What's the downside of lockdown in the enterprise?
The corporate world has given a huge subsidy to the generative Internet. Long before some companies realized how much money they could save with VOIP, there were people loading Skype onto their computers. Lots of applications had their proving ground on corporate PCs. It's unfortunate to see that thin edge of the wedge, even though it's rational, lead to a cascade of lockdowns in corporate environments and cybercafes and libraries and schools, and ultimately on home computers, as people say they want security and stability more than they want the uncertainty of not knowing if any given piece of code is out to do harm to their machine or their money or personal data.
I would just hate it if it turned out that we'd lost our critical mass. There are some new great apps whose very value depends on multiple people taking them up--Wikipedia with only 10 people using it is not going to be that impressive.
Most of us can't tinker with the engine of a modern car, which resembles in some ways a sealed appliance. Is there a point where technologies or systems are mature enough that there's more value to lockdown than openness?
I think we're just in the first 10 years of what's going to be a 50-year build-out of amazing applications coming out of left field, again and again. Look back at things like peer to peer, instant messaging, Wikipedia, Facebook. Stuff is devised by college juniors or two guys from Estonia at a time when there's a huge, structured industry also desperate to get the next killer app. I would hate to see that slice of outsiders excluded from being able to inject their creativity into the system.
I also recognize that it was extremely difficult to make a case for Wikipedia in 2000, before anyone knew what it was. That's the nature of real innovation. The word gets bandied about so much, often as a way to say "bigger, faster, louder," but something better may seem crazy to begin with--otherwise it can't be that new and different.
I don't mind ways of locking in some of the crucial gains we have, ways of trying to stabilize the gains that have been made so far. I don't mind a hybrid ecosystem, where people are happily using their iPhones in one corner and their PC in another. Some of the solutions I suggest in the book have to do with dual-purpose PCs, with a red zone and a green zone, so you can run the untrusted, goofy software in one zone and it can't reach the other zone, and you can flush it very easily. It's not a permanent solution, but one that recognizes the need to reconcile the experimentalist spirit with the fact that things are now mission-critical.
So what can CIOs do to maintain order in their own shops without stifling creativity on the Net?
I am hoping that there are ways forward that don't compel us to make a stark choice between the insecurity of an open PC and having to lock it down so that employees can no longer innovate on their own as they take up software that maybe central IT hasn't heard of. That may include installing software that radiates their vital signs, so we get a sense of what's going on the Internet--where is the bad code and the trustworthy code? Where is the code that professionals have decided is OK to run on their machines? We don't have those technologies, but we can build them. There's an Oxford/Harvard project called Stop Badware that wants to build that software. Maybe CIOs could become officers of technology, like lawyers are officers of the court, and take a role that recognizes the larger issue.