Automation Complication

With so many people spending so much time and money and attention on AI, let's consider what happens if all the hype is justified and AI suddenly can do almost any job. Uh, I mean, can be used to boost almost anyone's productivity.

Applying AI to the workplace the choice is enhancement versus replacement. By "enhancement" I mean that employers will ride the productivity gains to provide better service at a better price. By "replacement" I mean that employers will ride the productivity curve to fire people and increase profits by delivering worse service at the same price for higher profit.

Which option is best? Which is most likely? What happened the last time this option arose? The answer is "it depends." As is so often the case, the follow-up question is "what is the right question?"

I was working in "business process engineering" through the 1980s and 1990s when "computerize" was a verb. It meant "to apply a computer to traditional tasks" for those of you so young that this isn't a concept you ever encountered.

Everything is computerized now. The default is to add a computer to any process if there is any way at all to add a computer. But back then we had to justify adding a computer. For example, we had to figure out if people would use computers for personal tasks such as banking or making medical appointments. Now it is just assumed that adding a computer will make things faster and cheaper. We don't seem to worry so much about better anymore.

When I am asked about how AI will change working in general and cybersecurity in the near future I look back on two different instances when I used IT to bring significant productivity gains and the two very different outcomes. Since I want to respect the privacy of my clients, I am going to choose two examples so old that there is no chance of confidentiality problems. But while the technology described is now "old" and irrelevant, the human nature is still pretty much the same.

Digital Lab Requisitions

Once upon a time when a doctor wanted to order assays from a clinical laboratory or "lab" to be performed on a patient, that doctor had to fill out a paper requisition or "req." Ideally the req was easy to read and only asked for assays which the lab actually did, and the patient was clearly and uniquely identified and the ordering physician was also clearly and uniquely identified.

Handling these pieces of paper was a giant pain in the neck. The req was often the only record of the order until the req reached the lab. Reading handwriting and determining the actual assays, often ordered by nicknames such as "LFT" for "liver function tests" or "Chem 7" or "Smack," took time and human intervention. This task was left to data entry clerks who were often not qualified to resolve ambiguity and so the expert staff were often called upon to spend their precious time trying to decipher handwriting instead of doing laboratory science.

Then came the wonder of scanning, which meant that someone could scan the paper and make it available at any point in the process, so that a lab tech could double-check a funky-seeming order from the bench. Add the humble bar code, which meant that a req could be linked to a patient or an order or both, and things really got better as the paper could be scanned before being sent to the lab and the lab could go all digital.

I created and deployed a system to do just this for a large medical system. Suddenly the reqs were scanned at the draw stations and were automatically linked to orders and were visible almost instantly to everyone everywhere along the process. This was a huge step forward. This took a big load off of the lab's clerical staff.

In an ideal world this productivity gain would have been directed toward having more human attention to deal with the problem reqs, the ones written on prescription pad sheets, or with misspellings or similar but wrong names. Health care isn't a "good enough is good enough" endeavor: the now-available clerical time and capacity should have been used to make the problem reqs a faster and smaller problem.

This is not what happened. Instead, after a brief and shining period of working faster and better and with better morale, the department slashed the clerical staff and then we had "usual case optimization" in that the usual req sped through the process but the problem reqs were as big a problem as ever. Sometimes worse, as the automation and wrong-sizing (reducing the workforce below optimal levels) meant that the clerks were deskilled, the opposite of upskilled. The clerks now had less time and less experience to deal with worse reqs.

Clinical Consultation Support

Around the same time I created and deployed a web-based rich data environment to make clinical consultation more productive. Clinical consultation is the process in which a clinical expert looks at esoteric lab results and provides a summary of those results so that non-experts can understand them.

This process requires that an expert see the results, the patient history and previous results in order to put the results into context.

The cool part of this data environment was gathering up all the relevant information and presenting summaries through which an expert user could click for whatever level of detail was desired or required. The output of a session by the expert was not just the text of the clinical comment but a report suitable for the ordering physician to review and incorporate into the patient's chart.

As part of the automation this environment did some other things, such as printing an archive copy of the report to be filed, faxing the report to the ordering physician if that was requested and updating the system of record with the comment so that the electronic medical record was updated.

This system worked so well, allowing clinical comments to be published in hours instead of days, that there were some calls from ordering physicians's offices assuming that the wrong cases were being published. Surely this morning's cases couldn't be ready this afternoon?

It will come as no surprise that highly paid clinical consultants, whose work was very valuable, were not fired in order to keep the usual several day turnaround time. Instead it was congratulations all around and higher throughput became the norm.

It was not only the highly paid people who kept their jobs. Those "other things" replaced clerical work, but those clerks were not fired, their productivity gains were used to make the clinical consultation group work better. There is always clerical work to do and doing it faster is better.

My Crystal Ball

Before we get to my predictions I want to explain why I chose these examples. First all, as noted above, health care is not a "good enough is good enough" endeavor. Neither is cybersecurity. Stopping a fair chunk of outages is not the goal of cybersecurity. Second, the notion that more senior people (and their minions) are immune from automation still lingers but is no longer a certainty. AI can and will replace white collar thought workers, at least at first.

My preference is for enhancement over replacement for many reasons, not the least of which is that AI is a vastly more complex technology than scanning and bar code reading. Given the fact that AI is just plain wrong a fair bit of the time and that its true operating costs have yet to be felt, I think that replacement is terrifying from a performance and profit perspective, leaving ethics and sociology out for now.

But my preferences are never what governs technology adoption, so what do I see happening? I see an initial gold rush mentality, in which we currently reside, with rosy ideas that AI can do anything faster and cheaper. I see a phase where AI enhancement touches every profession, which is also starting to happen, until enough time has gone by to determine where it actually helped and where it did not.

There is the terrible prospect of adopting the technology, finding it awful and just giving into the sunk cost fallacy and keeping it anyway. In this future our children know that all software is buggy and mediocre, but that it is fast and easy to produce. The fast food-ification of jobs if you will.

We can't afford to screw up our cybersecurity so I can't get on board the "add AI to everything!" train. You need a real strategy and that strategy is not going to be the same for the business side of the house and cybersecurity side of the house.

Conclusion

I don't think that ignoring AI will work. I don't think that embracing it no matter what will work either AI. I fear that we are in the usual position of needed to assess our specific needs, assess the technology's capabilities and costs and then constantly weigh one against the other to see if and when to add the technology to our processes. Wooden stakes kill vampires, silver bullets kill werewolves but alas neither vampires nor werewolves exist. IRL there is no escaping homework.