Startups, Bubbles, and Unemployment

[Tim May]

I read with interest the comments on the "why are so many applied 
cryptographers unemployed?" thread.

I know a _lot_ of unemployed folks. Or folks looking for more than "part 
time consulting" work.

Lots of issues, lots of possible reasons for the high unemployment rate 
of applied cryptographers:

* The collapse or sale or downsizing of several companies which formerly 
employed a fair number of Cypherpunks: PGP (used to employ about 6-10 
list members that I know of), ZKS (maybe 5-8 active list memmbers, 
IIRC), C2Net in the 1994-97 years, Counterpane (several list members), 
and even Netscape (three list members, brothers, represented the 
"security department" for a while). This kind of collapse or downsizing 
dumps a lot of the same kind of people on the market.

* End to crazy ideas of "let's do a start-up!"

* An example. Here's part of an e-mail I received recently from someone 
who proposed that I give him some money for some kind of start up or 
charityware project in an area of interest to both of us. I have changed 
the details for obvious reasons:

"I had this vague hope that you might be interested in throwing some
money at an interesting problem in FOO to see if something worthwhile
might result with a view to seeing if it could produce money later.
Nothing so risky as a startup - a startup might make money, whereas what
I was thinking of would be absolutely guaranteed a ROI of 0%. No risk
there :-)  Hopefully a chance of some fun and benefit to humanity
though."

(This writer, an acquaintance of mine, has been trying for several years 
to get various projects going. Sad to say, his very words above indicate 
just how flaky his ideas are. He thinks others will fund projects as a 
kind of charityware. Given the loaded cost of people these days, even 
with reduced expectations in this current downturn, it hasn't even been 
possible for billionaires like Paul Allen to fund projects successfully. 
Many examples exist, even of some crypto startups, where tens of 
millions of dollars went into salaries, benefits, perks, facilities, 
with essentially nothing to show for the expenditures. More on this 
point later.)

*Back in the 1970s and early 80s, high tech start-ups were difficult to 
do. It took some really good ideas, or at least the departure of a 
talented group of people who had already developed something. Examples 
like Sun and Cisco are examples of where the core technology had already 
been developed (Stanford, in both cases) and where the companies could 
begin to SELL PRODUCTS almost immediately.

* A company formed at about the time the VC industry was transitioning 
from "hard money" (hard to fund a start up) to "easy money" was RSA Data 
Security. And though it owned a much more valuable property than most 
recent crypto startups have owned, it almost went under a couple of 
times. Read Levy's "Crypto" for some details of how it almost failed in 
the late 80s and again in the early 90s.

* I've seen a bunch of "applied crypto" companies during this recent 
Internet bubble where the intellectual property is far, far less 
compelling than "RSA" was. I don't mean to insult any of my friends 
here, but the notion with a lot of these companies seems to have been 
"We're young, we're Cypherpunks, let's raise some money, get a nice 
office space with our espresso bar and hot tub, hire our friends, and 
become rich."

(This is perhaps too harsh a summary. But I'll let it stand as a 
reference point.)

* There are still roles for start ups. But I think some really good 
ideas are needed. Just "riding the wave" is no longer working...it 
worked during the bubble years, for a bunch of companies...most of which 
are now greatly downsized or gone completely.

* Don't quit your day job. And if you don't have a day job, get one 
(assuming you need some money...some folks have independent sources of 
some amount of money).

(Note that during the tough period for RSA, most of the key technical 
people had other jobs, as professors, etc. I think Rivest took one year 
off from MIT to consult full-time for RSADSI, but mostly they had other 
jobs the whole time. Only after the revenues began consistently flowing 
were a lot of full-time people hired. During the bubble, of course, they 
staffed up to high levels, expanded, got involved in other ventures, 
etc. And Bidzos, of course, rode the bubble by co-founding and being 
Chairman of Verisign.)

* Doing things in a garage is more than just a quaint image. It means 
"doing things without _any_ burn rate." It means having a day job.

* The notion that a group will raise ten million bucks, rent expensive 
facilities, hire their friends, and THEN get to work on product 
development (or, more often, playing around with potential ideas), is 
just not plausible any longer.

* especially dangerous is the seductive idea that one can take a broad 
idea, seek funding, be the CEO, and then "hire a bunch of guys like Ian 
Goldberg."

