Real Artists Ship

For a number of reasons I follow emerging economies, the biggies being China and India. The BRIC countries (Brazil, Russia, India, and China) generally get lumped in together as the "next big thing", but they are at very, very different stages of development and more importantly are taking different paths. You can easily think of software security as an emerging discipline - despite a lot of talk and papers about Saltzer and Schroeder, we really don't have this stuff figured out. 

So China is following a well worn path similar to South Korea, Japan, and the early US. India is taking a totally different and unproven path towards growth. Tata Motors has been innovative in building the cheapest car - the Tata Nano which is a $2500 car, and engineering triumph, driven by a mantra that an engineer would stand behind "do we really need that?"

Now the progress to executing on this is held back by India's dysfunctional environment:

In a tale rich with incongruities, the Communist-run government of West Bengal State invited the Tata Group, a symbol of Indian capitalism, to set up its plant in an area called Singur. It acquired 1,000 acres from farmers on the company’s behalf.
As the project advanced, some farmers who had sold their land demanded it back. The main state-level opposition party, the Trinamool Congress, led protests demanding that the land be returned. Most people sympathetic to Tata accused the opposition of inducing the farmers to protest, while Tata’s critics said the farmers had legitimate grievances.

The issue simmered for months. But in recent days, protesters began surrounding the plant, blocking roads and preventing Tata workers from reaching the plant. “The existing environment of obstruction, intimidation and confrontation has begun to impact the ability of the company to convince several of its experienced managers to relocate and work in the plant,” Tata said in a statement on Tuesday.

The halt to the plant has caused many Indian business people to warn of a chilling effect on investment in the country. It is also unclear how Tata will be able to keep the Nano’s cost so low, since part of the affordable price reflects the company’s savings on the land in Singur.

Arvind Subramanian compares China and India's trajectories:

There is a fundamental asymmetry between state and markets. It is easier to create markets than it is to create state capacity or to prevent its deterioration. Creating markets is a lot about letting go, establishing a reasonable policy framework, and allowing the natural hustling instinct to take over. In other words, hustling is the natural state. Building state capacity, on the other hand, is quite different. It involves overcoming collective action problems, mediating conflict, creating accountability mechanisms where outputs are multiple and fuzzy and links between inputs and outputs murky, and contending with the deep imprints of history. In Weber’s memorable words, building public institutions is like the “slow boring of hard boards”.

In that light, China’s task of improving its private sector seems easier to accomplish than India’s task of arresting institutional decline. So, while China and India can probably both count on more years of high growth, the odds still favour China pulling off that feat than India. That, and not just the meagre medal tally, should be what India mulls over after the Beijing Olympics.

The Economist summarizes:

It's easier to liberalise a functional state than it is to functionalise a dysfunctional one, of any ideological stripe.

What does all this have to do with ostensibly the topic at hand - Information Security? Well Tata Motors had the innovation but they didn't have the deployment model, at least not yet. More to the point, a lot of software security gets driven by infosec groups but real change is only coming when its driven by the development group. Why? Development groups are functional, they ship code. A lot of the success in software security is predicated by who you choose to partner with, it is more effective and easier to add security into a functional development group that ships code.

Comments

[deepak]

Great blog, Gunnar. I used to work on the Security team at Microsoft that produced Anti-XSS and XSS Detect. Now, I am driving Security at Windows Live and it is a very different world.

Well written blog. Am still curious how you are still so familiar with news in India.