Neuro-tech comes to the PMO

Cognitive liberty
Cognitive privacy
Have these concepts come to a project near you?

Here’s the on-coming HR issue for the PMO, if it’s not already arrived:

Hidden, embedded, or even overt sensors of your cognitive state, what your doing, how often you do it, whether you’re focused or distracted or daydreaming are all within operating reach, or pretty close by. Are they legal without disclosure and consent? Are they transparent? And is there a path to challenge and dispute resolution?

Talk about 1984 big brother 40 years on!

Is all this really happening?
At least to some degree: Yes. 

And, the idea of "cognitive liberty" has spawned a whole genre of books and articles and podcasts.

Metrics everywhere

Working in the cloud with cloud-based applications? These applications, at least in theory, can track and interpret and report every keystroke (is your typing off today?); their timing (are you sleepy? Do you need to be awakened?); mind-block today?; and other metrics.

Working online from a work-based laptop? It can be interrogated routinely, even the camera may be watching. More likely not, however. But some advise turning off when you don't need it.

Other workplace devices: smart this and that you may be wearing or carrying? If there’s an internet connection there may be surveillance.

Would you agree to wear a sensor?

If you wear a digital smart watch, Fitbit, or the like, you've already made that decision.

Yikes! What did I sign?

Oops! Remember all that on-boarding paperwork? What did you sign that waived your privacy or agreed to surveillance?

And whose data is it?
It’s about you; is it yours? How is it stored and protected? Could it play into your next job interview if you change employers?

Do you drive as part of your project activity? Surveillance .... with permission ... has invaded the car insurance industry. Now to avoid premium surcharges, or more benignly qualify for discounts, you agree that your every driving detail can be tracked, evaluated, and reported. You are also told the data could be used in accident investigations.

Can the same idea be ported to the PMO? Will your cognitive record be cited in your next review, or influence your project assignment, or be considered in a project bonus?

Who has expertise?

And what’s the training around this for HR and supervisors? And what are the penalties for abuse?
And what about copyright of ideas? You'd better dust off the rule book. When is your stuff “work for hire” and when is it not?

The path

It's hard "to begin with the end in mind" as Covey might advise. Because.... because where could this possibly end? Is there a steady-state we are journeying to? Unlikely. More likely: there is no end-state; only constant innovation and change. 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Minimize your maximum schedule

---

To minimize your maximum schedule is a good thing. Or, it should be.

Here's how to do it:

• Subordinate all other priorities to the most important tasks. This begs the question: is there an objective measure of importance, and from whom or what does such a measure emanate?
• If you can measure 'importance' (see above) then do the densest tasks first, as measured by the ratio of importance to time.
  
  Note: a short time (denominator) will "densify" a task, so some judgement is required so that a whole bunch of short tasks don't overwhelm the larger picture. In the large picture, you would hope that the density is driven by the numerator (importance)
  
  
• Always do an 'earliest start', putting all the slack at the end. You may not need it, but if you do it will be there.
• Move constraints around to optimize the opportunity for an earliest start that leads to least maximum. See my posting on this strategy.
  
  
• If a new task drops into the middle of your schedule unannounced, prioritize according to 'density' (See above). This may mean dropping what you are doing and picking up the new task. Some judgement required, of course. It's not just a bot following an algorithm here. 
  
  
• If some of your schedule drivers have some random components, and you have to estimate the next event with no information other than history, then "LaPlace's Law of Succession" may be helpful, to wit:
• To the prior random (independent) outcomes (probability) observed, add "1" to the numerator and "2" to the denominator to predict the probability of the next event. (*)
  
  So, by example, if your history is that you observed, measured, or obtained a particular outcome independently 3 of 4 times (3/4), LaPlace's Law would predict (3+1)/(4+2) as the probability for the next similar outcome, or 4/6. This figure is a bit more pessimistic, as you would expect by giving extra weight to the number of trials (denominator).

_________________________

(*) (n+1)/(d+2) isn't just a guess, or throwing a dart at a board. It is a rigorous outcome of an algebraic limit to a long string of 1's and 0's with historic probability of n/d. Although LaPlace did the heavy lifting, Bayes gets the popular credit for the idea of using prior observations as the driver for new estimates with a modified hypothesis.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Feedback ... what it's all about

---

You hear about positive feedback; you also hear about negative feedback.

