A colleague pointed me to a good New York Times article last week, Why Samsung Abandoned Its Galaxy Note 7 Flagship Phone, on the epic disaster of its exploding phones:

Replacement phone for Abby Zuis of Farmington MN, click for story

After the initial reports that the lithium-ion batteries were catching fire, they replaced the battery only to find that the new design burned too.  They then said:

It did not help that the hundreds of Samsung testers trying to pinpoint the problem could not easily communicate with one another: Fearing lawsuits and subpoenas, Samsung told employees involved in the testing to keep communications about the tests offline — meaning no emails were allowed, according to the person briefed on the process.

This is just what Julian Assange was hoping for in his 2006 Wikileaks Manifesto:

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive “secrecy tax”) and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption.

Once people know that their words will be used against them, they’ll stop saying useful things.   He wanted to drive people to the Lomnasey Rule – “Never write if you can speak; never speak if you can nod; never nod if you can wink.”  He tried to damage systems that he considered conspiracies, such as the US occupation of Iraq and now the Hillary Clinton campaign.

The managers at Samsung may be remembering what stolen emails did to climate researcher Michael Mann.   A single line in an email from his colleague Phil Jones was enough to get him called out on the floor of the Senate and nearly fired.   The line from Jones was:

I’ve just completed Mike’s Nature trick of adding in the real temps to each series for the last 20 years (ie from 1981 onwards) and from 1961 for Keith [Briffa]’s, to hide the decline.

It was interpreted to mean that climate scientists were hiding the actual decline in global temperatures and therefore engaged in a worldwide conspiracy.   The scientific community fought back hard, but the controversy helped derail the Copenhagen Summit on climate change in 2009.   It wasn’t until the Paris Summit in 2015 that world action on climate change really began.  In those six years CO2 rose 20 ppm, about 5%.   Thanks, anonymous hacker.

I see this in my own work with respect to patents.  We are told never to discuss patent claims, validity, or prior art in email, for fear that it’ll be subpoenaed in an infringement lawsuit.   This obviously makes it difficult to get them right.

Farhad Manjoo thinks that the answer is to avoid email.  It’s so distributed that it’s inherently insecure.   Go with a central repository with encryption, like Signal from Open Whisper.  But email’s ease and accessibility is what makes fast, casual communication useful, and repositories can be hacked or subpoenaed like anything else.  You could, of course, abandon electronics all together, as Vladimir Putin apparently does.  Yet few (but some!) would hold up his regime as a model of good management.

The real answer for companies like Samsung is to adopt the engineering strategies of those who really do care about safety, like the designers of chemical plants, cars, and airplanes.  There’s a whole discipline now called Functional Safety which has standards for the design process itself and the certification of each component in a design.  The automotive version is an international standard called ISO 26262, and is influencing a steadily wider range of products.   It stresses that safety checking must be planned for from the beginning, and kept separate from the usual chain of command to avoid trade-offs between schedule and safety.   More and more tools are coming out to support it, like the DOORS and Jama specification systems.   These have a formal review process for all specs, can track all changes, and let one put links from requirements to design features.  When requirements change, as they constantly do, one can then see which features need to be fixed and which tests updated.

It’s a lot of work, and that’s why consumer product companies don’t do it.  Silicon Valley in general dislikes it, since it’s slow and rewards doggedness instead of ingenuity.  Yet now that their products are having major safety issues (looking at you, self-driving cars), it’s going to be critical.