Donut based security at Amazon

This is not a clever technical article where DONUT is some obscure new encryption algorithm. This is about getting people to lock their laptop screens. Using donuts.

In the early days of the Amazon San Diego office, we were in an unsecured, shared office space with other companies. As such, it was crucial that people remembered to lock their screens whenever they left their computers, even if only for a few minutes. But, humans forget, and we needed a way to actively catch them and help correct their behavior.

Cyber theft bad guy ooooo!

A normal company probably would have put up posters and sent out emails about the importance of locking screens – which would have been promptly deleted and ignored. Or had the managers reminding employees about the importance of security blah blah blah. Or created a 45-minute training video about the dangers of cybertheft with spooky looking cartoon bad guys.

What we did was this.

If we stumbled upon an unlocked laptop screen, we would send out an email from that person’s account:

To: sandiego-all@amazon.com

Subject: Free donuts tomorrow!

Hey everyone, I realized we haven’t had donuts in a while, so I’ll bring in a box tomorrow for everyone!  Enjoy!

You had to be fast, since the person could come back at any moment. The key was to not get caught, so they had no idea who did it.

If your computer was used to send such an email, you were duty-bound to bring donuts the next day. No ifs, ands, or buts. You had been donuted.  We consumed some ungodly creations, like these from VG:

vg-donuts.jpg

But this was remarkably effective.  Over time the donuts decreased in frequency, which was a little disappointing from a stomachular perspective.

There are a few reasons why:

  1. We made it a game. Everyone could participate. It was fun.
  2. Humans hate being embarrassed. This was mild, but it still stung enough for people to remember.
  3. There was an inconvenience factor. Now you had to drive and buy donuts tomorrow.
  4. There was social pressure. Everyone knew what was expected. Nobody ever failed to bring in donuts.

The cool thing is this game happened organically. I remember sending the first email out. It was a coworker’s computer – a senior Amazonian who should have known better. He dutifully brought donuts in the next day.  From there it caught on like wildfire. (I also donuted him another half dozen times before he learned – I swear he was the worst at locking his screen!)

Once the precedent was set, the game was on. Who said enforcing security was no fun?

 

 

The job title Director sucks

I loathe the term “Director”, because it connotes the opposite behavior of what senior leaders should really be doing.

A movie director tells every person what to do – where to stand, how to act, which cameras should shoot from what angles, which lighting to use, and so forth.  This works great for the movies, or theater, or dance, where you have a predefined script that you can start and stop at any moment.

steven-spielberg

This is a horrible analogy for fast-moving companies.  First, you can’t start and stop the action at any time.  Second, it’s not possible to have your arms around an entire product being developed. Even movie directors only shoot one scene at a time.

The other connotation of director is somebody who sets the overall direction. This is somewhat true, but at a fast-moving company with talented people, does one person really have all the good ideas? No.

Facilitator

Facilitator is a far better word: a person who makes an action or process easier. Facilitators help people overcome obstacles, resolve conflicts, and grow. They don’t tell you what to do. They help you figure out what to do for yourself.

Now, I’m not saying Indiana Jones and the Temple of Doom was a bad movie, or that Spielberg is a bad director. It’s that the paradigm of “directing” doesn’t work for fast-moving companies. And the problem with using the word “director” is that every time you hear it, it connotes the same mismatched behaviors. If you’re the Director, nothing can happen without you. Instant bottleneck.

Instead, you need to empower your people and unblock them, but otherwise get out of their way.  There’s a great book called The Coaching Habit that offers fantastic practical advice on how to listen to people and coach them, so that they take the initiative to solve problems themselves.

Try This

Try changing your title and seeing what happens.  Odds are you can’t change your official HR title, but you may have an internal phone tool, Exchange directory, or business cards.  Try changing your title on them to “Facilitator”. See how it affects your mindset and the mindset of others!

If you want to hone your skills, check out this blog on the 9 characteristics of a good facilitator.

