From Good to Bad and Back Again
What The Winter’s Tale can teach us about risk: Digital:Relationship Banking::Trading:Deal Making; Multipolar Deals; Whither Insurtech?; Cyber Achilles; Cyber Talent 2030
Exit, pursued by a bear
— William Shakespeare, The Winter’s Tale (3.3 1551)
Risk Developments this letter:
Digital:Relationship Banking :: Trading:Deal Making
Multi-Polar Deals
Whither Insurtech?
Cyber Achilles
Cyber Talent 2030
Turnarounds
If Shakespeare’s “The Merchant of Venice” is about debt and risk mismanagement and “The Tempest” is about innovation and new technology, “The Winter’s Tale” is a turnaround story. One of Shakespeare’s most inscrutable plays, “The Winter’s Tale” is controversial and frequently the subject of discussion among literary critics, but not popular enough to be known by those who have only scratched the surface of Shakespeare’s cannon. Being both obscure and important, “The Winter’s Tale” holds many lessons, chiefly why sequence matters, especially when things go from bad to worse, and how to recover from worse to better.
The Fall
As with all turnaround stories, things begin well. King Leontes of Sicily is hosting his childhood friend King Polixenes of Bohemia. After nine months, Polixenes is ready to return home, despite Leontes’ attempts to convince his friend to stay longer. As a last effort, Leontes sends his pregnant wife to convince Polixenes, who she easily convinces with her verbal agility. Suspicious of how quickly she succeeded, Leontes decides she must be having an affair, and the child is Polixenes’. This faulty logic. kicks off a chain of events:
Leontes orders Camillo, a Sicilian Lord, to poison Polixenes.
Camillo warns Polixenes instead and they both escape to Bohemia.
Enraged by Polixenes’ escape, he throws his wife in jail, and sends two Lords to obtain “evidence” of Hermione’s infidelity from the Oracle.
Meanwhile, Hermione gives birth to a baby girl in jail, whose sight drives Leontes to madness, and he takes two drastic actions.
He orders the child abandonded and arranges a show trial to humiliate his wife.
Shocked by the accusations against his mother Mamillius, Leontes’ heir, dies.
At the trial, the Oracle’s message exonerates Hermione, but Leontes finds her guilty anyway.
When Mamillius’s death is reported, Hermione faints, and is reported dead soon after.
Leontes, upon learning of his son and wife’s death is now repentant, but it is too late.
In Bohemia, Leontes’ daughter, Perdita, is left on the coastline, with royal trinkets, by the lord entrusted with the task as he is chased away by a bear, giving cause for Shakespeare’s most famous stage direction, “Exit, pursued by a bear.” Perdita is raised by shepherds, who have become rich from the trinkets, and grows into a beautiful young shepherd girl. Polixenes’ son Florizel falls in love with the lowly Perdita and plans to elope during a feast thrown by the now wealthy shepherd. The feast is enjoyed by all as Autolycus, a peddler cum conman, provides entertainment selling trinkets, picking pockets and telling stories, but the marriage is spoiled by Polixenes and his Bohemian (formerly Sicilian) Lord, Camillo, who attend the ceremony in disguise.
The Return
Facing penalty of torture and death, Florizel and Perdita are warned by Camillo, who again warns the innocent and helps them escape, this time in reverse, heading to Bohemia. This time a chain of events is initiated by Autolycus, who inverts the previous bad chain reaction.
Autolycus disguises Florizel and Perdita, providing guidanace on subversion.
Leontes receives Florizel, who pretends to be on a diplomatic mission, but the arrival of Polixenes and Camillo spoils the act.
Reunited, Leontes and Polixenes settle their fight and discover Perdita’s royal lineage.
The shepherds are made gentlemen for their kindness in raising Perdita, and Autolycus is forgiven for his mischief.
In the closing scene, Leontes, Polixenes, Camillo, Florizel and Perdita go to see a statue made in memorial to Hermione.
The statue comes to life, Leontes and Hermione are reunited and Florizel and Perdita are engaged.
