WannaCry and risk perception
Chris, Fraser and Nick discuss the public perception of WannaCry and what it tells us about how people perceive risk.
For more information on Aleph Insights visit our website https://alephinsights.com or to get in touch about our podcast email podcast@alephinsights.com
Transcript
Hello and welcome to the Cognitive Engineering Podcast produced by Tell Me Studios for Aleph Insights. In this series of podcasts we take a look at interesting topics and discuss what we think they tell us about analysis and decision making. I'm Fraser McGruer and I'm here with Nick Hare and Chris Wragg of Aleph Insights and this week we're discussing the recent cyber attack on the NHS, the British Healthcare Service. So Chris, can you lead us in on this, describe the events and then perhaps address this from the point of view of public perception?
Speaker B:So yes, this relates to the recent want to cry ransomware...
Speaker C:Why are you saying it like that? It's called wanna cry, it's driving me mad.
Speaker B:It may be called wanna cry but I can't bring myself to say wanna cry, it just doesn't... You just did it, you just said it. I did. Okay, the recent wanna cry ransomware attack which had a particular significant effect on the National Health Service in the UK but also affected lots of other organisations around the world and effectively encrypted lots of data held by these organisations and insisted on a ransom being paid in order to decrypt the information and allow the organisations to accept it again, to access it again. But I suppose the thing I'm most interested in about this is not the technicalities of how the attack was achieved or the impact of it but actually the public perception of the event and the risk associated with it. And it struck me, you know, having sat and listened to lots of pundits and read lots of coverage about it, it struck me as a classic public panic story which we've had, you know, things like, you know, not dissimilar to things like the millennium bug or, you know, when the Ebola virus was coming out, when you had the initial hype cycle around the threat to other parts of the world from that. And generally it strikes me these things kind of follow a pattern which is quite interesting which is, you know, to begin with the public doesn't particularly understand the threat. So it's a novel kind of threat, something they don't particularly have a technical insight into and so you get this huge overestimation of the risk to begin with and the interest in the risk. And then slowly you get sort of more information emerging as people begin to understand it better and people talk about, you know, mitigations to the risk start to surface of, you know, in this case backing up your information or how not to fall for a phishing attack. And you get slow reduction in the perception of the threat until the sort of panic is over and the news cycle moves on to whatever else it wants to worry people about. But it got me thinking about novel threats and how we react to them and how perhaps we ought to react to them and whether actually panic serves a sensible purpose. Okay, nicely set up. Before we sort of
Speaker A:go and answer some of those questions, just I don't think I know what the public perception is to this risk. I think I definitely know what lots of broadcasters and DJs, you know, radio DJs think about this a bit. But I don't know what the public perception of this is. Because I think as you're kind of intimating a little bit is we know what all these sort of pundits sort of think about and they get terribly excited about it and it's another news story and it's kind of forgotten the next week. But I don't think I've had a conversation with anyone about this, about you know, what do you think's happened to the public to the NHS and...
Speaker C:Well, I know a lot of people seem to think that the NHS had been attacked, you know, the coverage was gave the impression that some hackers had targeted the NHS and that's not what's happened at all. I mean, this is just the NHS is just one victim of this ransomware attack. What's irritating in this case is that, you know, it's a really easy thing to patch as well. So it just exploited this vulnerability that was patched out in various Windows updates. But I think they were using an old version of Windows. They'd been told, you know, as one of these things where, you know, no doubt, there are a whole bunch of, you know, of sort of IT guys in the NHS saying, you know, we really need to get the latest version of this software and had probably just been told, well, everything's been fine up till now. So we're not gonna, we're not gonna lay out this very small expense to do that. You know, I think that's what's frustrating is why do things have to happen before people take them seriously? I mean, you know, that's what it feels like, actually, instead of trying to understand risks from first principles and react in advance like we ought to, I think we basically just have to wait for things to go wrong. And then people do things about them. And, you know, you could say, well, actually, you know, there's an argument saying, well, that's actually a lot less effort as an approach. It's a perfectly good approach, you know, given that we're saving a lot of effort in trying to analyse and respond to risk, all we have to do is sit there and, and fight the last war, you know, but you guys are too clever,
Speaker A:right? Because this is about human nature. Right? So every day, my bloody computer is telling me to update something or other. And I just get saturated with these automated messages.