 

Nate’s Stock Market Theory of Management

I’m a fan of simplifying as much as possible. One strategy I love to use is analogies.

I’m sure you’ve heard the phrase “it’s like riding a bicycle”. We all know what that means – once you’ve learned a skill, you can take a break from it, but regain it quickly if you start again later.  Saying “it’s like riding a bicycle” encompasses not only this concept, but brings along a richness of emotion. Those summer days as a kid, riding your bike to the pool to meet up with some friends, maybe to grab an ice cream afterwards.

Managing teams is like stock market investing

Life at a fast-moving company is full of swings, highs, and lows.  In software, there may be launches, bugs, or service outages that cause different individuals in the organization to go back and forth rapidly. In operations, there can be holiday sales, labor strikes, or equipment issues that cause huge variations in day-to-day work. This churn is often visible, through email escalations, phone alerts, or literal flashing red lights.

Managers often fail in one of their most important responsibilities: providing stability for their teams.  As a manager, you are guiding your teams, helping them release products and triage issues. But, you’re not sitting side-by-side with every engineer, experiencing every bug fix with them.  Your job is to smooth out bumps and valleys, and keep the team together as a unit. In times of crisis, you are there to calm them.  In times of change, you are there to guide them through.

You are a smoothing function, like a moving average in a stock market graph.

moving average mgmt

The amount of smoothing you do is dependent on your role.  As a front-line manager (the red trend line), you need to respond to day-to-day events that impact your team. But as a more senior manager, you should not respond too quickly.  Overreacting to daily events leads to “knee-jerk reactions” or “seagull management“.

As you move into more senior management roles, you take on a broader perspective, and a longer-term view.  Rather than managing one team and thinking daily or weekly, you are managing multiple teams and thinking monthly or quarterly (the green trend line).  At the executive level, you are looking out 6-12 months and creating multi-year plans (the blue trend line).  Your job is to provide a stable vision for the team, a North Star to navigate towards.  In stock market terms, you are a daily, then a 50-day, then a 200-day moving average for your team.

Keeping in Sync

The stock market moving average analogy can be taken further.  You’ll notice in the graph I chose that each of the management layers is somewhat out-of-sync.  It gets particularly pronounced in the middle section, where lines cross and move in opposite directions.  In our analogy, this could represent a change in strategy, or an internal reorganization. Eventually, leadership realigns, and the team can move forward.

moving average mgmt change

Notice that while leadership is not aligned, the team vacillates back and forth. When teams report feeling “churn”, this is what they are feeling.

The longer time period a moving average reflects, the more it can be out-of-sync with daily events. In the above graph, the Director and VP/SVP levels are stable on the down and up swings. But their version of reality is not entirely in sync with what is happening day-to-day. This is a common challenge for senior leadership.

This is where empowerment comes in.  I would argue the above graph is healthy, if the front-line manager (the red trend line) is empowered appropriately. The long-term trend lines focus on the long-term, and the short-term trend lines focus on the short-term.

Having spent almost 7 years at Amazon, this is what Amazon does really well.  Every “two-pizza team” owns their own destiny – the tools they use, the coding methods they follow, the internal systems they reuse (or don’t), the scrum discipline they adopt, and so forth.

I witnessed numerous Amazon new hires experience extreme culture shock. Over the years I heard people comment that it seemed like “general anarchy”, “barely controlled chaos”, or even simply, “I can’t believe a company can operate this way”.  But consider the reverse. Think if every little decision about every feature, or toolset, or architecture choice had to go up to the VP layer (the blue trend line). The entire company would grind to a halt. Instead, it’s a rocket ship.

Try This

First, figure out what smoothing line you are supposed to be.  Are you a front-line manager? Director? SVP? Make sure you are acting appropriately.

Second, are you empowering your people? Empowerment is a big one that pays off. If you challenge people with a stretch goal and tell them “I believe in you”, they can do amazing things. (Shocking, I know.)

Finally, if you have any great stock tips, let me know.