Archive

Posts Tagged ‘statistics’

Empty Slogans and their Effectiveness: Examples and Statistics

August 7th, 2010 9 comments

Call me the opinionated curmudgeon or the truth-telling sage.  Call me anything you want, but when you do please don’t use some empty slogan.  If there is one thing I dislike more than spin and FUD, it’s the empty slogans that back them up.

Problem Statement

Too many times I’ve heard analysts, and those wanting to make a name for themselves, coming up with phrases such as “wield the power or yield the power” without any real solution for change.  These empty slogans rally the uninformed with their easy to relate to sound, yet fall on dead ears of those who understand that complex situations cannot be solved with catch phrases.  At best empty slogans fall by the wayside, and at worst they deter progress by keeping people in the dark about the true complexities of problems, enabling the problem to persist and even exacerbate itself like a cancer.

I don’t have a problem with slogans that come with backing, but empty statements have no place in bringing about positive change.  My current frustration is with the slogan, “Rugged Software“.  Is it slogan or a challenge? Will it be effective or is it a hollow statement?  My position is that any effective call-to-action slogan must carry with it some meaning and, even better, a toolbox of item with which to execute it. This slogan has neither.

History of Slogans

1. “Don’t Mess With Texas”

Probably the most well known slogan, though few know its intended purpose, is “Don’t Mess With Texas“.  This slogan has little to do with Texas individualism but with trash or should I say litter.  That’s right, in 1985 the Texas Department of Transportation (TxDOT) used this slogan – after many failed slogans – to reduce the amount of litter on Texas roadways.

The National Corporative Highway Research Program (NCHRP)’s Reducing Litter on Roadsides mentions “the campaign reduced the amount of visible litter on Texas highways by 72% in 6 years (Texas Department of Transportation 2008). The DOT asserts that the success is the result of, at least in part, the use of athletics and musicians who are admired by the the target audience.”  After millions of dollars and a plethora of celebrity endorsements middle-aged males were finally encouraged to reduce the amount of litter they threw out the window or onto the ground.

So why was this slogan so successful?  Earlier slogans of “Don’t be a Butt!” failed to launch even though they targeted the same audience of 18-35 year old males that were most at risk for littering.  Remember that even back in 1985 we knew the leading cause of litter was cigarette butts.  In a 2005 Visible Litter Study of Texas it showed that:

  • Over the course of 2009, approximately 1.1 billion pieces of litter accumulated on our highways; while this represents a 33% increase over 2005, it marks an 11% decrease relative to 2001.
  • Why the increase in litter since 2005? Cigarette butts! Tobacco trash – including nearly 400 million cigarette butts – comprised 43% of all litter on our roads.
  • The Texas Dept. of State Heath Services estimates 18% of all Texans smoke, and six in 10 smokers admit they litter. What does that mean? It means that just 11% of Texans are responsible for 43% of all our litter!

Apparently not only does smoking kill, it also accounts for the greatest form of litter in Texas from 1985 to 2009.  In fact, “According to the VLS, the amount of litter in nearly every category has increased since 2005 — tobacco, cups and cans (non-alcoholic), construction items, household and personal, and automotive debris.”

Has the program been effective?  Well picking up trash along the Texas roadside has cost the state “$47 million in 2009 … up from $38.7 million in 1986″.  This increase is costs is prevalent even though studies show a nationwide decrease (by 50%) in smoking from 1965 – 2007.  The smoking rates for Texans was 18.6% in 2008, almost on par with the national average.

2. “Take a Bite Out of Crime”

On July 1, 2010, McGruff the Crime Dog turned 30 years old with his famous slogan “Take a Bite Out of Crime” created for the National Crime Prevention Council. The goal was to reduce the levels of crime in 1980 which had reached a peak.  Now “crime” is a relative statement but is most often measured by a combination of violent crime and property crime.  There are other categories such as drug and cybercrime but for the sake of continuity of numbers we will account for just violent and property crime, the prime targets of the slogan.

According to the US Department of Justice, Bureau of Justice Statistics (BJS) figures, ”the crime rate had risen sharply in the late 1960s and early 1970s, bringing it to a constant all-time high during much of the 1980s, it has declined steeply since 1993.”

