Perilocity

Confusopoly, or Scott Adams, Prophet of Finance

While sitting in a small room perusing a book from the bottom of the stack, The Dilbert Future, I idly looked again at Scott Adam's prediction #2:

In the future, all barriers to entry will go away and companies will be forced to form what I call "confusopolies".

Confusopoly: A group of companies with similar products who intentionally confuse customers instead of competing on price.

OK, good snark. But look at the list of industries he identified as already being confusopolies:

• Telephone service.
• Insurance.
• Mortgage loans.
• Banking.
• Financial servvces.

Telephone companies of course since then have gone to great lengths to try to nuke net neutrality.

And the other four are the source of the currrent economic meltdown, precisely because they sold products that customers couldn't understand. Worse, they didn't even understand them!

It gets better. What industry does he predict will become a confusopoly next? Electricity! And this was in 1998, before Enron engineered confusing California into an electricity-price budget crisis.

For risk management, perhaps it's worth considering that simply selling something the customer can understand can rank way up there. Certainly for the customer's risk. And given how much the FIRE companies drank their own Kool-Aid, apparently it's good risk management for the company itself. Especially given that the Internet now gives the customer more capability to find out what's going on behind a confusopoly and more ability to vote with their feet.

To actually make a product the customer wants, and then provide good customer service: how old-fashioned! And how less risky and more profitable in the long term.

Class Action Coming for Identity Theft?

It wouldn't be a moment too soon:

I painfully predicted a few years back that phishing and related identity theft would result in class action suits. I lost my bet as it didn't happen fast enough, but a significant step has been taken (reported by Lynn) with the publication of a book that apparently blames the banks and the software manufacturers for identity theft.

— Signs of Liability: 'Zero Day Threat' blames IT and Security industry, Ian Grigg, Financial Cryptography, April 14, 2008

The book review iang quotes gets it about online crime not being amateur anymore: it's organized. And it gets it about perhaps a more important point:

Mortgage Confusopoly Disintermediated

Adam Shostack finds a company distintermediating the other half of the house buying confusopoly, mortgages:

SmartHippo today launched the public beta version of the first ever web site that allows individuals to use the power of a community to save money and make better decisions when shopping for rates on financial products and services.

"The lending industry is in a state of transformation," said George Favvas, President of SmartHippo, "and consumers are demanding more control and transparency in their dealings with banks and mortgage companies."

SmartHippo allows any individual to post information and feedback on the rate they received, and to compare rates with other members of the community with similar profiles. This lessens the chance of consumers with the same lending and risk profile getting different rates on the same loan, which can happen currently.

— SmartHippo.com Launches World's First Community Comparison Shopping Site for Financial Services at TechCrunch40 Event; Founding Participating Banks Include QuickenLoans and Bank of Internet, PRWeb, 17 Sept 2007

This is different from companies like LendingTree that already facilitate getting multiple bids for mortages in that SmartHippo lets mortgage customers comment on their experiences. Participatory, if you will.

-jsq

To Insure or Not to Insure?

Iang reminds me that it was on his blog, Financial Cryptography, that I saw the rough estimate of how much an identity theft costs, that is, about $1,000.

He follows up on my post of yesterday about LifeLock, discussing a company called Integrity which insures identities in Second Life. Or, actually, insures any lawsuits resulting from "inappropriate content", whatever that is.

Then he gets to the real quesion:

How viable is this model? The first thing would be to ask: can't we fix the underlying problem? For identity theft, apparently not, Americans want their identity system because it gives them their credit system, and there aren't too many Americans out there that would give up the right to drive their latest SUV out of the forecourt.

On the other hand, a potential liability issue within a game would seem to be something that could be solved. After all, the game operator has all the control, and all the players are within their reach. Tonight's pop-quiz: Any suggestions on how to solve the potential for large/class-action suits circling around dodgy characters and identity?

— If Insurance is the Answer to Identity, what's the Question?, Iang, Financial Cryptography, September 11, 2007

This wraps right around to the original reaction of the person from whom I heard it (hi, Anne Marie) on a list that is silent.

I have several thoughts about this:

ROI v. NPV v. Risk Management

There's been some comment discussion in about security ROI. Ken Belva's point is that you can have a security ROI, to which I have agreed (twice). Iang says he's already addressed this topic, in a blog entry in which he points out that

Calculating ROI is wrong, it should be NPV. If you are not using NPV then you're out of court, because so much of security investment is future-oriented.

— ROI: security people counting with fingers? Iang, Financial Cryptography, July 20, 2007

Iang's entry also says that we can't even really do Net Present Value (NPV) because we have no way to calculate or predict actual costs with any accuracy. He also says that security people need to learn about business, which I've also been harping on. I bet if many security people knew what NPV was, they'd be claiming they had it as much as they're claiming they have ROI.

Negligence and Breaches

Banks, shops and government departments have exposed thousands in Britain to the risk of fraud through "horrifying" breaches of data protection laws, a watchdog said on Wednesday.

In his annual report, Information Commissioner Richard Thomas, whose office enforces the Data Protection Act, said firms must do more to secure people's private details.

"The roll-call of banks, retailers, government departments, public bodies and other organisations which have admitted serious security lapses is frankly horrifying," he said in the report.

— Privacy watchdog warns of "horrifying" breaches, The Scotsman, Reuters, 11 July 2007

He's not talking terrorism, so we can hope this is not just more FUD.

Passport Friction

Ben Hyde has an interesting bunch of thoughts about verification friction:

We recently got new passports, a project that was at least a dozen times more expensive and tedious than doing my taxes. I once had a web product that failed big-time. A major contributor to that failure was tedium of getting new users through the sign-up process. Each screen they had to step triggered the lost of 10 to 20% of the users. Reducing the friction of that process was key to survival. It is a thousand times easier to get a cell phone or a credit card than it is to get a passport or a learner’s permit. That wasn’t the case two decades ago.

— Friction, by Ben Hyde, Ascription is an Anathema to any Enthusiasm, 10 May 2007

He mentions some cases where friction may actually be socially useful, as in making it harder to get liquor and easier to get condoms, or some automobile traffic engineering. Then he gets to the especially interesting part.

FedLine: Advantage or Menace?

This story in the New York Post has been all over the net:

CYBER FEARS ON FED'S WEB PLAN

By HILARY KRAMER

August 15, 2004 -- With little fanfare, the Federal Reserve will begin transferring the nation's money supply over an Internet-based system this month — a move critics say could open the U.S.'s banking system to cyber threats.

The Fed moves about $1.8 trillion a day on a closed, stand-alone computer network. But soon it will switch to a system called FedLine Advantage, a Web-based technology.

The story is quite confused. What is ``a Web-based technnology''? Is it one that uses web pages for entry? Or is this typical confustion of the web with the Internet? And does FedLine actually run over the public Internet, or does it simply use Internet protocols over private leased lines?

The story doesn't answer any of these questions. It also says:

``Patti Lorenzen, a spokeswoman for the Federal Reserve, said the agency is taking every precaution.

"Of course, we will not discuss the specifics of our security measures for obvious reasons," she said. "We feel confident that this system adheres to the highest standards of security. Without disclosing the specifics, it is important to note that our security controls include authentication, encryption, firewalls, intru sion detection and Federal Reserve conducted reviews."''

Somehow I'm not comforted by the first and most frequently mentioned method being security by obscurity. And the mention of firewalls would seem to indicate that this service does run over the public Internet. Let's see what Fed has to say about FedLine Advantage:

``FedLine Advantage is coming!

``In recent years, we have announced our strategy to provide access to all Financial Services using web technology. We are pleased to announce FedLine Advantage, the Federal Reserve Banks’ next generation of service access, is on the horizon.

