Off-Piste UX

Alex Race at UXDX EMEA. Video: https://youtu.be/eURoMKopkLg

Readable transcript: edited from the recording's captions for readability (fillers and false starts removed, punctuation and section headings added). Wording is the speaker's own. Timestamps are positions in the video. Names marked [?] could not be verified against the audio.

The day NotPetya hit

[00:00:01] It is June the 27th, 2017, and the day had started out like any other. It was 10 a.m. and I'd just started a meeting with colleagues at the Maersk Technology Center in the UK when a stranger burst into the room. "Cyber attack. Detach from network, detach from network, back to your desks," came the cry. There were brief seconds of bewilderment before we jumped up and out of the meeting room.

[00:00:29] I could see the screensaver on my laptop at the far end of the floor, but between myself and my desk was a scene that I could only describe as apocalyptical. Either side of me I could see screens with red flashing writing before going dark. I ran down the floor, making it within six foot of my laptop before that too went black. A stunned silence filled the air. Within four minutes of the cyber attack hitting Maersk, over 50,000 devices had been destroyed. They'd been hit by the NotPetya malware via a single software installation in the Ukraine.

[00:01:14] My name is Alex Race and I'm head of digital customer platforms at APM Terminals, part of A.P. Moller-Maersk, the world's leading shipping and logistics company. Today I want to tell you my story of how a cyber attack changed my life, pivoting my 20-year career in UX into a world of full-blown digital transformation. You'll learn how woefully ill-equipped I was for this journey, and how I relied on my skills as a seasoned UX practitioner to survive this alien environment. I hope that the next 20 minutes will provide you with the takeaways that you need to equip you in your career ahead.

[00:02:00] So, before joining Maersk my career had taken a fairly straightforward course. I graduated from university in Aberdeen before joining what was back then the world's number one mobile phone company, Nokia, as a user interface designer, and I spent the next 20 years working through a variety of agency and client-side roles before finally joining A.P. Moller-Maersk on February the 1st, 2017, as the head of UX and design for APM Terminals.

[00:02:33] Now just as a bit of background, APM Terminals is a bit like an airport for shipping containers, you know, the big metal boxes that you see on the back of lorries trundling down the motorway or the freeway. 90% of the things that we use have at some point been shipped in one of these containers, and it is an industry that is in desperate need of digitization, which is where my role as the head of UX and design was due to play a part.

[00:03:05] The first four months of my time at APM Terminals were pretty standard. There was lots of learning, a bit of traveling, some hiring. I was enjoying the job, I loved the company, and I felt like I knew what needed to be done to make the role a success. That was until the 27th of June 2017, the day that NotPetya hit.

The phone call, and taking the chance

[00:03:33] Anyhow, following the attack we were sent home and there was nothing we could do but wait for further instructions via WhatsApp. Over the next few days it was confusing, it was quiet. Our tech center was overrun by a combination of government agencies, management consultancies and senior representatives of our technology partners.

[00:03:55] Three days had elapsed before I received my own call. It was my manager. Hey Alex, listen, I need to take a few days out. I've named you as my deputy and you need to report into the Point in Maidenhead as soon as possible. This was a critical plot point. You see, my manager was responsible for customer digital, full stop. From the user experience to databases, firewalls, IIS servers, CMS and CRM platforms, that was my manager's role.

[00:04:27] I was a glorified UX designer. I could create some pretty nice wireframes, coordinate some successful user studies, but on the other hand I struggled to pair my mouse with my Mac. I was Clay Christensen's worst nightmare. I was the wrong tool for the job. But with little else to do with my time, I figured, well, at least it got me out of the house. So I replied, yeah, sure. And so the seed was sown.

[00:04:56] And this takes me to my first takeaway: embracing challenge and being brave enough to take chances to pull you out of your comfort zone. Someone once said to me that life is like a bundle of threads, and if you find the end to one you should pull it and find out where that leads. When I received that phone call I had no idea where it would take me, but I knew that I would never have that opportunity again, and decided to grab it with both hands.

Out of my depth in the crisis room

[00:05:28] Upon arriving at our Technology Center I was shown to my desk, I was shown into that room, I was told I could have anything I wanted for dinner as long as it came from Papa John's. I naively mentioned that I would be needing to pick my kids up from school at three o'clock. I was told, it's okay, we'll send a car. I sat at my desk. I was stressed, I was overwhelmed, I was totally out of my depth, and I was kicking myself for not having the courage to turn this particular gig down.