Speaker C:I don't know, you just automate, have updates that are automatic. What are you talking about?
Speaker A:Because I worry about it slowing down my computer and whatever might be going,
Speaker C:what the updates might actually be. Well, you're a nincompoop.
Speaker A:Well, there we go. I'm a nincompoop. Yeah, because you really don't want to get
Speaker C:ransomware. It's incredibly, not only the nuisance, but, you know, you're basically funding people to do it again. That's what's so irritating. It's all the idiots out there who were making this possible. You know, if everyone had good IT hygiene, like me, there wouldn't be any ransomware because there'd be no money in it.
Speaker A:You're ruining it for everyone else. Well, if only you could duplicate that hygiene in other parts of your life. Well, no, but look, this is why many times I have broken bones. Okay. I've, I've had God knows how many accidents in my life. And I'd probably had about
Speaker C:50. When I first met Fraser, he was, he was nursing a broken arm. Was I? Yeah. You had,
Speaker A:you'd had a motorbike accident. Yes. That's right. That's right. It was quite a bad one. Anyway. And so many times I've had pause to thought and to wonder why pain exists. Okay. And I think the reason why pain exists is to stop you from doing something. Because I remember sitting there with a broken arm, broken ankle saying, God, wouldn't this just be so much easier? I recognise that my broken bone needs to mend. Wouldn't it be much easier if I just had a red
Speaker C:light come flashing up on my foot? Yeah, this is actually a, quite a big philosophical question why, why does pain hurt? Yeah. You know, why? But, but I mean, that's exactly you. I mean, it's not controversial to, I mean, it's pretty well accepted. Obviously that pain has to be aversive. It's got to be something you don't want. Otherwise you'll just sit there, you know, absentmindedly stabbing yourself in the leg and going, I can put up with the, I can put up with
Speaker A:that little flashing red light. This is fun. And so that's my point, Nick, which is the, oh, why, oh, why do these organisations let this happen again and again? Why does it have to happen for them to learn to not do it? And the answer is that's the pain. So that is my answer to your question. I've solved it for you.
Speaker C:What, what's the, I don't understand.
Speaker A:So why don't these, why don't these organisations practice good, good IT hygiene? And the reason why is we can only learn through a painful experience.
Speaker C:Well, no, but we don't, that's not true. That's what I'm saying. I mean, it's like, if that was true in humans, then we'd, we would have to personally go around suffering every single thing that has ever happened to someone before we knew that, that, you know, jumping out of windows or, or, or sticking your hand in the oven was stupid things to do. You know, we, we, we are capable of understanding that, you know, dangerous things have the, have the potential to hurt us. And so we avoid doing them. And I just think that, you know, it seems like we organisations sometimes don't, don't try hard enough to do that.
