The Bredemarket Rule of Corporate Tool Adoption

(12/7: Thanks for catching the typo, Orlando!)

Whoops, I forgot something.

Bredemarket hasn’t proposed any rules.

This may not seem to be a significant gap to you, but it is to me.

I’ve proposed rules on my prior platforms, but haven’t proposed one from Bredemarket. Here’s a list of some of the “Empoprises Rules” I’ve proposed in the past. My favorite:

The Phineas-Hirshfield score measures, on a scale of 0 to 100, the probability that someone will ask exactly what the Phineas-Hirshfield score is.

From https://empoprise-bi.blogspot.com/2012/12/what-is-your-phineas-hirshfield-score.html. The Phineas-Hirshfield score is copyright 2012 by John E. Bredehoft.
Phineas T. Barnum. By unattributed – Harvard Library, Public Domain, https://commons.wikimedia.org/w/index.php?curid=47588191

Time for me to make a cryptic LinkedIn post. Although now that I’m sharing the secret here, I’ll have to lower the score to 89.

Bredemarket’s first rule

But before I share my revised Phineas-Hirshfield score, I need to share the first Bredemarket Rule, the Bredemarket Rule of Corporate Tool Adoption. (Copyright 2023 Bredemarket.)

In any organization, the number of adopted tools that perform the exact same function is always in excess of one.

In other words, if there’s someone in your organization who is using an iPhone, there is someone else in your organization who is using an Android phone.

Or someone has a Mac, and another person has a Windows computer.

Or someone has one brand of software, while someone else has the competitior brand.

Even if an organization dictates that everyone will use a single tool, there will be someone somewhere who will rebel against the organization and use a different tool.

By Alberto Korda – Museo Che Guevara, Havana Cuba, Public Domain, https://commons.wikimedia.org/w/index.php?curid=6816940

Three reasons why the Bredemarket Rule of Corporate Tool Adoption is true

Here is why this rule is true:

  1. Except in very rare circumstances, there are always multiple tools that perform the exact same function.
  2. Except in very rare circumstances (Bredemarket being a counter-example), organizations are made up of multiple people.
  3. In all circumstances, different people have experienced different realities and therefore like different things.

For example, on Wednesday morning I attended a Product Marketing Alliance-sponsored panel discussion in which one of the panelists mentioned that Asana was a valuable tool that helps product marketers get work done.

Another panelist was a Monday user.

Presumably the first panelist was exposed to Asana at one point and liked it, while the second panelist was exposed to Monday and liked it.

Or, since the panelists were from two different companies, maybe each company standardized on one or the other. Or maybe the departments within their companies standardized on a particular tool, but if you poll the entire company, you’ll find some Monday departments and some Asana departments.

Multiple tools in a single department

Even in the same department you may find multiple tools. Let me cite an example.

  • Several of the people who were in the Marketing department of Incode Technologies have since left the company, and I’m working with one of them on a project this week.
  • I had to send a PDF to him, and was also going to also send him the source Microsoft Word document…until I remembered from our days at Incode that he was (and I guess still is) a Google Docs guy.
  • (As I’ve shared previously, I’m not a Google Docs guy except when a client requires it.)

Even brute force will not invalidate the Rule

Of course, there are times in which an entire organization agrees on a single tool, but those times never last.

My mid-1990s employer, Printrak International, was preparing to go public. The head of Printrak determined that the company needed some help in this, and brought several staffers on board who were expert in Initial Public Offerings (IPOs).

One of these people took the role of Chief Financial Officer, preparing Printrak for its IPO and for two post-IPO acquisitions, one of which profoundly and positively impacted the future of the firm.

Along the way, he established the rule that Printrak would become a Lotus Notes shop.

By Ndamanakis – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=126610779

For those who don’t remember Lotus Notes, it was one of those Lotus-like products that could do multiple things out of the box. And because the CFO was the CFO, he could enforce Lotus Notes usage.

Until the CFO left a couple of years later to assist another company, and the impetus to use Lotus Notes dropped off significantly.

And that, my friends, is why my former colleagues in IDEMIA aren’t using HCL Notes (the successor to Lotus Notes and IBM Notes) today.

So how do you settle the Tool Wars?

Do you know how you settle the Tool Wars?

You don’t. It’s an eternal battle.

In the case of Bredemarket, I can dictate which tools I use…unless my clients tell me otherwise. Then the client’s word is law…unless there’s a compelling reason why my tool should be used instead of the client’s tool. In Bredemarket’s 3+ years of existence, I haven’t encountered such a compelling reason…yet.