Though the anti-crime slogan was adopted in 1980, crime continued to rise for another decade.  In fact, if you review the BJS figures along with the FBI crime figures you will notice a pattern outlined in the graphic above.  Both show a rise in violent and property crime from 1960 to a peak in about 1991-92.  This means the slogan either took 11-12 years to really take hold, or there’s another explanation for the decline in crime from 1993 to 2003.  (Some people suggest it was the introduction of the Three Strikes Law first passed by Washington state in 1993.  This turned out to be statistically incorrect after a 10 year study proved no correlation between such state laws and the reduction in crime.)

Instead, could it be the economic rise that lasted from 1993 – 2007?  If we measure the Dow Jones Industrial Average (DJIA) from 1993 at 3,500 to its height in 2007 14,000 one can easily understand why the violent crime rate followed an inverse pattern.  (Sure there was a DJIA dip in 2002 but it rebounded in only a few short years.  Crime shows a leveling off in those years but still a decline across the board.)

3. “Click It or Ticket”

One of my favorite examples of a slogan is “Click It or Ticket“, a National Highway Traffic Safety Administration campaign to increase the usage of seat belts in the US.  The slogan campaign specifically targeted young adults due to their low usage of seat/safety belts.  According to the Social Marketing Institute that closely monitored this program, we understand the following items.

Before 1980, usage of seat belts in the United States lingered around 11% despite volunteer and educational campaigns at local, county, and state levels. Between 1980 and 1984, individual organizations, public education programs, incentives and policy changes strove to increase the use of seat belts. However, these efforts failed to significantly affect usage in large, metropolitan areas, and in by the end of the effort, national seat belt usage had reached only 15%.

In 1984, New York became the first state to enact a mandatory seat belt use law, and by 1990 37 other states had followed suit. The vast majority of these laws were “secondary safety belt laws”, meaning that an officer had to observe another traffic violation before issuing a citation for a seat belt infraction. Despite this, the national usage rate climbed from 15% to 50%.

An extensive evaluation of the program showed not only when both communication and enforcement were combined in a single unified marketing strategy, the results were impressive (a 14% reduction in traffic fatalities), but when the communication was withdrawn and the enforcement left in place, seat belt use dropped dramatically. Once the communication component was restored compliance went back up.

An empty slogan alone would not have helped save lives and neither would just the law.  It was the combination of strong communication and message of call-to-action (“Click It”) plus deterrent (“or Ticket!”) that made this slogan an effective winner.

Analysis

Each of the above three slogans teaches us some important messages about about communication.

  1. “Don’t Mess with Texas” sounds to me like an empty statement and has little backing behind it.  Though it was effective for a short while, and though a high percentage of Texans associate it with anti-littering, the rate of such problems only slowed at best.  It is hard to say if the slogan was effective since the volume and cost of cleaning up litter both increased.  Perhaps the slogan slowed the activity but it had nowhere near the effectiveness as the seat belt slogan.
  2. “Take a Bite Out of Crime” sounds a bit more direct.  It mentions the call-t0-action and the direct object it wishes to affect.  It is debatable and perhaps unlikely that this slogan had a noticeable impact on crime due to the increase after its inception.  The eventual decrease in crime over a decade later can easily be explained in the increased economic jumpstart that rose the level of affluence across the board. (The 1980s were one of the worst economic recessions since the Great Depression in the 1940s.)
  3. “Click It or Ticket!” is just a great slogan since it combines call-to-action with deterrent and in this case an actual law.  Police in many states can now pull people over just for violation of this law instead of previously requiring another, more serious, reason.  The statistics show clearly how a good slogan combined with enforcement can be a powerful duo in affecting change.

Conclusion

How does one measure a slogan, and how does “Rugged Software” measure up?  Do you inherently understand the call-to-action? Is there a deterrent? Is the slogan celebrity endorsed and targeting the proper groups with the right incentives?  Only time and data will tell, but I challenge such organizations that wish to affect change to consider these criteria.