It’s a feel good play, until one realizes that Leontes’ and Hermione’s son Mamillius is still dead. Even the best turnarounds are costly, and the first priority for risk takers of all types is to avoid self inflicted wounds. Easy as that sounds, it’s not always so simple. Take Leontes for example. His beliefs about people, relationships and the world cloud his judgement. Polixenes is an old friend, but also clearly a rival. Both kings, both playboys in their youth and both fathers, they have too much in common for jealousy not to sneak into their friendship. Not only does Leontes’ jealousy contribute to his downfall, but also his prejudice. He cannot believe it is his wife’s intelligence, not her beauty that convinced Polixenes to stay.
Jealousy and prejudice, while bad, are common faults to be avoided. What really sets Leontes apart is his impulsive and headstrong nature. It is the sequence of events with cascading consequences that is so troubling. To be jealous of a friend or accuse someone innocent is rectifiable, but Leontes jumps to the conclusion and immediately plots a murder. When this fails, he predictably takes it out on his wife by throwing her in prison. Throwing your pregnant wife in prison is already a pretty bad look, so when presented with his child, Leontes becomes even more irate and takes it out on the most helpless person, a baby. To justify abandoning a baby and throwing your wife in jail, you’d need some pretty bulletproof evidence, so a public trial is necessary. When the trial doesn’t go your way, but you’re the king, you naturally throw out the evidence and declare the offending party guilty.
Order Matters
Take any one of these events out of order and the whole chain would break down. Leontes could have reasoned with his friend, but the attempt on Polixenes’ life made him flee. He could have let his wife give birth before jailing her, which would have provided time to cool off and perhaps not order his baby abandoned. No abandoned baby, no need for a public accusation to justify heinous acts. No accusation, Mallimus doesn’t die. No death of their son and Hermione doesn’t faint at the trail. No fainting and Leontes might have had one last chance to accept the Oracle’s exoneration.
This is reminiscent of another, more famous Shakespeare play, Romeo and Juliet. When Juliet is upset at being forced to marry Paris instead of Romeo, she takes a sleeping potion to fake death on her wedding day. Romeo hears of Juliet’s death and arrives at her tomb to find Paris, who challenges him. Romeo slays Paris and then poisons himself. Juliet wakes up to find Paris and Romeo dead, and stabs herself with a dagger. A chain of self inflicted events leading to great tragedy, that could have been avoided except for the sequence.
What separates “The Winter’s Tale” from Shakespearian tragedies, is that it not only demonstrates how human fault and poor ordering of events can lead to disaster, but also how mercy and kindness coupled with the right ordering can reverse course. For this reason, “The Winter’s Tale” is sometimes grouped with Shakespeare’s problem plays (“Troilus and Cressida”, “Measure for Measure”, “All’s Well That Ends Well”, “The Merchant of Venice” and “Timon of Athens”). These plays neither fit the tragedy nor comedy mold and often deal with ambiguous social problems and moral dilemmas of the day.
“The Winter’s Tale” deals primarily with class, lying and virtue. The kings both lack virtuous traits such as patience, equanimity and jurisprudence, while the shepherds are kind, magnanimous and humble. Other servants, such as Hemione’s attendant, who reports her death and made the “statue” in her memory, or Camillo, who twice disobeys his Kings, demonstrate when lying is actually virtuous. The main issue for which class is pivotal though is the marriage of Florizel and Perdita. Ultimately it is condoned when her royal lineage is revealed, and the shepherds, now wealthy, and shown to be honorable are made nobles.
The Lock
Still, one character does not quite fit, and is the key to kicking off a good sequence of events. Autolycus is a rogue, a vagrant and a lone wolf. Homelessness was one of the major social issues of Shakespeare’s time, as a flurry of vagrancy laws from 1530-1597 sought to curb the problems of unemployment, homelessness and a breakdown of feudal social order in a time when your place in society, your job and your home were one in the same. Peddlers, conmen and thieves, sometimes known as Abraham-men, in 16th century England, subverted this order through free travel, impersonation and having no masters.
Why is Autolycus the key? For one thing, he is a trickster, and we have spoken about the importance of tricksters here before. For another, he changes the whole tone of the play, introducing comedy. Besides one of the earliest mentions of sex toys, Autolycus also makes fools of numerous characters, most notably the Clown, who he robs three ways. First, he picks the Clown’s pocket on the highway while claiming he needs help standing up from being beaten and robbed. Second, while impersonating a peddler, he gets the Clown to pay for printed ballads, which the Clown buys to impress his love interest. Third, while impersonating a member of King Polixenes’ court he convinces the Clown to pay him with the shepherds’ money to get an audience with Polixenes, so they may plead their case that Perdita is secretly adopted from a noble line.