The question is posed: Is negative feedback good or evil?

Answer: Good!

Really? 

Yes, 'negative' is good.

Well then, what about positive feedback?

It can be, but it can also be destructive. Read on.

Ooops: did I mention what feedback is? Generally it is a sample or portion of an outcome, or something directly related to an outcome, that appears back at the source, or input, or beginning.

Positive feedback

Here's the thing: 'Positive' feedback is reinforcing, agreed, but that may not be a good thing. 

Really? Why not?

Because positive feedback encourages or promotes outcomes to ever increase, following the rule: 'more is better'. But such may become unstable, erratic, even chaotic. And, if the outcome has elements of distortion, disturbance, or some other impurity, then rather than 'more' you want 'less'.   

Negative feedback -- which is to be understood as feedback phased or timed to be not reinforcing -- helps with stability, predictability, and puts a damper on chaotic impulses. Done right, properly phased feedback can reduce distortion and help cancel-out disturbances. (*)

We can summarize this way: 

The primary purposes of 'feedback' are to: 

• Correct behavior (not always, or even mostly, human behavior), 
• Prevent 'runaway' and chaotic responses, 
• Confirm outcomes as expected, and 
• Enhance the predictability of outcomes. 

These latter advantages come from so-called 'negative' feedback.

Closing the Loop

NOTE: providing feedback has its own jargon: We say: feedback closes the loop (the loop is from outcome back to the source that drives the outcomes), or the 'loop is closed'

Now the tricky part: Strength and timing are everything. 

To close the loop effectively, the strength (or amplitude) of feedback, and the timing (or phasing) of feedback has to be such that the feedback provides a countermeasure to the potentially errant outcome, the net effect being an outcome just as predicted, void of the bad stuff.

What could possibly go wrong?

Actually, a lot can go wrong.

No feedback at all is the worst of the worst: the 'system' is 'open loop', meaning that there are outcomes that perhaps no one (or no thing) are paying attention to. Stuff happens, or is happening, and who knows (or who knew)?

Timing errors are perhaps the next worst errors: if the timing is off, the feedback could be 'positive' rather than 'negative' such that the 'bad stuff' is reinforced rather than damped down. 

Strength errors are usually less onerous: if the strength is off, but the timing is on, then the damping may be too little, but usually you get some favorable effect

Practical project management

Feedback for correcting human performance is familiar to all. Too late and it's ineffective; too much over the top and it's taken the wrong way. So, timing and strength are key

But, the next thing is communication: both verbal and written (email,etc). Closing the loop provides reassurance of the quality and effectiveness of communication. You're just not talking or writing into the wind!

And, of course, in system or process design, loops should never be open. Who knows what could happen.

I should mention:

The study of feedback systems generally falls within what is called 'cybernetics'. As described by sciencedirect.com, MIT mathematician Norbert Wiener defined cybernetics as “the study of control and communication in the animal and the machine." 

From Wikipedia, we learn: The core concept of cybernetics is circular causality or feedback—where the observed outcomes of actions are taken as inputs [ie, feedback] for further action in ways that support the pursuit and maintenance of particular conditions [ie, 'ways that support' requires the correct timing and strength]

---

(*) The difference between noise and song among many voices is timing or phasing. The members of a really good choir or ensemble sense the others and with that feedback each member adjusts to the pace of the others. But, get the timing wrong, and it's all just noise. 

 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Is AI eating the software world? An essay

---

Daniel Miessler has posted a provocative essay with the attention-grabbing headline: "How AI is Eating the Software World". (*) He subtitles his essay this way:

The future of software is asking smart questions to a mesh of APIs running layered models

Meissler posits three architectures:

1. "Outcomes" which is pretty much conventional software design: Inputs, controls, task or process, and outcomes.
2. "Understanding" which he thinks is the not-too-distant world of generative AI. A progressing stack of data (unorganized and unevaluated), information (organized data), knowledge (integrated information), and understanding (all before applied in context with situational awareness)
3. "SPA" which he has coined for "state" (present situation, but multi-dimensional), "policy" (... "which is your desired state and the set of things you want and don’t want to happen"), and "action" (..."which is the recommendations or actions that can be performed to bring the STATE in line with the POLICY.")

