliance serve the interests of security. A world with less signalling is not a better or more secure world, but a world with better signals is. Few understand. Birds know this.

Share

Risk Developments

This week I moved for the second time in a month (all I can say is moving sucks and moving twice sucks more than twice as much). I was planning on not doing a risk development section this week, but there is one story I had to talk about...

Testing Positive

As promised, SolarWinds saga isn’t over yet. New broke this week that the U.S. government is formally sanctioning six Russian cybersecurity firms: ERA Technopolis; Pasit, Federal State Autonomous Scientific Establishment Scientific Research Institute Specialized Security Computing Devices and Automation, Neobit, Advanced System Technology, and Positive Technologies in response to the SolarWinds breach, attributed to the Russian foriegn intelligence agency, the SVR.

It’s unclear what effect these sanctions will have. Sanctions in general are not terribly effective tools in diplomacy and this may be especially true in hacker circles, where a government record can sometimes be a badge of pride. Increasing the notoriety of Russian organizations already mostly decoupled and insulated from the West may just be empty signalling.

It’s hard to know what to do about an adversary that refuses to play by any set of common rules. As tense as things are between China and the United States, there is a shared sense of danger from destabilization. Russia, since the fall of the Soviet Union, has had very little to gain and nothing to lose in the current economic order. Until a shared story is created that brings Russia into the world economy, the petulant behavior will continue.

Share The Refractor

Gratitude

Big thanks to Byrne Hobart, Francine McKenna, 62726164 and Jeremiah Grossman.

The only way I’m going to be wealthy is if I take a risk. And if I take a risk now, I’m falling five foot, eight and a half inches. If I take a risk two years from now, I’ll have a bigger mortgage, I’ll have a lot more cash that I’m leaving on the table, and I don’t know if I have the stomach to do that.”

- David Greenblatt (founder of Endeavor), Power House: The Untold Story of Hollywood’s Creative Artists Agency

Risk Developments this letter:

• Paradigm Grift

• Ok… fine...  Archegos

• Cyber Impact

• Defensive Talent

• Brinkmanship

Dealers, Brokers and Agents

When legendary founders Ben Horowitz and Marc Andreesen set up the now hugely successful venture capital firm, Andreesen Horowitz (A16Z), did they model it after previously legendary VC’s like Sequoia, Kleiner Perkins or Accel? No, they modeled it after the talent agency Creative Artists Agency (CAA). The CAA story is fortunately recounted in dialogue by the book “Power House: The Untold Story of Hollywood’s Creative Artists Agency.”

As former founders themselves, Marc and Ben observed that the shift in power that occurred in the movie business in the 1970’s, from major production companies to talent, was occurring in startups as well. They correctly identified that the scarce resource in new ventures was no longer institutional know-how or capital, but talent. Unlike previous eras of venture such as whaling (someday I’ll write a Moby Dick post) or silicon semiconductors (Fairchild Camera Instrument), the best way to manage risk in new ventures today was to direct clusters of talent.

Risk management in asymmetric worlds such as venture, security, movies or catastrophe insurance is fundamentally about achieving or avoiding extreme outcomes. Because outcomes are always overdetermined, it is important to zero in on the commonalities between all extreme outcomes in a field. All successful movies have a star or make someone a star. All natural disasters happen in an area where there is a vulnerable population (otherwise they are called adverse events). All security breaches require the exploitation of a vulnerability (human or machine). All great venture investments have an exceptional team.

When a particular resource is scarce, market makers, brokers, agents and dealers can be invaluable. To quickly differentiate between these liquidity providers, think of market makers and brokers as working for the deal, agents as working for a specific party and dealers as working for themselves. What Andreesen and Horowitz recognized is that venture is a people business, and whoever would be able to arrange the right cast of characters, would get a share in the economics of the biggest successes. What they did better than CAA was to act as a dealer, not just a broker.

Still some of their deepest lessons come from CAA, and can be discovered in “Power House.” CAA was founded by Mike Ovitz (interviewed by Marc Andreessen here) and Ron Meyer. Mike is legendary as a salesman, known for his hustle and for being a typical flashy Hollywood agent. Ron is the veteran son of immigrants and known for his work ethic, deep sense of commitment and enduring loyalty. This team of ambition and flair coupled with duty and grit was a winning combination.

First is the importance of originality. CAA was a scrapy firm started by traitors of the William Morris Agency (WMA). WMA, which began representing vaudeville stars in 1898, is still one of the most powerful talent agencies in the world. When CAA was started, in 1975, they didn’t have the luxury of going head to head with WMA, so they picked off lower hanging fruit in publishing, directing, television and even professional sports. With fresh sources of scripts, vision and acting talent, they could offer formidable, and untapped, resources to movie production studios. Tapping previously uncontrolled resources in music, T.V., writing and sports not only provided alternative sources of revenue, but allowed them to offer a broader range of reinforcing services.

The second is the power of the package. CAA discovered early that if they brought various talents together, they could command a greater share of the economics. Instead of collecting 10% as a fee from each artist they represented, they could collect 5% of half the profits and 15% of the gross, if they bundled directors, writers and actors. This practice is lucrative, although controversial (The Wire’s David Simon has a famous amazing rant about it here). Not only did they make more money, but they could get projects done that production studios, previously blocked. This made their talent more loyal and happier, because creative talent is highly motivated by artistic vision. It also had the side effect of actually increasing box office hits, because, as it turned out, studios were not good at determining success ex ante. 

The third, is how the firm itself was organized. Henry Kravis, private equity billionaire and founder of KKR, has routinely cited his dissatisfaction with the culture at Bear Stearns as primary motivation for founding a new company:

… I started with a specific culture in mind, which is one of the reasons we all left Bear Stearns. Bear was very much an eat-what-you-kill culture, and that’s exactly what we didn’t want. We were big believers in working together. We wanted everyone to share in everything we did, whether you worked on a deal or not.

Similarly, Ovitz, Meyer and the rest of the founding team were dissatisfied with the office politics of WMA, and sought to build a partnership. This reinforced their originality and ability to package deals. With nobody fighting over deal economics, everybody would be happy to contribute their relationships to a package. In addition, the partnership allowed for a much broader set of services, including offering everything from financing to intellectual property. Legendary director Ron Howard had this to say about CAA:

The studio system is shrinking, but there are so many other ways to get projects going at an agency like CAA. They have relationships with financiers, companies, and distributors. It’s about trying to find that intersection point between what their client base, their talent, has to offer and what the marketplace will bear. I think they do it well, and I think they continue to do that thing that I care about the most, which is to allow a person like me to be able to connect with talented artists I want to work with. (10075)

Ultimately the founders of CAA had a falling out and the unique leadership team that built their culture fell apart, but a the next generation picked up the reigns and made it one of the premier sports agencies, expanding their crossover reach again, and even more recently their foray into politics (signing Joe Biden in 2017), seems to have paid off. In terms of equity ownership, private equity firms like TPG, Silver Lake and even Softbank have gotten involved in talent agency buyouts, seeing just how lucrative the business has become.

Returning to A16Z, we can see how the venture capital game, now shifted towards talent, changed, but what of other asymmetric games? Anytime risk and opportunity resides in the tails, brokers can create a bundle that is greater than the sum of its parts, and with payoffs and losses so unevenly distributed getting even a small percent of a massive outcome by controlling the scarce resource can turn and industry upside down.

So what of the security and risk space, specifically? We talk a fair amount about insurance  brokerages, cyber talent, arms dealers and financial market makers around here. In one way or another, these are all either brokers, agents and/or dealers. Since security is the inverse of opportunity, the challenge is not to find the scarce resource that drives the economics, like venture, but to prevent a single point of failure from creating catastrophic losses. The equivalent here is knowing where the vulnerabilities are, whether that’s a zero day in cybersecurity, an excessively leveraged counterparty in finance or a hazard that amplifies the loss caused by a peril. When your job is to pick up pennies in front of a steamroller, the game is to stay alive, which is easier said than done.

Risk Developments

Paradigm Grift

One thing venture capitalists love talking about is a paradigm shift. The phrase was stolen from Thomas Kuhn’s “The Structure of Scientific Revolutions” and is apt for describing emerging trends, although it was first coined to describe when a scientific idea or theory breaks the prevailing worldview among scientists. VC’s understand that the success of their investments is subject to many factors outside of their control, not least of which are technological or social trends. MySpace was Facebook before Facebook. Palm invented the first mass consumer handheld electronic device years before the iPhone. And so on.

Since the advent of cloud computing and mobile devices, there hasn’t been much to bet on. Driverless cars are taking longer than expected, AI has largely meant slight improvements to existing models and cryptocurrency, although presenting amazing speculative opportunities has not built a whole ecosystem of technologies on the blockchain, yet. 

With the pandemic speeding along regulatory approvals in pharmaceuticals, there seems to be an opening. What else could be next? Apple, Facebook and Niantic are betting on augmented reality glasses. Microsoft is exploring liquid coolant baths for servers. IBM says its ready to deliver homomorphic encryption. Could this be the beginning of the next paradigm shift, and if it is driven by big business, are we moving away from a world in which talent is the main driver of startups? If not, maybe there trends are not as obvious as those listed above.

Ok… fine... Archegos

So I guess I have to talk about Bill Hwang’s Archegos blowup that is costing Credit Suisse $4.7B. Counterparty risk is always difficult, and with incentives to keep driving lucrative fees from hedge fund clients, risk management is not usually in a position to step in and potentially spoil a relationship.

There’s somet talk in my circles of the possibility that Hwang, happy with his record breaking year, took half his gains (about $5 billion) off the table into his personal account, and dared his prime brokers to raise his margin requirements. This is all speculation, but whatever the case, it’s more difficult to encourage cooperation and prudent risk management for a joint stock company, as opposed to a partnership, where all the upside would be shared equally. Maybe the chief risk officer did her job, and maybe she didn’t, but having somebody to scapegoat is pretty convenient so that gains can be captured by a few and losses fall on someone else.

Cyber Impact

Speaking of losses. CNA’s website is back up after at two week outage due to a ransomware attack. One theory is that the website was down for a long time because they were following correct procedure and ensuring the ransomware didn’t spread. In a bit of good news, their email systems were fully recovered within one week. Corporate insurance brokers don’t sell a lot of policies without picking up the phone, so the website is less like Amazon and more like the DMV. In some ways this makes insurance brokers better suited to a high cyber risk world.