Between the second and the third robberies, Camillo orders Florizel to trade clothing with Autolycus, so that Florizel may flee with Perdita in disguise. Not only does this outfit swap provide Autolycus with the garb necessary to impersonate a courtier, and therefore connect the shepherds with Polixenes, but it is symbolic. He is teaching them the art of deception, just as his namesake, Autolycus Odysseus’ father, taught Odysseus (and Hercules).
In this way, Autolycus sets off a positive chain of events that begins with disguising Florizel and Perdita and ends with their engagement and the revivification of Hermione. The first act, disguising the lovers, is followed by introducing the shepherd to Polixenes. Then the arrival of Perdita and Florizel in Sicily results in Leontes’ joy at being reunited with his daughter. Camillo and Polixenes’ arrival coincides with Leontes’ good mood and all is forgiven. The Clown and the shepherds are made nobles as both kings are overjoyed, and Autolycus is forgiven by the newly minted nobles who are feeling magnanimous. Finally, all go to Hermione’s attendant’s house and Hermione “comes alive.” Nobody questions the attendant’s obedience to Leontes, and Florizel and Perdita obtain both family’s blessing to get engaged.
If Camillo and Polixenes arrived first, Leontes might have been displeased at seeing his former vassel and friend. The shepherds may have been brutally punished, if their appeal came before Leontes’ confirmation. Hermione may not have “come to life” if Leontes didn’t have reason to celebrate and Perdita had not arrived. As in Romeo and Juliet, Leontes may have been so distraught at the sight of the statue that he may have killed himself, and Hermione, like Juliet may have reciprocated. Out of sequence, this could have gone horribly wrong.
Pyrosequencing
It is Camillo who plans for Florizel and Perdita to escape wearing disguise, and disguises are what lets them leave swiftly, setting off the whole chain of events. It is Camillo who sees to it that each domino falls into the next, but just as with any chain reaction, there is not much for him to do, but watch. Feedback loops are powerful, but hard to get going, and a properly sequenced set of events is a feedback loop of sorts. We’ve talked about these loops before, in Negative and Positive Reciprocity, and they are central to what Charlie Munger calls lollapalooza effects. It’s why Big Exits Start Small and why aggregation risk is the bain of the insurance industry. So if Camillo foresees the potential and observes it play out, what does Autolycus have to do with anything?
Autolycus is the catalyst. The spark. The initial burst of energy. Chains of events move by inertia, stopping or starting that inertia requires creativity and some rule breaking. Camillo may help innocents escape unfair judgement, but he’s no heretic. Autolycus explains the characteristics of a good catalyst:
I understand the business, I hear it: to have an open ear, a quick eye, and a nimble hand, isnecessary for a cut-purse; a good nose is requisite also, to smell out work for the other senses. I see this is the time that the unjust man doth thrive....every lane's end, every shop, church, session, hanging, yields a careful man work.
The skills of a turnaround artist are listening for opportunities, spotting them quickly, acting on them decisively and sniffing out potential. A certain lack of adherence to scruples is also helpful, but note that Autolycus operates by a certain thief’s code, preferring lies of omission and trickery to threat of violence. He always remains on good terms, even with those he has swindled. Finally, to know the right hunting grounds and maintain a fastidiousness work ethic behind a facade of buffoonery.
Risk Developments
Digital:Relationship Banking :: Trading:Deal Making
Byrne Hobart had a piece (subscriber only) on what we can learn from the death of the evening newspaper. Do read the whole thing, because my take away will not do it justice. One lesson he shares is that the transition from analog to digital media was not a straight line. Daily papers did better as evening papers weakened, due to competition from TV and shifting customer preferences. Similarly, technology is upsetting the equilibrium in financial services, and don’t expect it to be a straight line from here to frictionless internet utopia. Some early winners will be unstable in the longer term, just as daily newspapers, who profited for decades, ultimately had to face competition from the internet.
