Bureaucracy Hacking - Creating Organizational Exploit Chains for Good
Where
Talks
HOPE_16
Duration
44 min
Explains how to push ideas through large organizations by using policy, stakeholders and bureaucratic process to get things done.
Summary
Adam L. Hesch, a former Navy officer who later worked at Facebook and the Defense Innovation Unit, presents "bureaucracy hacking": finding the weak points in large organizations, which he treats as information systems that store, compute and share information, and using them to create new value. He positions the idea as a response to Pournelle's iron law of bureaucracy, which holds that insiders devoted to the organization itself eventually take control from those devoted to its goals.
The middle of the talk lays out a working framework. It starts with a specific idea and a realistic execution plan, then checks for supporting policy or an approver, builds stakeholder support, ties the pitch to metrics or values, removes friction, chooses a communication style that suits the audience, and identifies the final decision-maker. Hesch illustrates each step with stories: a pitch that eventually led to Amber Alerts on Instagram, pre-staging ammunition on a Navy ship after finding a policy that let a vessel count as underway once its lines were off the pier, a one-word approval for firing signal flares on July 4th, and a drone detection prototype that secured funding through an unspent budget. He also describes winning a slot at an Army mountaineering school by preparing a thorough application folder.
He closes by urging newcomers to frame ideas as serving the organization's goals, to set their own ego aside, to find allies whom leadership trusts, and to look for precedent. In audience questions he applies the same approach to resistant peers and to situations where the decision-maker is hard to reach.
Related talks
Talks·54 min
David Young
Describes day-to-day security work on internal teams and as a consultant, from scoping to reporting.
Talks·50 min
Davis
Explains how compassion and non-punitive responses can build a security culture where employees report mistakes early.
Talks·40 min
Rafal Los
Draws parallels between raising children and running security programs, covering containment, behavior change, and leadership.


