Lars Harvey built a business on sharing the warning

Lars Harvey had a perfectly respectable reason to leave the San Francisco Bay Area: he wanted a life he liked. There was also a business calculation. His co-founder, Rod Rasmussen, a Washington native, persuaded him that Tacoma offered something worth moving for. The cost of living helped. So did the prospect of hiring people from the University of Washington Tacoma. In a business devoted to spotting trouble, the founders were making a considered bet on their neighbours.

That decision gives Harvey’s career a useful point of entry. Before the acquisition price, before the venture funding, there was a choice about where to work and who might eventually work alongside him. Internet Identity, later known as IID, would build its cybersecurity business in Tacoma. The city was part of the plan, rather than a return address attached to it.

Harvey became the company’s co-founder and chief executive. Over nearly two decades, his work kept returning to a practical difficulty: organizations could learn that something dangerous was happening online and still struggle to do anything useful with the information. A warning could be accurate, urgent and thoroughly inconvenient to use. Cybercrime had acquired modern distribution. Its opponents were still sorting out the correspondence.

A company before the capital

By November 2013, IID had 65 employees and 17 years behind it. Its $8 million investment from Bessemer Venture Partners was its first outside financing. The sequence matters. This was an established organization seeking money to expand a particular approach to security, with years of operating history already in the room.

Harvey spoke at the time about his pride in the company’s steady growth. The next task was helping large companies and government agencies share threat intelligence. IID’s ActiveTrust platform offered a way to exchange information about attacks. Rasmussen described an industry in which much of that sharing still happened through email. Anyone who has tried to find the definitive attachment in a crowded inbox can appreciate the design problem.

The company had already been adding management capacity. In 2012, it created vice president roles in marketing and in engineering and technology, appointing DS Benbow and Jason Atlas. Harvey linked the appointments to new customer growth and an expanding staff. The work required people who could explain the products as well as people who could build them.

These are quieter milestones than a funding announcement, but they help explain the business that investors encountered. IID was taking on the ordinary demands of a growing organization while working in a field where the underlying problem kept moving. Hiring, product development and customer demand had to keep pace with one another.

Permission to tell the neighbours

ActiveTrust’s premise was straightforward: defenders could benefit from learning about threats other defenders had already encountered. Its implementation required more tact. Organizations needed control over the information they contributed. The platform’s 2014 introduction described a system of screened participants and rules governing what could be shared, when, where and with whom.

Those controls gave substance to the idea of collaboration. A government agency and a business could both want better intelligence while having different obligations around disclosure. ActiveTrust offered a structure for exchanging useful information within chosen boundaries. The product had to accommodate the reasons people hesitated, as well as the reasons they wanted to participate.

Harvey’s public explanation drew attention to the way attackers already exchanged intelligence. Defenders needed their own useful networks. IID also worked on standardizing disparate information so it could be used by security systems. The ambition combined a human agreement to cooperate with the less glamorous work of making the resulting data fit together.

His earlier work supplies a less abstract picture of the stakes. In 2012, Harvey discussed DNSChanger, malware that altered the Internet settings of affected computers. IID offered a free service to help companies identify and remove it. The danger extended beyond a deceptive page on a screen: organizations faced connectivity problems when temporary replacement servers were due to go offline.

That episode put Harvey in the role of explaining an infrastructure problem to people who depended on the infrastructure. DNS normally does its work without inviting much conversation. Trouble in it can make an apparently simple act, reaching the intended destination, suddenly complicated. Much of IID’s business occupied that gap between an Internet service people assumed would work and the mechanisms needed to keep it trustworthy.

The hour inside the investigation

In September 2015, IID introduced Rapid Insight, a research tool for security analysts. A suspicious domain or Internet address could send an investigator through a dozen or more information sources. Rapid Insight put those searches in one place. The job remained an investigation; the repeated opening of separate research tools became less necessary.

Harvey described analysts confronting more warning flags than they could handle. The company said customers reported saving 15 to 20 minutes per hour of investigation. Those were customer reports presented at launch, rather than a universal performance guarantee. Even with that qualification, the intended benefit was easy to understand: give an analyst more time to examine the things that deserved attention.

Rapid Insight searched sources including DNS information, domain-registration information and malicious-site checks. Access was screened. There was a practical economy to the arrangement as well: IID combined access through a usage-based fee. The product addressed both the repeated steps in the work and the expense of assembling the research tools separately.

Behind the product announcements, the leadership team was changing too. Michael Brown joined as vice president of engineering in 2015, with responsibility for product technology and operations. Later that year, former Morgan Stanley cyberdefense executive Sean Tierney became vice president of threat intelligence. Harvey highlighted Tierney’s experience with financial institutions and collaboration across the intelligence community. IID needed both engineering capacity and people who understood the organizations using the results.

When the warning met the network

On February 8, 2016, Infoblox announced that it had acquired IID for $45 million in cash, subject to customary adjustments. Harvey and Rasmussen would join its management team. The announcement also said most IID employees were expected to join, including the engineering and threat-intelligence teams. There was an existing relationship: the companies had collaborated on a DNS Threat Index in 2015.

The business logic followed Harvey’s recurring concern about usefulness. Infoblox managed core network services. IID supplied intelligence about threats. Putting them together was intended to help organizations connect an external warning to activity and devices inside their own networks. A security team could then have more context for deciding what deserved a response.

“Enterprise security teams have a difficult time putting threat intelligence into operation.”Lars Harvey, February 2016

The important word in Harvey’s explanation was operation. A list of suspicious destinations still needed to reach the right systems in a usable form. He described the combination as a way to shorten the path from discovering a threat to enforcing a response. It was the stated purpose of the deal, expressed in terms of the work customers needed to complete.

After joining Infoblox, Harvey served as vice president of security strategy. His March 2016 writing returned to integrating intelligence with network devices. In May, he discussed an IID and Ponemon Institute survey of 692 IT security professionals. Seventy-five percent of respondents believed exchanging threat intelligence improved their organization’s security posture. That finding measured their views, and gave him another way to discuss the case for sharing.

The university in the original plan

Tacoma’s role continued beyond the transaction. The company’s relationship with local education had become concrete through recruiting and a research partnership with UW Tacoma. In a 2016 account of the university relationship, Rasmussen described the team’s sponsorships, scholarships, internships and employment opportunities, along with years of advisory-board service by both founders.

The point has a pleasing circularity. Harvey had been persuaded to move partly by the promise of a future workforce. The company then helped create opportunities for that workforce. A university could supply graduates; an employer could offer experience, work and a view of the problems those graduates might eventually tackle. Neither side had to be a decorative name on the other’s brochure.

UW Tacoma’s School of Engineering & Technology currently lists Harvey on its advisory board, identifying him as retired from Infoblox. It places a later chapter of his public life beside an institution that figured in the decision to build in Tacoma. The connection spans the company’s independent years, its acquisition and his retirement from the buyer.

The price of the acquisition is the easiest number to remember. The more revealing thread runs through Harvey’s choices about people and information: where to find colleagues, how to let organizations exchange warnings, how to reduce an analyst’s repeated work. Each involved making a connection useful. For someone whose business depended on warnings travelling well, it was an appropriately practical way to build.