About the Institute

The Hybrid Vigor Institute is dedicated to rigorous critical thinking and the establishment of better methods for understanding and solving society’s most difficult problems. Our particular emphasis is on cross-sector and collaborative approaches; we seek out experts and stakeholders from a range of fields for their perspectives or to work together toward common goals.
Principals | Advisors | What We Offer



hybridvigor.net houses the work of critical thinkers, researchers and practitioners who conduct cross-sector and cross-disciplinary explorations and collaborations.
Blog | Contributors | Topics

  Subscribe to Hybrid Vigor’s RSS Feed



Privacy | Funding


Contact Us



Intervention by Denise Caruso Read Intervention by Denise Caruso, Executive Director of the Hybrid Vigor Silver Award Winner, 2007 Independent Publisher Book Awards; Best Business Books 2007, Strategy+Business Magazine

'Hybrid Vigor' Archive


by ~ December 14, 2011

It is five years almost to the day since I published Intervention, my book on genetic engineering and risk. And I am more convinced than ever that everything I wrote about was spot-on. It seems like every week there is a new revelation about harmful consequences of living biotech products in the wild — consequences that were predicted by so-called activists, but totally dismissed by the industry and regulators.

For example, genes from engineered plants do spread, despite industry’s early and repeated declarations that they cannot. One result? Superweeds that now have built-in resistant to several herbicides.

What’s more, insects are adapting quickly to transgenic plants with insecticide genes. In Illinois and Iowa, a new generation of insect larvae feeds on the roots of genetically engineered corn. And in India, the pink bollworm is unaffected by the insecticide growing in the cotton plants it is eating (for which Monsanto blames the farmers).

And it seems that eating transgenic food may not be so harmless after all.

Yet nothing changes. In fact, the Obama administration is supporting the planting of genetically engineered crops in more than 50 national wildlife refuges across the country.

So … I think it’s time for me to start researching a sequel to Intervention, focused on exposing the dangerously cozy relationships between industry and regulators that ignore scientific common sense and put all of us at risk.

But I’m going to need your help — and I’ll send you a gift, or even many gifts, in thanks for your generosity.

Here’s the deal: For every $20 you donate to Hybrid Vigor, we will send a free copy of Intervention to you, or to anyone you’d like. Signed and inscribed, if you choose.

You also can have your gift copies sent to libraries. Just specify in the instructions that you want to donate your gift(s) to a library, of your choosing or ours, and we will take care of the rest. We can also donate your book(s) to or companies or non-profits or corporate libraries — say, for example, to venture capitalists that are funding biotech startups …

Just click here and merrily Paypal away (you can use a credit card at this link also):

Your generosity will be much appreciated, and put to good use.


by ~ August 26, 2010

USA Today reported on the growing trend for hackers to hijack people’s iTunes accounts:

They typically buy iTunes gift card codes, usually in $50 to $200 amounts. They then sell the codes — which can be used like cash to buy music and videos — at a steep discount, openly on the Internet.

If only these hackers could ensure their victims were from the landed class, they might be considered modern-day Robin Hoods. Alas, they’re garden variety thieves.

But what I liked about the article is that it captured the truly appalling apathetic attitude from Apple and financial institutions, who attempt to lay responsibility entirely on consumers:

Apple says there is little it can do about iTunes account hijacking. The company advises victims to change their passwords and contact their financial institution about being made whole.

Change their passwords? What good will that do? As the article points out,

iTunes logons also get stolen and sold off by hackers who spread computer infections containing keystroke loggers that capture logons as you type them.

So the hackers will capture you newly typed password, too.

Calls to your financial institution will likewise be met with a “talk-to-the-automated-hand” sort of attitude. After all, why should these guys care if you get hacked? These hackers drive up revenues by getting you to spend money that you wouldn’t have otherwise! Some economists would even argue that this kind of coerced economic activity is good for the economy!

Unfortunately, there’s very little consumers can do to protect themselves. How would you even know if you have a keylogger watching you all the time? Thanks to the lack of transparency in Windows and Mac OS, it’s difficult to tell when some rogue application is watching your every move. And of course, Apple shouldn’t be storing “credit and debit card, checking account and PayPal information” on their site. For their part, financial institutions need to come up with a better form of micro payments than opening a multi-year tab at iTunes on your personal credit card or PayPal account.

