Aug 28

A recently published research paper entitled “Detecting Deceptive Discussions in Conference Calls” provides an interesting look at lies and the liars who tell them (in this case, company CEOs and CFOs) as well as a peek into the future of of lie detection in general.

For this paper, the researchers decided to look at a group of statements by CEOs and CFOs in quarterly earnings conference calls held with investors.  They specifically wanted to focus on the times when fibs may have been told on these calls.   In order to find these occasions, they looked for cases where companies had to restate their financial results after the calls, or had to disclose other information such as material weaknesses in controls, late filings, changes to auditors, or form 8-K filings.

The researchers got hold of all available transcripts for US quarterly earnings conference calls between 2003 and 2007.  The transcripts were formatted in XML, making them a lot easier to parse.  Next, they broke down the transcripts, ignoring the “Management Discussion” parts which are presumed to be heavily scripted and vetted by legal, investor relations, marketing and other corporate types before a word is uttered.  That left the “Question and Answer” parts of the calls, which tend to be more spontaneous (hence providing more opportunities for questions leading to prevarications to be asked).  Finally, the statements of the CEOs and CFOs were isolated for analysis.  The researchers presumed that the CEO and CFO would know the true state of the company, thus providing them with opportunities to fib to investors during the Q&A.

After analyzing the data, they found that when executives fib…

  • They make more references to audience or general knowledge – “As you know…”
  • They use more words linked to extreme positive emotions – “The outlook for the company is fabulous!”
  • They make fewer references to shareholders value and value creation
  • CEOs in particular make fewer references to themselves and use more third person and impersonal pronouns.  They also use fewer words indicating non-extreme positive emotions as well as fewer “hesitation words” and words indicating certainty.
  • Interestingly, when CFOs tell lies, they tend to use more words indicating certainty

While the study itself was fascinating reading, I also found the authors’ summary of the different perspectives on deception noted by other researchers in the field.

From an emotional perspective, deceivers are thought to feel guilty about their deceptions and have a fear of being caught in their lies.  This leads to negative emotions, and a negative affect.  According to this perspective, deceivers will make more negative comments, use more general terms and avoid referring to themselves.  Their statements will tend to be short, indirect and evasive.

Taking a cognitive perspective on deception highlights the fact that it takes mental energy to lie and keep one’s story straight.  This perspective  suggests that deceptive statements will use more general terms and lack specific details.  Again, the deceiver will avoid referring to themselves and will avoid mentioing personal experiences.  Statements will tend to be shorter, to minimize the amount of keeping track that the deceiver must perform to make their narrative consistent.

Looking at deception from an attempted control perspective focuses on the deceiver’s efforts to avoid making statements which would expose their lies.  This perspective also expects deceptive statements to have non specific language, few self references, and short statements with little real detail.  The deceiver may inject irrelevant information into his or her statements to distract their audience.  If the deceiver is well prepared, there will be more specific information, and fewer of the natural hesitations found in normal speech.   This perspective also looks for lexical diversity as an indicator of deception; people telling the truth tend to repeat themselves, while deceivers seem to use a more varied vocabulary.  Maybe this is why it is interesting to listen to storytellers and other “professional deceivers.”

The final perspective on deception is that of lack of embracement – in this approach, the deceiver feels uncomfortable telling a lie and appears to lack conviction in what they are saying, mainly due to the fact that their claims are not in line with their experience.  Again, speaking in generalities, few slef references and short answers would be expected from a deceiver operating under this framework.

I had a few take aways from this paper:

It gave me a rational basis for the “gut feelings” we have when deciding whether a person is telling us the truth or not.  I will be a lot more conscious of the structure and content of statements when making these evaluations.

I also see this type of research, when combined with technologies such as pervasive digital recording and speech recognition, as possibly marking the beginning of a time when many of the statements we make will be automatically dissected, analyzed and evaluated (possibly in real time) to indicate whether statements are true or deception.  Like any other lie detection technology, this must be used with a clear understanding of its limitations.  A few years ago, we were told that voice stress analysis would make it possible for our phones to tell us when someone is lying in real time; the technology has not lived up to the hype.  A lot more research needs to be done here, but I think we are going to be hearing a lot more about this topic in the future.

I mean, would I lie to you?

  • Share/Bookmark
Aug 14

 

It is amazing how much (sensitive) information we can now carry around every day.  I have 8 gigs of all sorts of interesting stuff on a flash drive on my key ring, and hundreds of gigs on my laptop.  Keeping that data out of the hands of evildoers should I lose my keys or have my laptop stolen is really important to me.

 

That’s why TrueCrypt  is one of my favorite open source software products – it provides full disk encryption for Windows, Mac OS X and Linux systems at an unbeatable price point (free).  One of its nice features is that you can create a fully encrypted flash drive (or hard drive) on, say, a Windows system and then take that device and use it on a Mac or Linux system with TrueCrypt installed – quite handy for those of us who use different operating systems on a regular basis.  For the most paranoid amongst us, you can even set up hidden encrypted volumes within encrypted volumes to further shield your data from prying eyes.  Version 7 of this vital part of my personal information security toolkit was released back in July, and adds the ability to have volumes automount when they are connected to the computer as well as protection of crash dump and hibernation files on Windows 7 systems.  If you haven’t had a chance to play with TrueCrypt, give it a try today!

  • Share/Bookmark
Jul 10

lock up those bits!

Interested in Enterprise Rights Management?  In the New York City metro area?  Free on July 14th?   New York Metro InfraGard is putting on an ERM seminar which looks really worthwhile.  I think that ERM is going to be a key tool for security professionals over the next year or two as new mobile devices, as well as devices owned by employees and business partners become more and more integrated with our businesses.  I’m planning to be there and look forward to meeting some readers!

  • Share/Bookmark
Jun 30

Daniel Dantas did...

Looks like open source disk encryption software TrueCrypt has shown its mettle in a cybercrime case out of Brazil.   The Brazilian police seized 500 TrueCrypt protected drives from the apartment of Daniel Dantas, a Rio banker accused of financial crimes.  In Brazil, there is no law compelling defendants to reveal passwords to encrypted evidence, so the Brazilian crime lab attempted to break the encryption for five months with no success.  They then turned to the US FBI, who ran dictionary attacks against the encryption for another year.  No joy.  As a result of the banker’s good password practices, the 500 drives with potential evidence were reduced to really ugly paperweights.

While this was a loss for the good guys, it does provide security professionals with some valuable information.  First, choosing a strong (long non dictionary word with special characters, numbers and the like) password is still an integral part of good basic meat and potatos security practice.  Second, if the FBI is unable to crack a TrueCrypt protected drive without the user having chosen a boneheaded password, it seems like the program  is a good and cost effective choice for protecting personal data as well as in small business environments.  The only thing missing for bigger business is some sort of key management and recovery scheme… sounds like an opportunity for an entrepeneurial crypto programmer.

  • Share/Bookmark
May 03

WhereFi? ThereFi!

By alberg useful stuff Comments Off

On the radio, oh oh oh oh, on the radio!

Here’s a handy resource for the busyness traveler… the HotelChatter 2010  Hotel WiFi Report lets you know where you can score free WiFi during your stay.  It even tells which chains have free connectivity in the lobby (handy when you have some downtime and want to hang out where you can surf).

  • Share/Bookmark
Tagged with:
preload preload preload