The New York isn’t letting insurers off the hook however. Following the Department of Financial Services’ framework and recent enforcement actions, the state legislature is considering tougher privacy regulations and higher standards for businesses. So far the regulation has fallen most heavily on the financial services industry, with insurance being of particular interest. What could be more interesting is to encourage creative bundles that bring together talent, capital and know-how that addresses the problem from new angles. 

Defensive Talent

One area in which talent is scare, but has a hard time commanding a share of the economics is defense. In part its because the players are so big and because the institutional know-how is so difficult to navigate. Raytheon isn’t slowing down it’s D.C. area recruiting. One interesting feature of cybersecurity, as opposed to most defense technology is that although it isn’t revenue generating, it also isn’t easily off-shored.

Boeing, for example, has all of its manufacturing plants in the United States, and then flown to the customer. In one recent $1.6B order the U.S. and Australian Navies are buying 11 P-8A (military grade 737’s) equipped with sonobuoys, essentially submarine hunting radar devices attached to buoys that can be deployed by plane across a wide area, perfect for monitoring Chinese submarines in the South China Sea.

Brinkmanship

Since the end of the Cold War, there hasn’t been much threat of great power conflict. The U.S. has, of course, faced enemies, but enemies it was sure it could defeat and who were also sure they could be defeated, at least temporarily. Now that history is rebooting two main points of friction raise troubling signs. The first is Taiwan, which Scholar Stage has a nice writeup on. The political, geostrategic and economic importance of Taiwan make this by far the biggest concern in the world today.

There is, however another threat to keep an eye on. Russia is moving materiel to Crimea in an apparent build up and simultaneously strengthening its arctic forces. Putin’s opportunism probably indicates he’s not so much plotting a second (third?) Russian Empire, but looking to put together original sets of talent, capital and know-how to take advantage of asymmetric risks, while the U.S. is distracted with China.

This new era of international affairs is going to require innovation and new models of procurement, intelligence, warfare, diplomacy and peace making. It’s time to rip up the old playbooks and embrace the 

Gratitude

Big thanks to Tanner Greer, Christopher Ming and James Andrew Miller for your writings which all found their way into and inspired this piece. 

Actual freedom has not increased in proportion to man's awareness of it.

- Albert Camus, The Rebel

Risk Developments this letter:

• Cyber State

• Long Tail

• Public, Private Identity

• Intangible Future

Rebel Risks

Albert Camus, famous for “The Stranger,” “The Plague” and “The Myth of Sisyphus,” is one of the most important writers of the 20th century and the father of absurdism. In the same year that Ernst Jünger published “The Forest Passage,” Camus published “The Rebel,” a long essay (or short book) on rebellion, revolution and art. Like Jünger and Ge Fei, Camus is addressing the problem of resistance. Unlike Jünger and Ge Fei, he had first hand experience as a resistance fighter during WWII in occupied France. He describes the philosophy of rebellion as, “a philosophy of limits, of calculated ignorance, and of risk.” Camus’ explanation and description of rebellion is both more cogent and better explained than Jünger or Ge Fei, and yet his prescription leaves much to be desired.

“The Rebel” is split into five parts:

1. a psychoanalytical description of the rebel,

2. a metaphysical exploration of rebellion,

3. a historical exploration of rebellion,

4. the similarities between and consequences of rebels and artists,

5. and Camus’ prescription.

In discussing his argument, it may be helpful to draw on one of Camus’ most famous lines, from “The Myth of Sisyphus,” which concludes, “one must imagine Sisyphus happy.” Breaking this line down we can focus on three points which correspond to the five parts of “The Rebel.” The first part of note is “Sisyphus happy.” Clearly Sisyphus is unhappy and this dissatisfaction with injustice and meaninglessness in the world corresponds to the psychological and metaphysical roots of rebellion. To “imagine Sisyphus happy” is to create an alternative, either through change in material conditions, i.e. historical rebellion, or creation of new worlds, i.e. art. The “must” is Camus’ preferred solution, and this is where he fails.

The psychology of the rebel is the identification with the victim. It is the observation of  injustice and the risk taking to correct it. It is neither an act of egoism, although the ego may provide drive, nor resentment, which ends in bitterness or unscrupulous ambition. What would make Sisyphus, the victim, happy? It is not simply hard work that makes one miserable, it is meaninglessness and repetition of the task as well as the excessive punishment. In Camus’ metaphysical exploration of rebellion he discusses the role of Christianity in unravelling injustice and giving succor to the victim. If Sisyphus shares his burden with Jesus and will be rewarded in the eternal afterlife, his burden is easier to bear and is given both finality and meaning, but in such a sacred world, all such evils can then be excused and rebellion is unnecessary. This is why Camus turns to Nietzsche, who believes god is dead, restarting the cycle of rebellion and oppression.

When it comes to historical rebellion, Camus begins with the regicides, which ultimately lead again to deicide, but here Camus goes further. The early regicides, like the French Revolution were driven by rationality, disposing the divine right of kings. In Germany, rationalist thought progressed under the unification of Germany, the a new type of federalist government with the separation of church and state. Meanwhile, Russia began to tear itself apart, influenced by French rationalism through the lens of German propensity towards action. The early Russian nihilists pioneered the tactic of suicide bombing the Tsars. These revolutionaries risked everything, especially because they rejected any afterlife, to demonstrate ultimate rationality. Without the sacred beliefs of pre-revolutionary France or the realism of Bismarck’s Germany, rationality became an exercise in faith. The dogmatic adherence to the principle that nothing matters and reality is whatever we make of it culminates in terror. 

From here Camus discusses the development of individual terror into two branches of state terror; the irrational terror state, under fascism, and the rational terror state, under communism. Returning to Sisyphus, we may say that to imagine him happy we have two alternatives, we can imagine Sisyphus taking revenge against the gods (fascism), or we can imagine Sisyphus subjugating the gods (communism). Fascism, Camus says, fails to be a revolution, since it is not unifying, but depends on divisions in society to maintain order through fear of the other. Here we come across Jünger, as Camus quotes:

… Ernst Junger, even went as so far as to choose the actual formulas of nihilism: “The best answer to the betrayal of life by the spirit is the betrayal of spirit by the spirit, and one of the great and cruel pleasures of our times is to participate in the work of destruction.”

Perhaps it is because “The Forest Passage” had not yet been published, or because Jünger matured and distanced himself from his early bellicose writing, but this seems to me a misinterpretation. Betrayal of life by the spirit is a good description of fascism. Fascism is the revivification of the sacred without god at the center, but the worship of the will to power. As Jünger points out, the only way to defeat the irrational terror state is o appeal to greater irrationality, that of divine individuality. The rational terror state, which Camus focuses on for the remainder of the chapter, has no such ethical reservoir to draw on.

The demand for justice ends in injustice if it is not primarily based on an ethical justification of justice; without this, crime itself one day becomes a duty. When good and evil are reintegrated in time and confused with events, nothing is any longer good or bad, but only either premature or out of date.

Here Camus makes the distinction between revolution and rebellion. Revolution is rebellion situated in history. “Every revolutionary ends by becoming either an oppressor or a heretic,” he says. Therefore, and this is where, again Jünger, Ge Fei and Camus agree, “art should give us final perspective on the content of rebellion.” This is because art, like rebellion, is a demand for unity, the impossibility of revolution and ultimately the creation of a new universe. The artist can imagine Sisyphus, enjoying his task and finding meaning in his punishment. Thereby the artist creates for him a new universe.

If this sounds absurd, that’s the point. Camus believed that by embracing the search for meaning in a meaningless universe, one could create meaning. He ultimately suggests a moderate path between God and history, between formalism and realism, between unity and nihilism and between divine right and state terror. This is why he describes rebellion as “a philosophy of limits, of calculated ignorance, and of risk.” 

This brings us to the final point of analysis in “one must imagine Sisyphus happy.” It is evident, by now, that Camus, Jünger and Ge Fei agree about the importance of resistance, the centrality of the artist and the tenuous middle path, but Camus, keenly aware of the danger of serious nihilism, did not anticipate the more insidious danger of absurdism. It is the paradoxical “one must” that Camus stumbles over. Absurdism may be a coping mechanism for those in dire straits, but as anybody who has feigned laughter at a joke knows, mandatory humor loses its rebellious quality. The required criticism and self flagellation of modernity is no less totalitarian, just because it has a jaunty ironic pose, as Katherine Boyle points out in her terrific essay “On Seriousness”: 

Camus could not have anticipated the total triumph of absurdism, and how in complete conquest it would become a victim of its own success. Here we are left, by process of elimination with Jünger and Ge Fei. Camus, brilliant in his analysis, but lacking in his prescription, is strongest when writing about art. He asks, “Is creation possible? Is the revolution possible? — are in reality only one question, which concerns the renaissance of civilization… Rebellion in itself is not an element of civilization. But it is the preliminary to all civilization.” As Jünger and Ge Fei point out, to create is to either withdraw from society or to do battle with it. Camus did not know how right he would be when he wrote:

To create, today, is to create dangerously.

Share

Risk Developments

Cyber State

After repeated wake up calls in 2020, the State is asking for greater powers. NSA chief, Paul Nakasone, is requesting broader powers for the intelligence agency that is nominally prevented from collecting domestic signals intelligence. Instead of seeking permission to directly surveil domestic networks, he is asking for greater cooperation with the private sector. It is unclear what surveillance capabilities the NSA doesn’t already have through its private sector relationships, but it seems likely that there are gaping holes in both the information they can collect and the ability to use the information they already have. Closing the information gap without closing the capability gap would not produce the desired result.

Similarly, the Biden administration is issuing an executive order to make software vendors disclose data breaches to U.S. government customers. I’m more sympathetic to the idea that a customer should be notified if a product they buy is harmful, but both of these theories operate under the assumption that the main thing holding the government back is lack of information. The terror of cyberattacks can be used to justify plenty of injustice, so we should take these steps seriously. Perhaps the antidote to terror is not information or absurdity, but creativity.

Long Tail

Long tail risks are ill suited to modern attention spans. When Berkshire Hathaway’s oldest operating subsidiary, National Indemnity Company, which exploits this arbitrage, bought asbestos liability from P&C insurers, they created a complex and lucrative new market.