``FedLine Advantage will extend the use of web technology to provide access to critical payment services such as Fedwire Funds Service, Fedwire Securities Service and FedACH Services. In addition, FedLine Advantage will also enable the use of financial services that are currently accessible via FedLine Web, making it the access method of choice for Federal Reserve Financial Services.``

That Fed web page in turn links to a PDF of Volume 2 Issue 2 of the newsletter Fedfocus,
which is dated May 2004. Hm, it appears this is old news.

Fedfocus May 2004 defines Virtual Private Network (VPN) and Frame Relay, notes how
the former works over a public network and the latter does not, plus various kinds of encryption such as SSL, and various kinds of user authentication, such as passwords or USB. However, it never quite seems to say which of these technologies FedLine Advantage will use.

That issue of FedFocus does emphasize conversion from an MS/DOS earlier version. So it seems to be largely a user interface move. Which would indicate a change to a web interface, perhaps using the same underlying physical links as before.

If I had to guess, I'd say that they'd probably start with Frame Relay, and offer VPN service to those who want to risk it. And I'd guess that convenience would increasingly win out, resulting in many more VPN customers than FR ones.

Even if it stays completely on leased lines, there's still the issue of the computers that are used to use the web interface. The Fedfocus issue mentions that an old version of Internet Explorer will no longer be supported for FedLine Web (a service currently in use) but newer versions of IE will be supported. What if someone compromises IE on such a computer?

I suppose what happens is that some transactions may get compromised. Of course the same thing can already happen if you use IE to access your bank account over the Internet, although the scale may be bigger. In other words, it's the usual tradeoff of more convenience for somewhat more risk. Maybe this change will promote enough additional commerce through convenience to offset any losses from the increased risk.

That's many smallish risks; not one huge risk of the entire Federal Reserve system being compromised all at once, as the newspaper article might lead one to believe. Well, probably not. I wonder if the Fed practices software diversity and topological and physical distribution of resources?

We're moving into Tom Clancy territory here, and it's already late as I type, so I'll leave more on this to another day.

Suffice it to say that this is yet another case where technology alone will not completely manage risk, and non-technological means are also needed.

-jsq

Financial Services Risk Tamed?

Here's a report by PricewaterhouseCoopers and the Economist Intelligence Unit that says that quantifying credit market, regulatory, and even IT risk isn't enough.

``But what about those areas, like reputational risk, that are both harder to measure and more sudden and severe in their impact?''

According to the report, which is based on a survey, while the internal corporate profile of risk management has increased in recent years, this has been not so much because of proactive measures as reaction to outside pressures from regulators and rating agencies. It seems most companies still see risk management as a relatively low-level activity having to do with crunching numbers of types they are already familiar with, rather than as a strategic activity that involves both quantifying additional areas of risk and making plans for types of risk that may never be quantifiable to the extent of some of the traditional areas. The report says that those companies that have made the shift to viewing risk management as such a strategic activity find it a source of competitive advantage.

``Such institutions accept that uncertainty cannot be tamed, only mitigated.''

Like the Chairman of Lloyds, the report recommends risk management plans be overseen at the board level; however it notes that that mostly isn't happening yet. Reports like this will help make the lack of board oversight of such a plan a reputational risk.

Curiously, the report doesn't say anything about insurance, which is one of the more obvious ways of mitigating risks that cannot be tamed.

I think a time will come not long from now when a company that does not have Internet business continuity insurance will suffer a reputational risk.

The report does mention Basel II, as not only a way of witholding enough capital to deal with risk, but also as an incentive to dramatically improve risk management policies and procedures. And it notes worries that if Basel II becomes best practices that further risk management strategies might be inhibited.

It mentions geopolitical risks beyond the control of the corporation, such as regime change, and it emphasizes the importance of risks outside the corporation involving supplies and outsourcers and the like, yet the report does not mention Internet continuity problems that could result from such sources and affect business.

No report is perfect. This one makes some important points based on real data about what companies have done to manage risk and some more things they need to do.

-jsq