[00:05:57] I'll never forget the first crisis meeting the next morning, when I was asked my opinion on DC recovery. I took a punt on DC meaning data center, but they were referring to domain controller, leaving both them and I wondering what the hell I was doing in the room. As my colleague set about solving the issue of the destroyed domain controllers, which I now know look after users, roles and permissions on the company servers, I got my head down doing what I do best: making lists. Lists of our applications, of vendors, of our employees, of our priorities.

[00:06:34] After a couple of days the team had one small piece of luck. A power outage at our office in Ghana had protected a single domain controller from becoming infected. When it was discovered that the office did not have enough bandwidth to sync the data over the internet, a relay race by private jet was set in motion between our team in Ghana and the team in London to get a hard drive back to the recovery teams. Within 36 hours we had our first domain controller restored and the recovery could start in earnest. Only, I had no idea what recovery actually looked like.

[00:07:17] My saving grace came in the form of a scrawled code in the corner of a whiteboard of the crisis management operations room. I recognized it as a cost code and I asked our executive assistant about it. It's a cost code for Project Disaster Recovery, she said. Can anyone use it, I asked. Yes, she replied, as long as it will help dig us out of this mess. It was then I saw the silver lining. I had budget, I had a list of vendors, I had applications and a topography of our digital estate. I just had to figure out how to put these things together quickly.

[00:07:57] Which brings me on to my second takeaway: building your journey takes time. It was like real-time user journey mapping, but without the design thinking, without the access to stakeholders all the time. With hindsight and experience I would have known to ask about funding, budgets, cost codes, but I had neither. This was a journey that I was having to map as I went along, identifying the pieces of the puzzle as I came across them and trying to put them into some order. It was like a huge jigsaw puzzle where I was constantly on the lookout for new pieces, but the more pieces I found the easier it became to identify the next pieces.

Fifty applications and no budget

[00:08:44] Fast forward three months and our digital estate was fully restored, but the soul-searching continued for a long time afterwards and we were still licking our wounds. What had emerged over that period was the sheer scale of our fractured customer digital landscape. We had over 50 digital customer applications, all with separate designs, separate brandings, different logons, different infrastructure underneath. It was a total mess, and there was no overarching strategy to help alleviate the situation.

[00:09:21] Having previously worked in the business to consumer space, where customers are regularly given the ability to self-serve online, I enquired why the APM Terminals website couldn't do the same. The answer that came back surprised me: the website is just a marketing tool. This wasn't an acceptable response, but to counter it I needed data, and to get data I needed to blow the cobwebs off my UX toolbox to do some research.

[00:09:52] After gaining access to our analytics tools, I discovered that the perception of the company website as just a marketing tool was totally misguided. apmterminals.com consisted of 700 pages, but only two pages accounted for 70% of our website traffic: the pages for our terminals in New York and LA, which had managed to create some container tracking features. They attracted the most traffic. In contrast, our news features, which had a presence on almost every page of the website, attracted a mere one percent of the traffic. This was quantitative proof that there was customer demand for self-service capability on apmterminals.com.

[00:10:38] And this takes me to my next takeaway, which is to interrogate the data. Anyone who's worked in the arena of UX and design will be accustomed to their work being torpedoed at the last minute by a HiPPO looking to do a swoop and poop. And because opinions on design can be so subjective and emotive, these situations can be frustrating and stressful for designers. By interrogating the data you can build up a qualified story around your proposed design or your strategy, to disarm that HiPPO before they have a chance to swoop and poop.

[00:11:15] However, I had two obstacles that I needed to overcome. apmterminals.com was so undervalued that it had zero budget for the year. That's right, a website that attracted 8 million users a year had zero dollars of funding, not for development, not for maintenance. My second problem was that I was the only person who thought that having 50 customer facing applications was a problem. People genuinely thought I was deluded. First I had to find a way to secure funding for our digital strategy, and then I had to make people care enough to help support it.

Selling the strategy in the language of the audience

[00:11:59] So over the next few weeks I crafted a digital strategy proposal that was based around the added value that a centralized, customer focused digital channel could deliver for the company. I focused on the increase in customer satisfaction, the lower cost to sell, increased revenue. But as I reviewed the deck that I was due to present to the technology leadership in The Hague the next day, I noticed a glaring omission, an open goal that I was about to miss.

