Stealing from the Cambridge Public Library

March 5, 2010

Who’s to blame when IT projects fail? Michael Krigsman argues that blame should generally be shared among the three major culprits (software company, consulting company, customer), and a recent torrid discussion among the Enterprise Irregulars largely supported him. If anything, several pundits have told me in private, blame the customers. “If a customer’s going to be stupid, we can’t stop him,” said one.

I’m not comfortable with this argument, because I don’t think it’s sufficiently rigorous. In any unfortunate chain of events, many people have a hand. But it’s simply wrong to blame them all. Some, because of their role or their power or their ability to influence events are principally responsible, while others are merely incidentally involved or are even victims. To get the blame right, you have to dig down and figure out where the power lies.

To see what I mean, let me use an example used by philosophers in the area. You all probably know that World War I began after Gavrilo Princip assassinated the Archduke Ferdinand in Sarajevo. The problem is, who do you blame? Princip (who, it happened was so indecisive and incompetent that he was walking away from the spot he’d picked), the Archduke, who went to Sarajevo only because he wanted to have an outing with his mistress, or the political situation in Europe? Hard to say. But the one thing you don’t want to do is blame the coachman, who, as it turns out, turned down the wrong street and thereby brought the Archduke right to Princip.

In my view, the closer you are to setting the parameters for a project, the more likely it is that you’re setting the course of future events. So if I want a culprit, I look at the person who’s holding the gun, because it’s his decision whether to fire or not. For that reason, I tend to think that the software vendors are presumptively responsible. They’re the ones who decide what can and can’t be done with the tool they sell, and if they create a situation where dominos like misuse, misunderstanding, careerism, stupidity, etc., fall into each other one after the other, like the great countries of Europe, they are responsible, because they could have and often should have anticipated this and done what they can to prevent it.

This isn’t just because they set the conditions and they are responsible if they design conditions that don’t work. It’s also because they give the people the idea that that’s what they’re doing. We tend to give these mandarins the benefit of the doubt, believing that these products are fully tested, that they accord with best practices, that the most experienced people are working on them, etc., etc., etc. And once they realize that this is the expectation, that people do expect them to be good engineers, etc., etc., they take on extra responsibility. It may be fooish, yes, and If the customers believe that tommy-rot, perhaps their foolishness is contributing to the problem. But it still seems to me that the people who accept the power given them by this false belief need to take the responsibility that goes with it.

And that’s why they are presumptively responsible.

I was reminded, forcibly, of this by a recent event at the local library, which just re-opened in a brand new facility with brand new automatic checkout machines. I’m a good citizen, so when I went in the other day with my seven-year-old red-headed daughter, I renewed a book she hadn’t finished. Thirty minutes later, we checked out a couple of new items that she had found.

In the meantime, somebody had checked out seven videos on my account. I still don’t exactly know how, but let’s just assume for the sake of argument that when I finished renewing, I walked away from the terminal, leaving my session “live,” and somebody later walked up to the terminals and just added a few videos to what “I” was doing.

The sessions do time out, and the first thing you’re supposed to do is scan your card, so there’s at least some possibility that this was done with malice aforethought. Somebody had realized that you can steal the Cambridge Public Library blind, if you just hang around the terminals and act quickly after somebody walks away from them. It’s kind of a public-spirited stealing actually, because the person who gets stuck with the bill is not the taxpayer, but the person who used the terminal. The books appear on their account, and as the supervisor told me later, it’s the library policy to make people take responsibility for the books on their account.

“If you use plastic,” he said, “There are tradeoffs, and you just have to accept that fact, my friend.”

You see, as soon as I found these spurious borrowings on my account, I had immediately gone and found said supervisor and told him. My feeling was, “This is a new system, and it’s flawed. If one person has figured out how to do this, others will, too, and pretty soon, it will be open season on the pitifully few books in the aforementioned library. Somebody had better get cracking and fix this.”

Well, that was my feeling, until I talked to the supervisor, who corrected me. “What you say is impossible. We have never had a case like this. You are responsible for the books. Case closed.” I didn’t take this quietly, so eventually, he took down my name and the list of spuriously borrowed videos, and after I left, he shoved the list in his drawer.

The only reason I know even this much is that three days later, I came in to borrow another book, and the videos were still on my account. “I called the assistant director, but he/she is out of town,” he said. I think if he honestly believed that one could steal lots of books with impunity from the library, he would not have reacted this way. But he didn’t. He just thought I was a liar.

Here is where the aforementioned presumption comes in. This guy simply couldn’t believe that the computer system that he had been given could have a flaw. Rather than believe that, he preferred to believe that I, standing there with my seven-year-old daughter, had checked out the videos (seven of them), secreted them somewhere in the library, gone up to him and tried to get them off my account. After I succeeded, I guess he was thinking, I would then go back to the hidden cache, put the seven videos under my arm and walk out right in front of him.

