bark/bite

I was just 16 years-old when I became an industrial spy, recruited by a Boston-based museum to create a secret dossier on the highly-lucrative Tourism-Industrial Complex in that historic waterfront city.  

Day after day in the summer of 1982 I visited competing museums across the City of Boston, surreptitiously collecting brochures and taking careful note of what I saw: how long the ticket lines were when they opened their doors in the morning; how much the gift shop charged for cold water on an especially hot day; whether the rest rooms were inside the museum itself and clean, or if they were the nasty outdoor port-a-potties like the kind my employer offered its paying guests. I took special note of which charter bus companies were delivering throngs of tourists to competing museums but not to ours.

Desperate to be more competitive in a crowded market – Boston was brimming with all sorts of Revolutionary War-themed tourist-traps back in the 80s – this particular for-profit museum recruited me for this perilous mission because of my unique qualifications: my mom was the gift shop manager there, and I had a bicycle.

By summers’ end, I had pedaled from one end of the city to the other and compiled a detailed report on the competitive landscape.  

I thought I was a legit spy kid, even though I wasn’t exactly breaking into competing museums at night to rifle through the office filing-cabinets.  (And forget about hacking their computers, if they even had any: in 1982, I was still struggling to figure out the cassette-drive on my TRS-80 at home on school nights.)

Four decades later, I realize I wasn’t actually an industrial spy. I was simply conducting market research.

I hadn’t thought about that sneaky summer job in a long, long time, but the memories came rushing back this week when I read Verizon’s new Cyber-Espionage Report, created by the very insightful team at the Verizon Threat Research Advisory Center.  (Note: I work at Verizon, and the authors and researchers of this report are my colleagues and friends.) Drawing on seven years of data collected for Verizon’s much-lauded annual Data Breach Investigations Report, this new Cyber-Espionage Report explains that some specialized hackers steal secrets on behalf of (and with support from) nation-state governments — sort of like how my teenage snooping was sponsored by mom’s shadowy boss at the museum. 

In fact, there are a lot of similarities between the guerilla-style (yet legal) market research I was conducting back when Ronald Reagan was president and the kind of (illegal) cyber-espionage detailed in the new Verizon report.

For example:  Cyber-spies invest significant time and energy into reconnaissance before striking.  Once they’ve identified their next victims, cyber-spies play it “low and slow,” patiently waiting for the right time to act.  (16-year old me was in no hurry, either.  I was getting paid by the hour!)

Also, cyber-spies often use “social engineering” — pretending to be who they’re not — to gain access to systems and then exfiltrate sensitive data.  (Sad-faced 16-year-old me politely asked the staff at competing museums for brochures “for a paper I’m writing for summer school.” They always handed them over with a sympathetic smile.)

Verizon’s new Cyber-Espionage Report also explains how companies can more effectively detect if they’ve been attacked by cyber-spies. Technologies like Artificial Intelligence and advanced data leakage prevention tools play a big role in breach detection, but the report calls out one simple, low-tech indicator that your organization might have been successfully attacked by a cyber-spy: the creeping realization of an unexpected loss of competitive advantage and market share.

When I completed my secret mission and submitted my report in August, 1982, I had no way of knowing definitively if my work had put a crimp in our competitions’ business. But I do know that my research (typed up on an IBM Selectric II typewriter once owned by spy novelist-extraordinaire Robert Ludlum – that’s another story for another time, sorry) resulted in one major strategic change in how my mom’s museum operated: they began allowing visitors into the gift shop without having to buy a ticket to the whole museum.

My mom, 86 years-old now, seems to remember selling a few hundred extra commemorative Boston-themed spoons that autumn because of that policy change. 

And me?  Well, I didn’t grow up to be an actual shaken-not-stirred-martini-drinking spy. But I did go into Marketing. 

Still, at the end of that summer of 1982, I thought I might have a bright future in espionage. I eagerly plowed my stealthily-gained earnings right back into my start-up spy business:  I bought a new vehicle…not a James Bond-worthy Aston Martin, but a shiny new bicycle…and I had a stack of 007-wannabe business cards printed at the Copy Cop on Washington Street in Boston. 

The name’s Grady. 

David Grady.