Cybersecurity breaches are also long tailed events, with it taking months, on average, to discover a breach and even longer to determine the impact. It was over two years later that Equifax settled with the FTC for its data breach and only last year that the Department of Justice indicted four members of the Chinese military on charges related to the hack.

So it shouldn’t be a big surprise that the SolarWinds hacks are still unfolding, now at the Department of Homeland Security. It appears that some high level officials had the confidentiality of their email compromised. Whatever the response may have been, DHS is one of the most cyber forward organizations in the U.S. government, so we can be fairly certain we haven’t heard the last of SolarWinds.

Part of what makes these events long tailed or not, is how the breach is handled. Insurance companies may have already figured this out, as major cyber insurance underwriter and recent hacking victim, CNA can attest. The most important cost control may not come before the breach, as most people assume, but after.

An example of what not to do has been provided by network and IoT device manufacturer, Ubiquiti. In a recent post by security blogger Brian Krebs, an insider claimed that their January 2021 breach was in fact far worse than reported. If there was a coverup and customer information was accessed, it could create much greater costs down the line.

While cybersecurity can never guarantee absolute protection, good planning, prepared employees and resilient systems, can greatly limit financial impact. In other words, “a philosophy of limits, of calculated ignorance, and of risk” is your best defense against the long tail.

Public, Private Identity

A lot of noise has been made over privacy and vaccine passports recently. New York State is rolling out their version, with help from IBM. With over $100B of economic impact, New York is eager to get the tourism dollars flowing again, so it makes sense that they would be first in the ring, especially making the passports free and voluntary. Optional vaccine passports do not need to be a concern for personal liberty enthusiasts.

A new transatlantic privacy deal is in the works as Europe and the U.S. continue to reset relations under the Biden administration. European regulators have been wrankled by American big tech, with a mix of legitimate cause for concern and some other more geopolitical objections. When monolithic organizations, such as governments or monopolies control information, that can be a recipe for disaster. Mike Solana of Pirate Wires, has a good writeup of the U.S. social media debate, which raises a good question about whether personally identifiable information should also belong to a protocol.

Google isn’t waiting for that day, but simply building a credential management system for car keys, house keys and identification cards straight into the Android open source project. While not a distributed and permissionless credential store, it is a step towards convenient, but sovereign digital identity. It’s easy to point out the fact that OEMs are still a point of failure, or that independent verification of Google’s work is challenging, but hopeless nihilism isn’t going to get us any closer to a future we want. Building just might.

Intangible Future

Whatever that future does turn out to be, we know one thing for sure, intangible assets will be a lot more important. Insurance broker Marsh is betting on this with new intangibles product leaders, one for digital assets and another for D&O. For at least thirty years, the economy has been dominated by software. This is such a truism that even the term tech has become synonymous with software.

Yet, the pandemic may prove an important turning point. The advent of mRNA vaccines was made possible by computer technology, and as the biotech revolution continues apace, we may see more gains from software leak into the tangible world. One area that is going to have to catch up in physical reality to make that happen is even more connectivity. Part of Biden’s infrastructure plan calls for $100B to bring broadband to every American. Now if only his plan was called something that implied less terror than “future proofing.”

Another intangible leaking into reality is the Prospera charter city project. We’ve discussed Franchise Owned Quasi-National Entities (FOQNEs) before in this newsletter, so the concept isn’t entirely new, but Prospera is taking an interesting approach. By building a digital community first and offering business and legal services, Honduras is trying to become a “tropical Delaware” or an American Singapore.

Subscribe now

Gratitude

Big thanks to Katherine Boyle and Mike Solana for sharing your writing and ideas that helped inspire this post!

Tell me, what’s the most valuable thing anybody can ever have? It’s their life, isn’t it? But you can hold onto it as tightly as you can for every waking hour, and you’ll still have to let it go when the time comes, won’t you?

- “The Invisibility Cloak”, Ge Fei

Risk Developments this letter:

• Ransom Where?

• Insurance Thinking

• Contemporary Monetary Theory

• Cyber Equity

• Regs With Legs

Surviving Modernity

In 1980’s China, author Ge Fei came to fame as the founder of contemporary Chinese fiction. It was the time of market-economy reform, the end of Maoism, a period of opening up to the world and an era of tentative freedom. Despite Ge Fei’s prominence in avant-garde literary circles, he did not frequently participate in public events and took a break from writing novels in 1994. In 2012 he published “The Invisibility Cloak” and in 2016 he burst onto the Western literary scene, when Canaan Morse translated it for English speakers. Still, Ge Fei keeps a low profile preferring to spend his time teaching and heading a Chinese Literature department. In fact, Ge Fei is not even a professor of literature, but a pen name used by Liu Yong a professor at the prestigious Tsinghua University (frequently called the MIT of China, which boasts alumni such as president Xi Jinping). Explaining the enigmatic novella “The Invisibility Cloak” is difficult, but knowing this background and split personality helps just understand what he is trying to say about society, capitalism, technology and risk.

In just eleven chapters, Ge Fei manages to envelop the reader in modern Beijing, with its juxtaposition of gritty noir with shiny materialism. It is a city full of strivers, grasping materialists, tenuous friendships, hollow intellectualism and the odd stubborn resistor, like the main character, Cui (pronounced Tsuay). The novel is fairly light on plot. Cui makes ends meet by sporadically building audio systems for the rich. Facing potential eviction, Cui asks his estranged friend, Jiang Songping, to crash at his garment factory. Jiang, rebuffs the favor and instead offers Cui a shady, but wealthy client, who may be a criminal, named Ding. Cui briefly considers marrying a kind but homely friend of his sister’s before deciding to sell everything he has and do one last job for the gangster. When the gangster vanishes before paying, Cui finds a mysterious woman occupying the mansion where he installed the audio system.

What the novel lacks in plot, it more than makes up for in character development. Cui, divorced and in his forties, spends much of the book reminiscing about the past. He lives with his sister and her loutish husband, but many of the scenes happen in his memory, with his ex-wife, his dead mother or his erstwhile friend. A relic from a different time, Cui never gets up before 10AM, refuses to wear t-shirts and despises modern technology, especially poor quality, mass produced audio equipment made after the 1990’s, a “golden age for audiophiles.”

The sets of characters in the book can be described by two character traits, reliability and dependence, as they relate to Cui. He depends on his family and friends, but they are unreliable. He cannot depend on the Beijing intelligentsia, who make up a shrinking portion of his clients, but they are reliable. His fellow audiophiles, who he buys and sells parts with are reliable, and he depends on them. This leaves the remaining characters, the wealthy and mysterious, as characters he does not depend on and who are unreliable.

The first set of characters, family and friends, represent betrayal. The failing moral system, and confucian backbone of Chinese society, that focused on the family for thousands of years, is being torn apart by modernity. When he seeks out Jiang, now a company CEO, for a bridge loan, Cui is berated, and Jiang bitterly terminates their lifelong friendship. Cui discovers his own sister is lying to him, claiming her husband is beating her because Cui won’t move out. His ex-wife casually suggested a divorce noting that she was already sleeping with someone at work. Finally, even Cui’s own parents were unreliable. His dad lay down and died while working and his mother passed away before warning him that his wife was too pretty to be faithful to him. 

The second set of characters, the educated and elite, lawyers, politicians and professors, are reliable, polite and always pay on time, but Cui finds them sanctimonious, ethically vacuous and logically inconsistent. They “are supposed to be the people who take on the world’s problems as their own, who shoulder the world’s burden,” but they are more obsessed with showing off their taste and lecturing about the ills of society. They are predictable, and their tastes follow fashions, which makes them reliable customers, if one can put up with their pontificating.

The third set of characters are Cui’s fellow audio system makers. He has never been swindled in a deal with buyers and sellers of high-end audio equipment, despite sending money over the internet to many different countries. Cui breaks the fourth wall to explain,

In an age where scams and cons are so common… you have to admit… such a standard of trust is a miracle…. No doubt our community is still a haven. I personally attribute this to the higher than average ethical conscience among members of the community, shaped by the influence of classical music on human character (“The Invisibility Cloak”, 80).

These people trade technology from the 90’s and live by a code of honor, but being dependable is quickly going out of style.

The final set of characters, the kingpins, are lacking in taste, but commission audio systems from Cui without pompous lectures and don’t pretend to know hi-fi systems better than him. These are the big fish that can support Cui for months at a time. Ding, the biggest of these big fish, lives in Sleeping Dragon Valley, as if to say that only he can pacify the Dragon. While extraordinary and dangerous, Ding is not dependable. Unlike the intellectuals, the bosses cannot be trusted to pay. This description may seem unflattering, but it is their lack of pretense that is admirable and while reliability is often seen as a benefit, it is also a constraint. The business owners’ unreliability also offers uncapped upside. In financial terms it’s a call option, a payoff with asymmetric upside.

In the modern atomized China, family and friends cannot be depended upon, the elites are mediocre, and the number of makers is shrinking. The only way out is to refuse to play by the rules. This echos “The Forest Passage” by Ernst Jünger, which I wrote about last week. Jünger’s Forest Rebel does not outwardly protest, but turns inward to find the weakness in the Leviathan's armor and strikes at that joint. Liu Yong uses invisibility cloaks to avoid the Dragon. As Byrne Hobart pointed out last week, anonymity is a free call option. If you are pushing the envelope of criticizing the government, it’s always good to do it anonymously, but if it becomes wildly popular, you can exercise your option, revealing your identity, safe in the knowledge that you’re too big to jail. When Ge Fei originally became popular, reforms were watering down the cultural revolution and hopes were high for market and civil liberties reforms. Since the implementation of the cultural revival, that hope for free expression has abated.

Ge Fei is writing again and now from his position of authority, he has a platform, if not the same liberties, which explains his nostalgia for an earlier era and his distrust of technology. While the Forest Rebel and the Invisibility Cloak share much in common, including deep introspection, there is at least one key difference between the two. The Forest Rebel turns inward for spiritual sustenance to take down the Leviathan, but the Invisibility Cloak turns inward to escape the Dragon. It is explained to Cui how he can go on living in such a confusing world:

You should understand that nothing in this world is ever truly clear. If life is crazy, let it be crazy! If you tried to live every single detail of your life with perfect clarity, you surely wouldn’t even make it through the first day, Try to be perfect, and where’s the fun?

