I read with interest the comments on the "why are so many applied
cryptographers unemployed?" thread.
I know a _lot_ of unemployed folks. Or folks looking for more than "part
time consulting" work.
Lots of issues, lots of possible reasons for the high unemployment rate
of applied cryptographers:
* The collapse or sale or downsizing of several companies which formerly
employed a fair number of Cypherpunks: PGP (used to employ about 6-10
list members that I know of), ZKS (maybe 5-8 active list memmbers,
IIRC), C2Net in the 1994-97 years, Counterpane (several list members),
and even Netscape (three list members, brothers, represented the
"security department" for a while). This kind of collapse or downsizing
dumps a lot of the same kind of people on the market.
* End to crazy ideas of "let's do a start-up!"
* An example. Here's part of an e-mail I received recently from someone
who proposed that I give him some money for some kind of start up or
charityware project in an area of interest to both of us. I have changed
the details for obvious reasons:
"I had this vague hope that you might be interested in throwing some
money at an interesting problem in FOO to see if something worthwhile
might result with a view to seeing if it could produce money later.
Nothing so risky as a startup - a startup might make money, whereas what
I was thinking of would be absolutely guaranteed a ROI of 0%. No risk
there :-) Hopefully a chance of some fun and benefit to humanity
though."
(This writer, an acquaintance of mine, has been trying for several years
to get various projects going. Sad to say, his very words above indicate
just how flaky his ideas are. He thinks others will fund projects as a
kind of charityware. Given the loaded cost of people these days, even
with reduced expectations in this current downturn, it hasn't even been
possible for billionaires like Paul Allen to fund projects successfully.
Many examples exist, even of some crypto startups, where tens of
millions of dollars went into salaries, benefits, perks, facilities,
with essentially nothing to show for the expenditures. More on this
point later.)
*Back in the 1970s and early 80s, high tech start-ups were difficult to
do. It took some really good ideas, or at least the departure of a
talented group of people who had already developed something. Examples
like Sun and Cisco are examples of where the core technology had already
been developed (Stanford, in both cases) and where the companies could
begin to SELL PRODUCTS almost immediately.
* A company formed at about the time the VC industry was transitioning
from "hard money" (hard to fund a start up) to "easy money" was RSA Data
Security. And though it owned a much more valuable property than most
recent crypto startups have owned, it almost went under a couple of
times. Read Levy's "Crypto" for some details of how it almost failed in
the late 80s and again in the early 90s.
* I've seen a bunch of "applied crypto" companies during this recent
Internet bubble where the intellectual property is far, far less
compelling than "RSA" was. I don't mean to insult any of my friends
here, but the notion with a lot of these companies seems to have been
"We're young, we're Cypherpunks, let's raise some money, get a nice
office space with our espresso bar and hot tub, hire our friends, and
become rich."
(This is perhaps too harsh a summary. But I'll let it stand as a
reference point.)
* There are still roles for start ups. But I think some really good
ideas are needed. Just "riding the wave" is no longer working...it
worked during the bubble years, for a bunch of companies...most of which
are now greatly downsized or gone completely.
* Don't quit your day job. And if you don't have a day job, get one
(assuming you need some money...some folks have independent sources of
some amount of money).
(Note that during the tough period for RSA, most of the key technical
people had other jobs, as professors, etc. I think Rivest took one year
off from MIT to consult full-time for RSADSI, but mostly they had other
jobs the whole time. Only after the revenues began consistently flowing
were a lot of full-time people hired. During the bubble, of course, they
staffed up to high levels, expanded, got involved in other ventures,
etc. And Bidzos, of course, rode the bubble by co-founding and being
Chairman of Verisign.)
* Doing things in a garage is more than just a quaint image. It means
"doing things without _any_ burn rate." It means having a day job.
* The notion that a group will raise ten million bucks, rent expensive
facilities, hire their friends, and THEN get to work on product
development (or, more often, playing around with potential ideas), is
just not plausible any longer.
* especially dangerous is the seductive idea that one can take a broad
idea, seek funding, be the CEO, and then "hire a bunch of guys like Ian
Goldberg."