Note: This is NOT directed at ZKS, which actually DID hire a guy like 
Ian Goldberg! Instead, what I mean is that I've heard more than a few 
people say that this is what they hope or plan to do with their crypto 
startups, that they hope (or "hoped," past tense, as they all seem to 
have abandoned these ideas now) to raise some VC money and THEN hire 
brilliant applied cryptographers to actually build the product.

* Well, this business model ain't likely to work. For lots of reasons. 
First, product development in a startup has _always_ been an iffy 
proposition. (I frankly cannot think of any good examples where it has 
worked. Most successful products were developed by very small groups, or 
already developed. Yahoo, for example, was already running out of Jerry 
Yang's bedroom. Netscape was Mosaic was developed by a small group (Marc 
A. and others) at Fermilab, I've already mentioned Sun and Cisco, and 
there are other examples. I could make a  catalog of what was developed 
where...left as an exercise for you to think about, or comment on in 
replies to this thread.)

The second reason this business model doesn't seem to work is that 
there's a major shortage of Ian Goldbergs out there! A lot of "applied 
cryptography" people are actually not very skilled at coding, it 
appears. A lot of "applied cryptographers" are what used to be called 
"systems analysts" (in fact, the parallels are eerie).

The third and probably most important reason is that a "good idea" is 
not enough. Products that people actually pay money for is the raison 
d'etre of companies. Whether the products are widgets or programs or 
services (though beware of service companies, as the money is usually 
not there), a company MUST sell something. A lot of folks seem to think 
companies are just cool places to play around with ideas at.

(Side note: I witnessed a couple of "pre-bubble" companies which, in my 
opinion, didn't fully understand the importance of getting a product out 
very early and having real revenues to both fund further development and 
to act as a sanity check (feedback) on their ideas. They each burned 
through many millions of dollars in the 1988-93 period and both 
ultimately vanished. Ironically, they were pursuing ideas which lie at 
the foundations of modern e-commerce and the Net.)

* If I were to fund a company (don't even ask!), I would look for 
several characteristics:

-- a really good idea that could (could, not certainly will, as there is 
always risk) lead to actual sales of actual products

-- a small group of people who have actually demonstrated some form of 
the product and who may already have a prototype, with money only needed 
to finalize the product and get it out on the market

-- a group of people who are NOT each expecting $120K or more in loaded 
salaries so they can then begin to think about how to apply their cool 
ideas to some undefined market or product (high burn rates have killed 
many of the companies I've alluded to)

-- people who have been working for nothing, who have day jobs, who have 
developed the idea or product with their own money and effort

* To reiterate the obvious, the absolute worst approach is to just think 
that putting a bunch of Cypherpunks or other people together will 
somehow, miraculously, lead to a product being developed. It didn't work 
with Chaum, it didn't work with Xanadu, it didn't work with ZKS (in the 
original form), and it failed completely with Paul Allen's "Interval" 
project.

(The oft-cited example of Xerox PARC is an interesting one to look at. 
I'll do that in another post, perhaps. I knew a lot of the folks at 
PARC.)

So, I think a whole lot of technical people are unemployed because of 
the bursting of that crazy bubble we all know about. Not too surprising. 
And that bubble gave a lot of people the foolish idea that the product 
cycle is "Raise money, hire friends, spend a couple of years planning a 
product, do an IPO, retire rich."

(One of the reasons for the bubble was related to this: a lot of high 
tech start-ups were "hollowed-out" by founders and early technical 
people getting out while the stock was skyrocketing, leaving only the 
spear carriers behind to try to get a product out the door. One guy I 
know was a core technical founder of one of the early Internet auction 
companies--not E-Bay, by the way. He sold his stock in the company in 
1998-99, as it was hitting $100 a share and moved to a ranch in Montana 
with the profits. The company collapsed, for various reasons, was 
acquired, the acquirer also collapse, the stocks were delisted, and the 
remaining assets were picked up for small change by another auction 
company.)

* As others in this thread have noted, most corporate "crypto experts" 
are mostly just product integrators and bug fixers. Anybody in a large 
company who is the "crypto expert" is probably just the guy shopping for 
whatever products are out there (we know that homegrown crypto is almost 
a bad idea anyway, so this is good) and then integrating them with the 
company's e-mail and Website products. And those products are almost 
always going to be whatever Microsoft and Verisign and others are 
selling. Boring, really.


To close on a less bleak note, this is a fine time for people to "get 
back to basics." The world-changing implications of strong crypto are 
yet to come, and at least some of you will likely be involved in 
companies which both change the world and which make you very, very rich.

Good luck,


--Tim May