CrankySec

Blameless(ish)

Do you ever get the feeling that no one really understands what you're saying, regardless of how you say it? That feeling that you somehow managed to piss people off, even when you do exactly as told? Have people called you "difficult", "abrasive", or "unprofessional"? You may be suffering from "giving a shit even when it makes other people look incompetent."

You're not alone: giving a shit requires something of a pragmatic outlook on life, and many folks in technical fields commit the corporate sin of being pragmatic. The problem is that pragmatic people tend to focus on the problem in order to come up with solutions. And to do that, one must first acknowledge that a problem exists. And, like any good student of the service management arts, you have been conditioned to go look for the mythical "root cause" of said problems. This is where things get tricky: more often than not, the root cause is "someone fucked up." Given that we're all humans (I hope), at some point or another, we are going to fuck up. That's just one of those certainties in life that's up there with death and taxes.

This is so common that a whole methodology was developed to handle the emotions associated with failure so people can deal with the issues at hand instead of pointing fingers or going on the defensive: blameless postmortems. Unless something criminal took place or intentional malpractice is at play, practitioners of a blameless culture generally acknowledge that shit happens, let's fix it, make sure it doesn't happen again, and let's move on. And that works pretty well. Unless, that is, the fuck up is systemic and/or caused by sociopaths dead set on climbing the corporate ladder above all else.

See, a blameless postmortem works pretty well when the persons we are not to blame are rank and file like you and me. We can take that in stride because we know that a) shit happens, and b) we're not climbing any ladder anyway because we're not sociopaths and we're not part of the in-group that gets promoted. The real problem happens when you try to blameless upward: the director doesn't want people walking around saying that the blameless lies with things that are their responsibility. The vCISO won't accept blameless for things of their own doing. If they are the root cause of anything, it can only be that they are the root cause of incredible joy. Or the root cause of massive productivity gains. Or the root cause of Microsoft and Oracle still being in business. "Was it a bad decision to lock myself in AWS/Azure/Google Cloud? Nah. Every security problem caused by the sheer madness that is the garden variety cloud offering is probably due to some dumb individual contributor or the cybersecurity team that I overwork and don't train." Same deal with "Was it stupid of me to sign a 25 year lease on this multi-million dollar office that no one wants to come to because they can absolutely be just as productive working from home and we can just rent a meeting room for $50 if they need to get together once every two weeks? Nah. No one wants to work." Major Principal Skinner vibes.

So, this blameless thing is for the poors. People high up don't fail, so they don't need blameless anything. Please refrain from going to your boss's boss and telling them that maybe this time-consuming thing they love to do makes no sense. It's not about making sense, silly! It's about looking good! The only thing you can do here is to stop caring, stop trying to change things, and stop trying to be reasonable and point out the obvious. Unless, of course, you find yourself in the rare position of "working with great people" or, if you're anything like me, you just cannot abide bullshit. In that case, make sure you have some funds stashed away for a rainy day, because it will pour.