A 2019 article in The Atlantic reads to me like a whole narrative that is slowing working towards an answer yet never achieving one.

It is kind of ironic.

If you rise towards a single objective there will be a fall, leaving you guessing what’s next… whereas if you continuously improve you may enjoy life-long success instead of feeling it only was in the past:

Entrepreneurs peak and decline earlier, on average. After earning fame and fortune in their 20s, many tech entrepreneurs are in creative decline by age 30. In 2014, the Harvard Business Review reported that founders of enterprises valued at $1 billion or more by venture capitalists tend to cluster in the 20-to-34 age range. Subsequent research has found that the clustering might be slightly later, but all studies in this area have found that the majority of successful start-ups have founders under age 50.

Any single objective is really made up of a large number of rise and fall movements.

So the answer is… how to recover and rise again, a form of adaptation and change.

The less you obsess at achieving a single peak as a life’s objective, the better you might become at climbing every day after you reach it.

I suspect that the Harvard Business Review is stuck measuring narrow factors in their closed-minded study of wealth accumulation. It’s like saying a study has found children under age 4 making rapid improvement in language are in creative decline by the age of 10. Yeah, they move on to other improvements, like math!

What if progress is the goal, instead of perfection of any one step along the way? Are you moving on too fast, too slow? These may be worries ahead, yet at least you’re still moving.

The saying “don’t wrestle with a pig” is a terrible one. A very similar saying, yet dispensing far superior advice, is “don’t strike the King to wound”.

The latter suggests taking on harm can be self-limiting in achieving goals — don’t commit suicide. But the former means what?

That oft-misquoted saying about pigs seems to just emphasize quitting as soon as you start something. Like saying don’t walk up a hill only down.

Is it really wise to advise squeamishness towards any challenge that brings even minimal cost?

In other words, why would you think it wise to run away when someone starts slinging mud? Are you afraid of mud? And does the fact someone else enjoys being in mud change anything?

Makes no sense logically, therefore it’s a saying begging deeper analysis.

Why not defeat an adversary in wrestling and then clean yourself as one would be expected after achieving any task requiring perspiration and exposure?

Consider the following version of the saying, which suggests one is wise to disregard a fear of becoming dirty while working hard to persevere against adversity:

It has been remarked by a wise man that he who wrestles with a hog must expect to be spattered with filth, whether he is vanquished or not. This maxim I have long known and appreciated; nevertheless, there are occasions when it must be disregarded. A man may be attacked in such a way that he is compelled to flagellate his hogship, even at the risk of being contaminated by the unclean beast.

Risk of contamination may be required. Not the most eloquent saying, but a whole heck of a lot better than giving advice to quit something just because it gets hard.

The title of this blog post is from our 2013 RSA Conference panel presentation on the ethics and business of “hack back”, a stage we shared with CrowdStrike and Trend Micro.

It was based on 2012 presentations we had been giving to explain an ethical business model for hack back, based on setting international precedent and trial: a working legal framework for self-defense using information technology.

We had a fairly large turn out those years, and I’ll never forget CrowdStrike’s founder demanding that no recordings be allowed for our panel.

He wanted no press coverage.

I found that highly annoying because the WHOLE point of our efforts at the time was to raise awareness to bring MORE scrutiny, transparency and therefore ethics into the market.

And then CrowdStrike basically took a $50m self-loan and went on to becoming yet another American Anti-Virus company with ties to the FBI, moving the dial not an inch.

Fast forward and I’m here today to say the sad news from the NSA didn’t have to turn out this way.

David Evenden was hired in 2014 to work in Abu Dhabi on a defensive cybersecurity project, only to discover it was actually an offensive spy operation for a United Arab Emirates intelligence service.

Obviously things really took off around this time Evenden mentions.

I gave several talks after 2013 where I implored people to understand that “hack back” was very active even if people continued trying to keep it secretive.

Why so secretive? One reason obviously is entrapment of those recruited to do the technical work.

Once in Abu Dhabi, Evenden realized he had been deceived and that he and colleagues had actually been recruited to perform offensive hacking operations and surveillance on behalf of the UAE’s National Electronic Security Authority, or NESA (the UAE’s equivalent of the NSA).

The deception didn’t initially concern Evenden, however, because the work was primarily focused on conducting surveillance against would-be terrorist targets.

Ugh. Deception is a very loaded word here.

This is a text-book example of exactly what in 2013 we were working so hard on to avoid. Even if Evenden is lying, he can do so on the basis that deception is very easy when there’s zero transparency built in the system.

Evenden goes on to say literally the exact thing we discussed in our panel of 2013, which as I said was censored by CrowdStrike.

I’m an American and I want to target something overseas. What’s going to happen to me? Nothing. Almost nothing. We just proved that…

Even in 2017 I was on a panel at BSidesLV called “Baby got hack back” where I implored people again to consider how much of it was going on already without transparency or accountability.

It wasn’t a hypothetical for me in 2012. It certainly wasn’t in the news enough in 2017 (there was an audible gasp from my audiences) yet should have been.

Even if these stories would have been published sooner, more importantly an opportunity was missed to run and test far better guidelines for the market to reduce deception and confusion about legal hack back.

So I guess the point here is that this “proof” story is a decade after we very clearly said it’s a viable business plan, with activities mostly obscured and hidden from view, such that it needed open discussion already to avoid errors (e.g. criminal charges).