Speaker B:I think there is something definitely though in a personal experience of pain is that much more resonant than the, the, the sort of abstract somebody else's pain. Oh, this thing happened to somebody else and you never, you can never quite empathise with them to the extent or, or, you know, see their perspective enough to genuinely believe it's going to happen to you. There's always this element of optimism bias, which is yeah, but either they deserved it or they were more stupid than I am. But, but somehow, but it's only when you burn your own fingers that you, that you truly, truly listen to it. And I, and I, but interestingly, you know, I suppose my initial sort of interpretation of this is panic around those things is when they're, when they're breaking and something happens, you actually, you actually get a distortion or overestimation of, of, of the risk at that point. So, so as bad things are happening to other people and you, you, you see that happening in it and there's something different when, when that sweeps into a, into a panic about a particular. Well, yeah, but I think there's a
Speaker C:rational, when a new category of threat emerges to, you know, to sort of err on the side of caution, it's rational because you're, you're acquiring information. So you're at a point of high uncertainty. It does make sense to, to then sort of wait and see, and you probably want to take mitigating action. But yeah, I mean, there's lots of, lots of interesting examples. I mean, I remember the, do you remember the flesh eating bug of panic? It was about 20 years ago. And you know, it was sort of the impression was that there was this great plague of contagious flesh eating bugs that there was a headline, I think monster bug ate my face. And it was, they were totally unconnected. They basically, this was a virus, this is a virus that's kind of anyone could get and that, you know, one story hit the headlines and then, then people went and unearthed other stories and turned it into a non-existent epidemic. You know, so, and, and I think there, you know, there are, it's interesting, some, some kinds of you know, health and safety behaviour is, is totally and utterly wrong. It's based on completely incorrect beliefs, like, like, you know, not going, not going swimming after you've eaten. I mean, everyone knows that one, right? You don't go swimming after, after you've eaten. Why? Because something to do with getting cramp. I mean, there's absolutely no evidence for it at all. There's and then there's the, my favourite one is the, is the, the Korean fan death myth. Do you know about that one? Yeah. Basically Koreans generally believe that if you are in a room with a fan on, you die. That if you, if you go to sleep and you leave a fan running in your room, you die. Okay. They think, they think that there is no evidence for that, but it's a very widely held belief in Korea. What I have, I mean, it's, it's, it's barmy, it's been, it's apparently been, it's about 100 years old, this, this thing, you know, there's no evidence for it. And yet people take mitigating action, you know, go around switching their fans off. Okay. I didn't expect to hear that.
Speaker A:Okay. Well, look, we're slightly meandering off course. Let's sort of bring it back on track because we want to talk about novel risks. Am I right? And we want to talk about how do you quantify a risk that's novel that, you know, where you don't, you don't know what the
Speaker B:risk is. Yeah. So I think, I think that's quite, that's particularly applicable to, to these kinds of cyber risks because you know, insurance in relation to these, these cyber risks is a, is a newly growing market. But of course it, it poses a question of, of how, how you start to estimate the risk associated with things for which there isn't necessarily a huge amount of precedent. Now we're getting more and more data about cyber risks and their impacts and the different kinds of them. But if you compare it to something like, you know, the, the risk associated with fire, we don't, we don't have the same level of data. So first of all, you know, how, how do you start to estimate the, the probability of, of you being subject to this particular type of risk? And then how, how do you estimate the size of the, of the damage caused to you or the impact or the cost when you don't necessarily have a huge number of, of, of precedents to, to base it on, you know, with, with, with something like a fire risk, it's, it's relatively easy to estimate what the, the upper cost would be, you know, it would be the, cost of the house and all of its, all of its contents. But with something like a cyber risk, it may be more difficult to determine, you know, what level of, of cost might be associated with, with something like that, how far it might, it might go and what level of damage it could cost. So I think this poses a, an interesting question about assessing novel, novel risks.
Speaker C:Yeah, I suppose the interesting thing with cyber risks is the, is the fact that they, all of them seem to exploit a hitherto unnoticed vulnerability. And you know, what, what's, we can't ever really be sure that there isn't some, you know, super vulnerability out there where a really, really effective virus will sort of one day basically lock down every, every connected computer in the world. Or, you know, that, that's the kind of thing which is we sort of imagined to be low probability, but we might, might be wrong. You know, we did, it's very hard to sort of quantify those kinds of one-off that's really, really big and completely unprecedented risks. But I think the, I think the, the, the approach is to try and look at the actual system to understand the characteristics of the system and make judgments. I mean, you can, you can, you know, if we can look at risks to, I dunno, like aviation or something, and we don't need to, we, we, we don't need to have data on every single plane crash that's ever happened to understand, you know, what factors are potentially risky because we can look at an aeroplane and we understand in engineering terms, how the system works and how an aeroplane works and where the kind of engineering vulnerabilities are. So you don't, you don't have, you don't have to wait for things to happen. You don't, you know, you can, you can do it by looking at the system. You can break the system into smaller parts and, and understand each of their characteristics.
