Building a brand loyalty – how NOT to

Disclaimer: this is a rant.

OK, so I travel a lot. Over a dozen trips this year to be more precise (17 and counting). As such, I tend to be “liked” by airlines which I tend to travel more with. Nevertheless, on my last couple of hops into Europe, I decided to test the water and make sure that I wasn’t missing anything. You know – play the educated consumer who does not get locked down to a certain brand, shops around and knows what’s on the table in terms of alternative suppliers. And that’s how my story starts with ElAl.

you have to realize, than up until this month, I haven’t flown a single flight with ElAl for almost a decade. I have been a loyal customer of another airline (and it’s “alliance”) and as a frequent traveller have been on their highest status for the past few years in a row. I figured, that based on this I would get equal status in ElAl and the same benefits – which turned out almost right… Upon submitting my current status with Continental and my flight history I got a quick call back to inform me that ElAl have graciously granted me (drumroll…) GOLD status!. Gold??? Too bad that my current status with Continental is Platinum. A quick explanation on the phone, and another call back and I was an ElAl Platinum member.

Cool. Shaky start, but getting there. Off to the flights. My real test was a flight that mixed business with a bit of vacation in London with the wife. Used to the status rules on EVERY OTHER AIRLINE I expected that my significant other would get the same treatment as myself. SURPRISE. Pay up – that’s what I got when I tried to get “preferred” seating (exit row/bulkhead) for us. 80 “points” later (because ElAl can’t use miles like the rest of the industry does – that would enable people to compare apples to apples and they can’t have THAT!), and we got a seat for my wife as well.

The flight to London was uneventful, nothing too fancy in terms of service, checkin process, or alike (no separate boarding to business/platinum – just a general “yee-haa!” of a mess, well, that’s Israel for you…).

But airlines are not tested when everything is ok, but when the shit hits the fan. Enter snowpocalypse. the local UK version of it at least. On Saturday the 18th, a bit of snow hit London, and started showing signs of disrupting the quiet English city in ways that were unexpected (surprise – wintery weather in the UK…). As our flight time was fast approaching, we gave ElAl a quick call to check up on our flight status. 7pm, and ElAl’s representative festively announces to us that the flight is on time, and will be leaving so we can head off to Heathrow. Just to set the stage right – we are following what’s going on in Heathrow through all the news channels as both the airport and every other airline on the planet is feverishly communicating to their customers on what’s up and what’s not.

We make our merry way to the airport, all packed up and ready to go, only to get to Heathrow and find a temporary hostel. everyone is stuck, people are sleeping on the floor, and the gates are all closed. The ElAl crew is happily handing out flyers that state the flight being delayed for tomorrow morning.

Problem 1: How come your local crew is completely out of touch with the HQ? How come you tell us to get to the airport when every other airline is saying don’t come in as the flights are cancelled? How come you are waiting for the airport to call you instead of trying to communicate with the locals and get a status update. Answer???? Nada.

Let’s just have a quick recap: Heathrow airport: website is constantly updated with flight status and airport status. They have a twitter account, which constantly updates people on what’s going on, and keeps answering people’s questions. ElAl: website does not reflect any changes in status of flights, no indication whatsoever of any issues with EU flights or airports. On the other hand, ElAl has 3 (three) twitter accounts! (@elalUSA, @elal_il, and @elal_airlines) They must be on this so hard updating everyone!? Nope. All they have there are announcements of flight deals, and ways to spend your worthless points. WHILE PEOPLE ARE STUCK AT AIRPORTS.

Fast forward almost 2 days: Apparently, ElAl have booked me on a flight from Luton airport. Apparently because they didn’t call or text (which they became very good at – especially leaving automated voice messages in different languages on irrelevant flights). So, what’s the problem you ask? you got to get on the first flight out back to Tel-Aviv? Right. If only I was traveling alone… In utter incompetence they left out my wife from the reservation, and kept her on a waiting list for the flight from Luton (which was obviously full to the teeth), and booked on a Heathrow flight later in the evening. The lack of communication here is glaring again: I’m supposed to find out by myself (by nagging and calling them a couple of times a day) that I’m scheduled to leave to Luton early in the morning, and it would have probably helped them to figure out their mistake in not booking my wife if they would have called to notify of the change.

