Security Theater

Download a PDF version here

Security theater is a concept that you’ll experience everywhere once you know what it is.

Bruce Schneier, a security expert who created the phrase, explains:

Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security.1

Here’s how Schneier describes the concept:

An example: the photo ID checks that have sprung up in office buildings. No-one has ever explained why verifying that someone has a photo ID provides any actual security, but it looks like security to have a uniformed guard-for-hire looking at ID cards. Airport-security examples include the National Guard troops stationed at US airports in the months after 9/11 — their guns had no bullets. The US colour-coded system of threat levels, the pervasive harassment of photographers, and the metal detectors that are increasingly common in hotels and office buildings since the Mumbai terrorist attacks, are additional examples.

Security theater isn’t just limited to airports and buildings. We all know the insanity surrounding passwords. Corporations require longer, more confusing passwords (ultimately written down to remember) and requires a change every 60-90 days (that again, leads to writing them down). This just swaps one risk for another, as explained below:

"Forcing employees to use a complex password with special characters in it means everyone is just going to add an exclamation point at the end of their existing password. This is why your accounts payable clerk has a yellow sticky note on their cubicle wall with their password on it. They just want to get their job done, and you're making it harder for them with no discernible improvement to security…highly complex memorized secrets introduce a new potential vulnerability: They are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner.2

Security theater is driven by the urge to “do something”, even if that something is ineffective, costly, and prevents finding a real solution. This “something” is often big and visible, so a convincing story can be sold to the public that the past injustice will never happen again.

People want comfort. They want closure. And they want an answer. Now.

The public demands immediate action, and politicians wisely obey.

Schneier elaborates:

Security is both a feeling and a reality. The propensity for security theater comes from the interplay between the public and its leaders. When people are scared, they need something done that will make them feel safe, even if it doesn’t truly make them safer. Politicians naturally want to do something in response to crisis, even if that something doesn’t make any sense.3

Which is why the concept of security theater applies so well to another area: Investing

Most investment activity is pure “theater”. A lot of work is investment related, but leads to no tangible, actionable insight. Think about CNBC. CNBC is 24/7 supercharged security theater – constant yelling about investments making investors worse off. It’s reactionary, inflated opinions that give the illusion of knowledge but doesn’t provide any value to investors.

We keep our days busy with the idea that busyness means adding value. It doesn’t work that way. Investors hyper focus on the urgent and irrelevant (investment noise) over the nonurgent, but relevant (investment value).

“Investment theater” permeates all levels of an investment organization, from the junior analyst to the CIO. Eliminating investment theater is challenging because most activity is tied to investing, so it feels worthwhile. But we rarely examine what really improves decisions.

Below is a list of the most common “investment theater” I’ve seen in my career:

• Annual/Mid-Year market forecasts (Every shop puts these out but they don’t work for several reasons)

o First, the estimates all hover around consensus, are completely commoditized, and therefore don’t provide value.

o Second, they never predict the risks/surprises that move the markets and would help investors through advance notice. If you argue that surprises are by definition hard to predict, I would agree and again challenge why they waste their time doing these.

o Third, their predictions are so vague they can be right regardless of what happens

• Earnings previews (quarterly earnings are already overrated as a predictor of long-term success, but now analysts share detailed guesses on how they think the quarter will go)

• Randomly scrolling Bloomberg/Factset/CNBC news feeds (You feel like you are on top of what’s moving the markets, but in reality, it’s just distracting you from tangible, focused research/thinking)

• Tracking Fed minutes/economic releases (I’ve seen very few investors who can consistently trade around economic releases or use it to add value to their long-term process. However, many investors feel required to have an opinion on all things econ, even though they can’t explicitly tell you how it adds value to their process)

• Discussing economic events as if you predicted them (Most economic discussions are just reporting about the past and making it seem like you knew more than you really did.)

• Having meetings because you’ve always had a meeting (Do you really need to meet? Can you do it through email or cancelled it all together? Meetings are fine if there’s a specific purpose and decision to be worked out. If there’s nothing new, cancel the meeting)

• Requiring analysts to check the box in their process, to prove they are “working” (Investment organizations tend to reward visible, check-the-box behavior rather than valuable, actionable ideas. A simple, two-page investment recommendation is more valuable than a complex, 30 page excel model. Don’t make analysts check every box. Let them decide what’s relevant and then provide feedback to help them hone their decision making)

• Requiring documentation/compliance checks to cover your ass, rather than actually improve risk management (Producing reports doesn’t reduce risk; real risk reduction is thinking and talking about risks that are unknown and can’t be modeled well or fit into a clean category)

• Having update calls when there is no material to update (No sense having a call if there isn’t something material to talk about)

• Packing your schedule with manager calls, leaving no time to think (I know many investors who brag to anyone who will listen about how much they pack into their day. However, there’s a lot of value to free time and the ability to think without calendar pressure. But that’s uncomfortable for many investors because it doesn’t feel like work)

• Adding high profile consultants/research providers to prove a commitment to investment excellence (Many organizations make a big splash with spendy investments to prove their commitment to success; however, success isn’t driven by how much you spend on outside help)

• Taking lots of notes during a company/manager meeting to show you worked hard, rather than just focus on material issues (lots of work is done to prove you showed up and worked hard vs. developed new and differentiated insights)

• Excessive economic/investment data inside client/committee/board reports (no one ever reads the 100+ pages in these reports, but it again provides an illusion of confidence and knowledge)

• Checking the box behavior on due diligence (Too much preference to cover every item vs. concentrate on the meaningful exceptions)

• Hiring people based on resume/pedigree, rather than on their actual skills (Instead, test them on their actual role – make them right up an investment recommendation and see if they can make a coherent case; don’t just assume they can based on where they went to school or where they worked)

• Just about everything related to technical analysis (Death crosses, head and shoulders pattern, Fibonacci retracements…)

So how do investors cut out the meaningless work and focus on valuable stuff? Here’s a few ideas:

1. Investment teams need to be radically honest about what adds value to the investment process and what is just for show. Every meeting, process, and requirement should be reviewed by the team together to see if it improves investment decision making. Everyone on the team, from the junior members to the CIO, need to agree on what matters, otherwise everyone defaults into peacock mode – working late or adding complexity just to impress others, not because it leads to good ideas. When value is judged by production – number of ideas covered, hours worked, or length of work, you’ll get lots of filler that meets the quantity metric but fails the quality metric.

2. People thrive when they have meaning, autonomy, and control over their work. As Schneier states, “The security measures that work are largely invisible.”4 It’s the same for investors – what works are the hidden cultural factors – trust, communication, commitment to the team/purpose, etc. These attributes will drive excellence more than a command and control structure – obedience, process, documentation, and rigid standards.

These attributes are often overlooked by investment leaders. Great investors are used to dealing with facts, figures, data, information, etc. Not emotions, motivation, leadership, and teamwork. It’s a different mindset. You can’t control your team like robots or run it like a factory line. Leaders who demand meeting exact standards end up with people great at obeying those standards but terrible at creating differentiated ideas. Give people the freedom to thrive, thereby ensuring the organization won’t wither from excessive theater-type work.

3. Remember, you control how you react to the external environment. When the markets drop, you don’t have to jump on every news story to try to figure out what’s going on. You don’t need to create a new procedure just because an investment lost money. Many investors still feel like if they only worked harder and had more controls, they would have avoided a loss.

4. In reality, a certain amount of theater is necessary. Boards of directors and clients will want what they think is important. Pick your battles wisely - no sense fighting them if they think it helps them. However, always separate in your mind the valuable from the nonsense.

The urge to do “something” is the biggest source of investment theater. Patience and a calm mindset will go a lot further than knee-jerk, emotional decisions. It’s often our answers to problems that cause more problems than the problem itself. When you examine great investors, you should pay attention to what they are not doing, rather than focusing on what they are doing.

Sources:

1, 3-5. “Beyond Security Theater.” Bruce Schneier. https://www.schneier.com/essays/archives/2009/11/beyond_security_thea.html

2. “5 examples of security theater and how to spot them.” https://www.csoonline.com/article/3544293/5-examples-of-security-theater-and-how-to-spot-them.html