Screw You and Your Panopticon

Chapter 9 in my ongoing story about workplace surveillance

< Previous Chapter | First Chapter | Plot Summary | Next Chapter >

Modern-day panopticon prison in Cuba. Photo attributed to David Murakami Wood.

Four years after she left Wizards, Stamper called me out of the blue. 

“What the hell?!” I said once I figured out that it was really her. “How great to hear from you!! How’ve you been?”

And we jumped right in, laughing, catching up on all the little stuff (her finally having a serious boyfriend, my kids growing up and heading off to college), just like the old friends that we were, without touching once on the last time we had talked or why it had been so long. That was nice. But I had to ask:

“Stamper, where the hell have you been?”

“Oh, just right here in Seattle, I mean, we moved into a condo we bought, but I’ve been around.” 

“You know that’s not what I meant,” I pressed.

“I know, I know, look, I’m sorry, I just … well, I just left Wizards and absolutely lost myself in this new job. Dan, it’s been so wild, so exactly what I was hoping for …”

“Stamper, you know I don’t even know where you went!”

“What?” she said. “I didn’t tell you? C’mon, I must have told you.”

“The last thing you said was, I’ll tell you as soon as I start.” 

 “Oops!” she said and laughed, a sincere, self-deprecating laugh.

I know I’ve painted Stamper as a real hard-ass, and she is, but I never suspected her of being mean or intentionally hurtful. She just wasn’t at all concerned with what other people thought when she was focused on other things. I kind of admire that about her.

“It was so exciting starting this new thing, Dan, I just kind of got lost in it, I mean, I have such a great team and I was given access to so much, just, muscle …”

“Stamper, where are you? Where are you working?”

“Oh shit Dan, I have so much to tell you … and listen, some of it, well, I trust you, but I’m supposed to have you sign an NDA if I say anything.”

“Seriously, you want me to sign an NDA for a conversation with an old friend?”

“That’s the joy of working for a big company! It’s no big deal, really, I’ll send it over and then let’s get together for coffee or a beer … or, are you still hiking? Maybe we go on a hike?”

Well, she knew what made me tick. I’d pretty much go on a hike with anyone who could keep up, even if I did have to sign a damned NDA. So we set it up a hike, and I signed the digital form, and I finally got to hear the full story. Well, I guess it was the full story.

A week later we set out on a snowshoe hike. It was late enough in the season for the avalanche danger to be gone but not so late that the snow was totally compacted. Plus it was a rare bluebird day in March, when it’s usually socked in with clouds, so we were in pretty high spirits. High enough that when we met at the park and ride and she started dragging her gear out of the back of her Subaru to throw in my car, the first thing I said was, “I can’t let you in my car unless you tell me where you work.”

“Oh for god’s sake, ” she said, “I’m at Amazon, I’m sorry, I don’t mean to make such a big mystery out of it, it’s just, …”

“Ah, don’t worry about it, I was just giving you shit,” I said. “I figured you went to one of the big guys, either Microsoft or Google or Amazon. But remember, you didn’t tell me anything when you were winding down at Wizards, I’m dying to hear the whole story.”

“God, that was such a weird time! I was so disappointed that we couldn’t push harder, and you seemed kind of stuck … I’m sorry, but it’s true … just like stuck trying to play the game there,” she said. She had nailed that one.  “But remember when you and I published that article about risk-based content delivery? I think it was before those Duke idiots got involved in the company? Well, someone at Amazon reached out to me and said he was interested in what we were doing, asked if I could have coffee. So I did.”

In the back of my mind I wondered why he hadn’t contacted me too—I was co-author on that article—but maybe he figured I was too tied into running the company to entertain what he ended up proposing to Stamper. (Or maybe Stamper told him I was stuck, I don’t know.) Anyway, he tried to woo her into coming to Amazon right then, but she told him she was having too much fun but that she’d be in touch if that changed. When she called a few weeks later to tell him that the private equity investment wasn’t bringing the acceleration she had hoped for, he suggested that at a company like Amazon, she’d have access to some of the best talent and the deepest pockets of any company in the world.

“I wasn’t a pushover, Dan,” Stamper insisted. “You know how bullish I was on what we were after! I told them that I had a plan to totally re-invent how we managed employee performance and I was only interested in moving if I thought they could help me pursue this dream. I told him I needed total control and access to the budget I’d need to make it happen.”

