CertaDNS
Skip to lesson

Classifying a Finding · lesson 3 of 3

The cost of being wrong

After this lesson you can

State what each misclassification costs, and which direction to err in.

Assumes you have read Ranking a queue.

Both misclassifications cost something, and they cost different things to different people. Knowing which direction to err in requires knowing what each one actually does.

The two errors

Missing a live phishing domainReporting a legitimate business
Who bears itYour customers, and then youA third party who has done nothing wrong
Immediate effectCredentials harvested, payments divertedTheir site suspended by a host acting on your report
DurationUntil detected — days to weeksHours to days to reverse, if they can reach anyone
ReversibleNo. Losses have occurred.Partly. The disruption already happened.
Second-order effectReputational damage, regulatory interestYour future reports weighted lower by that abuse desk
Legal exposureLimited — you were the targetReal. Interference with a legitimate business is actionable.

Which way to err

Err toward investigating, and against reporting. Those are different actions with very different costs.

  • Investigating a legitimate business costs you an hour and costs them nothing, because they never learn you looked.
  • Reporting one costs them their site, and costs you credibility with an abuse desk you will need again.
  • So the threshold for looking should be low and the threshold for acting should be high, and confusing the two is what produces automated takedown requests against real companies.

Before sending any report

Have I seen the content myself?
   Not a screenshot from a tool. The actual page.

Does the content impersonate us, specifically?
   A similar name with unrelated content is not
   impersonation.

Would I defend this in writing to their lawyer?
   The test that catches the reports that should not
   be sent.

Is there a plausible innocent explanation?
   A real business with a similar name. A reseller.
   A former partner. A coincidence.

Every one of those questions has stopped a report that should not have been sent. None of them can be answered by a scoring engine.

Automated takedown requests are where this goes wrong

A pipeline that files abuse reports on a score, without a human reading the content, will eventually file against a legitimate business — and repeatedly, because the rule that matched once matches every cycle. Automate detection and triage as far as you like; keep a person between the queue and the report.

Knowledge check

Why should the threshold for investigating be much lower than the threshold for reporting?

Last reviewed