Just be flexible enough to use whatever tool you need to use, and you’ll be fine.

Explaining the Confusion of Wildebeest

I’ve been using the word “wildebeest” more often lately. In the Bredemarket blog, on Bredemarket’s LinkedIn pages, on my own LinkedIn page, and even in a job application cover letter.

For those who don’t know why I’m so hot on wildebeest, let me explain.

It all started with the dogs

When I started Bredemarket as a marketing and writing service firm, it stood to reason that I would have to market and write about Bredemarket itself.

There’s a common phrase for this practice: “eating your own dog food.”

Another John (a Mr. Carson) took “eating your own dog food” literally. From NBC. This picture from Madly Odd, https://madlyodd.com/johnny-carson-alpo-dog-food-ad/

It’s a VERY common phrase.

And that’s a problem, because people who eat their own dog food sound just like everybody else.

So I moved to iguanas

It’s important to differentiate yourself from the competition. Trust me on this.

So I stopped talking about eating my own dog food, and when I set my initial goals for 2021 in December 2020, one of my goals was “eat my own iguana food.”

But then I moved on

But for some reason the iguana emphasis left me cold, and I quietly pivoted back to mammals a little over a month later.

Black wildebeest. By derekkeats – Flickr: IMG_4955_facebook, CC BY-SA 2.0, https://commons.wikimedia.org/w/index.php?curid=14620744

Now I don’t always eat my own wildebeest food myself in this regard. I’ve previously noted that my Empoprise-NTN blog isn’t updated regularly…

From https://bredemarket.com/2021/01/25/three-ways-to-prove-to-your-customers-that-your-firm-is-an-ongoing-viable-concern/

(Which reminds me; time to update Empoprise-NTN again. If Buzztime even exists any more.)

The following month I made it official in “When wildebeests propose.”

You’ve heard the saying about eating your own dog food. That statement bored me, so I started talking about eating your own iguana food. Eventually I tired of iguanas and pivoted to wildebeests.

From https://bredemarket.com/2021/02/09/when-wildebeests-propose/

And for over 2 1/2 years I’ve continued to focus on the majestic wildebeest, both singly and in confusion (the correct term for a group of wildebeest). Let’s face it: how many other marketing and writing experts are talking about wildebeest? It’s my own little distinctive thingie.

The problem with wildebeest

But now I’m asking myself whether this is a GOOD distinction. After all, the common definition of “confusion” is NOT a positive one. Unless you’re a New Order fan.

From https://www.youtube.com/watch?v=c_L_-CKg6pw

So perhaps I’ll retire the wildebeest for something new that more closely reflects Bredemarket’s differentiators:

I help firms win by explaining why the firm serves its customers, focusing on customer needs, and highlighting benefits.

Yes, those are the same differentiators that I currently include in my personal LinkedIn profile. But after all, Bredemarket is a one-person operation.

sin, a one-man band in New York City. By slgckgc – https://www.flickr.com/photos/slgc/8037345945/, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=47370848

If you have an idea of something that is better than a dog, an iguana, or a wildebeest, post it in the comments.

Stand Out From the Identity Crowd

A note to those of you in the identity/biometrics industry.

From Sandeep Kumar, A. Sony, Rahul Hooda, Yashpal Singh, in Journal of Advances and Scholarly Researches in Allied Education | Multidisciplinary Academic Research, “Multimodal Biometric Authentication System for Automatic Certificate Generation.”

Gartner has released a new report, “Emerging Tech: Security — How to Stay Relevant as an Identity Verification Vendor.” Because it’s better to be relevant than to be irrelevant.

Anthropological Alphonse Bertillon. By Jebulon – Own work, stitching of archives of Service Regional d’Identité Judiciaire, Préfecture de Police, Paris., CC0, https://commons.wikimedia.org/w/index.php?curid=37546591

When co-author Akif Khan promoted the report on LinkedIn, he made the following comment:

Identity verification (which Gartner defines as the ID-plus-selfie process) is arguably the topic that I get the most inquiry calls about, but I also cover >70 vendors in this space. My end-user clients struggle to differentiate between them, and as the market evolves, it will become tougher to stand out in the crowd.

From LinkedIn.

C. Maxine Most of Acuity Market Intelligence advocates a similar message about the need to stand out. She provides the following to her clients:

Innovate, differentiate, and outmaneuver the competition

From https://www.acuitymi.com/.

It is in the vendors’ interest to keep the identity market from becoming a commodity market. But how can vendors keep the market from becoming commoditized when (almost) everyone is sharing the exact same message?