Share

Risk Developments

Ransom Where?

The FBI’s annual Internet Crime Report is out, and complaints are way up (69% YoY) as are losses (20%). Business email compromise is still the leading type of incident, but ransomware is growing fast. The FBI also notes that it vastly underestimates the damage from ransomware because it does not count any business interruption loss or remediation costs and victims are often reluctant to report paying ransom to the FBI, which discourages the practice.

Another report by the Cisco Talos Incident Response team noted the dramatic rise in ransomware is supported by commodity trojans, open source software and victims’ own infrastructure. Byrne Hobart wrote about the Sierra Wireless ransomeware incident, noting that now tangible losses are being felt, leading to a continued rise in cybersecurity spend.

One more bit of ransomware news is that electronics manufacturing behemoth Acer was hit with a $50M ransomware attack perpetrated by a REvil group; the largest known ransom to date. At a time when NFTs (Non Fungible Tokens) and crypto art sets all time price highs, the original cyber art is keeping up. The industrialization of cyber crime has been a long time coming, and as compliments continue to be commoditized, the trend will continue.

At one point in “The Invisibility Cloak” Cui asks the mysterious woman inhabiting Ding’s mansion how she ended up there and she offhandedly remarks that she was taken hostage, just like him. Cui protests, unconvincingly, that he did what he needed to do; he is a free man. In some sense, when you’re down to your last option, you are a hostage, but as victims who pay up and don’t get restitution know, it is only when you exhaust even your last option that you can truly be free.

The view from the attacker side is fascinating in this interview with the REvil group’s “Unknown.” The political economy of cyber crime is an underrated topic, and is critical to understanding the future of risk. The topics “Unknown” covers include why REvil attacks targets outside the Commonwealth of Independent States, how the affiliate business model works, ransomware as a cyber weapon (and why it doesn’t get much use) and cyber insurance. Here’s an excerpt:

DS: Do your operators target organizations that have cyber insurance?

UNK: Yes, this is one of the tastiest morsels. Especially to hack the insurers first—to get their customer base and work in a targeted way from there. And after you go through the list, then hit the insurer themselves.

Insurance Thinking

Speaking of targeting cyber insurance holders and then carriers, themselves, CNA, one of the biggest underwriters of cyber insurance, was hit with an attack that forced them to disconnect their systems. Not much more news about this today, but their stock is trading flat as of mid-day today. Another insurance giant, Willis Towers Watson (WTW) is offering a new cyber product to the energy industry. As the second biggest broker in the world, they have a good perspective across industries and know that securing legacy grids and devices in the energy industry is a much different problem, with a different distribution of losses, than securing networks and applications in the financial services industry.

Two other large insurance companies with prominent cyber lines, Chubb and The Hartford made insurance news with an acquisition offer that was quickly rebuffed. Both companies have been pioneers in applying deep technical expertise to insurance problems. The Hartford was a major innovator in developing and popularizing controls for steam boilers, which I’ve written about here. Chubb created a set of for-profit technical schools in the 1970’s that ultimately failed but intended to train people to work in the IT field.

In terms of anticipated risks, CNA certainly should have been more aware of their own risks, and brokers like WTW have had visibility to see that that cyber risk should be underwritten separately from general business risks. Chubb also experienced a breach last year. So what gives? One explanation is that the front office and the back office don’t share information. Another is that insurers, who are short cyber risk, don’t believe cyber risks are that bad (otherwise, they would be long), or at least that the risk can be diversified away.

Risk expert and SIRAcon board member, Tony Martin-Vegue, has a great new post up on part one for future proofing risk models, that may provide another explanation; the “the vulnerability du jour.” His three rules are no specifics, quantify uncertainty and embrace the possible. Everybody is subject to “it won’t happen to me” bias and this is only compounded by the false relationship between impact and probability. Humans are not naturally statistical thinkers and we struggle with the difference between a 0.0001% chance of a catastrophic event and a 0.001%, even though the latter is ten times as likely.

As society continually reduces mundane risks, we come to rely less on our personal relationships and rely more on the institutions that hold up our complex emergent systems. Over-reliance on scholars, lawyers and politicians leads to shocks when exotic and speculative risks emerge. These cracks in the system are inevitable as seeds of the next crisis are often sewn by the solution to the last one. The key, as Cui learns, is to flow with the crises, not against them.

Contemporary Monetary Theory

We’ve talked some about the history of money, decentralized banking and The Fed. What we haven’t addressed directly is Post-Keynsianism and Modern Monetary Theory. As a coherent school of economics, it’s hard to tie together. As an observation about how the Federal Reserve is a defacto branch of government that will always fund the Treasury Department, it has become a matter of fact.

Cyber Equity

Cyber equity financing news came fast and furious this week. Risk analysis and cybersecurity firm QOMPLX is going public via a SPAC. The oldest bank in America, BNY, invested in Fireblocks, a crypto custodian, and will be rolling out services using their product. Private equity firm, KKR is taking cybersecurity training company KnowBe4 public in an IPO and Fortinet acquired cloud security startup ShieldX.

Equity financing is not a source of capital one can depend on, but it is reliable. When it’s hot, it’s sweltering and when it’s cold it’s freezing. This goes for times as well as sectors. The key is always to time that last job and the key to timing is having the option to walk away. That’s real freedom.

Regs With Legs

Unlike equity capital markets, one thing you can’t (usually) walk away from are regulators. The EU put out a new Cybersecurity Strategy which says all the right things about providing a public good like national security, but top down approaches are difficult to pull off, and coordinating EU member states on norms, laws and information sharing will not be easy and may prove impossible.

Meanwhile, The New York Department of Financial Services (NYDFS) settled with Residential Management Services Inc. in the second ever cyber enforcement action. The settlement is for a paltry $1.5, compared to the $5B in loans they process annually (my back of the envelop estimate is $100M in revenue on processing fees alone). Another term of the settlement is submission of an incident response plan, which seems like the least they could ask for. Maybe some systems remediation and preventative controls would be more helpful? Still, any progress is good progress. Small concrete steps in the right direction, however feeble they may be, are better than pontification by those who “are supposed to be the people who take on the world’s problems”

Subscribe now

Gratitude

Big thanks to Byrne Hobart, Canaan Morse and Tony Martin-Vegue for sharing your writing and providing inspiration throughout this piece.

“Here and Now” is the Forest Rebel’s motto.

- Ernst Jünger

Risk Developments this letter:

• Acquiring Identity

• Back (to the) Office?

• Civil Cyber

• Hyper-Space

• Intangible Insurance

100 years of Writing and War 

Writing in the wake of the horrors of World War II, an enigmatic author, soldier, entomologist and future centenarian, Ernst Jünger produced “The Forest Passage”, a call for individual rights, freedom and resistance to totalitarianism. Jünger is best known for works he completed during his juvenile years as a soldier. He was one of the most decorated German soldiers in World War I, and there can be no doubt about his courage, although there is still much debate about whether his writings glorified war or dispassionately describing war. Despite his social conservatism and hawkishness, he refused overtures by the Nazi party multiple times, and his son was arrested for subversion and assigned to a penal unit, where he was either killed in combat or executed by the SS. Still, his earlier period haunts his legacy and the question can be raised, “Why listen to this writer at all?” Before we go any further, let me be clear, I am not attempting to defend Jünger, nor put him on trial, but to simply learn from his unique experience at the center of the most important events of the 20th century. What was his approach to risk, and why did he view danger as both necessary and revitalizing? How did he manage to resist totalitarianism on multiple fronts, and what can we learn from the protean tradition that he, Alcibiades and Autolycus embody? Finally, what insights about technology did Jünger produce and how was he so prescient in his science fiction and allegorical writing?

Risk is discussed in short bursts at three different points in the book. The first time risk is mentioned is during an analysis of elections and resistance. In Jünger’s estimation, modernity transformed the ballot into a questionnaire. Totalitarian governments rely on the perception of high turnout and nearly unanimous victory, but perhaps more importantly, the implication of freedom signified by the two percent who vote against a dictator. Calling on independent thinkers to reject this false choice and make their dissatisfaction heard by means other than the ballot box, Jünger states, “The moment he decides to take the risk and abandon the realm of statistics, the senselessness of pursuits, which lie far from the origins, will become clear to him” (pg. 17). Our current obsession with quantifying, simulating and statisticalizing everything from mortgaged backed securities, to war games and daily average users runs contrary to this line of thought. Here, to risk means to gamble on some ineffable human quality of resilience, truth and individual freedom. Referring to his earlier writings on the Worker and the Unknown Soldier, representatives of labor (communism) and the military (fascism) respectively, Jünger coins a new figure, the Forest Rebel. This Forest Rebel employs art, philosophy and theology to forge a tenuous third path, between the Worker and the Unknown Soldier, “[resolving] to risk the experiment” (25).

The next time risk is discussed is during his expatiation on fear. Fear, Jünger claims is the animating force behind automatism, the phenomenon of restricting one’s own power of decision making in favor of the machine. This machine, whether a figurative institution or literal piece of technology, thrives off instilling fear, and “fear besets even those armed to the teeth — indeed, them above all” (30). Fear and danger are linked, and danger cannot be reduced without first addressing fear, but neither can fear be banished absolutely; it is part of the human condition. The acknowledgement of danger, Jünger believes, will dispel the thrall of fear. “... The probability of catastrophe diminishes in step with the individual’s victory over fear” (36). The antidote to fear is daring, and it is in these intimate moments of fear and daring that quantity becomes irrelevant. Call it the power of narrative, storytelling or constructivism, but the most powerful force against risk is creating your own reality, where the odds don’t matter.

The final mention of risk integrates the two previous themes of totalitarianism and fear through a discussion of property. Jünger is clearly not materialist (in the Marxist sense), and warns against redistribution of property, but neither does he attach too high a value to material (in the colloquial sense) property. He cautions against holding on to the trauma of being dispossessed, saying that it will lead to civil war and terrorism. This echos the theme of reciprocity and feedback loops we have discussed before. What is new is that Jünger has seen both the effects of expropriation by both fascism and communism, and he identifies that nation-states do not have a monopoly on terrorism. In fact, disaffected individuals will mimic the state’s tactical use of terror, if they identify too closely with what they view as their property. Therefore, it is not the possessions, as such, that are important, but that we possess them. This means having fewer possessions, and ideally those which are harder to expropriate, such as our words and knowledge, is crucial. Since the Forest Rebel must be daring and willing to make great sacrifices to protect their property, we can view risk as a choice, rather than an imposition. Echoing Goffman, we get the impression that only by encountering danger can one prove their character, and thus taking a calculated risk is a demonstration of the conquest of fear.