Problem 2: Not notifying your best customers that they are supposed to leave from a different airport is BAD!. Not taking care of the entire reservation (my wife, duh!) is BAD. Having someone at Luton as a station manager that claims that I’m introducing more problems for him by saying that “we are here and I’m flying WITH my wife because ElAl fucked up” is BAD (not to mention that I had to remind him that the flight was in his full control and reservations can’t do anything with it, because I know, and checked…).

Epilogue: Dear ElAl, thanks for getting me Platinum status. You can have it back. Really. I’m sending you back the fancy card because you have FAILED. You failed to understand that you operate in a competitive market. You failed to understand that you need to SERVE your customers who overpay for your tickets for some reason. You FAIL on an operational level if I need to be the one to come up with alternative suggestions for flying people out of places (Luton, maybe a train to another city and a flight from there). You FAIL when I need to ask if you are sending a widebody carrier (747) instead of the regional one (757 or 767) that gets to Luton as there are probably many other customers like me stranded in Heathrow. And for that you are not getting my business again for another decade probably.

Picking up the glove – DC9723

Every time I get back from the annual DefCon/BlackHat/BSides conferences in Vegas, i usually run into some of the local security folks that managed to make the trip as well, and the plan ride home usually goes like this:”so, this year was pretty cool, huh?”, “yeah, funny how we only get to meet up so far away from home”, “right! Isn’t that a shame that we don’t have any local conferences back in Israel?…”.
You get the idea.
So, after many years of just complaining and saying that we suck, we decided to finally give it a go (we being my colleague Itzik Kotler and myself).
Ergo, DefCon group 9723 (or DC9723 for short).
We have bought the domain, set up a site, and called for the first meeting to be in Tel-Aviv on December 21st. Hope that this will finally bring this disjoint community together and will get us up to par with other communities all around the world.
See you there!

The power of collaboration (BlueHat post)

Some additional BlueHat wrap-up -  a collaborative post with a dear colleague of mine Fyodor Yarochkin has just been posted on the BlueHat blog.

The interesting thing about this is that my interaction with Fyodor have been as follows:

  1. Email exchange prior to BlueHat, as we were speaking one after the other, and were referring to the same ecosystems but from different points of view.
  2. Meeting in Seattle/Redmond at BlueHat, having some conversations (and drinks, yes, some drinks were involved too) about work, research, and such.
  3. Speaking one after the other.
  4. Working together on a post through online sharing tools where we basically played with throwing ideas around, putting in writing what we thought about them, exchanging some ideas and directions, and coming up with the aforementioned post.

To sum this up quickly, we didn’t really know each other (not virtually either) a few weeks ago, and based on our mutual interests, research and passion we were able to come up with a (somewhat) cohesive post that at least I can stand back and say “damn!, that’s pretty good” (and learn something from).

Only in InfoSec!

Stuxnet Analysis Report

So, after quite some time of working behind the scenes, and making an effort to focus on essence rather than buzz, the CSFI have published their official report on Stuxnet.

I have had the opportunity to assist (just a bit… work has been taking its toll) in the report writing – mostly inCSFI Logo terms of countermeasures for a threat like this, and some basic analysis.

Feel free to download the report form here:CSFI_Stuxnet_Report_V1

As well as watch the demonstration video on the CSFI website: http://csfi.us/?page=stuxnet

Kudos to all the great contributions from the CSFI-CWD (Cyber Security Forum Initiative – Cyber Warfare Division)  fellows!

The Botnet Wars – industry Q&A

I was approached recently by Bart Parys from Panda security in order to participate in an industry expert Q&A about the botnet wars (apparently he did his homework as he got quite the lineup to participate in this, guessed he can count me as a close miss :-) …).

He managed to compile a great Q&A where you can read some of the views and opinions on the current state of business at the Botnet (including exploit kits and crimeware kits) marketplace.

The full article is available at: http://malwaredatabase.net/blog/index.php/2010/10/25/the-botnet-wars-a-qa/

Enjoy!