Eventually, the software that runs a project or a business will be defined by a number of APIs that address various layers of multi-dimensional sources of "understanding" but work in a SPA kind of architecture. 

Need something new in the SPA? Define an API, or buy it from someone else. 

Need to offer something to a customer? Give them access to an API that pulls from your company's value-add stack of "understanding". 

Now Miessler readily admits that the current generation of generative AI tools are not ready for business or project prime time because what you get is not predictable or necessarily repeatable (if you run a generative AI query 10 times you are likely to get 10 different answers. That's a no-no for most business or project processes)

Like I said, a provocative essay.

__________________

(*) An essay from 2011 by Marc Andreessen, with a similar title, is this one: "Why Software is Eating the World"

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Remote workers cyber security

---

Is part of your team working from home, or from a remote location?

Here's some common sense guidance from NSA on how to up your game re cyber security from those locations. 

The usual stuff is there, starting with keeping all your mobile and fixed OS's up to date with the latest security patches, but then going on about password security and admin privledges.

Of course, there is everyone's favorite: Don't open links from unknown sources, but I would add: Don't open links you would not expect from a known source. Instead, text the sender to find out if the sender actually sent you the link.

One that you don't see very often caught my eye:

"Schedule frequent device reboots

To minimize the threat of non-persistent malicious code on your personally owned

device, reboot the device periodically. 

Malicious implants have been reported to infect

home routers without persistence. 

At a minimum, you should schedule weekly reboots

of your routing device, smartphones, and computers. Regular reboots help to remove

implants and ensure security. 

For more guidance on better protecting your smartphone,

refer to the “Mobile Device Best Practices” CSI."

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Looking at resumes for your project?

---

Working on your project staffing plan?

Looking at resumes for positions to fill?

That may be "old school"

How so?

Psycho drama

More and more, PMOs are realizing that there's a psychological divide among those suited to remote work and those suited for in-house work. For some, remote work is 'lonely' and for others it's inspiring. And for many others, the story is just the opposite; they need the community of office or in-the-field work.(*)

Resumes can't really capture all that stuff; it's no secret that resumes don't tell the whole story, and indeed may be misleading regarding a good fit to the position. And now, with a chat bot on every laptop, a written resume may be unoriginal, if not outright fake.

New graduates
Many 'new grads' have little beyond college to put on a resume, but there are indicators to look for:

• Average grades, or better shows some prioritization for conventional classwork
• Sports participation may indicate aggressiveness or competitive spirits
• Incubator participation may indicate an entrepreneurial bent
• Work in order to pay for school shows grit and determination (not the easy road, I can assure you from personal experience)

No resume at all?

Now, however, there is a trend to 'no resume at all', or at most a big discount applied to the value of a resume. How is the PMO supposed to work in such an environment?

Some of the answers are in this framework, which should filter out the AI fakes and avatars:

• Personal interviews that tease out not only relevant experience (in effect, an oral resume), but also tease out ideas for innovation, attitudes towards teams and bureaucracy, and preferences for work environment.
• Psychological profiles, starting with the venerable 1940's invention: Myers-Briggs (**), but now there are literally hundreds of profile apps to choose from. 
• Work samples, prototypes, and answers to quizzes or puzzles.
  In the recruiting for the WWII Bletchley Park decryption team, applicants ---- whether lawyer, baker, mathematician, or candlestick maker --- were asked to solve a puzzle in a matter of a few minutes. If you were good a puzzles, you got the job, regardless of resume!

Resume - Psycho standoff

What do you do if you have a good resume candidate with a questionable psycho profile, and another candidate just the opposite: one who really fits the job profile, but for some weakness in their resume?

One PMO went about it this way in a risk management approach:

• What's the cost of making a mistake and choosing wrong, as would be proven over time?
• What's the cost of hiring both and letting the round pegs naturally find the round holes?
• What's the expected value of each choice? 
• Choose according to the best value obtainable for the organization, usually the highest expected value

How about the college degree?

Only about 1/3rd of adults in the U.S. have a college degree. Shortages of applicants has led many hiring officials to reevaluate the the college degree as an entry credential to a job offer. There is a trend in the direction of allowing work experience and track record speak to individual capabilities.