Jünger was no stranger to fear and danger, having been wounded seven times during WWI. Despite his many brushes with death, he remained cautious and his tendency for equivocating only increased as he aged. For a full biography and interview, see this video. He comes off as aloof, cold and perceptive. It is clear that he is a cunning survivor with a grim sense of humor. Humor, as it turns out is a key instrument of freedom according to “The Forest Passage.” As daring is the antidote to fear, humor is the antidote to propaganda. The fool can slip past the censor and does not offer support to the dictator by endorsing the perception of free speech. It is precisely Jünger’s rejection of authority, both on the left and the right that protected him, and although he was associated with an attempted coupé (for which the conspirators were executed), he stayed far enough away to survive. His comical detachment belied keen powers of observation, and, when coupled with the heroic aura he became impervious, even as a critic of the regime.

Being at once at the center of power and an outsider, he had an ideal vantage point from which to view technological history. His novels, “The Glass Bees” and “Eumeswil” presage nanotechnology, automation, holographs, historical information databases and omniscient surveillance. In Dan Geer’s now eight year old essay, “We Are All Intelligence Officers Now” he explains surveillance capitalism and the intelligence community:

It is said that the price of anything is the foregone alternative. The price of dependence is risk. The price of total dependence is total risk.

Geer’s relationship between risk and dependence, is reminiscent of Jünger’s danger and fear. To eliminate risk, we must begin with dependence, and it is only by addressing dependencies, that is, technology on which we rely, that we can address risk. Geer ends with a plea to allow individuals to opt out of data collection, ceding the decision to those in authority. The Forest Rebel offers and alternative means of resistance.

Jünger’s detached observation of power up close and his own personal experience with the mechanization of war provided him with insights, but not interest in the use of technology. In the same year “The Forest Passage” was published, Jünger experimented with LSD and in the video interview linked above, he states a preference for psychedelics over computers. Without getting too mystical, it is worth noting Jünger’s association of the Worker and technological automation with the Titans of ancient Greek mythology. In one of the more abstruse sections of “The Forest Passage” he make the analogy between modern, urbanized society and the Titantic. He acknowledges the mixed metaphor of the forest and a ship, but then goes on to say this is not as disjunctive as it appears, referencing the Homeric Hymn of Dionysus who grew vines to ensnare and cover the pirate ship on which he had been taken hostage.

In the hymn, all the pirates jump overboard, except the helmsman, who Dionysus takes mercy upon for holding firm aboard the ship. Jünger implies that the Forest Rebel, by submitting to the danger and vanquishing fear, can eliminate risk despite the odds. There is no getting off the ship of technology, there is only drawing on inner strength to resist the chaos aboard.

Share

Risk Developments

Acquiring Identity

Cloud identity management (IDM) darling Okta announced a $6.5B acquisition of identity provider Auth0 two weeks ago, and I didn’t have a lot to say at the time. Public markets were not very happy about the deal, so the CEO of Okta went on TV to defend the acquisition. His reasoning is basically that Okta is focused on employee IDM and Auth0 is focused on customer IDM. All of their major competitors have customer identity and access management (CIAM), and Okta is now competing for more complex deals at multinational organizations. These customers may offer their own customer portals, applications and features, so it was necessary to have a better complete solution. Besides, the revenue multiple put on Auth0 was lower than the multiple markets give Okta. And plus, Auth0 was getting ready to go public and we all know that IPO’s get a pop.

Ok, so the logic is reasonable enough, but the valuation is still eye watering. In the near term, we will see whether Auth0 customers replace legacy IDM systems with Okta and whether Okta customers add on Auth0, if they don’t already have a CIAM solution. Ripping and replacing identity systems is extremely difficult, so the lock in is very good, and the recurring revenue of winning over even a fraction of Auth0’s customers may be worthwhile. The real question, in the long run, is whether the combined suite of cloud identity services can match the flexibility and utility of traditional on-premises systems that are already moving to the cloud.

SuperTokens, an identity startup, posted this comprehensive breakdown that made the front page on Hacker News. They cite the major incumbents as Okta, Auth0, Firebase (Google) and AWS Cognito, and while there aren’t many direct cloud competitors that have been as successful as Okta, that leaves out major players like Microsoft, Ping, ForgeRock, IBM, Sailpoint and other IDM platforms favored by enterprises. Younger companies without identity debt are likely to select solutions offered by their cloud providers such as AWS or Google, but the risk of leaving access open on various on-premises, legacy or third party systems is too great for the enterprise. As Okta continues to grow and mature from the nimble rebel it was just a few years ago, it will come to resemble the customers they aspire to capture. It will become the cloud IDM legacy provider, when SuperTokens, or some other startup, ushers in the next wave of identity, possibly as an API.

Back (to the) Office?

Banking is a relationship business, but it’s also a highly manual process business with large back offices. Throughout the pandemic, bank CEO’s have been some of the first to support getting back together in office space, but that probably means for deal teams and clients. Back office teams are mostly being moved to cheaper locals.

There is naturally some tension between the desire to foster new talent and to satisfy the new work from home lifestyle that middle management has become accustomed to. Coming back together is a risky move and as with any time corporations make risky moves, the consultants have been brought in.

Some employees may have backed themselves into a corner by moving away or buying homes. There may come a moment when they see how indispensable they really are. Many of the roles being relocated are the ones that have plenty of applicants, and the roles close to the center of power may not be full of Forest Rebels, but they are filled with protean types that affect an aura of invincibility.

Civil Cyber

The Whitehouse is taking steps to address the recent spate of hacks. The crux of the issue, intelligence agencies claim, is that Russia and China are using U.S. based infrastructure to avoid detection, since foriegn intelligence services do not have responsibility for monitoring domestic activity. More information sharing is not going to solve this problem.

The difficulty of addressing attacks by Russia and China, that emanate from inside the U.S. is that it threatens our civil society, just as terrorism attempts to undermine the moral high-ground. Terrorism, whether state or non-state sponsored, seeks to elicit a reaction to justify its actions and win political support. Likewise, hacks by China and Russia, that misuse U.S. infrastructure, seek not only to extract information, but to elicit a response from the state that will make the U.S. more like China and Russia.

On top of this, a new report claims that a quarter of all cyber threats spotted in the wild have never been seen before. While one should always view marketing claims with suspicion, it is one more data point in the, “are bugs sparse or dense?” debate. What these two stories combine to mean is that the U.S. needs to think about more than just cybersecurity, but property in general. Short of a technological solution, such as a panopticon that respects privacy, free societies are going to have to make some hard tradeoffs.

Hyper-Space

Lockheed Martin won two big missile deals this past week. First is the U.S. Airforce’s hyper-sonic space missile program for $1.5B. Second is for joint U.S. and U.K. Navies’ submarine-launched missile manufacturing. I don’t have a lot to say about either of these except that, wow missiles are expensive, and if hyper-sonic space missiles aren’t Titanic, I don’t know what is.

Intangible Insurance

While Aon and WTW continue to encounter impediments to their proposed merger, the other biggest global insurance brokerage, Marsh, is doing some rebranding after an infusion of cash from Warren Buffett. With a war chest and a streamlined logo, they’re getting ready to play David to the coming Goliath. 

One interesting take on what is an otherwise blah corporate rebranding is that Marsh has a deeper perspective on intangibles than many businesses. As a the value of intangible assets has risen from just 17% in 1975 to 90% today the insurance business has taken note, offering cyber insurance, directors and officers insurance, reputation insurance and M&A transaction insurance. In fact, Berkshire’s insurance arm just hired away a top AIG specialty insurance professional.

Marsh knows this as well as anyone, and indicates such in their transactions insurance 2020 report. While insurance continues to face difficulties with global warming, the pandemic and low interest rates, the M&A boom has at least been one bright spot. Even when acquisitions cool down, as all M&A cycles surely do, insurance will have plenty of other intangibles to insure, that is, if they aren’t too busy with their own acquisition problems.

Subscribe now

Gratitude

Big thanks to Pablo Pineche for sharing the syllabus from Peter Thiel’s seminar, “Stagnation or Progress.” The syllabus, which includes many fantastic books, culminates by assigning “The Forest Passage.”

“… When every last patch of land is claimed by one government or another, and when citizenship is treated as an absolute condition of human existence, the ocean is a realm that remains radically free.”

- William Langewiesche

Risk Developments this letter:

• Micro and Macro Hacks

• Cyber Coverage

• Cyber Financing

• Commodity Commons

The Sea and the State

The subtitle of “The Outlaw Sea”, “A World of Freedom, Chaos, and Crime”, could just as easily apply to a book about cryptocurrency as to one about international waters. As a book about life at sea, it accomplishes its goals to entertain and inform, and as an allegory for the limits of institutions, it is a powerful argument. This argument also explains why I’m bullish on cryptocurrency, but still don’t own any.  When co-founder of Venmo and Fin Analytics, Andrew Kortina gifted me the book, I knew I had to read it!

The book is a set of anecdotes woven together by author William Langewiesche, who starts with an overview of what the system of international waters is and how it functions. Here he draws on interviews with the coast guard, port administrators, pirates and sailors to describe an semi-anarchic system that is ostensibly self governed by the International Maritime Organization (IMO), a special agency of the United Nations, but in practice, one that is pressured, influenced and cajoled by military and financial interests. The first third of this book focuses on organized crime, terrorism and other stateless threats. The primary anecdote for this section follows an organized criminal venture in Southeast Asian waters off the coast of Indonesia, where a Japanese bound shipment of aluminium is stolen and later recovered by the Indian Navy.

The book is anchored by the main anecdote in the middle third of the book, that deals with the sea as the space between nation states. Through a set of harrowing firsthand accounts, legal documents and a sensationalized fictional retelling, we learn about the sinking of the MS Estonia. The story is about how the fall of the Soviet Union, combined with complicated economic relationships and vulnerable legal systems, caused the greatest naval catastrophe since 1987. The Estonia was a ferry and cruise ship operating in the Baltic Sea between Estonia and Sweden, carrying just under 1000 people, of which only 137 survived. Its sinking caused international outrage and in response the governments of Estonia, Sweden and Finland created the Join Accident Investigation Committee (JAIC). The JAIC report blamed the shipbuilders, who in turn blamed the ship operators, and ultimately, the overly politicized commission was ineffective, except at creating more paperwork and new lifeboat regulations.