“You asked for ‘total control?’”

“You know I did! Of course I didn’t get it. The guy—his name is Shreed—told me that ‘total control’ was only available to Level 10 and above, and even then, at the level I was talking about, stuff still had to get approval from Bezos himself. But Dan, he said that Bezos knew about what I was trying to do and had personally given him the green light to bring me in.” 

“That must have felt good” I said.

“Hell yes, it was flattering—especially after we had Mike slow-rolling everything, then those PE assholes barely giving my work … I’m sorry, our work … the time of day.” 

“No worries—it was always your work,” I admitted.

“But then, he started asking about the IP behind these ideas, and I was like, ‘I don’t know anything about intellectual property, I leave that stuff to Dan.’ Remember when I asked you about patents? I was trying to figure out whether we had applied for any patents on any of these ideas …”

“And of course we didn’t!” I lamented. “We were honestly going as fast as we could, and neither Nels nor Mike thought it was worth slowing down to patent any of these ideas.”

“Well, I didn’t know either, but Shreed was glad to hear we hadn’t, because then he said it would be fine for them to hire me … and Dan, honestly, he made it sound really good. I mean, there’s great money, that’s part of it, but what he promised me was that I would be given the team and the budget and the control to get this done. Hell, they were forming a new business unit just for this purpose, the Human Dynamics Team, and they offered me the Head of Strategy position. I couldn’t say no.”

“Okay, that explains a lot,” I said. “You got a little dodgy there at the end, but I guess I would have too. But hey, it sounds perfect for you … how’s it been going?”

“Oh my god Dan, it’s been unreal. It was unreal from day one! You remember how the thing I was just dying to get to was the identification of behaviors that we wanted to change? Well, they were already well down the road to having that one solved. In the first place, we have complete visibility into what employees are doing on their computer and also on their phones, since you have to install this Amazon connection app to connect to the network …”

And then, for the next 90 minutes—interrupted as often by her reminders that we were under NDA as it was by my questions—she broke down what they were doing. Stamper had gotten a lot smarter on the technical side of the game, so some of it got pretty nerdy, nerdier than I could keep up with, but mostly it was just the fully fleshed out manifestation of those conversations we’d had from the start. I got it in Stamper’s typical headlong rush of words:

“So, basically, everything employees do is connected to our network, and our IT team is really good at making sure everything is well integrated, so they can see whether people are using decent passwords, and they can control the flow of protected information with deep inspection of any of the email or file transfers or anything. That kind of stuff. I mean, basically, they can just prevent most of the stupid stuff that we’d try to train people about, so people couldn’t really make a lot of the mistakes we’d see. I mean, they could try, but we could see them trying, and we could just pop up little messages on their screen in real time saying something like, ‘Remember, we can only send healthcare data when we have a signed agreement,’ or something like that.”

“My first few months there, it was just me getting familiar with everything that we could detect and then seeing if we could figure out how to intervene right at the moment to give people a little nudge in the right direction. The nudging stuff was a blast: I had access to some good writers and graphic artists, and we’d create these fun little characters to make it so our stuff wasn’t boring. And we’d escalate when we needed to: like the first time, you just get this tiny little reminder, but then if you tried to do something wrong the next time, it might be longer, and then longer still if you kept doing it. It’s pretty intense what we could know about people with all the data we can gather.”

“But c’mon, who has time to deal with all that data you gather?” I objected. “I mean, what’s the point?”

“You only think that because you’ve worked at companies that aren’t very good with data! Dealing with this stuff is nothing at Amazon. It’s nothing! Like, we’d set up a protocol for each risk we were tracking, and you’d go through these levels of graduated ‘training,’ but if you were still taking a risky action after getting level 3 training—that’s what we called it—well then, you’d kind of go into this different category. We’d notify your manager, and your score would go into your profile for consideration during the annual review. You know how we used to say that people should get fired if they couldn’t figure out cybersecurity? Well, here it’s real. I mean, we’ll try to get you to improve, but if you just can’t or won’t, well, you’re sending us a pretty clear signal that you’re not interested in living the leadership principles.” 

I ignored the “leadership principles” bit; I had gotten used to that from the Amazonians I knew. But I was ready interested in how they locked in on these complicated behavioral things I knew Stamper was trying to change. 