But will consumers care enough to boycott iTunes? Doubtful. So in the meantime, I recommend befriending a hacker.


by ~ August 25, 2010

John Fontana recently posted on the burgeoning interest in the topic of trust. One his links includes a discussion with two people I know and whom respect on this topic, Hilary Ward and John Clippinger (whose book “Crowd of One” I reviewed back in my Burton Group days). I highly recommend checking out all these resources!


by ~ August 18, 2010

My friend and security-industry-great, Gunnar Peterson gave a fantastic keynote presentation at the Cloud Identity Summit last month. During his speech, he used a series of images to show show some absurdly feeble attempts at security. One in particular caught my eye:

Bike Security

Given the subject of my presentation two days later—”trust” in the cloud—I couldn’t resist goading Gunnar a bit by countering that the bike’s security in fact passes muster. Here’s my argument:

According to Murphy’s Law, this bike should be stolen. And yet, there it is. Someone even took a picture or it. Is there something else going on here that’s keeping the bike from being stolen? I think so. In fact, I offer a special exception to Murphy’s Law. I call it “Mikey’s Law” and it goes like this:

Just because something can be stolen doesn’t mean it will be.

Perhaps in the society where the owner lives, simply putting a lock around something expresses one’s wishes for the item not to be taken—and that’s sufficient security because others respect that wish. People may even help you enforce your wish for respect of personal property by taking pictures and looking out for would-be thieves. Sounds like the kind of place where I’d like to live, in fact.

Idealistic? Perhaps. But for most of us it’s also part of our everyday experience. After all, do you lock up all of your valuables all of the time? Can you leave your wallet or purse in your office and expect to come back an hour later and find them just where you left them? In many cases, in fact you can. And that’s a good thing.

My point is that security practitioners are inclined to propose the “security society” as the ideal model for public safety. In a security society, citizens can’t trust others, fear that bad things always will occur, and lock up everything of value. In my view, the security society is the model of last resort. Where we “live” we should instead aspire to create a cooperative society, one based on trust rather than distrust. Yes, bad things will happen in the cooperative model, just as they do in the security society. But then again, all hell won’t break lose either, as some would have us believe. And even if the incidence of theft if a security society and a cooperative society were roughly the same, in which place would you prefer to live?


by ~ June 1, 2010

Today is the first day of my month-long fellowship at the STUDIO for Creative Inquiry, in the College of Fine Art at Carnegie Mellon University.

I am here at the invitation of Golan Levin, director of the studio and, back in the day, a former colleague at Interval Research. The fellowship is funded by the National Endowment for the Arts.

Golan told me I could do anything I wanted, and so I invited Robin Gianattassio-Malle to come work with me on inventing a better way to help people learn and think about the consequences — both risks and benefits — of innovations in science and technology. We want to go beyond the usual binary, “fawning or damning” approach that dominates media coverage today, to actually informing people about these incredibly complicated issues.

I’m really excited about this project. It’s the first time in a long time I am going to have the opportunity to roll up my sleeves and do what I do best: to help people understand complexity in a way that is engaging, helpful and accurate. We are going to have to confront some tough design issues, but between us we have an amazing network to draw from.

Robin and I will be working at the STUDIO with two other fellows — Kyle McDonald and Jacob Tonsky — both of whom are wicked smart and from whom we expect to learn a lot.

We will be building a prototype over the next few weeks, and I will be posting updates about our progress. Yeehaw!


by ~ March 29, 2010

The word “trust” appears 32 times in the press release announcing the official launch of the Open Identity Exchange (OIX). Normally, I’d be enthusiastic about such dense coverage of a critical topic, but in this case I question the group’s understanding of the term.

A Governance Template, Not a Trust Framework

OIX is a kind of standards body where techies from various industries come together to prescribe satisfactory methods for identification, so that these IDs can be used across websites. From the OIX site, the process is as follows:

… policymakers representing a trust community (e.g., government, industry association, professional society) start by developing a trust framework specification. This document defines the identity proofing, security, and privacy policies that must be followed by identity service providers to reach a specified level of assurance (LOA). In some cases it will also specify the data protection policies that must be followed by both identity service providers and relying parties to reach a specified level of protection (LOP).

Lastly, the trust framework defines the qualifications necessary to be an assessor for the trust framework—a person or a company who has the professional experience necessary to assess whether an identity service provider or relying party is in compliance with the policies specified for a certain LOA or LOP.

Next the policymakers contract with a trust framework provider (TFP) to operate a certification program for the trust framework. A TFP who operates by the OITF model performs the following functions:

  1. Publishes the trust framework so it is publicly accessible.
  2. Accepts listings from assessors who meet the qualifications specified in the trust framework.
  3. Accept listings from identity service providers (and in some cases relying parties) who are successfully certified by a qualified assessor.
  4. Publish updates to the trust framework as it is revised, and periodically renew certifications of participants as required by the trust framework.