The final third of the book deals with the end of a ship’s life, focusing on the Alang, India, a coastal town of under 20,000 inhabitants, nearly all of whom are migrant workers employed in the shipbreaking industry. Here, wealthy nations dispose of their ships amid dangerous working conditions and environmental blight. Ships, birthed in the drydocks of nation-states, spend their lives outside of the safety and paternalism of sovereignty, returning to nation-state controlled beaches to be carved up and sold off as scrap metal. The process of deconstructing a ship can expensive and cumbersome, so entrepreneurs in developing countries turned their misfortune at being born in a country with weak civil institutions into fortunes. In an interesting comparison, Alang, India and Baltimore, U.S.A. are juxtaposed. The U.S. Navy, facing mounting repair costs to maintain derelict ships and constrained by EPA export restrictions, decommissioned four ships in Baltimore at a cost of $13.3M. Countries with permissive labor and environmental protections will take any ship that can make it to their shores and the shipbreakers pay for the right to disassemble them. Langewiesche concludes, “Shipping is like the larger world in which it operates—an inherently disorderly affair, existing mostly beyond the reach of nations and their laws…”

Cryptocurrencies, like ships, originate within the confines of a legal system. The inputs they require, energy and integrated circuits are complex to produce and controlled by nation states. Once these digital abstractions have been mined, they set sail on the open web, passing through registries (wallets) and flying whichever “flags of convenience” best suit their purposes. Here they glide, frictionlessly, from port to port amid traffic so dense it obfuscates their purpose, ownership or origin. That is not to say (at least in bitcoin’s case) that concerted effort cannot determine the provenance of one ship or digital token, but as one Coast Guard officer put it, “We’ve got thirty million boats out there…. Can you imagine how we’d have to turn down the gain?” The more interesting question is how cryptocurrencies come to rest. They are not taken out of circulation, like ships, but they do come to land, ultimately upon the shore of a nation-state, when they are exchanged for fiat.

In a recent interview, Coinbase CEO, Brian Armstrong, is pressed by Tyler Cowen on where the value of cryptocurrency comes from:

COWEN: I don’t know exactly who, but someone else has less purchasing power, right? Bitcoin isn’t apples. You can’t eat it for lunch. If I find some bitcoin, clearly, I’m better off, but I’m commanding resources that would have gone to other people, and it’s not clear where the efficiency gain arises that’s giving someone somewhere in the system more apples.

ARMSTRONG: It’s not clear to me that bitcoin is a zero-sum game. Something new of value has been created, which is that we now have a global, decentralized value — and with other cryptocurrencies, of course, because it’s not just about bitcoin now. We have medium of exchange. We have security tokens, smart contracts. This is actually driving a lot of innovation and new value, I would say. It’s not clear to me it’s zero-sum. I think there’s something inherently of value that probably made people, net, better off overall there.

COWEN: But what is that? When do I get my apples, so to speak? Where do they come from?

ARMSTRONG: Well, anybody can participate of course. I’m not sure I’m answering your question super directly, but yes, of course, anybody can participate in this global, decentralized network, and it’s there to benefit anybody who wants to use it. I think, now, about probably 10 percent of Americans and maybe 60 or 70 million people globally have crypto, at least. So it’s been growing a lot.

This is not exactly a satisfying answer, and as the CEO of a newly publicly listed company, I can understand why he is hesitant. There are, of course many answers here, most interesting is Layer1 founder, Alex Leigl’s answer given to Byrne Hobart on a recent The Diff subscriber call. Bitcoin, as a consumer of energy, smooths out notoriously spikey energy demand. This increases the cashflow created by intermittent energy producers, who traditionally only turn on to capture the high energy prices, but can now mine bitcoin in the meantime. Having a store of ready energy production, is better than a battery because there is no energy loss and it makes marginal energy projects, like renewables in some cases, viable.

The endgame here is for bitcoin to be the global energy standard, the way oil is today. Oil tankers are a way to transport energy anywhere in the world, despite the expense and difficulty of maintaining an electric grid and/or natural gas pipelines. If energy markets become priced in bitcoin, as oil markets around the world are priced in dollars, you will be able to take excess energy off the grid in Texas and spend it on electricity in Tokyo. If an energy producer is mining bitcoin with its power supply, they should be indifferent between mining or selling that power for bitcoin. Still, saying “cryptocurrency is valuable because it costs energy,” begs the question.  

We know energy is valuable and we know it takes energy to mine cryptocurrency, so the question is not, “Can an energy producer sell cryptocurrency?” but “Can an energy producer buy all the inputs it needs in cryptocurrency?” This is a harder question to answer. Comparative advantage between ports means ships always have something to put in their holds in both directions, even if demand is less on one route than the other. The alchemy of turning cryptocurrency back into energy requires that energy producers want cryptocurrency in the first place. Inputs for renewables like turbines, photovoltaic cells, steel and cement are not priced in cryptocurrency (yet), and furthermore taxes, which any energy producer will always have to pay, are priced in government money.

So here we are, beached on the shores of the nation-state and run aground by the international finance trilemma (a topic we’ve discussed before). As long as countries can borrow in their own currency, they will require payment of taxes in that currency. So what then is the scrap value of cryptocurrency? In Alang, we learn that ships are torn apart to have the steel sent to rerolling minimills that produce low quality steel rebar for the booming Indian construction market. In Baltimore the legal system created a much more lucrative business to dispose of ships in a way that did not harm workers or the environment. Similarly for cryptocurrency, it is not the inherent value, but the regulatory arbitrage opportunity created by nation-states. As a rule, countries prefer to borrow in their own currency (EU members foolishly gave up sovereign currency and most have regretted it ever since). Export led countries prefer a stable (and low) exchange rate, meaning they must implement capital controls. This is felt particularly acutely in China and Russia, two big exporters with wealthy citizens distrustful of government. The citizens of these countries who want to get wealth out are the ship-breakers of cryptocurrency. The residual demand will always exist as long as people in Russia and China want to get more value out than their governments will allow.

This is not a point that many people like to make or to accept, but it is the backstop to cryptocurrency value and it is one of the reasons the United State government is hesitant to remove this thorn in the sides of their adversaries. Being long cryptocurrency leads one to believe all sorts of potential uses, and Brian Armstrong provides a number of hand wavy explanations as do all of my cryptocurrency advocating friends (don’t hate me, please), but oftentimes many possible explanations is a tell. Any new technology, even a general purpose technology, needs a killer app. The good news for cryptocurrency is that there is one, the bad news is that some governments hate it.

I applaud the rise of cryptocurrency and as a technology enthusiast, I am hopeful for the potential of smart contracts, decentralized autonomous organizations, micropayments or other innovations that cryptocurrencies could enable. At the same time, I have little use for cryptocurrencies, at least for as long as I am not worried about capital controls. The existence of cryptocurrency offers a way out for anybody who feels trapped by their system of government. For those that believe in self determination, this is a good thing! Still, I don’t personally feel trapped, so while I am rooting for bitcoin and other cryptocurrencies, I don’t have much use for them yet, but the best way to keep government from growing tyrannical is competition.

The value of cryptocurrency may, in the end, accrue to all of us who accept living in a nation-state, and that’s a good thing! You don’t have to buy cryptocurrencies enjoy their benefits, but if nobody buys cryptocurrencies, the world will be poorer for it. Many cynics may get rich if cryptocurrencies keep rising, and some unlucky paper hands (🧻🤲) may lose money when the cryptocurrency market corrects, but true believers aren’t going to convert their cryptocurrency back into fiat anyway, and that is the more interesting thing. What do you do YOU want to do with cryptocurrency besides buy money?

Share

Risk Developments

Micro and Macro Hacks

Last friday news broke that the Microsoft Exchange Server product had been hacked. Microsoft sells self-hosted exchange software to hundreds of thousands of customers, although it also competes with it’s Microsoft Online, hosted solution, which is also part of the popular Microsoft 365 cloud office bundle. This is already a wider hack in many ways than SolarWinds, and the numbers keep growing, but it’s not as deep a hack.

For one thing, SolarWinds’ products were administrative tools, that gave deep network insight and access that attackers could use to embed persistently and move laterally. For another thing, many sophisticated and sensitive clients have already moved to a managed email exchange, meaning that many of the 250,000+ affected customers are small businesses and local governments running legacy systems. Still the Biden administration is taking this seriously.

This hack also differs from those on SolarWinds in that it is attributed to the other main U.S. cyber adversary, China, not Russia. It has the hallmarks of a Chinese campaign, less sophisticated, noisier and mass targeting. Russian nation-state hackers, as a generalization, have the capability to plan long term operations targeting specific critical systems for the purpose of achieving a certain objective. China has historically operated opportunistically, working smarter, not harder. It’s the difference between pirate trawling a well traveled trade route for easy prey and privateer with a letter of marquee authorized for a specific goal. Neither are good, but so far nobody is being charged hostis humani generis.

Cyber Coverage

Ransomware is up, limits are down and brokers are getting squeezed. One big challenge is that there hasn’t been widespread agreement about what is covered by cyber insurance and what isn’t. Many legacy general liability policies seem to provide some cyber coverage, a risk that underwriters call, “silent cyber.” Stand alone cyber policies would not only clarify coverage, but also create a new income stream for brokers, carriers and reinsurers, it’s no wonder the industry wants more cyber specific policies.

Still, the insurance industry has a weird adoption curve. Brokers sell the most policies after a high profile catastrophe, but a catastrophe of that size may scare away carriers. It’s a similar phenomenon to liquidity in exchanges. Liquidity always disappears when you need it most. Therefore, discipline and a long-term view can pay handsomely to those who don’t capitulate to market pressure before an event and hold their beliefs after an event.

One space that has seen a positive event over the last few months is cryptocurrency. We’ve discussed the reluctance of insurers to deal in the cryptocurrency space before. Now broker Aon is jumping in with Nayms, a smart contract provider, to pilot cryptocurrency insurance for Teller Finance, a lender operating a decentralized protocol, and underwritten by Relm Insurance Ltd. Like international waters, insurance will become the defacto regulator in cryptocurrency, if the space stays beyond the reach of the nation-state, but within the realm of property.