Of course, in the sciences, engineering, physics, mathematics, and statistics, etc., you could be self-taught, but most companies are not there yet, and don't have the requisite means for evaluation of self-taught in lieu of work experience. 

And, there may be licensing issues as well as certification required for accreditation or insurance purposes. But, some of that may be changing.

Office automation

And finally, maybe you hire an avatar and not a person at all. This choice may be getting there faster than you think.

+++++++++++++++++

(*) And those factors are not the only thing: there is the culture divide between remote and office; team dynamics which are quite different from one to the other; and significant differences in the vectors of career paths for the remoters vs the office types. 

(**) Did you know they are a mother-daughter team?

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

A new project role: Prompt Engineer

---

I've mentioned this idea before: a new role coming to projects is that of "prompt engineer".

And so what is the job description?

• Able to write imaginative queries (prompts) in natural language for an AI engine
• Able to understand their flaws, supercharge their strengths and game out complex strategies to turn simple inputs into results that are truly unique (according to one published description)
• Able to work with other humans to refine their queries
• Able to validate responses from the AI engine
• Able to experiment, almost without limit, to discover and refine

Here's the rub: 

Whereas computers execute software code precisely and with consistent repeatability, that's not what you get when you query today's chat engines built on "large language models"(*). In my personal experience, the exact same query, executed multiple times, gets you somewhat different answers every time.

Simon Willison, a British programmer who has studied prompt engineering, is quoted in the Washington Post as saying: “I’ve been a software engineer for 20 years, and it’s always been the same: You write code, and the computer does exactly what you tell it to do. With prompting, you get none of that. The people who built the language models can’t even tell you what it’s going to do.”

And, "prompt injection" may be a prompt engineer's tool to tease out performance, or it's a malicious hacking tool aimed at the AI engine. 

Wikipedia says this: "Prompt injection can be viewed as a code injection attack using adversarial prompt engineering. In 2022, the NCC Group has characterized prompt injection as a new class of vulnerability of AI/ML systems also."

Then there are the art and image creators, built somewhat differently than the large language models.

Prompts with these image engines don't have to be the formal language constructs of the large language models. And indeed, sometimes just a grab-bag of words will get you amazing images. 

The prompt engineer morphs into the prompt artist.

For the prompt artist, there is a business there: Some artists will sell you proprietary prompts for favorite images.

Beyond the normal domain

The Washington Post reports: The role is also finding a new niche in companies beyond the tech industry. Boston Children’s Hospital this month started hiring for an “AI prompt engineer” to help write scripts for analyzing health-care data from research studies and clinical practice. 

The law firm Mishcon de Reya is hiring for a “legal prompt engineer” in London to design prompts that could inform its legal work; applicants are asked to submit screenshots of their dialogue with ChatGPT.

______________________

(*) Large language models: A language model is a probability distribution over sequences of words. Given any sequence of words of length m, a language model assigns a probability to the whole sequence. More simply, a language model predicts the next word, or the next sentence even, from the probability that such as been seen before in the training data. A "large language model" is one that uses a very large data set for training. And the definition of "large" is getting larger with time and experience. 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

New: Risk Management framework for AI

---

The U.S. NIST has issued, after long discussion and drafts reviewed, their risk management framework (RMF) for A.I. You can read it here.

NIST says:

 The AI RMF refers to an AI system as an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments. AI systems are designed to operate with varying levels of autonomy (Adapted from: OECD Recommendation on AI:2019; ISO/IEC 22989:2022). 

Not everything is new cloth; a lot has been drawn from ISO risk management standards, as well as other Agency risk management guides.

Other opinions

If you want a good overview of A.I. risks as seen by an expert pseudo skeptic, then read Gary Marcus.(*)  He, with co-authors, have written multiple papers and a well respected book entitled: 

"Rebooting AI: Building Artificial Intelligence We Can Trust"

Not surprisingly, Marcus sees great risk in the acceptance of the outcomes of neural-net models that interrogate very large data sets, because, as he says, without context connectivity to symbolic A.I models (the kind you get with symbol algorithms, like that in algebra), there are few ways (as yet) to validate "truth". 