This model explains some rather peculiar news from the finance sector in 2020. Bank of America’s profits from Q4 2020 are down 22%. Brutally low interest rates hurt the retail giant, while trading profits did not increase nearly as much as at some other banks. Goldman Sachs, meanwhile, doubled its profits in 2020 due to its trading and deal making. With success like that, and BoA’s fresh wounds, you might wonder why Goldman is taking such pains to build out retail banking, offering checking accounts later this year. And it’s not just Goldman, JPMorgan is buying credit card rewards points manager cxLoyalty.
Goldman is betting on digital banking (check out other Goldman thoughts here), while BoA is saddled with the cost structure of a large manual system of retail banking. JPM is somewhere in between, with a large retail workforce, but stronger trading and deal making to buoy the relationship banking. Deal makers had a good year as capital markets ballooned and retail investors piled into IPO’s, but just like with the daily newspapers, a better environment today does not mean a sustainable long-term advantage.
As relationship banking gets pummeled, like the evening papers of yesteryear, digital banking will continue to win. It’s not just a story of retail versus investment banking, but of fintech versus labor intensive models. On the investment banking side of the house, trading has long benefited from the scale of symbolic manipulation, whether dollars or bits. Any industry based around symbolic manipulation, such as media, software or finance, inherently understands the importance of sequence. In media's case, the longer term threat of digital transformation was a short term windfall for the fittest analog players. Finance may be living through it’s own 1970’s newspaper boom, but deal making fees could be the next Chicago Tribune.
Multi-Polar Deals
Network device conglomerate Cisco, got antitrust approval to buy Acacia Communications. The San Jose, CA based company buying the Maynard, MA based company wasn’t held up by U.S. regulators. It was regulators in China that had scotched the deal. Acacia backed out this summer citing the Chinese regulatory approvals necessary as both companies have significant contracts in place with Chinese firms. Acacia, which makes silicon solutions to connect optical networks used in long-haul metro and inter-datacenter will be a boon to Cisco’s optical networking, but the deal signals a new regime for multinational M&A.
In 2018 Chinese regulators quashed the American Qualcomm and Dutch NXP deal. The Trump administration was in full China hawk mode, and people were heralding his administration as catalyzing a foreign policy pivot. Fortunately for China, Trump is a loose cannon, but he is no sequencer. Sequencing a set of events to reorder the global system turns out to be a lot harder than blowing it up.
Earlier this month, American Applied Materials raised its bid for Japanese Kokusai pending Chinese regulatory approval. During the Biden administration honeymoon, perhaps American firms see Chinese regulators easing up, but don’t count on it lasting too long. Now that Chinese regulators have used the stick and the carrot, they won’t hesitate to use the stick again, if Biden attempts to re-sequence international affairs.
Whither InsurTech?
Retail banks were not the only ones hit hard by perpetually low interest rates. The insurance industry has suffered low rates and a soft market for years now. Finally the market is firming up as premiums rise, but rates continue to be rock bottom for the foreseeable future and expected losses last year were the fifth highest on record.
Doubling down on Byrne’s thesis from above as it related to banking, are there ways to apply it in insurance? There isn’t quite the retail versus investment banking split, although there are brokers, underwriters and reinsurers, and the digital divide has not made itself felt yet. Insuretech, all the rage a few years ago, seems to have fallen out of the fintech discussion.
It could just be overshadowed by financial infrastructure companies or maybe lending, payments and neobanks are sucking up lots of oxygen, but I think it’s something else. Insurance has a cultural issue as it relates to risk. Alex Danco’s terrific piece on the Canadian startup ecosystem underscores some of the cultural traits (or lack thereof) that Canada and the insurance world have in common.
While the dour, detail oriented outlook of insurance may not be a good fit for startups, it could be great for cybersecurity, a field prenaturally disposed to pessimism. One interesting question I like to ask is whether it’s easier to teach a cybersecurity person insurance or insurance person cybersecurity.
Insurance broker and risk advisor Marsh, has announced a list of fifteen cybersecurity products designated by a group of carriers organized by Marsh. What should we expect from this list? The carriers potentially have useful data (loss size and frequency) and perhaps less bias than a tech insider might. Still, the list doesn’t cover a full tech stack, or even the most important parts, so as a practical guide, it’s not much help, and as a financial lever, it lacks any alignment of interests through discounts on premiums or other mechanims. Cybersecurity pros have healthy skepticism and a first principles view of how cybersecurity impacts a busines, which means the dominant regime for software selection is highly discretionary, but it won’t necessarily stay that way.