Speaker A:So I should just keep updating my computer?
Speaker C:Well, yeah, that's, I mean, I don't, I think there's not an IT person on earth who wouldn't tell you to do that. So, so yeah, keep, keep doing that.
Speaker A:IT, IT people are always telling me to do all sorts of things.
Speaker C:Yeah, they're probably right. Well, they're probably right about the IT stuff.
Speaker B:But it does, it does, it does beg the, the, the question of, of sort of health and safety or risk aversion fatigue, you know, and, and the way, particularly in this country, if people mention the term health and safety, everybody sort of groans and rolls their eyes to the, to the skies. And, and yet, you know, aside, those, those totally unnecessary health and, health and safety measures that, you know, Nick was sort of mentioning earlier on, those aside, generally, you know, what, what they're suggesting you do is about reducing, reducing the risk to you as an individual, but we do have this sense of, I suppose, just a general disdain for health and safety and health and safety measures.
Speaker C:Well, there is, there is the, the whole sort of the Daily Mail cancer issue. There's actually, there's a website, I don't know if it's still up and running, but which is, which is the sort of Daily Mail things that give you cancer and things that cure cancer. And basically there's, there's hundreds of things on this list that the Daily Mail has at some point reported as, as giving you cancer. And some of them are on both lists, you know, some things both give you cancer and cure cancer everything it's, you know, from asparagus to, to, you know, no net games. Yeah. And I, I think, I mean, it's interesting thinking about actually things like the, the evidence on smoking being bad for you, which took a long time. It, you know, that's, that's an example where we, we was the, almost the other way around, you know, we, we had, instead of panicking and stopping doing something, we, you know, we had really had to educate ourselves into taking appropriate measures. And I think the, you know, contrast that with something like BSE, do you remember the BSE scare? Yeah. Yeah. Where, you know, a lot of people instantly stopped buying beef and, and then there's things like, you know, which, which was sort of the, the opposite of the smoking situation. And then there's things like global warming where, you know, we all probably ought to be taking very significant action, but you know, no one, there seems to, it seems to be just
Speaker A:very, very difficult to motivate people. But doesn't this all go back to what I was talking about, which is this kind of pain threshold or the pain alert, right? Whereas with something like global warming, it's such a slow burning problem and actually doesn't really feel like a problem a lot of the time that we don't do anything about it. Similarly, smoking is quite good fun. And, and so that's why sort of, that's why people take some convincing about that. Whereas I guess seeing someone suffering from brain spongiform, whatever it was, it's, it's sort of inherently terrifying, you know, Christ, I'm going to stop eating. So it doesn't, doesn't it all go back to that is our own natural, I don't know, human emotions, I guess. Yeah. Although, I mean,
Speaker C:I don't, I don't really understand. And I'm not sure there's a sort of well-developed theory of what determines that, that reaction, because there's not superficially that much difference between sort of finding out about BSE and Kreutzfeldt-Jakob disease and finding out about smoking and lung cancer. And yet in the case, I mean, both things involve, you know, both involve doing a fun thing. Yes, exactly. And why, why, why did the BSE thing or, you know, the, the salmonella and eggs thing, why did they lead to people suddenly switching to chicken and not buying eggs? Whereas, whereas, you know, with, with smoking, it's, it just took years and years
