Profiling
If you haven't heard the wheelbarrow joke, let me share a variant with you:
A mill has a generous policy of allowing its workers to take home sawdust to heat their homes with. However, because the mill works in very fine woods, it has to watch out for theft of lumber. Every night, one of the workers stays late, and takes whatever sawdust no one else wants, puts it in a wheelbarrow, and heads home. Every night, one of the security guards stops him, and inspects the sawdust. Sure that the worker is up to something, he sifts through the sawdust looking for scraps of lumber; he checks the underside of the wheelbarrow; he searches the worker. Nothing.This goes on for years; it becomes an evening ritual that the men share; almost a private joke. The worker never complains about the searches, the guard, convinced the man is a thief, but with no evidence, reports nothing.
In a pub one evening, the two men run into each other. Over a pint of Guinness, the retired guard asks the retired worker, "Look, be straight with me. I know you were up to something. Just let me know so I can rest easy. What were you doing?"
"Stealing wheelbarrows."
And therein lies the problem with looking for bad things, and not bad people. Had the guard even once raised a concern about the gentlemen, some accountant might have noticed the inordiante number of wheelbarrows the mill went through, and connect the dots. But because the guard was focused on a list of items that might be stolen, the thief got away with it.
There are lots of lessons in this one, but, at the heart, just remember: the bad guy is more clever than your system.
