This is one of my favorite USDS stories: Very quickly in my career at USDS I developed a reputation for being a person you could send out an SOS distress call to, not so much inside USDS itself but externally with contractors and different government partners. There’s a fair amount of backstabbing in the government, even in the civil service. Whenever you chose to reach out to a 3rd party to ask for help you were taking a risk that the person you reached out to would screw you over. Just because DC doesn’t have a palace doesn’t mean we don’t have palace intrigues.
Anyway, one day this group of security researchers reached out to me and let me know that the agency they were working with was being actively targeted by domestic white supremacists. They had alerted the appropriate people and made recommendations but were getting the run around. The website the white supremacists were interested in targeting had thousands of known security vulnerabilities but it also had a very specific launch date non-negotiable and written into law (this is a stupidly common thing in government). Leadership did not want to stop development work to fix security issues, but they also could not be seen to be ignoring security issues. Especially not thousands of them. So they would engage with the researchers, put on this big performance with meetings and field trips and PowerPoint decks, and then do nothing.
And they were doing this on multiple fronts, slow walking both external consultants and government oversight authorities. It wasn’t a situation where we could report the problem up to one of the many organizations in charge of information security in the federal government. Everyone who could be called upon to apply pressure was already aware of the situation and applying maximum pressure.
I suggested we let the FBI know and see if they could block the potential attackers for us without worrying about the website. No crime had yet been committed, so the FBI couldn’t technically do anything about the threats. But they do track this kind of information and perhaps what the security researchers had could support other investigations. It took me a couple of weeks to find the right contact and reach out. After establishing that he was on the relevant task force and that they did track this info and were interested in hearing about what we had found, I suggested we go grab coffee and fill in some of the details. I had provided a set of potential locations, including the agency cafeteria which was super nice.
“Actually do you have an office or a conference room we can use?”
Sure, I said. And this didn’t bother me because the phrase let’s get coffee is always kind of figurative. To begin with, I don’t drink coffee.
A huge part of my job at USDS was coffee dates. The way we fought the bureaucracy was to build networks of people whose goals were aligned and whose skill sets or resources were compatible. The first contact with a new node was always informal. I needed to size you up, determine your incentives, your tolerance for risk, how you defined success. But I also needed to establish trust. I never thought to handle this situation any differently just because the FBI was on the other end of it.
Anyway, the agent comes up to my office, he closes the door and takes out his badge. “I have to show you this first.”
This seemed strange to me because I did not actually have any reason to believe he wasn’t who he said he was, but certain jobs will make you paranoid so I shrugged it off.
As we chatted, I noticed he was taking a lot of very thorough notes, which struck me as odd but — again — I dismissed. The conversation was friendly and productive. He set expectations appropriately. We agreed on how to follow up later. He stood up to leave, shook my hand, turned for the door, but stopped short as he touched the door knob.
“Oh wait, I forgot something. Could you raise your right hand for a minute?”
Confused. I did so.
“Everything you told me today is true to the best of your knowledge?”
I looked at my still raised right hand. Oh…….. “This is one of those things where if it isn’t I go to jail for a million years, right?”
“Well….. probably not a million years. But yes.”
“Yeah, it’s all true as far as I know.”
He smiled and told me to have a nice day.
Dazed, starting to appreciate that I might have accidentally bitten off way more than I could chew, I eventually wandered back to USDS HQ, which is a townhouse off of Lafayette Park just outside the White House. I ran into Matt Cutts in the foyer.
“What’s wrong?” he asked me.
“The strangest thing just happened,” I said before telling him the whole story. When I finished I realized that Matt was just staring at me, completely silent. He stared at me like that for an uncomfortably long time.
“What?” I snapped.
Then he started laughing. Loud and sort of manically.
“What?” I repeated. “Jesus Christ, what is it?”
“Marianne,” he said. “Why is it always you?”
“What do you mean?”
“I have two hundred employees, Marianne. It’s always you. No one else gets into these situations. It’s always you. If someone had told me that one of my employees was hunting white supremacists with the FBI I wouldn’t have to ask who it was because, of course it’s you. It’s always you. Why is it always you?”