  • Why are you in business? To provide trust.
  • What do you do? Trust stuff.
  • How do you do this? Trust us.

If all the identity companies are peddling the exact same thing, the cheapest vendor wins.

Which is why certain vendors strive to do things differently.

And I’m here to help.

I ask my clients questions before I start work so that we can craft the client’s unique message. Read Bredemarket’s e-book “Seven Questions Your Content Creator Should Ask You” for more details.

Are you ready to craft a message that looks just like everybody else? Well, I CAN’T help you with that.

Are you ready to craft your own message? Then let me tell you how Bredemarket CAN help you do this.

Identification Perfection is Impossible

(Part of the biometric product marketing expert series)

There are many different types of perfection.

Jehan Cauvin (we don’t spell his name like he spelled it). By Titian – Bridgeman Art Library: Object 80411, Public Domain, https://commons.wikimedia.org/w/index.php?curid=6016067

This post concentrates on IDENTIFICATION perfection, or the ability to enjoy zero errors when identifying individuals.

The risk of claiming identification perfection (or any perfection) is that a SINGLE counter-example disproves the claim.

  • If you assert that your biometric solution offers 100% accuracy, a SINGLE false positive or false negative shatters the assertion.
  • If you claim that your presentation attack detection solution exposes deepfakes (face, voice, or other), then a SINGLE deepfake that gets past your solution disproves your claim.
  • And as for the pre-2009 claim that latent fingerprint examiners never make a mistake in an identification…well, ask Brandon Mayfield about that one.

In fact, I go so far as to avoid using the phrase “no two fingerprints are alike.” Many years ago (before 2009) in an International Association for Identification meeting, I heard someone justify the claim by saying, “We haven’t found a counter-example yet.” That doesn’t mean that we’ll NEVER find one.

You’ve probably heard me tell the story before about how I misspelled the word “quality.”

In a process improvement document.

While employed by Motorola (pre-split).

At first glance, it appears that Motorola would be the last place to make a boneheaded mistake like that. After all, Motorola is known for its focus on quality.

But in actuality, Motorola was the perfect place to make such a mistake, since it was one of the champions of the “Six Sigma” philosophy (which targets a maximum of 3.4 defects per million opportunities). Motorola realized that manufacturing perfection is impossible, so manufacturers (and the people in Motorola’s weird Biometric Business Unit) should instead concentrate on reducing the error rate as much as possible.

So one misspelling could be tolerated, but I shudder to think what would have happened if I had misspelled “quality” a second time.

Announcing a WhatsApp Channel for Identity, Biometrics, ID Documents, and Geolocation

From NIST.

I’ve previously stated that Bredemarket is present on a bunch of social platforms.

Well, if you’re a subscriber to the Bredemarket mailing list, or to the Bredemarket Threads account, then you already know what I’m about to say. Bredemarket is now on one additional social platform…kinda sorta.

I’ll explain:

  • What WhatsApp channels are.
  • How this impacted me.
  • Most importantly, why this may, or may not, impact you.

(Long-time readers of the Bredemarket blog see what I did there. In reverse.)

What are WhatsApp channels?

Meta, the company that owns Facebook, Instagram, WhatsApp, Threads, and half the known universe, wants to keep people on those social platforms. They can check out any time they like, but they can never leave.

Scanned by Wikipedia user David Fell from the CD cover, Fair use, https://en.wikipedia.org/w/index.php?curid=14790284

So now WhatsApp, the service that was originally intended for PRIVATE communications between people that knew each other’s phone numbers, is now your latest source for Kardashians news. Seriously; there are millions of people who follow the Daily Mail’s “Kardashians News” channel.

No, this is NOT a Kardashian (yet), but this is something that @cultpopcult would post (with a misattribution) so I’m doing it myself. By Office of Congressman Greg Steube – https://twitter.com/RepGregSteube/status/1451579098606620673, Public Domain, https://commons.wikimedia.org/w/index.php?curid=112088903

Some people are kinda sorta breathless about this, if you take the IMM Institute’s LinkedIn article “WhatsApp Channels: Revolutionising Business Communication” as evidence.

WhatsApp, a widely used messaging platform, has recently introduced a revolutionary feature known as WhatsApp Channels. This innovation empowers businesses to thrive by effectively communicating with a broader audience, sharing vital information, and engaging with customers in a more personalised and efficient manner.

From LinkedIn.

Revolutionary? Frankly, this isn’t any more revolutionary than the similar broadcasting feature in Instagram, with one important difference: not everyone can create an Instagram channel, but anyone with WhatsApp channel access can set up their own channel.