Now I ask you, which of these scenarios is more implausible. One, the designers of the checkout system did so imperfectly, leaving a security hole, which somebody found, possibly inadvertently. Two, this white-haired father of a seven-year-old was trying to steal from the Cambridge Public Library by claiming that he had not checked out videos that the system said he had just checked out (even though the videos were nowhere about his person).

Implausible as it is, this well-educated person who by his choice of profession shows that he has dedicated himself to the life of the mind simply found it impossible to believe that there was anything wrong with the system. He believed this so firmly and so thoroughly that he couldn’t even be bothered to notify anybody about the problem, even though, if there were a problem, it would be a good idea to fix it as quickly as possible, before the library shelves were emptied. So far as I can tell, he still believes it.

The thing is, I almost fell into the trap, too. I’d had my probity questioned, so you know who I was blaming? That supervisor. I really had to sit down and think before I realized who was really at fault. That’s right, it was the vendor. To see why, think about what happens in an analogous situation, at the bank machine. When you take money out of these machines, you simply can’t leave the machine open for the next guy to use. You have to get your card back, and if you try to leave without doing so, you are alerted, loudly. Clearly, best practice in the area is to make it really hard for somebody else to pirate a session. And the vendor didn’t follow this best practice.

I should have known this from the beginning, because I should have remembered that the vendor is presumptively responsible. But as long as I don’t remember it or the supervisor doesn’t know it, the vendor is off the hook. Instead of blaming Princip (or maybe the Archduke or the political situation in Europe), that supervisor is doing the natural thing and blaming the coachman, the guy who made the last and most visible mistake. And until he can be taught that this is a mistake, books will continue to be stolen from the Cambridge Public Library.


3 Responses to “Stealing from the Cambridge Public Library”

  1. Dennis Moore Says:

    David —

    “Yeah, I’m gonna have to go ahead and disagree with you there …” — Lumbergh, Office Space

    Interesting story, but flawed conclusions. In most IT projects, the software vendor provides a component, not the whole system (not the hardware, not the implementation). Enterprise software vendors rarely are responsible for the whole stack and the integration – but when they are, then you could certainly hold them responsible for project failures. The analogue of the enterprise software vendor in this story is the maker of the scanning laser component, haplessly blamed for not forcing a rescan of the card for each item, despite having that capability (but the integrator didn’t use it).

    I am willing to bet good money that the scanning laser component works well in any number of other libraries and other applications. However, the integrator who put together the combined system, of which the scanning laser was 10-20% of the upfront cost, severely botched the design and implementation.

    You could certainly argue that the customer should have known the design was flawed, and should have demanded references of other libraries who were successful with the system as designed. In fact, typically, the integrator will ask the customer to validate the design every step of the way, as the integrator has far less expertise in the use case than does the customer.

    But ultimately, the failure was with the integrator, not the component provider. As is VERY often the case with failed IT projects (whether the integrator is IT or a third party).

    — Dennis Moore

  2. David, I am an EI and do not agree with Michael. I am just tired of pointing it out so often. He says he has been watching failures for over a decade but then ends each note with the lame “devil’s triangle” – kumbaya, everyone’s to blame. As in car insurance, there should be a systematic apportionment of blame. In my experience is often 10% customer, 30% sw vendor, 60% SI. The SW vendor and SI have done it thousands of times, for most customers it is a life event. The SI is being paid a premium to deliver results. The SW vendor should be in the business of watching and certifying its partners. Imagine if every one in business did a shoddy job and blamed each of us for being a stupid customer.

  3. toppundit Says:

    I want to thank Dennis for an interesting correction and extension of my argument, one I entirely agree with. In the example, the vendor might well be blameless; it is possible, even likely, that the integrator could have and should have provided a system that would not allow people to take out books under somebody else’s name. In that case, yes, it would have been the integrator who was presumptively responsible.

    Since I agree with Dennis, is it also possible that Dennis also agrees with me? The basic point of my piece was that in IT projects, the people who shape what is possible are presumptively responsible when things go awry.

    So, when World War I erupts, you can blame Gavrilo Princip (a lot), the Archduke Ferdinand (some), the political situation in Europe (perhaps), but whatever you do, don’t blame the coachman, despite the fact that it was his error that made the whole thing possible. (If he had followed the prescribed route, the Archduke would never have encountered Princip.)

    Similarly, when a library checkout system starts assigning DVDs to the wrong account, blame the integrator or the equipment provider, but don’t blame the guy whose account was hijacked.

    Michael Krigsman says this argument is specious, but I’m not sure why. Is he saying that I should make the library whole because the DVDs are on my account? Is he saying that the taxpayers just have to take the hit? Surely the only reasonable position is Dennis’s and mine. The people who provided the flawed system should take the hit. That’s what I mean by presumptive responsibility.

    Why don’t they actually take responsibility? Vinnie’s argument is that they often do take responsibility, and if so, that’s great. But his comment about “other businesses,” needs a caveat. Other businesses are not necessarily governed by the same rules. Most businesses that make products are governed by the law of products liability. They are strictly liable if they make a defective product. Technology vendors are not governed by this law. If they were, you wouldn’t need a notion of presumptive responsibility. It would have already been established.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: