Risk Scenario

The Witches of Adams Hall

Crafty hackers inflict serious reputational damage.
By: | April 24, 2012
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

Part One

As dawn broke over Boston, collegiate rowers were already knifing through the grey, green-tinged waters of the Charles River in their shells in twos, fours and eights. There was mist on the ground and through it could be seen the blooms of daffodils and azaleas along the walking path that meandered next to the river.

Scenario_Witches

In her dorm room in Adams Hall, Marijke Haddon, an electrical engineering and computer science major, had been up all night and was still hard at work. Just down the hall, so too were her close friends, Greta Milne and Lindsey Rosen.

The three sophomores had been particularly quiet these past three weeks. They had recently come under the influence of Dierdre Livingstone, a political science professor who had become infamous among the faculty for her tendency toward virulent socialist and feminist rhetoric. Another influence, rooted in modern paganism, or Wicca, had influenced the coeds to the point that they had started calling themselves The Witches.

Spurred on by numerous lattes quaffed at a local Coffee Shop, unfiltered nicotine, little sleep and their worship of Livingstone (they could quote whole paragraphs of her book “The Dollar Dragon”), The Witches came to the conclusion that they would use their technology skills to right some perceived wrongs. The three tech-savvy students had been hackers since high school and they were very good at it. Now, they wanted to do something to make their teacher proud.

Oblivious to the spring dawn unfolding outside her shuttered dorm room window, Marijke pushed the “enter” button on her computer, saw what she had done then turned to her iPhone and texted a brief, triumphant message.

“Done!” came the spark of the instant messages to Greta and Lindsey’s iPhone 6S’s. Marijke’s brilliant green eyes flashed as she held her clenched hand to her lips in excitement: She felt the tingles along her scalp under her bleached and dyed dreadlocks threaded with tiny sea shells and multicolored beads.

Marijke, the daughter of Jungian therapists from Mill Valley, Calif., had reason to be proud of herself and her friends. Using a combination of techniques and focusing on a specific weakness they identified in a ubiquitous email server, The Witches had stolen entire email databases from thousands of companies, both large and small.

The massive amount of data (more than 25 terabytes) was stored amongst hundreds of hacked servers around the world configured to create a Scenario_Witchesvirtual RAID-5 array. The beauty of the architecture was that even if as much as 20 percent of the servers failed or were brought down, the system would still function. The Witches were confident that this combination of disbursed storage and redundancy would make it very difficult to shut down the database.

But The Witches were not done yet. Big Data is only as valuable as the meaning that can be derived from it. To that end, The Witches’ crowning achievement was their creation of TRUTH, a search engine that not only made the database searchable by company, topic or executive, but also formatted results to read like dialogue in a novel. Accessible via multiple webpages and apps, TRUTH results were also easily shared and distributed via email, text and social networks.

The Witches’ accomplishment represented a quantum leap beyond Wikileaks. Rather than a massive document dump, this was an organized and highly secured system that presented results understandable to all and easily shared.

Like all well designed user interfaces, the system was dead simple and required no instructions. The Witches pushed out their creation to the world through all available social networks, with a sample search that was sure to grab headlines:

“Discover the #TRUTH. Search ‘Om-Orange and Cheap Labor’ at www.SeeTheTruth.com”.

[poll id=”7″]

[poll id=”8″]

Part Two

Om-Orange was not only the most successful new retail store of the 21st century, it also was widely praised as the creator of the first true Post-Modern brand.

OMlogo-pg2-288The company consistently generated astounding gross margins of more than 60 percent by selling yoga and Pilates apparel in urban and upscale markets around the country. But its affluent coastal customers looked to Om-Orange for much more than just clothes. By combining modern marketing techniques with the traditional eastern practices of yoga and Ayurvedic medicine, Om-Orange represented something closer to a religion than a lifestyle. Customers willingly called themselves “Followers” and the company’s tagline “Love Being You,” was referred to as “The Mantra.” In an era of deep skepticism and widespread

pessimism, Om-Orange represented health, happiness and self-fulfillment.

At the center of the movement was the company founder and CEO, Danny Merchant, better known to the Followers as “Chief Guru.”

Danny’s heritage uniquely positioned him to create this powerful combination of commerce and spiritualism. Danny’s grandfather, Simon Merchant, was one of the legends of Santee Alley in Los Angeles’ garment district. From him, Danny inherited a love of textiles and an innate business sense. His mother was a proud “Flower Child” and from her he absorbed the ideals of the 1960s. The duality of his personality carried over to his eduction – he attended Harvard and spent five years traveling through Asia; at one point living in an Indian Ashram. Eventually he made his way back to the U.S. and started Om-Orange in his parents’ garage in Malibu in 2001. Since then his company grew relentlessly.

To the Followers, Danny Merchant was an enlightened leader who demonstrated that people could earn great livings and be spiritually evolved. Wall Street loved Danny for his famously aggressive management style.

But unbeknownst to the the Followers, the key driver of Om-Orange profits had nothing to do with breathing routines or flexibility. The company’s secret sauce was garment fabrication centers in Vietnam and the Philippines that employed cheap labor and had horrendous working conditions. Danny had discovered these centers during his Asian travels. As Om-Orange grew, he formed management teams in Da Nang and Angeles to ensure that the company utilized the cheapest suppliers without regard for the workers.

It wasn’t until John Robinson joined the company in 2006 as its first risk manager that Danny started to feel the drag of morality on his ambitions. The board had insisted on hiring John in preparation for the company’s 2007 IPO. John immediately saw the risks of having such contradictory supply chain and brand strategies. What would it do to Om-Orange’s progressively-themed brand if working conditions in the company’s Southeast Asia factories were exposed?

Danny and John proceeded to have a blunt and brutal battle that mostly took place through a series of email exchanges. At first, Danny was unwilling to give up a strategy that had created such terrific margins and success, and he made his position clear in the most direct and forceful language possible.

John did not back down but chose to remain complimentary of Danny, and focused on the attributes of the brand. In the end, the obviousness of John’s arguments won over the marjority of the board.

To his credit, Danny eventually came to his senses and agreed that it was much too risky for a public company to continue to use the existing manufacturers. John came up with an auditing program, overseen by risk management, to ensure that labor was treated fairly. By the time the company went public, Danny, John and the board felt that the company stood on good ethical ground.

Danny genuinely appreciated John’s counsel and approach. As a result, John was promoted to Chief Risk Officer and became a valuable member of the Om-Orange executive team. John felt that he was living the dream.

Then the Witches of Adams Hall went public with the TRUTH.

[poll id=”9″]

Part Three

The Witches hit a home-run in promoting “Om-Orange and Cheap Labor” as a sample TRUTH search. Below is a copy of the results:

WitchesMaseehB-pg3-550

It is hard to overstate the frenzy that was unleashed by the above TRUTH search results as well as additional searches of the Om-Orange emails. Global networks emitted a near audible roar from the sheer volume of tweets, Facebook postings, emails and texts that followed. The formatted excerpts of Danny and John’s exchanges magnified the shock value of the TRUTH revelations as lengthy internal conversations were reduced to easily digested sound bites. Re-enactments based on the dialogues were posted on YouTube and an app was released that would read the dialogue out loud, instantly becoming a hit with late-night TV hosts.

Om-Orange, as part of its errors and omissions coverage with a Europe-based insurer, had a crisis management component. But the public relations consultant retained by the carrier was completely overpowered by the viral flood. No one cared that the incriminating emails were four years old, or that the company had completely changed its ways and was now a model of responsible supply-chain management.

The company’s public relations voice was effectively stifled. There was simply not enough time for the company or its crisis management team to more fully explain the situation or the company’s complete history, and dig the company out of the hole created by the TRUTH revelations.

The most vehement reactions came from the Followers. Feeling betrayed and duped by Danny Merchant, Om-Orange customers organized public “burnings” where former Followers stripped off their Healing Hoodies and tossed them into bonfires. It was as if the intensity of the Followers’ affinity for the brand was directly proportional to their subsequent rage. Watching one such burning in Cambridge, Mass., The Witches of Barton Hall held hands and beamed as the traditional method for the destruction of ancient witches was symbolically turned on their corporate target.

Even though Om-Orange’s story ended in similar fashion to other infamous corporations such as Enron, Worldcom and Lehman Brothers, the speed of its demise was unrivaled. Within weeks, a boycott organized by former followers caused a complete collapse of sales.

Danny, who owned a controlling share of the stock, refused to leave and fought gamely to try and correct the record. But he had already become irrelevant. With the brand in tatters and sales flat-lined, the company could not even sell itself and declared Chapter 7 bankruptcy before the end of the quarter.

[poll id=”10″]

[poll id=”11″]

Summary

The collision between the Witches and the Followers deeply felt emotions and passions created a perfect storm that inflicted mortal damage to Om-Orange’s reputation. After all, the simplest definition of a brand is the emotional connection a customer feels to the company. Some of the other key points that were raised in this scenario include:

1. Speed kills: Social networks, mobile access and other modern forms of communication have created the ability for information to be distributed almost instantaneously to just about everyone. The time it took the e-mail dialogues on TRUTH to be known around the globe and do substantial reputational damage was about a week.

2. Hackers pose multiple threats: Cyber risks are primarily thought of as related to the destruction of corporate networks, theft of customer data or corporate espionage. But given how much of modern business is now digitally documented, the damage inflicted on a company through a hack-attack is limited only by the assailants motives and imagination. The Witches were successful not only in accessing the emails but also in creating a way to make them easy to read and share.

3. Reputational risks can be fatal: Even if it doesn’t destroy a company, damage can be done extremely quickly and have significant negative impact on a company’s sales or stock price. Case in point – Netflix, where an unpopular business decision caused a digital uproar that translated into a full retreat and punished stock price. The stronger the emotional connection a brand generates, the more successful the brand is; but the more susceptible the company becomes to brand damage. The degree of hypocrisy evidenced in Danny Merchant’s dialogues with his risk manager was fatal because of the extreme connection the Followers felt to Om-Orange.

4. Assume nothing is secret: Is it really possible to create a secure communications environment? Even the U.S. government’s most secret cables and communications have been leaked. Having policies that govern your company’s complete set of communication channels should be as important a priority as any other type of corporate security. Email was a poor communication choice given the nature of the discussions between Danny Merchant and John Robinson.

5.Strong brands are the best defense: As noted in point No. 1, even aggressive crisis management approaches may not be effective due to the short amount of time available to communicate a rebuttal. A strong brand often times can be leveraged to deflect moderate criticism by buying a company time to address issues and concerns. The disclosure that Apple was tracking mobile users didn’t last longer than a few days, in part due to the trust customers have for the Apple brand.

6. Procurement – the next frontier: It’s not just reputational risk that lies in wait for companies that don’t understand the makeup of their supply chains. In the case of Om-Orange, the company’s Southeast Asian manufacturing facilities created a reputational problem. But they just as easily could present a supply-chain problem. Insurance carriers are losing patience with company’s that haven’t fully vetted their supply chains.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected].

More from Risk & Insurance