    Which got me thinking.

    How I was impacted by WhatsApp Channels

    I began mulling over whether I should create my own WhatsApp channel, but initially decided against it. Bredemarket has enough social media properties already, and the need to put Bredemarket stuff on WhatsApp is not pressing (the “100” WhatsApp group members get enough Bredemarket stuff already). The chances of someone ONLY being on WhatsApp and not on ANY other channel are slim.

    I’d just follow the existing WhatsApp channels on identity, biometrics, and related topics.

    But I couldn’t find any.

    So I created my own channel last Friday entitled “Identity, Biometrics, ID Documents, and Geolocation.”

    Why should you care?

    Why should you care about my WhatsApp identity channel? Maybe you SHOULDN’T.

    If you don’t use WhatsApp, ignore the WhatsApp channel.

    If you use WhatsApp but have other sources for identity industry information (such as my Facebook group/LinkedIn page), ignore the WhatsApp channel.

    But if you love WhatsApp AND identity, here is the follow link for “Identity, Biometrics, ID Documents, and Geolocation.”

    https://whatsapp.com/channel/0029VaARoeEKbYMQE9OVDG3a

    Geolocation Identifies People (Who Don’t Want To Be Identified)

    From https://nextdoor.com/p/ks5wW5n_csJB?utm_source=share&extras=NDk4MjIxOTI%3D

    A person in Upland, California posted this on the local NextDoor. While anecdotal and not statistical, in this case the geolocation capabilities of a device (in this case AirPods) identified someone in possession of a stolen vehicle.

    https://nextdoor.com/p/ks5wW5n_csJB?utm_source=share&extras=NDk4MjIxOTI%3D

    Ransomware Doesn’t Celebrate a Holiday

    Government Technology posted an article on a ransomware attack that affected Ardent Health Services facilities in multiple U.S. states, including Texas, Idaho, New Mexico, Oklahoma, New Jersey, and Kansas over Thanksgiving Day, requiring some ambulances to be diverted and some services suspended.

    By Mangocove – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=133200606

    Government Technology observed:

    The Thanksgiving timing of the attack is unlikely to be coincidental. Hackers are believed to see holiday weekends as an opportunity to strike while network defenders and IT are likely “at limited capacity for an extended time,” the Cybersecurity and Infrastructure Security Agency (CISA) has noted

    From https://www.govtech.com/security/ransomware-impacts-health-care-systems-in-six-states

    And it’s not like the hackers are necessarily having to pass up on their turkey dinner. Few if any holidays are universal, and over 7 billion people (including many hackers) did NOT celebrate Thanksgiving last Thursday.

    Does this mean that companies need to INCREASE security staff during holiday periods?

    I’m Taking Small Business Saturday Off

    Although Bredemarket is a small business, I’m not doing anything for Small Business Saturday.

    Why not? Because Bredemarket is a B2B business and not a B2C business, most if not all of my clients have been closed since Wednesday afternoon enjoying the U.S. Thanksgiving holiday.

    Breakfast.

    So I’m celebrating a mostly non-business Saturday. Instead of filming Bredemarket content, I enjoyed a not-so-nutritious breakfast (skipping Starbucks AND Del Taco) and bought TWO birthday cards for my wife. (At 50¢ each, that’s an entire dollar!)

    Big birthday spender!

    See everyone Monday.

    Login.gov and IAL2 #realsoonnow

    Back in August 2023, the U.S. General Services Administration published a blog post that included the following statement:

    Login.gov is on a path to providing an IAL2-compliant identity verification service to its customers in a responsible, equitable way. Building on the strong evidence-based identity verification that Login.gov already offers, Login.gov is on a path to providing IAL2-compliant identity verification that ensures both strong security and broad and equitable access.

    From https://www.gsa.gov/blog/2023/08/18/reducing-fraud-and-increasing-access-drives-record-adoption-and-usage-of-logingov

    It’s nice to know…NOW…that Login.gov is working to achieve IAL2.

    This post explains what the August 2023 GSA post said, and what it didn’t say.

    But first, I’ll define what Login.gov and “IAL2” are.

    What is Login.gov?

    Here is what Login.gov says about itself:

    Login.gov is a secure sign in service used by the public to sign in to participating government agencies. Participating agencies will ask you to create a Login.gov account to securely access your information on their website or application.

    You can use the same username and password to access any agency that partners with Login.gov. This streamlines your process and eliminates the need to remember multiple usernames and passwords.

    From https://www.login.gov/what-is-login/

    Obviously there are a number of private companies (over 80 last I counted) that provide secure access to information, but Login.gov is provided by the government itself—specifically by the General Services Administration’s Technology Transformation Services. Agencies at the federal, state, and local level can work with the GSA TTS’ “18F” organization to implement solutions such as Login.gov.

    Why would agencies implement Login.gov? Because the agencies want to protect their constituents’ information. If fraudsters capture personally identifiable information (PII) of someone applying for government services, the breached government agency will face severe repurcussions. Login.gov is supposed to protect its partner agencies from these nightmares.

    How does Login.gov do this?

    • Sometimes you might use two-factor authentication consisting of a password and a second factor such as an SMS code or the use of an authentication app.
    • In more critical cases, Login.gov requests a more reliable method of identification, such as a government-issued photo ID (driver’s license, passport, etc.).

    What is IAL2?

    At the risk of repeating myself, I’ll briefly go over what “Identity Assurance Level 2” (IAL2) is.

    The U.S. National Institute of Standards and Technology, in its publication NIST SP 800-63a, has defined “identity assurance levels” (IALs) that can be used when dealing with digital identities. It’s helpful to review how NIST has defined the IALs. (I’ll define the other acronyms as we go along.)

    Assurance in a subscriber’s identity is described using one of three IALs:

    IAL1: There is no requirement to link the applicant to a specific real-life identity. Any attributes provided in conjunction with the subject’s activities are self-asserted or should be treated as self-asserted (including attributes a [Credential Service Provider] CSP asserts to an [Relying Party] RP). Self-asserted attributes are neither validated nor verified.

    IAL2: Evidence supports the real-world existence of the claimed identity and verifies that the applicant is appropriately associated with this real-world identity. IAL2 introduces the need for either remote or physically-present identity proofing. Attributes could be asserted by CSPs to RPs in support of pseudonymous identity with verified attributes. A CSP that supports IAL2 can support IAL1 transactions if the user consents.

    IAL3: Physical presence is required for identity proofing. Identifying attributes must be verified by an authorized and trained CSP representative. As with IAL2, attributes could be asserted by CSPs to RPs in support of pseudonymous identity with verified attributes. A CSP that supports IAL3 can support IAL1 and IAL2 identity attributes if the user consents.

    From https://pages.nist.gov/800-63-3/sp800-63a.html#sec2

    So in its simplest terms, IAL2 requires evidence of a verified credential so that an online person can be linked to a real-life identity. If someone says they’re “John Bredehoft” and fills in an online application to receive government services, IAL2 compliance helps to ensure that the person filling out the online application truly IS John Bredehoft, and not Bernie Madoff.

    As more and more of us conduct business—including government business—online, IAL2 compliance is essential to reduce fraud.

    One more thing about IAL2 compliance. The mere possession of a valid government issued photo ID is NOT sufficient for IAL2 compliance. After all, Bernie Madoff may be using John Bredehoft’s driver’s license. To make sure that it’s John Bredehoft using John Bredehoft’s driver’s license, an additional check is needed.

    This has been explained by ID.me, a private company that happens to compete with Login.gov to provide identity proofing services to government agencies.

    Biometric comparison (e.g., selfie with liveness detection or fingerprint) of the strongest piece of evidence to the applicant

    From https://network.id.me/article/what-is-nist-ial2-identity-verification/

    So you basically take the information on a driver’s license and perform a facial recognition 1:1 comparison with the person possessing the driver’s license, ideally using liveness detection, to make sure that the presented person is not a fake.

    So what?

    So the GSA was apparently claiming how secure Login.gov was. Guess who challenged the claim?

    The GSA.

    Now sometimes it’s ludicrous to think that the government can police itself, but in some cases government actually identifies government faults.

    Of course, this works best when you can identify problems with some other government entity.

    Which is why the General Services Administration has an Inspector General. And in March 2023, the GSA Inspector General released a report with the following title: “GSA Misled Customers on Login.gov’s Compliance with Digital Identity Standards.”

    The title is pretty clear, but Fedscoop summarized the findings for those who missed the obvious:

    As part of an investigation that has run since last April (2022), GSA’s Office of the Inspector General found that the agency was billing agencies for IAL2-compliant services, even though Login.gov did not meet Identity Assurance Level 2 (IAL2) standards.

    GSA knowingly billed over $10 million for services provided through contracts with other federal agencies, even though Login.gov is not IAL2 compliant, according to the watchdog.

    From https://fedscoop.com/gsa-login-gov-watchdog-report/

    So now GSA is explicitly saying that Login.gov ISN’T IAL2-compliant.

    Which helps its private sector competitors.