He says the risk of systems like those recently introduced by OpenAI and others is that with these tools the cost of producing nonsense will be driven to nearly zero, making it easy to swamp the internet and social networks with falsehoods for both economic and political gain.

-----------------

(*) Or, start with a podcast or transcript of Marcus' interview with podcaster Ezra Klein which can be found wherever you get your podcasts, or on the New York Times website.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

New job skill: be able to talk to AI

---

Charlie Warzel has posed an interesting thought in an essay about the sundry impacts that may come about with ever more sophisticated AI tools in the workplace:

Talking to AI may be the most important job skill of this century

For the moment, it's about writing or constructing a 'prompt'

Warzel makes this point: "AI evangelists will similarly tell you that generative AI is destined to become the overlay for not only search engines, but also creative work, busywork, memo writing, research, homework, sketching, outlining, storyboarding, and teaching. .... 

If this AI paradigm shift arrives, one vital skill of the 21st century could be effectively talking to machines. And for now, that process involves writing—or, in tech vernacular, engineering—prompts."

New job title
Now you too can become a "prompt engineer"
You don't need math; you don't need computer science. You just need command of natural language.
Wait! Is "prompt engineer" in the resource catalog for your project?

Prompt is the new word to know
And so, let's get familiar with the idea of a "prompt":

• It's your guidance to the AI tool or machine
• It can be quite specific, directive, and structural complex, unlike the simplistic prompts you put in a search engine query window.
• It can also be just a list of words that are 'parameters' for the desired outcome
• It's in natural language, not a software language

As an example, Warzel offers this "prompt" for prompting something like ChatGPT

“Write a five-paragraph book report at a college level with elegant prose that draws on the history of the satirical allegorical novel Animal Farm. Reference Orwell’s ‘Why I Write’ while explaining the author’s stylistic choices in the novel.”(**)

More is better, or at least different

What I've noticed in my use of ChatGPT is that if you run the same prompt multiple times, you often get back different results. I've found that my value-add is to merge the beset ideas from the multiple outputs.

Make or buy?
You don't need to do this stuff yourself. There are now companies selling from on-line sites ready made prompts. And why not? Where there is a need, capitalism moves in!

____________________

(**) I actually did put that 'prompt' into ChatGPT, and I got back -- in a few seconds -- five paragraphs that seem to answer the requirement, though I don't have the background to validate accuracy. 

Such validation is one of the unresolved hazards of such AI chat engines.

 

I did, however, use ChatGPT to write a posting about which I do have the background to validate the answer.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Create Sloppy schedules -- on purpose

---

Be a sloppy scheduler.

Really?

Yes, do that.

Why?

Because sloppy schedules are schedules that are naturally risk averse; they have risk mitigation built in. With slop here and there, things can move around, expand, contract, and react to unforeseen dependencies.

And so what is sloppy?

Sloppy schedules are those with a lot of buffer between the important events (buffer means unscheduled time boxes, and/or deliberate slack built into durations)

You can be sloppy with milestone schedules, or its close cousin "black box schedules".(*) But you can also be sloppy with traditional task oriented network schedules (like the very old PERT method or its close cousin PDM, as supported in MSProject and other similar tools)

Advantages

Consequently, with risk aversion built in, sloppy schedules are more predictable and more strategically stable than tight schedules with do-or-die milestones. You can 'prove' this to yourself by building a histogram of possible schedule outcomes with a randomized simulation. On a small scale, the statistical formulas in Excel are good tools for building a a convincing demo. 

Disadvantage

The biggie, of course, is that your business imperative which is the underlying driver for your project may require a shorter schedule than that obtainable with a sloppy schedule. 

If so, move on to the discussion below about tools.

Tools you have

So, for this dilemma, you have a few tools to work with:

• Reorganize the work, or the work flow, to obtain a shorter timeline. I've written about this technique before.
• Step up the training, tools, and methods for better productivity
• Shift work to other organizations that can work in parallel, thereby shortening serialized work
• Avoid the trap of focusing on the "critical path" rather than the "most important" path. I've written about the trap as well. The latter may be a lot shorter than the former, with little loss of business value.
  
  

______________

(*) Blackbox schedules are those with elements of work encapsulated in black boxes (internal detail unknown or not visible) and then the black boxes strung together in some type of network.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!