According to several news reports[1] yesterday, traffic is down at Target due to the recent data breach.  Some of this is due to consumer backlash.  People are simply mad at Target. They believe that Target did not do a sufficient job of protecting their data.  That’s somewhat reasonable.  However, there is another group that believes that shopping at Target is now more risky than shopping at other stores.  I think this group might be making a common “data-driven” mistake.

I’m no security expert, but at this point, I’d think that Target is probably one of the safer places to shop.  First of all, everyone is keeping an eye on it.  The hackers know that Target increased its security.  They also know that Target knows how and where the data were stolen.  Target has brought in security specialists to help them fix their systems.  It’s going to be much harder to get back in.  My guess is that the hackers are going to be moving on to the next company on their list – the unsuspecting company that doesn’t yet understand where its security holes lie.

However, this is one of the problems we have with data.  When something big happens, we start placing greater emphasis on it.  When people read about a shark attack they become more concerned about swimming in the ocean – even if they are on the other side of the country, swimming in a different ocean. In reality, they have a much greater chance of being killed driving to the ocean than they do of being attacked by a shark.  The recency and severity of the event incorrectly inflate our assessment of its likelihood.

But our brains don’t just irrationally inflate probability.  Sometimes our brains do the opposite. They cause us to believe something is less probable than it really is. 

Consider this.  You just flipped six “heads” in a row with a coin.  Is the coin more or less likely to land on heads on the next flip?  The typical gut-based answer is that it would be less-likely to flip another heads.  It seemslike the world should balance itself out and a tails should be coming up.  But, that’s not the case.  The chances of getting heads on any coin flip are 50%.  It doesn’t matter what happened previously.  But our brains don’t like that. 

Our brains rely on patterns. When flipping a coin we generally see it alternate between heads and tails. We know that it doesn’t alternate perfectly but we don’t tend to see very long streaks of either heads or tails (which is only because we don’t flip long enough). Similarly, because of our reliance and acceptance of patterns, we would expect a lottery ticket with the numbers 13 20 45 52 62 and 75 to have a better chance of winning than one with the numbers 1 2 3 4 5 6.  After all, we rarely see a consecutive set of numbers win the lottery.  Yet, those two tickets have the exact same chances of winning.

Statisticians classify these different types of events into two categories: dependent and independent.  Dependent events, as their name implies, are events where later events are influenced by earlier events.  The chances of you being picked first for a team is much lower than the chances of you being picked third (because there are fewer people in the pool when the third pick is being made). That’s a dependent event because the pool changes with each pick.  On the other hand, each number on a six-sided die has an equal chance of coming up on every roll (one in six).  That’s because the die and number of options on the die do not change after the initial roll.  There are still six choices and each number still has a one in six chance of coming up.  The chances of a person winning the lottery a week after they previously won are exactly the same as if he or she hadn’t already won.  While they have a contextual link, the events themselves are independent.

While the issue with Target isn’t a mathematically dependent event, it does share some characteristics.  Once the data breach occurred, it influenced the future.  It changed Target’s behavior and it most likely changed the hacker’s behavior. There is a dependency and that dependency should be taken into account when assessing probability and risk.

Our day-to-day decision making relies on our ability to predict what might happen in the future.  Unfortunately, our brains don’t always use the data we have effectively. In fact, our brains tend to get it backward.  We tend to see dependent events as independent and inflate their chances.  And, we tend to view independent events as dependent and under-estimate their probability.  In both cases, we wind up making irrational decisions.

Think through your problems and decisions.  Consider their broader context.  Don’t confuse familiarity (or lack of familiarity) with probability.  When it comes to placing bets (in Vegas, in business, or in life), your best chances are to go with the statistics rather than your gut.

---