Speaker B:and years to not have very much impact. This is where behaviour comes in and the, the, the idea of, of panic and, and sort of the cultural setting that it's not necessarily, you know, it is driven by our, our sort of desire to conform to what society is, is, is doing. And some, some things, for whatever reason, create an initial panic that then, that then snowballs. So, I mean, if you look at something like, and, you know, shifts over time, if you look at something like pregnant women drinking alcohol and how, you know, we're now at a stage where that is very much something that is a, is a taboo, which previously wasn't a taboo and probably happened quite quickly. But then you get other things like people dropping the eating of, of beef, which, which happened, which is a much more acute sort of panic. And then you get things which evolve much more slowly, like, you know, like the reduction in, in smoke, you know, smoking or
Speaker A:smokers. We need to round things up pretty swiftly, but I just want to, it seems to me that I feel sorry for you guys at Aleph sometimes, because it feels like you're a voice crying in the wilderness. You're, you're this sort of oasis of, of rationality dealing in this irrational world or trying to help people. A shining, a shining beacon. A shining beacon of, right. And my question to you is this, is I was just wondering, going back to when we first met Nick and me and my broken arm, and how strong a memory is that for you? Uh, I remember it pretty well. I thought,
Speaker C:hang on, this guy, uh, seems like, seems like one of us. Right, there we go. Just to flesh that out a bit more, uh, Fraser and I met during one of the National Childbirth Trust, uh, how to be a parent lessons. And, um, and, uh, yeah, it was, it was sort of Fraser and I were the, were the two who were probably there, um, with, with the most, with the most sort of skepticism, really. Uh, everyone else was very, well, I think most, most of the other dads were very earnest about it. And I think, uh, Fraser and I were a bit less earnest. Yeah, we rock to a different tune. Um, but, um, but I, yes, I basically remember it quite well, I think, you know, which, uh, might suggest that we are, you know, primed to look for other people's misfortunes so that we can, we can learn from them. But the
Speaker A: l, hold on, I broke my arm in: Speaker C:just very, very slow, uh, healing. No, you're right. Maybe it was just that you'd bashed yourself up in an accident of some kind. Uh, I know, you had something wrong with your arm. You, you'd bash, was it, what was it then? What are you claiming was the ailment that you're suffering from?
Speaker A:No, I think probably what it is, is pretty much any time anyone will listen, I will sort of regale them with stories of me sort of, you know, my, my scrapes and escapades. And so that's probably what happened. I've got some quite vivid scars on my arms as well, where it looks like I've been arguing with a crocodile. Um, and in fact, my children think I did have an argument with a crocodile once. And that's why I've got these scars on my arm. I'm intrigued by the idea of an argument with a crocodile. What was, what would it have been about? Um, you're not, yeah, you're not eating my, I think it was, I always tell them that I was telling off a crocodile for trying to eat children or something. And I was wagging my arm, my finger at the crocodile.
Speaker C:And so, so probably that all makes sense. I'm now going to go around believing that that's
Speaker A:what happened because it's got a vivid mental image. Okay, chaps, right. We'll wind up there. Um, yeah, as always, I really enjoyed that. Yeah. From cyber risks to, um, don't mess with crocodiles. Yeah. Watch out for those crocodiles. It's the next public panic.
Speaker C:Well, no, no, that's true. Cause the alligator, the alligators in the, in the sewers, you know, that one in New York, supposed to be a population of alligators down there. Yeah. I'm not even sure that that's not true. Could be. I think there might be of cases where, where there has been an alligator in the sewers. I mean, true or not. I'm just going to try and
Speaker A:I think I'm going to go on the side of caution and not go down those sewers next time I'm in
Speaker C:New York. But well, yeah. And don't just don't, don't go to the toilet. Yeah. Go to the toilet in the corner of the room where the crocodiles can't get you. That's my health and safety advice.
Speaker A:That's the rational approach. Yeah. Okay. All right. Um, Chris Wragg, Nick Hare of Aleph Insights. Um, I'm Fraser McGruer. We've been here with the Cognitive Engineering Podcast. Thank you. And until next time, goodbye.