“Look, that sounds fine for the cut-and-dried stuff, but what about the harder stuff—the really tricky phishing and the social engineering?” I asked.

“No, no, you’re right—the easy stuff was pretty straightforward, since we had the tech in place to monitor and deliver it. But it really got fun with the phishing and social engineering, because we had all this data about our employees, we could craft these really sophisticated phishing campaigns based upon individual profiles. Remember we used to tell people to send out a fake phishing email to everybody? They laughed at me when I told them about that. Here, we put them into a profile class right when they’re hired—based on all the data we’ve gathered from the hiring process—and then we use all this other contextual data—who they work with, who they correspond with outside the company, what they list as their hobbies, etc.—to really hone in and target fake phishes. And we track how they respond to them—not just do they delete it or do they click a link, but how long they look at it before they delete, or whether they forward it to their home email, just like anything that would show they were susceptible.”

“Wow, if only you could implant chips in their brains and observe whether they were tempted or not, then you’d really have them,” I ribbed her.

“Fuck you Dan,” she snapped. “You always wanted to take this over into the dark, Big Brother shit and it’s not like that!”

“Oh c’mon, it is like that!” 

“It’s not!” she insisted, and with some vigor. “Dan, I swear, we’re only looking at the stuff that directly impacts the company’s security—and only on stuff that employees agreed that they’d do. We’re just holding people accountable.” 

“Is that your word, ‘accountable’? Cuz it sounds a lot like corporate bullshit or worse to me. Or like something the Stasi said as they spied on people.”

“Oh there you go, Mr. know-it-all—who the hell are the Stasi?” she jabbed back.

“They were the East German secret police. They gathered information on every East German citizen to keep them in line.”

“C’mon Dan, you know I don’t want to be part of the Stasi,” she said. I think she was a little hurt that I’d go there. She was such a complicated person: one minute hard-ass, the next sensitive flower. But then the hard-ass was back: “I still think this is reasonable, what we’re doing. I know there’s a line we don’t want to cross, and I’m not going to cross it!”

“Okay, I’ll quit busting your balls. But I want to know, what do you do with this information you gather on people? I mean, for example you know I looked long and hard at that ‘win a free vacation’ email before I deleted it? So what?”

“Think about it Dan—if you’re intrigued by that email, what is that telling me as your employer? Are you not happy in your job? Are you daydreaming about vacation when you should be working? Do you wish you had more money to vacation—so that maybe you’d be susceptible to a bribe? There’s lots of ways you could be a risk to the company.”

“Yeah, but maybe it’s just a gray day outside and they stopped for a minute to think about sunshine—I mean, that’s not exactly a risk to the company.”

“That’s why we gather so much data, Dan—it’s not like we’re going to overreact to one data point. It’s if we see a trend over time, then we maybe use related data to see if we’ve got an issue.”

It’s funny, I used to get pretty excited about what Stamper wanted to do, about where she wanted to take this integration between behavioral detection and training, but now that I heard where it had taken her, it just seemed kind of creepy and sad: creepy for the employee, who knew that no matter what they did, their employer was monitoring them and taking note of what they did, and sad for Stamper and the people she worked with, the Human Dynamics team, because for all the power of their technology, all they were really doing was spying on people in order to reduce the risk of human error. Was it really worth it?

That’s what I wanted to know, and I pushed her on it. “So Stamper, here’s my question: What the hell does this get you? You’re describing a nightmare for employees, who know that you are tracking their every move, and it sounds like a nightmare for you prison guards too, who can see everything and stop any problem before it even happens. Congratulations, you’ve created a panopticon!”

“Screw you and your panopticon nonsense, Dan,” she said. “You’re just jealous because you’re stuck at Wizards doing the same old shit.” 

She had me there. And her putting it that way just made me want to change the subject. Luckily we were pulling up to the trailhead, so we got distracted by unpacking the car, putting on our gear, and heading off into the untracked snow. It’s a good friend you can butt heads with for an hour, and then set it aside and have a great hike. By the time we were through, we agreed we’d have to do it again soon.

< Previous Chapter | First Chapter | Next Chapter >

Disclaimer: This is a work of fiction. I’ve made up the story and the characters in it. While certain businesses, places, and events are used to orient the reader in the real world, the characters and actions described are wholly imaginary and any resemblance to reality is purely coincidental.