Moreover, I think a good slogan should also be backed by a solid set of tools, resources, guides, and such that lower the barrier to entry for people to participate.  In the case of litter due to cigarette butts, we can encourage the use of additional ashtrays in cars.  In the case of software, we should provide a series of guides, e-learning, checklists and such that provide guidance on how to secure applications based on both the functional use of the application and the language in which it is developed.


Update: I have received more cuss word feedback on this blog post than I have on anything else I have ever written; so let me clarify end explain the goals of my position.

I actually like the “Rugged” software movement as a method of raising awareness. I didn’t give it enough praise for starting a movement, but that is all it is, a start. Rugged is an infrastructure that in order to be remembered as an effective movement need a nervous system and muscular system.

Just like “Click It or Ticket” we need to pair the positive awareness with tools, checklists, and even enforcement of some sort (be that regulatory, legal or other).  I don’t want the success of Rugged to make people complacent or feel that a manifesto alone is an effective strategy.

Share

When are data breaches just outliers?

August 19th, 2009 6 comments

Recently the large story to hit the news, the thing people are all reading and writing about, is the story about how 1 guy (and 2-5 accomplices) were able to steal 130 million payment-cards in over three years, and finally got caught.  The question is, what if Albert “Segvec” Gonzalez (aka. Cumbajohnny) is an outlier?  A statistical anomaly.

Facts of the Case

Rich Mogull has a good overview of the indictmentWired magazine, the Washington Post (Brian Krebs), and the Wall Street Journal all have coverage.  Rich has an interesting comment that:

In the “drama” category, we learn that the main perpetrator is the same person who hacked TJX (and multiple other retailers), and was the Secret Service informant who helped bring down the Shadowcrew.

This indictment covers breaches of Heartland, Hannaford, 7-Eleven, and two “major retailers” breached in 2007 and early 2008.

This is the same Albert Gonzales who was indicted last year for breaches of TJ Maxx, Barnes & Noble, BJ’s Wholesale Club, Boston Market, DSW, Forever 21, Office Max, and Sports Authority.

The attacks both sniffed traffic and attempted to identify stored card numbers. They targeted data at rest and in motion.

The Wired article adds:

But these are just the latest in a string of high-profile breaches that have been connected to Gonzalez. He and 10 others were charged in May and August 2008 with network intrusions into TJX, OfficeMax, Dave & Busters restaurant chain and other companies.

Using a SQL-injection attack, the hackers allegedly broke into the 7-Eleven network in August 2007, resulting in the theft of an undetermined amount of card data. They allegedly used the same kind of attack to infiltrate Hannaford Brothers in November 2007, which resulted in 4.2 million stolen debit and credit card numbers; and into Heartland on Dec. 26, 2007. Of the two unnamed national retailers mentioned in the affidavit, one was breached on Oct. 23, 2007, and the other sometime around January 2008.

Gonzalez was a Secret Service informant who once went by the nickname “Cumbajohnny.” He was a top administrator on a carding site called Shadowcrew when he was arrested in 2003.

Gonzalez called his credit card theft ring “Operation Get Rich or Die Tryin.” As Wired.com previously reported, he spent $75,000 on a birthday party for himself and once complained to associates that he had to manually count $340,000 in stolen $20 bills after his counting machine broke.

Stephen Watt, a 25-year-old programmer who was working for Morgan Stanley, created a sniffing program dubbed “blabla” that Gonzalez’s gang used to allegedly siphon credit and debit card numbers from TJX and other companies and is facing sentencing this month.

The Wall Street Journal adds:

The Treasury Department recently reported that of the more than 55,000 incidents of wire fraud since 1998, more than half of them occurred in the past two years.

For the techie in each of you, I’d recommend Rich’s summary of the Visa/FBI/USSS data breach report in February 2009.

Allegations

From all accounts it appears that many of the major payment-card data breaches in the last three years can be attributed to a small handful of people, and perhaps one ringleader. Could this be a normal attack pattern, or were these individuals outliers?  If they were the crest of an even bigger wave of attacks, it does not bode well for corporate America, but if they are statistical anomalies then what would the world look like if we ignored them when measuring the success of the PCI program?