If you’re a rationalist from the tech world, you might say, “tech is too hard to learn and Dunning-Kruger tells us amateurs are overconfident.” Then again, Dunning-Kruger seems to be a statistical mirage and the insurance industry can be just as opaque as cybersecurity. Still, I’m a believer that cybersecurity will figure out insurance. One thing that’s most puzzling about cybersecurity is how culturally pessimistic it is, while still maintaining an optimistic startup scene. That paradox seems reminds me of Autolycus and his ilk.
Cyber Achilles
We like to say around here that “Any sufficiently advanced antivirus software is functionally undistinguishable from malware.” Endpoint protection company Malware Bytes was targeted by the same threat actor as the perpetrator of the SolarWinds hack, according to Microsoft, in December. Malware Bytes doesn’t use SolarWinds, and the breach only affected a limited number of emails, but two things are significant about this threat. First, the adversary used similar techniques, like self signed certs and privilege escalation, but this time targeting weaknesses in Microsoft Azure Active Directory (AD). Second, they were going after another security company.
Security companies create an Achilles’ heel for attackers to focus their efforts on. Widely deployed with high level privileges, security tools make the perfect weapon. Not only was this threat actor targeting Malware Bytes, but also one of the biggest single points of failure, Microsoft AD. AD has been a sore spot for many years, and the centralized internal servers that run these services are necessary, but tricky to manage.
Another such single point of failure is Domain Name System (DNS) traffic. DNS is how computers look up IP addresses associated with a human readable domain name. Computers do this recursively, by asking the next computer up the tree to resolve the domain name, and if they can’t, asking the next computer up the tree, and so on. When one of these caches is poisoned, an IP address can be spoofed, resolving a legitimate human readable URL to a malicious IP address.
To prevent this, companies may run their own DNS servers internally, so common requests don’t have to hit the public internet, or they can use a variety of security techniques, such as DNS Over HTTPS (DOH). Using DOH encrypts the request so that the traffic is opaque to anyone, but resolvers. This prevents a man-in-the-middle attack, whereby a bad actor inserts themselves into the DNS query chain and returns a malicious IP address. Yet, there are downsides, the biggest of which is that it centralizes traffic in third-party DOH resolvers.
When coupled with internal DNS servers, DOH can be problematic, since many security tools must monitor internal traffic to work, and as the article linked above says, Iranians have already use DOH to exfiltrate from networks they have compromised. Last year the Computer Infrastructure Security Agency (CISA) asked US federal agencies to stop using DOH internally. So now the NSA is telling enterprises the same thing. Not terribly shocking to hear from an intelligence gathering agency that you should have nothing to hide, but they have a point.
It is a fundamental axiom of the internet that security technology is dual use (commercial and defense applications), but that it also enables the attacker is the worst kind of self inflicted harm. When it comes to self inflicted harm, we should take heed of Leontes and avoid extreme solutions to problems that we don’t even fully understand.
Cyber Talent 2030
Finally, I’d like to discuss another recurring theme here, cyber talent. Hardware security startup, Red Balloon Security, made a splash with their attention getting recruiting and interview tactic of sending out encrypted hard drives with bitcoin on them. They have performed similar stunts in the past, setting up a hackable ATM in the Columbia computer science lounge. With limited resources, and a high bar for talent, this is a clever approach.
At the same time 41% of IT leaders in a Trend Micro survey reported that they believe their role will be performed by AI by 2030. It’s possible that cybersecurity jobs, like law, are bimodal, but I think it’s more likely that something else is going on. It takes a certain kind of nihilism to believe that what you do is so rote that a computer could do it, but also that a computer shouldn’t do it. In the future, AI will do all the management and compliance tasks that don’t matter anyway, while the real IT security pros do important things, like dig up cash we’ve buried in the ground
Gratitude
Thank you to Roger Farley, Byrne Hobart, Alex Danco and Matt Levine for your input and writing that contributed to this week’s letter!