Cyber Financing

Two big cybersecurity finance moves happened this week. First, Synack, which has created the world’s largest network of freelance white-hat hackers, by offering testing tools for them to coalesce around, raised $300M from venture firm Accell and hedge fund Tiger Global. Their skyhigh valuation pitches them as a SaaS company, but given that their value is more in the people than the software, that may not be true. Still 75% of the cybersecurity market is services, so they have a much bigger addressable market than most software security companies. Justifying their $4.7B valuation is a matter of market share and margin. If cybersecurity is an orderly cleanup, more like decommissioning a ship than scraping it for parts, than margin shouldn’t be hard to justify. Market share will come down to just how differentiating their tools are.

On the other end of the spectrum, cybersecurity a old-timer, Mcafee, is selling off its enterprise software business to a private equity buyer to focus on consumer and personal security. The consumer security market has always been tough for any business except antivirus vendors, especially those with broad name recognition. This deal definitely has the feel of a decrepit supertanker pulling up at Alang beach and being stripped of any valuable remains.

Commodity Commons

In non cyber news an interesting story about commodities theft came to light. The first is an entertaining tale of a trader buying $36M of copper, only to have copper painted pavers delivered. Not only was the deliver fraudulent, but it turns out the insurance policies, which would normally cover the fraud, were also mostly fraudulent, leaving the trader to take the matter to the courts. So far 13 people have been arrested in Turkey. Shipping containers and insurance contracts are abstractions that allow for mass transportation across ungoverned spaces, but these abstractions also create vulnerabilities to exploit.

There is an analogy here between analog and digital systems that I did not make above. Containers and digital containers. Certificates and digital certificates. Vulnerabilities and, well you get the idea. As with all analogies, this one is imperfect, but at least it’s useful. The reason it’s useful is because these are all tragedies of the commons. Other examples are public health, climate change, nuclear waste, space exploration, etc. The inverse of the tragedy of the commons is stone soup, or a schelling point. Being part of something, working together and believing in the same story is what makes these abstractions work. The opportunities and risks are determined by whether we see open space as a place to create new stories or a battleground between existing ones.

Subscribe now

Gratitude

Big thanks to Andrew Kortina, Alex Liegl, Byrne Hobart, Tyler Cowen, Brian Armstrong, Benjamin Dean and others for sharing your ideas with me!

I have written my work, not as an essay which is to win the applause of the moment, but as a possession for all time.

- Thucydides

Risk Developments this letter:

• Fate of Insurance

• FOQNEs

• Broadband Gap

• Tech and Support

Mythos of the Peloponnesian War

Last week I ended Part I of “The Thucydides Trope” before sharing the two biggest risk lessons about decentralization and insider threats. To understand these lessons, I claimed, we had to first answer the questions, “why read Thucydides” and “what happened in ‘The History of the Peloponnesian War’?” Now we will turn our attention to the lessons, which must be situated in the context of ancient Greek thought.

In ancient Greek education, rhetoric was highly prized and debated. It is in this context that Thucydides was writing, and the type of rhetoric he uses in “The History of the Peloponnesian War” combines narrative (diēgēma), description (ekphrasis) and fable (mythos). In his introduction he alludes to other histories (Herodotus) as including hearsay and superstition, positioning his work, by contrast, as purely descriptive, and while there are certain dry recountings of battles and statistics, it is narrative, and particularly the four speeches, that compels the reader. The last and most important context clue about “The History of the Peloponnesian War” is that it ends abruptly just after Thucydides describes (2,000 year old spoiler alert!) the demise of the Athenian empire. 

This is an important signal that it is more than a simple description or narrative, but a story with a moral. The victors (Sparta, Thebes and Corinth) must have approved of the text, which presented a convenient explanation of the war that blamed Athenian political duplicity, democratic avarice and above all imperial hubris. It is with this in mind that we should read “The History of the Peloponnesian War” as a more than just description or narrative, but as a fable.

The two lessons to be learned from this fable are about decentralization and insider threats. Much of the work focuses on the issue of governance, both the political processes within Athens and the attempts at managing external relations, either between hostile city-states or with allies and tributaries. These governance issues relate to the second point about insider threats since the insider threat is often what exposes weaknesses in internal governance to external relations and vice versa. Before diving into the comparisons between systems of governance, here’s a brief refresher on the most important characters and speeches:

• Pericles (popular and restrained Athenian politician/general)

• Cleon and Nicias (Athenian politicians/generals, hawk and dove respectively)

• Brasides (Sparta’s greatest general)

• Gylippus (Spartan general in Sicily)

• Alcibiades (Athenian politician/general and traitor)

Speeches:

• Congress of the Peloponnesian League

• Funeral Oration of Pericles

• The Melian Dialogue

• Speeches of Nicias and Alcibiades

When we left off last week, in book six, Athens had elected the reluctant Nicias and the hawkish Alcibiades (after speaking their cases) to lead a 100 ship invasion of the island of Sicily, in order to break their stalemate with the Peloponnesian League. The reasoning, the hawks claimed, was in part defensive, since Syracuse, the largest city-state on the island of Sicily, was related to the people of the Peloponnese. Furthermore, Syracuse was the second largest democracy, behind Athens. From a modern perspective we might find it odd that democracies did not see themselves as natural allies, but the Hellenistic view of democracy was as a fickle and rapacious form of government. It was thought that eventually the expanding spheres of both democracies would collide, and that Athens should strike while they still had the upper hand.

It is important to remember that Athens inherited much of its empire as a direct result of defeating the Persians in the naval battle of Salamis. They earned their reputation by fleeing the safety of their city and taking to ships that routed the Persian navy, saving the Peloponnese from invasion. This honor, cunning and naval superiority earned them both respect and justification for their imperial claims. In the first major speech of the History, The Congress of the Peloponnesian Confederacy, the Corinthians plead with Spartans to defend their allies and make war on Athens, while the Athenians invoke Salamis and attempt to justify their empire as a defensive necessity.

The irony is that the democractic, urban and educated Athenians, who allowed their imperial subjects to bring lawsuits and treated their subjects as peers, must act more tyrannically to ensure their colonies, tributaries and trade routes remained intact. As a democracy, they wielded reputation, narrative and rhetoric to keep together their empire. The oligarchy of Sparta, by contrast, ruled a largely agrarian and static society based on a system of caste slavery. The Helots, a serf-like class, provided labor to the Spartiates who, as a small ruling minority on the Peloponnese, had to maintain a constant war footing due to potential revolts. This kept their allies from harboring any suspicions that Sparta aspired to an empire and made dealing with the Spartan kings easier, as they had a reputation for deliberation and consistency.

It is this tension between internal decentralization and external centralization on the one hand, and internal centralization and external decentralization on that other, that underpins the whole conflict. As Thucydides points out, alliances are based on both trust and fear. Trust that your allies will keep their word and fear of what they or their enemies are capable of. Decentralized systems make it difficult to anticipate how promises will be kept, but centralized systems are more susceptible to concentrated risks. Historical analogies are always flawed and sometimes dangerous, but the importance of reputation and perception is ever present. For comparing systems today, the timeless truths about reputation and the perceptions of your counterparties is far more useful than trying to determine direct equivalents, whether looking at cryptocurrencies, Sino-American relations or remote work.

Getting back to book six, we must address the most pivotal event and most pivotal character of the whole History. The night before the Athenian fleet launches, bound for Sicily with great fanfare and investment of wealth, manpower and political capital, a number of herma (sacred statues) are desecrated. Alcibiades is sent off with the fleet and tried in absentia by his accusers for defiling the statues and other sacrilegious acts. While sailing to Sicily, the generals debate between strategies. Nicias’ plan, in keeping with his reticence, was to come to the aid of their allies, broker peace and make a show of force. Alcibiades wanted to make permanent encampment on the island, employ diplomacy to win more allies and then attack Syracuse by land and sea. It was his plan that was chosen, but it would proceed without him as news of his arrest reached the fleet just as they arrived in Catania (see map below) and he defected to Sparta, slipping away on his return journey to Greece.

It is from this point onward that the History takes its tragic turn. With Alicibiades providing important intelligence to Sparta, Gyllipus is dispatched to rescue Syracuse and the fate of Athens is sealed. After winning some minor victories, the Athenians are unable to gather significant allied support and make their assault on Syracuse, which nearly succeeds, but the Syracusians hold out for Spartan support. Hearing of the Spartan expedition, Athens sends yet more ships with their greatest general, Demosthenes, who has a short lived victory followed by a resounding route, which forces the Athenian army back into a marsh and bottles their navy up in a harbor. At this point it becomes clear that the greatest fighting force Athens ever fielded will be annihilated, along with their best generals.

News soon reaches Athens where the people go into a state of shock and despair. Alcibiades further twists the knife by inciting revolt among the Delian League as he travels from city to city sharing the news. Ultimately, he defects again to the Persian side (he may have seduced a Spartan king’s wife) under satrap Tissaphernes. The Persians, who had been funding the Spartan navy to combat the Athenians, began to withdraw their support. In advising Tissaphernes, Alcibiades plots his return to Athens by attempting to get the Persians to switch sides. He is not successful in gaining Persian support, but he manages to take power on the island of Samos and incite a coup in Athens, where an oligarchy of 400 takes power and reinstates him as an Athenian general. Eventually the oligarchy collapsed and was replaced by a government Thucydides calls “the 5000” a broad oligarchy of propertied Athenians. Alcibiades plays a key role in multiple naval victories and takes the fight to the Hellespont (modern day Turkey near Istanbul). Alcibiades then makes a victorious return to Athens, and the charges of blasphemy are dropped. The History then abruptly ends, before one last Athenian defeat followed by a peace settlement with Sparta two years later.