[00:12:33] My deck was centered around achieving customer outcomes, and I hadn't remembered my audience. At the time we had a very old school IT leadership team and they would have deemed the customer focused achievements as being business problems. I had to make my proposal an answer to a technology problem, not a customer one. It's backward thinking, I know, but that's how immature we were in those days.

[00:13:05] I racked my brain as to what technology cared enough about to support my proposal, and then it hit me: security. We were barely recovered from one of the first recorded acts of cyber warfare against a company, and yet we had 50 applications that hadn't been touched in years. They were an imminent security threat. I put a slide together detailing the threat and stuck it at the front of my deck.

[00:13:36] The next day I presented to the leadership team and ran through my analysis, that they were sitting on a security time bomb and that the only answer was to support my initiative. I never got to present the rest of the deck. Generous interim funding was granted immediately, without even factoring in the business and customer benefits.

[00:13:56] Throughout 2018 we began an upward trajectory, doubling the size of our project team from one to two and appointing a development agency to work with us on the apmterminals.com rebuild. The business appointed a head of digital to act as my two-in-a-box, and together we began to formulate our plan to bring the strategy to life. Whilst we had won the backing and funding of the technology organization for apmterminals.com, we still had to make a case to the commercial organization and make them understand what was in it for them. And for this we dug back into our UX toolbox.

[00:14:36] It was all about demonstrating the art of the possible. Demonstrating the art of the possible had always been a well-trodden path for me during my UX and design leadership days, and I saw the task of securing the support of our commercial partners as being no different. To that end, we worked with our designers to make static vision pieces illustrating the future of apmterminals.com and printed them out on glossy boards, which we displayed at our headquarters in The Hague. These boards formed a catalyst for many an impromptu discussion with people who would not ordinarily have contacted us. These translated into guest passes for many strategy meetings that we would not ordinarily have been privy to. And in addition to the static boards, we created clickable prototypes which allowed us to bring to life our future world of apmterminals.com, and these were shown and demonstrated to our senior commercial directors in dedicated showcase sessions.

Everyone has a role to play in the user experience

[00:15:39] With all the senior stakeholders then on board, the development of the new website kicked off in earnest in 2018, and it is here that my next lesson comes in. Everyone has a role to play in the user experience. Throughout my 20 years I spent as a contributor and a leader in the user experience space, I spent endless hours protecting myself and my teams from outside interference. As seasoned UX professionals, we should be left to craft experiences without having to be subjected to the unvalidated opinions of the 250 other people involved in the product delivery process. But now I was faced with a cold reality: I was wrong.

[00:16:27] You see, what I learned was that everyone has something to contribute to the user experience, even the people you would not ordinarily think of. Cyber security: well, unless they're involved, we have an insecure product which will then be blocked by browsers. Database engineer: well, if they're not involved, our product will crash during unexpected surges in website traffic. Mike from our operational excellence[?] team: well, he's the one making sure that we're available 24/7.

[00:17:02] Some people may argue that while the above may be important, they should not be considered part of the user experience. But I've seen the flip side of these. These are real world examples that I'm giving you, and I can tell you that our customers firmly believe that they belong in the user experience bucket.

[00:17:30] The new website went live in April 2019 and delivered a radical new user experience with an equally radical technology stack. When being asked what the internal metrics would be, I simply said, everyone will want a piece of the action. And how prophetic that eventually turned out to be. The relaunch of apmterminals.com triggered a wave of interest in our new digital strategy, as the business started asking for more and more self-service capabilities to be built on the website.

[00:18:03] Over the next two years we secured investment that we could only have dreamed about at the beginning of our journey, and we used it to deliver a range of new customer journeys for our customers. These included container tracking across 70 terminals, truck appointment systems across dozens of our terminals, e-commerce journeys, multi-channel operational alerting, real-time dashboards, and we delivered the first monetized APIs to have been delivered within the entire Maersk group, which was a huge achievement.

[00:18:40] Throughout the development of such features, and accompanied by a coordinated marketing strategy, we've grown the user base of the website by more than 300% since 2017, and apmterminals.com has firmly established itself as a strategic channel for the future.

[00:18:58] And this leads me to my final takeaway, because you've got to believe in yourself. I had to believe in myself even when I didn't think I could do it. I had to believe in myself and I had to fight for it, because to be honest, if this UXer can come out of a cyber attack to define the digital strategy for a four billion dollar company, well, I'll tell you something, anything can happen.