Lastly, the OITF model includes roles for auditors and dispute resolution service providers to assist in ongoing assessment of trust framework participants and resolution of any disputes that may arise.

(Side Note OIX: also don’t abuse the word “lastly.”)

Apparently OIX just hosts the party and provides the napkins (for sketching), but little else. Defining the standards is up to the policy makers and certifying compliance is up to a Trust Framework Provider (TFP)—whatever that is.

Identification isn’t Trust

I suppose that, if successful, OIX will improve the way digital IDs are used. That’s not altogether a bad thing, but it’s also not trust.

By analogy, imagine that, in order to improve the effectiveness of TSA screeners, the government sets a policy requiring travelers to present both a driver license and passport at the airport. Does it follow that everyone inside the secure area of the airport will trust each other? If the TSA screener clears someone, does that mean the screener trusts the traveler? Or that the screener trusts the ID? Do the IDs foster any kind of trust at all?

If there’s one thing I’d like to get through to techies who work these protocols, it’s this: identification isn’t trust. Please find another word to describe what you’re doing.


by ~ March 16, 2010

Imagine a friend invites you to a dinner party. This year, the invitation goes, the party will be catered so you’ll need to pay $40 per guest. Maybe you’re not too excited about the catering idea, but you figure you want to support your friend, so you decide to attend and bring your spouse. At the party, the general consensus is that it’s fun to see everyone, but the catered food wasn’t nearly as good as the traditional potluck approach. Later, word’s passed around that your friend decided to do some cost-cutting on the catering, which explained the below-average food. Then news breaks that because of these cost-cutting measures, your friend actually turned a nice profit on the party and was able to buy her kid a new Nintendo DSi (apparently the kid got mad while playing with the old one and threw it against a wall).

Would you feel happy for your friend? Or would you feel used? After all, your friend took the initiative; she took the risk (after all, what if someone got sick and decided to sue her?); she organized the event; she provided the venue. In short, your friend was the entrepreneur; she “owned” the party. And if that’s not to your liking, what’s stopping you from throwing a party of your own?

But you may still experience a sense of betrayal that comes from feeling obliged to attend an event for friendship’s sake—an event that ostensibly was just a party but turned out to be a fundraiser for your friend’s spoiled kid. In addition, your attendance at the party mandated the attendance of your spouse, prompted you to buy a new dress, and encouraged your mutual friends to attend as well. So you also unwittingly marketed this fundraiser for an over-privileged kid. And of course, since the food was sub-par, you feel taken by your own friend.

Stone Soup 2.0

This modern retelling of the Stone Soup fable is a commentary on capitalistic society, one in which the Pot & Stone owners walk away with most of the soup. Or more literally, American capitalism is a system that distributes the greatest rewards to owners of infrastructure. In this economic arrangement, business owners have much greater control over the value created by the business than do the contributors. This reward structure is said to encourage private enterprise and competition, which eventually will produce the greatest good for the largest number of people.

But the Law of Relational Symmetry tells us that the party in control of the relationship will exploit the other participants. In today’s businesses, owners control the most important aspects of the relationship, such as the ability to set compensation, benefits, and terms of employment. Contributors usually have to sign away their rights to any intellectual property they create to their employer. And often, contributors sign non-compete agreements that restrict their movements after refusing to work under unfavorable terms. With no ability to hold property (intellectual property in this case) and an acute need for income and healthcare, workers in today’s society need jobs the way Victorian women needed husbands.

So while capitalism is undoubtedly the best system practiced on a massive scale for producing wealth, it is nonetheless a system of exploitation and produces less than optimal results for all parties.

Continue reading »


by ~ February 14, 2010

Anyone who read Frank Partnoy’s book F.I.A.S.C.O will immediately appreciate the context of this story: The NYT reported today how Wall St. banks Goldman Sachs and JP Morgan assisted the Greek government in hiding hundreds of billions of dollars in debt, while collecting over $300 million in fees for themselves. According to the Times:

Wall Street tactics akin to the ones that fostered subprime mortgages in America have worsened the financial crisis shaking Greece and undermining the euro by enabling European governments to hide their mounting debts.

As worries over Greece rattle world markets, records and interviews show that with Wall Street’s help, the nation engaged in a decade-long effort to skirt European debt limits. One deal created by Goldman Sachs helped obscure billions in debt from the budget overseers in Brussels….