The character of Alcibiades is one of the most polarizing in ancient history. Ambitious, cunning, treacherous and shrewd, he is the kind of person you want on your side, not because he is loyal, but because of the damage he could do as an enemy. He was the only general capable of pulling off the invasion of Sicily, but his private interests prevented him from winning necessary political alliances. The ambitious insider echos the themes from the Melian Dialogue, the conflict between liberal ideals of justice, honor and moderation on the one hand and realist ideals of force, self interest and appetite on the other. Alcibiades is clearly a representative of the realist school. Organizations that ignore realism are doomed to become prey, but those that ignore liberalism will become victims of their own ideology, when realism metastasizes as insider threat. This excellent essay by Emil Kleinhaus on Leo Strauss’ reading of Thucydides explains:

Athenian general Nicias virtually repeating the Melian view, is clearly deliberate.49 Strauss insists that the connection between the dialogue and the expedition must be seen in light of Thucydides’ explicit explanation of the expedition’s failure—“the emancipation of private interest in post-Periclean Athens.”50 Yet the dialogue is about public interest of the most extreme kind, namely the desire for empire. In fact, it mirrors Pericles’ last speech, in which he admits that “the empire is a tyranny” while defending the empire on the basis of “the glory of the future.”51Strauss must somehow link Thucydides’ judgment about private interest ruining the Sicilian Expedition with the fiercely public-minded strain of thought that runs through Pericles’ last speech and the dialogue. He argues:

Those who contend that there is a connection between the Melian Dialogue and the Sicilian disaster must have in mind a connection between the two events which Thucydides intimates rather than sets forth explicitly by speaking of the emancipation of private interest in post-Periclean Athens. The Melian Dialogue shows nothing of such an emancipation. But it contains the most unabashed denial occurring in Thucydides’ work of a divine law which must be respected by the city or which moderates the city’s desire for “having more.” The Athenians on Melos, in contradistinction to Callicles or Thrasymachus, limit themselves indeed to asserting the natural right of the stronger with regard to the cities; but are Callicles and Thrasymachus not more consistent than they? Can one encourage, as even Pericles and precisely Pericles does, the city’s desire for “having more” than other cities without in the long run encouraging the individual’s desire for “having more” than his fellow citizens?52

Strauss has thus established a direct relationship between the arguments presented by the envoys to Melos and the Athenian failure at Sicily and even the eventual civil war. As Clifford Orwin puts it, “the introduction of the ‘Athenian thesis’ into domestic affairs proves disastrous.”53 The justification for tyranny cannot be bracketed and applied only in the public sphere, according to Strauss, and the Athenians at Melos defend tyranny in strong language. During the Archidamian War, Pericles was able to subvert Athenian democracy and maintain order, but after Pericles’ death, the position articulated in the dialogue leads inevitably to the domestic strife that undermines the expedition. The “Athenian thesis” as expressed at Melos is self-mutilating.

In conclusion, let us dispel the common tropes associated with Thucydides. You have probably heard of the Thucydides trap, a phrase coined by Graham Allison and picked up by Chinese propagandists. It alludes to the famous explanation Thucydides ascribes to the war, “the growth of the power of Athens, and the alarm which this inspired in Sparta, made war inevitable.” This line of reasoning draws a historical analogy; the United States is to Athens as China is to Sparta. Historical analogies are usually wrong, but this one is wrong and unoriginal. It is a rehash of the Cold War analogy that came about from the anti-war movement during the Vietnam War, which at least had clearer parallels. In that case, Vietnam was represented as the Sicilian Expedition, a foreign folly fated to bring about the fall of a democratic empire. The United States was caste as Athens and the Soviet Union Sparta, but as history has shown, that analogy was also imperfect.

The lessons about decentralized systems tending towards tyranny or the difficulty of balancing defense against invaders while preventing insider threats are Thucydides’ real lessons. As we have done when discussing Machiavelli, let us turn back to Strauss. The paradox of governance, as Strauss points out above, is that realism can only avoid self-mutilation by sacred law, yet sacred law is irrational. The paradox of history, Strauss goes on to explain, is that universal truths cannot be extracted from particular events, yet particulars are subject to universal truths as well as idiosyncrasies. Overdetermination is a difficult problem and historical analogy is a dangerous game. What lessons we can learn from Thucydides are clouded with sentiment of not only Thucydides himself, but also those that preserved, copied and translated his text.

That is why the third lesson we can learn from “The History of the Peloponnesian War” is the power of an early departure. The abrupt ending, while the conflict still raged, is evidence that Thucydides died before completing his work. Byrne Hobart had some illuminating thoughts on departed leaders in a recent issue of The Diff:

At GE, Welch maintained his celebrity status by hitting his numbers. After GE, he could only maintain that status by drawing a sharp delineation between the remaining positive parts of GE (which he took credit for) and the negatives (for which he could blame the EPA, the SEC, and, most inconveniently, his successor). Institutions as diverse as ancient Rome, Christianity, and Bitcoin illustrate the importance of a charismatic founder who departs from the scene as soon as a successor takes over; founders who provide running commentary after they're no longer in charge end up complicating management enormously.

We should trust Thucydides more because of his inability to meddle after he was published. It is an odd advantage to die before being done, but Thucydides had a few odd advantages; he was an ostracized Athenian, a failed general and a writer unable to finish his life’s work. These “advantages” allowed him to violate the paradox of history. Because of this, we should honor his work by refraining from simple syllogisms and instead, closely read his work for universal truths.

Share

Risk Developments

Fate of Insurance

We’ve been following the long awaited Aon WTW megamerger here, and if markets are any kind of truth indicator, it looks like the deal may get the green light. Merger arbitrage hedge funds are taking interest as a few events create opportunity, including the recent European commission hold, Australian regulatory interest and Warren Buffett’s investment in Marsh. One advantage mentioned in the article would be increasing centralization of broker data. Brokers are just one piece of the insurance value chain though and they rely on carriers and reinsurers. With more data and greater market power they may be able to drive a better bargain for their customers or they may just capture the improved pricing for themselves. 

All of this is happening amid a continued difficult year for the insurance industry, as Europe’s four biggest reinsurers fail to earn their cost of capital. Low rates, lots of competition and an uptick in losses has made the environment favourable for reinsurers and carriers, but brokers have had less exposure to all three of these issues. In fact, as premiums rise and capital markets are awash in quantitative easing, fresh money is pouring into insurance despite the difficult environment.

Whether Aon is merging or not, they are seeking to take advantage of the demand for insurance assets with a new offering aimed at named perils in new and emerging technologies. The combination of accessing the capital markets directly through sales of insurance linked securities and more tightly prescribing the specific peril being covered may be an attractive proposition for the insured and investors, but Aon may face challenges building an ILS empire if it’s centralized model gets pushback from its traditional allies.

FOQNEs

A couple weeks ago, I wrote about Neal Stephenson’s Snow Crash, a cyberpunk dystopian novel in which Franchise Owned Quasi-National Entities (FOQNEs) have replaced the nation-state as provider of public goods. Now Microsoft is open sourcing its SolarWinds hunt tool for anybody to use. I applaud Microsoft and am grateful for their efforts, but isn’t it odd to rely on monopolies instead of governments?

The CodeQL project, owned by Microsoft, is part of their Github acquisition. Github itself is adjacent to a public good. A code versioning and repository business’ compliment is code, so it’s not very surprising that they want to commoditize code. An operating system’s compliment are applications, which is why Microsoft loves “developers, developers, developers.” Still, open source cybersecurity tools are a classic example of a nonrival, nonexcludable good, so why is the government failing to provide this public good?

In other FOQNEs news, the bitcoin barge was scrapped. After libertarian cryptocurrency enthusiast purchased a cruise ship, during the cruise industry’s nadir last spring, they found out that owning the boat was not enough to make it the fiat free utopia they had hoped. It turns out the insurance industry requires payment in legal tender and the owners could not get the policy required under maritime law. If bitcoin keeps going up and rates keep going down, insurers are going to feel pretty silly for not taking premium that invests itself, but as it turns out, insurance companies still have to pay investors, employees and taxes in government money.

Broadband Gap

The ability for governments to provide public goods depends on both the good and the government. As discussed, the U.S. government is not particularly good at provisioning code, but it has historically been pretty good at building out telecommunications infrastructure. Still, in much of rural America broadband internet access is still expensive or impossible to get. This long form piece from cnet does a great job of discussing part of the issue.

Now with work and study from home being accelerated, the FCC is approving a $50M subsidy for high speed internet. Still, this won’t do much for people without access to broadband. For all the talk of remote work, little of the wealth is going to be spread to rural America. Concentration of power in a few metropolitan areas may keep the current system from imploding, but it’s not going to do any favors for improving social mobility, defeating stagnation and reigniting innovation.

Tech and Support

One public good that the U.S. government provides in abundance is national defense. The Airforce just awarded a $4.445B contract to defense contractors General Dynamics, ManTech and Northrup Grumman for “Special Access Programs” support. These classified programs require lots of secrecy and information infrastructure to support. Everything from systems integration to classification systems, identity management, authentication, auditing and training has to be done, just to support secrecy, which General Dynamics and ManTech have teamed up to provide before.

Secrecy can be an issue of national security, so it makes sense to protect vital information, but it also is by definition a support task. That is, maintenance, not production. David Graeber has a great line I’ve mentioned before about producing a cup once, but washing it ten thousand times. Most work is not productive, by which I mean capital creation. Creating a cup saves future generations from having to produce drinking vessels or use their hands, but washing a cup does not compound the effort.

Likewise, Internet of Things (IoT) devices, such as cars, appliances, sensors, meters, etc. will provide a boost to efficiency but then require ongoing support and security to maintain. With the number of IoT devices expected to triple by 2025, this could be a major drag on productivity, unless the devices are built with security and maintenance in mind. One particularly scary application of this could be autonomous weapons.

Paul Orlando’s newsletter, Unintended Consequences, touched on that issue last week. He raises moral, democractic and systemic risk issues, all of which are big concerns. In addition there are problems of proliferation and support. Autonomous weapons are a lot easier to build, acquire, steal or modify than say nuclear or biological weapons. MSCHF, the marketing/trolling stunt performance collective, for example attached a paintball gun to a Boston Dynamics robot. Boston Dynamics was none too happy about the association and voided their warranty. It’s easy to imagine a future in which a country buys autonomous weapons from an ally and is then threatened with the national-security-as-a-service being turned off. Alliances are about trust and fear after all.

If you’re interested in further discussion about autonomous weapons, decentralization and risk, check out this terrific interview with former U.S. military member, Radigan Carter,

Subscribe now

Gratitude

Big thanks to Radigan Carter, Demetri Kofinas, Paul Orlando, Byrne Hobart and Emil Kleinhaus.