In 2003, Gonzalez, a carder in his own right, was arrested by the Secret Service and turned into a mole to allow them inside of CardersMarket, one of the largest carding rings in the world.  Though Gonzalez was outed at the time by Dave Thomas (aka. Ethics or El Mariachi), many people did not listen to his rants at TheGrifters.net.  Allegedly, Dave Thomas was at the time an informant for the FBI on the same operation.  Later that year, Gonzalez would replace Kim Taylor (aka. MacGyver) as the board manager.

In March 2004, Gonzalez expanded his domain by replacing Dmitry Golubov (aka Script) as board manager for CardersPlanet.

In 2008, Albert “Segvec” Gonzalez, Christopher Scott and Damon Patrick Toey were indited and accused of hacking into TJX Companies and thus exposing 40 million payment-cards.  This 2008 indictment named Aleksandr Suvorov (aka JonnyHell) of Estonia and Maksym Yastremskiy of Ukraine.  Could these be the two “Russian” conspirators that are mentioned in the current indictment of Gonzalez?

But Gonzalez would not have gotten very far had it not been for his friendship with Stephen Watt.  Mr. Watt, a 7 foot tall, 25-year-old programmer, wrote the packet sniffer “blabla” for Gonzalez to capture transactions as they traversed the corporate networks.  Interestingly enough, Watt “graduated from high school at 16 with a 4.37 grade point average and from college at 19″, but had a bug in the software that caused it to deactivate each time the POS was rebooted.

Outliers

Again, I begin to wonder what the world would be like if these personalities had not met or operated in unison.  What would the payment-card world be like without Gonzalez?  It may be a stretch to speculate that this one individual and his actions equate to outlier status. By this measure military dictators and oppressive regimes could also be named outliers even though their affect is quite impactful.

What we are really measuring here is the difference between potential energy and kinetic energy and the catalyst to convert matter from one to the other.  We can assume that there are vulnerabilities in every system and the grater the number the higher the potential energy.  The catalyst, in this case Gonzalez, plays the role in converting that potential energy (vulnerabilities) into kinetic energy (stolen cards and then cash.)  Without the catalyst the measured state would stay the same and as such represent a seemingly stable statistic.

We can ignore this alleged stability in the system by stating that all vulnerabilities have the potential of being converted into cash, but until they are such statements are meaningless (outside of theory modeling.)  To this point we measure vulnerabilities not by their size in population but by how frequently they are exploited.  Without a catalyst to convert the vulnerabilities they contain little value from a metrics perspective of data compromises.

Statistics

According to DataLossDB.org the number of payment-card numbers lost between 2007-2009 equates to the following:

2007: 111,957,179 records

2008: 13,439,242 records

2009: 130,965,494 records (to date)

The total number of records for (almost) three years time = 256,361,915 records.  So, let’s see what these numbers look like if we remove Gonzalez from the picture.  That’s right, let’s throw out the catalyst for the outliers and see what the world of data breaches looks like for the Payment Card Industry.

If we count up the number of records lost due to Gonzalez between 2007-2009 we have the following respectively: 94,000,000 (2007), 4,303,930 (2008), and 130,000,000 (2009).  The revised data for those three years would look as following:

2007: 17,957,179 records (down 84%)

2008: 9,135,312 records (down 32%)

2009:  965,494 records (down 99%)

Analysis

What can we learn from this data?  Well, one can speculate that in the absence of outliers like Gonzalez, the overall volume of credit card fraud is dropping.  In fact, without him we would be coasting through 2009 with very few payment-card related data breaches at all!  I won’t make the mistake you anticipate and confuse correlation with causation.

One could also conclude that payment-card related fraud does not follow a normal Gaussian distribution.  In fact, it appears that payment-card related theft and fraud is statistically closer related to the probability distribution of terrorism than traditional crime statistics.

Taking a business perspective one still needs to be on the lookout for attackers and carders who wish to target your business in an effort to “get rich or dye tryin”.  Wherever there is financial or payment-card data there will be those who wish to plunder and capitalize on it.  One thing we must remember is that underground carding is a business model, albeit an illegal one.

Share