Global Security, Privacy, & Risk Management

Black Swans, Probability Ignorance & FUD: Risk 101 February 13, 2012

I have written several posts on risk and risk within the maritime security industry.  You can read them here (#1, #2) There is a common mistake people sometimes make when venturing into risk management.  It is the focus on the impact of an event while ignoring the probability or overestimating the probability of the event.   Very serious events with very low probabilities of occurrence (or those which you are unable to calculate) are what has been coined as Black Swan events by Nassim Taleb in his book of the same name.  When calculating or estimating risk it is sometimes a temptation to look at those incidents with high impact potential and low probabilities while ignoring the less severe events with her probability.  This would be akin to venturing into the Amazon Rain Forest and protecting yourself from Grizzly bears (very large impact but low, low probability) only to die of blood loss from being bitten by a million mosquitoes because you did not take a mosquito net or bug spray as you were not concerned with “a little mosquito bite”.

It is important to calculate risk by using a method that accounts for both impact and probability.  This will give you a method by which to calculate the actual risk of an event and take appropriate steps to manage the risk.  As can be seen by the graphic at the top of the post, a high impact low probability event poses the same risk as a low impact, high probability event assuming the ratios are equal.  While the impact can be calculated as someone finite (for example, the worst that can happen to a person is likely to be killed) the probability of an event which can cause the event can range from unlikely to infinitesimally small.  As an example of probability ignorance I will use an example from my own life.  A woman I know carries a hammer in her car given to her by her mother.  The purpose of the hammer is to break the car window and escape in the event the car plunges into a lake or other body of water and begins to sink.  While the idea of drowning in a sinking car is certainly frightening, the likelihood of a car plunging into a body of water at 7,000 feet in high desert is very, very, very low.  In this scenario it would be suggested that a better use of the money spent on the hammer was a 20 minute discussion on the value of always buckling the seatbelt and never speeding.

So why is this important?  Simple.  Security practitioners sell on a concept known as FUD or Fear, Uncertainty, and Doubt.  A great example of FUD is a commercial I saw recently.  A security company announced that 4  houses are  burglarized every 14 seconds in the US. The commercial then goes on to show a mother and her children and how scary a burglary can be.  Lets do some quick math to see how ‘scary’ this really is.  According to the US Census Bureau there are about 131 million housing units in the US.  If there is a house burglarized every 14.6 seconds this means that there are 4.1 burglarized per minute, 246 per hour, 5,917  per day and 216,000  per year.  WOW!  That is alot! BUT…this means that if you live in a home you have a .16% change of having your home burglarized in a given year. This does not seem so bad now.  Keep in mind that some areas such as urban areas have higher crime rates than other areas and some houses are burglarized more than once.  Another area where the security vendor attempts to convince you to use their services is by intimating that burglaries result in physical assault.  In the commercials, a woman (not a man) is with her children talking about how the neighbor was burglarized and “while the children weren’t home, imagine if they had been.”  Very few burglaries result in any physical harm to anyone but the imagery in the commercial is significant.

When listening to the inevitable sales pitch from a security vendor, keep in mind that they have an objective to sell you services.  The easy way to do this is to use the FUD technique.  If I am selling meteorite insurance, I will tell you about the dangers of meteorites, irrespective of who small they may be.  Remember, it is easy to lie with numbers and easier to lie with statistics.  Always base security implementation on a risk analysis.

Black Swan events – The Amazon rain forest example gives us a good opportunity to talk about Black Swan events.  While we can calculate the probability of being attacked by a Grizzly bear in the Amazon (practically zero since they do not live anywhere but North America) there could be a situation in which a Grizzly bear was present and did attack someone.  Maybe a person illegally imported a bear and let it go in the Amazon.  This type of event would be a ‘Black Swan’ as you really could not calculate the probability of that specific event.  The book is a very good starting point for this concept.

-Graphic from MindTools.com