Perilocity

What about the Therac-25?

Someone suggested that Dennis Quaid should be reminded of the Therac-25 "if he thinks computers will reduce risk without a huge investment in quality, quality assurance and operational analysis." For readers who may not be familiar with it, the Therac-25 was a Canadian radiation-therapy device of the 1980s that was intended to treat cancer. It had at least six major accidents and caused three fatalities, because of poor software design and development.

Why should anyone assume Dennis Quaid doesn't know that quality assurance and operational analysis are needed for anything designed or controled by software? The man is a jet pilot, and thus must be aware of such efforts by aircraft manufacturers, airlines, and the FAA. As Quaid points out, we don't have a major airline crash every day, and we do have the equivalent in deaths from medical errors. Many of which could be fixed by Computerized Physician Order Entry (CPOE).

Or ask the Mayo Clinic:

Dennis Quaid: Medical negligence deaths as many as a major airline crash every day

People think Internet security is bad (it is), but let's look at medical security:

"Actor Dennis Quaid has become an advocate for electronic medical records. In 2007 his 12 day old twins received a massive accidental overdose (10,000 units of heparin instead of 10 units), a near-fatal error that could have been prevented by the kind of bar code technology that the VA has been using for decades. (Yes, folks, sorry, a government institution was decades ahead of privatized healthcare on this.)"

"Quaid points out that the widely quote 100,000 accidental deaths every year from medical errors equates to a major airline crash every day."

I point out that that's three times the annual deaths from automobiles, and around #5 in leading causes of death in the U.S.

-jsq

HelpJet: Disaster Evacuation in Style

AIG may sell boutique wildfire insurance, but that's nothing on HelpJet:

The new service from West Palm Beach-based Galaxy Aviation guarantees its well-heeled members a seat on a chartered jet out of the hurricane zone, reserves five-star hotel rooms and limousine transfers and rolls out a red carpet — literally.

"We call it evacuation in style," said Brian Rems, who came up with the HelpJet concept.

— Hurricane Victims Can Evacuate in Style, By MATT SEDENSKY, Associated Press Writer Saturday, September 16, 2006

Naomi Klein points out the flip side:

For the people left behind, there is a different kind of privatized solution. In 2006, the Red Cross signed a new disaster-reponse partnership with Wal-Mart. "It's all going to be private enterprise before it's over," said Billy Wagner, chief of emergency management for the Florida Keys. "They've got the expertise. They've got the resources." He was speaking at the National Hurricane Conference in Orlando, Florida, a fast-growing annual trade show for the companies selling everything that might come in handy during the next disaster.

— Disaster Capitalism: The new economy of catastrophe, By Naomi Klein, Harper's Magazine, September 8, 2007

So what are we looking at here? Clever entrepeneurs seeing a market need and filling it? Or the calculated privatization of every government function (Klein)? More to the point, is it good risk management?

Oh, and is there really money in it? www.HelpJet.us currently is all about Galaxy Aviation, and doesn't say Help Jet anywhere, nor does it mention the kinds of services Help Jet was selling. (I'm pretty sure that's the right URL, since Google still shows old initial text for about.html as "Not any more with Help Jet, the world’s first hurricane escape plan that turns a hurricane evacuation into a jet-setter vacation. Here’s how Help Jet works. ...") Meanwhile, AIG has been known to start a line of insurance just to see if it will sell.

-jsq

ROI v. NPV v. Risk Management

There's been some comment discussion in about security ROI. Ken Belva's point is that you can have a security ROI, to which I have agreed (twice). Iang says he's already addressed this topic, in a blog entry in which he points out that

Calculating ROI is wrong, it should be NPV. If you are not using NPV then you're out of court, because so much of security investment is future-oriented.

— ROI: security people counting with fingers? Iang, Financial Cryptography, July 20, 2007

Iang's entry also says that we can't even really do Net Present Value (NPV) because we have no way to calculate or predict actual costs with any accuracy. He also says that security people need to learn about business, which I've also been harping on. I bet if many security people knew what NPV was, they'd be claiming they had it as much as they're claiming they have ROI.

Flying Risk

Airport risk management:

It was while waiting to board a transatlantic flight from Heathrow last month, having been asked to show my papers at least six times more than one ever used to be, that a hopeless fantasy took root in my mind. As my handbag was overturned, I recalled reading recently that globally there were an estimated 27m scheduled flights a year. A little further along, as my 120ml bottle of contact lens cleaner was confiscated, I thought how few of them had met a hideous fate at the hands of terrorists. And as I later removed my shoes, recalling that the sole apparent justification for this was that one complete halfwit had failed to set fire to his trainers some years ago, I realised that I was willing to play these odds.

— I'd risk flying with terrorists to escape this airport hell, Marina Hyde, The Guardian, 4 August 2007

But did anybody ask her (or us)?