Note: This is NOT directed at ZKS, which actually DID hire a guy like
Ian Goldberg! Instead, what I mean is that I've heard more than a few
people say that this is what they hope or plan to do with their crypto
startups, that they hope (or "hoped," past tense, as they all seem to
have abandoned these ideas now) to raise some VC money and THEN hire
brilliant applied cryptographers to actually build the product.
* Well, this business model ain't likely to work. For lots of reasons.
First, product development in a startup has _always_ been an iffy
proposition. (I frankly cannot think of any good examples where it has
worked. Most successful products were developed by very small groups, or
already developed. Yahoo, for example, was already running out of Jerry
Yang's bedroom. Netscape was Mosaic was developed by a small group (Marc
A. and others) at Fermilab, I've already mentioned Sun and Cisco, and
there are other examples. I could make a catalog of what was developed
where...left as an exercise for you to think about, or comment on in
replies to this thread.)
The second reason this business model doesn't seem to work is that
there's a major shortage of Ian Goldbergs out there! A lot of "applied
cryptography" people are actually not very skilled at coding, it
appears. A lot of "applied cryptographers" are what used to be called
"systems analysts" (in fact, the parallels are eerie).
The third and probably most important reason is that a "good idea" is
not enough. Products that people actually pay money for is the raison
d'etre of companies. Whether the products are widgets or programs or
services (though beware of service companies, as the money is usually
not there), a company MUST sell something. A lot of folks seem to think
companies are just cool places to play around with ideas at.
(Side note: I witnessed a couple of "pre-bubble" companies which, in my
opinion, didn't fully understand the importance of getting a product out
very early and having real revenues to both fund further development and
to act as a sanity check (feedback) on their ideas. They each burned
through many millions of dollars in the 1988-93 period and both
ultimately vanished. Ironically, they were pursuing ideas which lie at
the foundations of modern e-commerce and the Net.)
* If I were to fund a company (don't even ask!), I would look for
several characteristics:
-- a really good idea that could (could, not certainly will, as there is
always risk) lead to actual sales of actual products
-- a small group of people who have actually demonstrated some form of
the product and who may already have a prototype, with money only needed
to finalize the product and get it out on the market
-- a group of people who are NOT each expecting $120K or more in loaded
salaries so they can then begin to think about how to apply their cool
ideas to some undefined market or product (high burn rates have killed
many of the companies I've alluded to)
-- people who have been working for nothing, who have day jobs, who have
developed the idea or product with their own money and effort
* To reiterate the obvious, the absolute worst approach is to just think
that putting a bunch of Cypherpunks or other people together will
somehow, miraculously, lead to a product being developed. It didn't work
with Chaum, it didn't work with Xanadu, it didn't work with ZKS (in the
original form), and it failed completely with Paul Allen's "Interval"
project.
(The oft-cited example of Xerox PARC is an interesting one to look at.
I'll do that in another post, perhaps. I knew a lot of the folks at
PARC.)
So, I think a whole lot of technical people are unemployed because of
the bursting of that crazy bubble we all know about. Not too surprising.
And that bubble gave a lot of people the foolish idea that the product
cycle is "Raise money, hire friends, spend a couple of years planning a
product, do an IPO, retire rich."
(One of the reasons for the bubble was related to this: a lot of high
tech start-ups were "hollowed-out" by founders and early technical
people getting out while the stock was skyrocketing, leaving only the
spear carriers behind to try to get a product out the door. One guy I
know was a core technical founder of one of the early Internet auction
companies--not E-Bay, by the way. He sold his stock in the company in
1998-99, as it was hitting $100 a share and moved to a ranch in Montana
with the profits. The company collapsed, for various reasons, was
acquired, the acquirer also collapse, the stocks were delisted, and the
remaining assets were picked up for small change by another auction
company.)
* As others in this thread have noted, most corporate "crypto experts"
are mostly just product integrators and bug fixers. Anybody in a large
company who is the "crypto expert" is probably just the guy shopping for
whatever products are out there (we know that homegrown crypto is almost
a bad idea anyway, so this is good) and then integrating them with the
company's e-mail and Website products. And those products are almost
always going to be whatever Microsoft and Verisign and others are
selling. Boring, really.
To close on a less bleak note, this is a fine time for people to "get
back to basics." The world-changing implications of strong crypto are
yet to come, and at least some of you will likely be involved in
companies which both change the world and which make you very, very rich.
Good luck,
--Tim May
