Competitive Intelligence

Kryptonite: Tough World, Tough Luck - Company Drawn Asunder by Bic Ballpoint Pen

On September 12, 2004, a forum poster at bikeforums.net noted that he could open his Kryptonite lock with a Bic pen. One day later, one of his fellow bikeforums.net forum members posts video of the lock being picked, verifying the claim. Just a few days after the initial forum post, the story leapt into the mainstream media with on September 23 in The New York Times, “The Pen is Mightier Than the Lock,” and only afterwards did the company finally post a statement on their Web site. By then, of course, it was too late - AP and dozens of other media outlets had picked up the scent and the product was ostensibly finished.

The bike-lock maker heard about the problem through an e-mail to its customer service department, but didn't issue a formal statement about the vulnerability until days later. By then, angry and confused customers were flooding the company with questions about their locks. "That was probably the most astounding thing - to see how rapidly this whole thing developed and moved around the world at an amazing speed," says Karen Rizzo, director of marketing at Kryptonite, a division of Ingersoll-Rand.

I learned of the situation myself just a few days ago from an interview with the technique's popularizer, Benjamin Running, in CSO Magazine online:

The first time Benjamin Running picked his $90 Kryptonite bike lock with a 10 cent ballpoint pen, it took a few minutes. But after 10 tries, he says, “I had it down to five seconds.” Running, a Brooklyn-based graphic designer, reported this astonishing discovery on his blog, Thirdrate.com. “Bike owners beware, that same bright yellow lock that once said, Don’t screw with me! now screams, Steal me!” Running wrote. He also linked to a video demonstrating how he penned his own lock. It was this video that turned Running into an internationally sought after “hacker.”

Could Kryptonite have avoided the situation? Unlikely – it’s a fundamental design flaw with unforeseen consequences of an innovative and curious guy trying something new. But, they certainly could've reacted more quickly, had they been monitoring the online discussion space. One thing's for sure: pride goes before the fall... nobody had the foresight to think of what might happen if their product is suddenly made useless. As the old CI saying goes, it's rarely direct competitors that jump up and put you out of business - it's usually a threat you'd never heard of.

- Arik