People tend to think that the biggest deciding factor in their career is their talent or skill, but I don’t believe that. The way you process risk and handle fear has more impact on what kind of career you have than any other single factor. At USDS people saw me as something of a big game hunter. One of those few people always tied up on really critical national security type things, but I didn’t pursue those projects I just took opportunities that came across my desk and that other people were too scared to act on. With the FBI situation a large part of my ability to do that was rooted in ignorance. I didn’t stop to think that the FBI’s culture and process might assign a significance to my outreach that other organizations would not. But I also didn’t see myself as taking on this huge responsibility and all the corresponding risks. I was just there to connect two groups of people. To open the door for them so that they could get things done. I didn’t worry about whether I was qualified or capable of handling domestic white supremacists because I didn’t see that as my role. I trusted the researchers to be good at their jobs. I trusted the FBI to be good at their jobs.
A lot of getting people to perform well as their manager is about anticipating their decision making, and a lot of that is about understanding two things:
- How are they incentivized?
- How do they perceive and process risk?
But it’s not just about managers considering their employees, surviving in an organization at any level involves anticipating the behavior of others. When people begin to take on leadership roles eventually they have to decide how they are going to handle fear. When you are the leader, you are the person who is held accountable for failure. The higher up you go, the more you are accountable for and the less you have control over it. Trust in you team is important, but your perception and acceptance of risk even more so. Leaders with a low tolerance for risk do not become leaders with a high tolerance for risk if you change their employees looking for trustworthy ones. Everybody wants to have this implicit , instinctual, don’t-need-to-think-about-it-and-never-doubt-it-for-a-second trust. That’s the gold standard. But most relationships of trust are formed because you just choose to set aside your doubts and trust, not because you have these great reservoirs of faith.
Leaders as they develop tend to break in one of two directions on risk. There are the leaders that — like samurai — embrace death. They see their role as protecting and empowering the people below them who do the real work and it’s an honor to serve the team’s interests even if things do not go well for them personally. In the best organizations the leader’s manager also does not fear death and they have the same safety as they grant to their people.
But some people don’t process risk in that way. Those leaders get drawn into trying to outrun death, which is as impossible metaphorically as it would be literally. You can’t avoid taking responsibility forever. Eventually there will be some disappointment or mistake that you will be called on to answer for.
The leaders who have a low tolerance for risk — and I say leaders instead of managers because on engineering teams these concepts also apply to Staff and Principal engineers — will respond to risk by either avoiding it outright or figuring out how to spin the situation so that it is Not Their Fault(TM)
These leaders ultimately become bureaucrats. The perfect job is the job with the glamorous title and the big paycheck where no decisions and no risks need to be taken. These leaders end up in startups more often than you might expect. That’s because continuing down a career where you’re running from death all the time does real damage to you psychologically. It’s important to understand that even though it seems like these people don’t care they are still human and they still have the same basic needs and feelings as anyone else. Fleeing death doesn’t just hurt the people they throw under the bus, it also hurts them. They want to be respected by their employees and often know they are not. They want to be admired and often know they are not. They also feel guilty screwing people over to survive.
When you are in a work situation where you are respected and admired, that is often its own reward. If you don’t have that, the components of your job that give you a sense of value and satisfaction are all connected directly to the career ladder. What is your title? What is the prestige value of your projects? How many people report up to you? How many people report up to them? How much are you getting paid? How much equity do you have? All that shit becomes very important because it is often all you have. People who flee death are in a state of constant anxiety. It’s like the worst form of impostor syndrome. They self soothe by climbing the career ladder. So even though a startup may seem like a poor fit if you don’t want to take on responsibility and just want to rubber stamp things all day, those opportunities are very attractive to leaders who fear death because the prestige of them is a substitute for the satisfaction of doing a good job.
And once people start working that way it becomes a cycle that escalates. No one is born knowing how to run a 1,000 person engineering organization. People need time to build skills before they are ready for a promotion. If your actual job triggers enough fear and anxiety for you to betray the trust of your closest colleagues, you won’t do better one level up. The further beyond your area of competence you get, the worse the stress gets, the faster you need to run to escape death.
Eventually you end up spending all your time trying to look busy, avoid responsibility and save face by scapegoating others. Meanwhile leaders who don’t fear death tend to have slower career progressions because they take more satisfaction from their actual jobs and focus on building skills that will make them better. The end result of this is that it often feels like everyone at the top is maliciously incompetent.