September 11, 2008
reliance on security claims: what can go wrong?
One of the perpetual threads is about how to deal with users' expectations (profit!), especially when they clash with the goal of protecting their assets (governance). In one example, people are dealing with the impossibility of CA liability versus the imponderability of universal service to browser users. In another place, security researchers are mentally edging away from life-as-seller to life-as-mentor. In user interface circles, the news is likewise not good: all the efforts look good on paper, but have trouble working in measurable practice.
Just how far is the gulf between user expectations and what the infrastructure can deliver? One airline just got a lesson:
Apparently a botched news story sparked a selloff of shares of United Airlines (UAL) yesterday. It seems that, on Sunday afternoon, the South Florida Sun-Sentinel accidentally re-ran a six year old Chicago Tribune article about United filing bankruptcy. Unfortunately, there was no date associated with the story, and Bloomberg picked it up and reported it as new information shortly before 11AM yesterday.
Not surprisingly, this blunder resulted in massive selling, driving shares of UAL down 75% from a bit over $12/share to $3/share. Here’s a screenshot of the stock chart showing the precipitous drop.The story was pulled, and United is reportedly investigating what happened. As of right now, the stock is trading at just shy of $11/share. It’s kind of scary what an errant click of the mouse can do, isn’t it?
It is pretty clear that users can be spooked by a false story. It's also clear that the degree of spooking is inversely related to the accuracy of information; the vast number of stories that are printed in the media have approximate truth in them.
What to do about this? In practice, there is little to do. Make sure that the source of the error is fixed, and, make sure it was an innocent error. But that doesn't solve the real problem, only makes sure that the one person never makes the one exact error again.
In practice, a rogue hit can always damage. So, roll out the damage control. The answer with how to deal with these totally unexpected events then is almost always "we'll look at it when it happens," and "we have damage control for that."
(The users in the above case might have other views. But for them: investment is risky, and they can always take their dispute to the courts. I'm more interested in how it would play out in a security market where courts traditionally haven't backed up the user, and the market is supposed to be non-risky by design.)
Posted by iang at September 11, 2008 04:30 PM | TrackBack