Thursday, July 10, 2003

RIAA a threat to national security?

John Dvorak suggests that the RIAA may be doing the devil's work indirectly [snark] as well as by intent [/snark] by promoting the spread of anonymizing technology, easily exploitable by terrorists and other nasties. This may sound over the top, but he could be onto something.

Dial the clock back to the early '90s, when the NSA et. al. were trying to foist things like the Clipper chip and Skipjack algorithm onto the cryptography world. This misbegotten policy not only failed to influence commercial development, but motivated righteously indignant cryptographers and coders to spread what was until then rarified knowledge around the world. Where it is undoubtedly used and enjoyed by terrorists and mafias, as well as those hiding from totalitarian governments. Fortunately for the NSA, cryptography use is still rather uncommon, so there at least remains a kind of message signature which can be used for traffic and network analysis.

Anonymization is another two edged sword. Like crypto for privacy, most people have found it more of a pain that it's worth. That's left the few services and servers supporting anonymity as visible targets for attack, and they have been. Now enter the RIAA with their threat to close down P2P servers and sue their (non-anonymous) operators. Once more we will have righteously indignant technologists propagating the knowledge - in this case anonymization - and particularizing it to the perceived threat to P2P. But in this case, we add one more element. Millions of users, all ready to adopt a new way, if it's the price of continuing to share files. Then good luck with the traffic analysis, and trying to nail down and extinguish the anonymizing servers. And just as with crypto, the system works for the bad guys just as efficiently. Dvorak may have his over the top moments, but this isn't one of them.

Via the VodkaMan
3:32:36 PM    


VC: Outsourcing Failure

One comment on venture capital is its perceived proclivity to back and sometimes encourage high risk projects. While this is popularly exaggerated (and of course we'd like lower risk projects ) there is a kernel of truth. It has to do with a co-evolved symbiosis between venture capital, the firms it backs, and large established companies.

One of the VC industry's roles is outsourcing risk for the big companies. Consider for a moment the failure rates for venture-backed companies. Out of ten funded, perhaps half will return more than the invested capital, with one or perhaps two being home runs. The rest will return little if anything on the investment.

Just trying running with that failure rate as a product or P&L manager inside a large company. Your career there would soon be over. Even as a 'research' manager, that kind of death rate among launched projects means trouble (trust me, I've been there). The result is that realistic managers have a limited 'risk budget' that they mete out very carefully, and it restricts their ability to make big jumps in markets or technology. While abstractly some ratio of risk/reward should be the measure of success, practically the accepted level of risk is capped.

Leading directly to the classic founding scenario for a venture-backed startup: Disgruntled product manager, engineer, and marketer grumbling into their beers about the short-sighted, risk averse &%#$$&^* management who can't see what's being missed, right under their noses. Soon there is another business plan circulating, and it may end up being funded.

And it may fail. We investors won't be happy, but at least our model is predicated on that risk. As for the founders, they may have to go back to a big company, sadder and a little burnt around the edges, but hopefully wiser and certainly with valuable experience. (And for those reading from outside the Valley, that is part of the core of our regional advantage: a busted startup is not considered a blot on the resume here.)

Or it may win. Cheers all round! Perhaps a new NASDAQ listing is born. More likely, the venture will be bought by - a big company. They will pay a premium to the founders and the investors to buy in what they couldn't do themselves, partially because of risk aversion. With the big company's sales and marketing power behind the new acquisition, they'll make a profit anyway.

So, yes, we are specialists in risk and failure. If the risk level is too low, there is likely to be a bunch of established companies beavering away on the problem already. Our best bet is on a project that would draw the reaction 'interesting, but too scary' from an in-house manager. That means he'd need to take on the risk in several bites, while we may fund someone to go straight at it. That's our specialist role in the economy, and the reason that a mixture of established and venture backed companies will innovate faster than a pack of big dogs.
9:59:11 AM