In 2001, just after Greece was admitted to Europe’s monetary union, Goldman helped the government quietly borrow billions, people familiar with the transaction said. That deal, hidden from public view because it was treated as a currency trade rather than a loan, helped Athens to meet Europe’s deficit rules while continuing to spend beyond its means.

As the Times article later calls out, the rest of Europe is livid. Countries like Germany are likely going to have to flit the bill for this—just as they were nearly finished paying for reunification with East Germany. An article in Der Spiegel (link refers to the English version) discusses bluntly Goldman’s role in the shenanigans. According to the Spiegel article:

In the Greek case the US bankers devised a special kind of swap with fictional exchange rates. That enabled Greece to receive a far higher sum than the actual euro market value of 10 billion dollars or yen. In that way Goldman Sachs secretly arranged additional credit of up to $1 billion for the Greeks.

This credit disguised as a swap didn’t show up in the Greek debt statistics. Eurostat’s reporting rules don’t comprehensively record transactions involving financial derivatives…. Goldman Sachs charged a hefty commission for the deal and sold the swaps on to a Greek bank in 2005.

In an interview between a Spiegel reporter and HSBC chairman Steven Green, the tension is palpable. The interviewer begins with the question “Mr. Green, when was the last time you were ashamed to be a banker?” The interviewer goes on to ask, “You are not just the group chairman of Britain’s HSBC, the world’s largest private bank. In your free time, you also serve as a lay preacher in the Anglican Church. Have you ever prayed: ‘Please God, rescue capitalism’?”

As the Spiegel interview bears out, yelling at the bankers is a cathartic (a nice Greek word) but fruitless exercise. Like Iago in Shakespeare’s Othello, bankers respond with complete dispassion when discussing the suffering they’ve enabled and insist on the legality of the trades and their innocence in these matters. Back to the Times article:

Wall Street did not create Europe’s debt problem. But bankers enabled Greece and others to borrow beyond their means, in deals that were perfectly legal. Few rules govern how nations can borrow the money they need for expenses like the military and health care. The market for sovereign debt — the Wall Street term for loans to governments — is as unfettered as it is vast….

In Greece, the financial wizardry went even further. In what amounted to a garage sale on a national scale, Greek officials essentially mortgaged the country’s airports and highways to raise much-needed money.

Does trust depend on a society’s ability to create a law for every possible act of treachery? Could Moses have brought down the 10,000 commandments from the mountain? Maybe over-the-counter derivatives trades are legal by some literalist interpretation of securities law. But clearly the people who wield the power of such financial instruments pose greater risks to society than Jihadists. In my view, these kinds of over-the-counter trades ought to be illegal and subject to the worst kinds of penalties on the books.


by ~ January 16, 2010

This week, I started a new job as Sr. Manager at Accenture. I’ll be working in Accenture’s Security Consulting Practice, focusing on Identity and Access Management. So my new role is basically a continuation of my career for the last dozen years, but at Accenture it’s also an opportunity to get involved in some of the most challenging and culturally relevant identity projects of our time.

Governments continue to develop identity systems, commercial sites increasingly add social networking features, and new cloud services strain existing modes of online trust. I’m looking forward to a very interesting year!


by ~ November 30, 2009

The NYT ran an article today discussing how humans may be wired for trust. In a recent study of small children, scientists discovered that traditional views of human nature as hopelessly egocentric and fiercely competitive don’t portray the full picture. From the article:

“We’re preprogrammed to reach out,” Dr. de Waal writes. “Empathy is an automated response over which we have limited control.” The only people emotionally immune to another’s situation, he notes, are psychopaths.

Dr. Michael Tomasello, one of the researchers cited in the NYT article, explains that “we are both selfish and altruistic at the same time.” Some of the altruism in humans comes from what Tomasello describes as “shared intentionality.” Again from the article:

The shared intentionality lies at the basis of human society, Dr. Tomasello argues. From it flow ideas of norms, of punishing those who violate the norms and of shame and guilt for punishing oneself. Shared intentionality evolved very early in the human lineage, he believes, and its probable purpose was for cooperation in gathering food. Anthropologists report that when men cooperate in hunting, they can take down large game, which single hunters generally cannot do.

I’m sure this view of human nature feels intuitive to most people, but Western traditions haven’t given these ideas much play. Perhaps the current economic crisis will inspire policy makers and economists to re-evaluate the philosophical underpinnings of capitalism.

But narrowing the topic to the field I work in (digital identity and internet security), I wonder 2 things: How can we provide for shared intentionality on the Internet? And how do we also imbue applications and other non-human actors on the Internet with similar instincts?

Comments welcome!