Making The Most of a Moment
Four years ago, I met with my colleague Katie Moussouris, who had led the charge for “bug bounty” programs at Microsoft. For the uninitiated, bug bounties are paid by software vendors to independent security researchers who find and report potential vulnerabilities in their products before they can be exploited.
I was tasked with creating digital marketing collateral that would promote Microsoft’s first major bug bounty contest, a year-long campaign where, at the end, three researchers would win up to six figures for their exploits.
This is an eclectic, intelligent community, one which it would be tough to get the attention of in a genuine way. In my conversation with Katie, who is steeped in this culture, she shared with me a phrase from another colleague, Jonathan Ness, that came to define the campaign: “Mad Loot. Lots of it.” I loved it, and insisted we use it.
The launch of the contest came in Las Vegas at the BlackHat USA security conference in August 2011, and the unique “Mad Loot” collateral was received better than we could’ve dreamed.
A year went by, and now we were at BlackHat again, to give away said “Mad Loot” to the contest winners. My challenge: how do we give away the “Mad Loot”, and get the most out of it, without a mad marketing budget?
I pitched my colleagues at Microsoft the idea of a live, American Idol-style reveal of the BlueHat Prize winner on a big stage at Las Vegas’ shiniest nightclub. I also promised that we could have video of the event edited and published within 2 hours. I also promised that they only production cost would be travel and expense for a crew of 2 people, including myself. I also suggested that we should expect an uptick in coverage with this unorthodox announcement.
Here’s how we did it: I proposed we take a 5-minute window of the Microsoft Researcher Appreciation Party, which another part of the company was already paying for and was going to hold regardless, to get us the stage, and the rowdy crowd of 1,000 onlookers. Cost to me: $0.
We shipped a crate full of our production gear, including two cameras and our edit computer, to Las Vegas. Cost: about $1,000 in transit, including buying the crate, which we ended up re-using for years.
We had a crew of two people: David Wheeler, my trusted cameraman/editor extraordinaire, and myself. I handled the writing and producing of the event; David expertly handled all technical odds and ends. Cost to me: David’s usual costs, plus travel.
My colleagues from Microsoft were recruited to join us on the stage. Dustin Childs helped me in the cramped backstage with the contestants. Emily Anderson assisted with an on-stage presence, and, as you see, Mike Reavey served as our host, for the most part reading off a script I’d prepared for him. Cost to me: I had to buy coffee for a few people.
The result spoke for itself. Despite the 10pm Pacific time announcement, media in the Asia-Pacific region latched on immediately, and security trade press stayed up to report it.
Almost all accounts referenced the mood and tone of the reveal, calling it splashy, shimmering, and electric. Certainly not adjectives typically used to describe hacking contests.
If they didn’t embed their own video they shot on their mobile phones, many other reporters embedded our video, which posted by midnight. It was a true win as “owned content” became “earned content”, and Microsoft’s voice was literally carrying the night and the following days.
Here are the little-known backstories to this “Mad” reveal:
One of the cameras was unmanned. We only used two cameras for this shoot. David manned one camera for stage close-ups to focus on our host and the contestants. A second camera was kept locked-down, alone, on a wide shot on a tripod in the middle of the crowd. At any moment, a random person in the crowd could have stolen the camera, sabotaged it, or even just shut it off, which would’ve lost us a critical “cutaway” camera angle, and the project quality would’ve suffered. A calculated risk.
“Blow the roof off this place.” The moment where the stage became engulfed in confetti, and strobe lights flashed furiously, was cooked up by myself and the technical guy at the nightclub. In going over the rundown of the show earlier that night, I took him through the lighting cues I wanted at certain times.
- Me: “At this point, the reveal of the ultimate winner, just hit every button on this console. Seriously.”
- Technical guy: “We haven’t really… um, we don’t really do that.”
- Me: “Then do it tonight. I’m serious. Blow the roof off this place. Let’s see what happens.”
I almost bludgeoned at least six people with a 30-pound tripod: A way we saved money on this production was to complete the editing and post-production in a hotel room, and not rent a separate workspace. The only downside: we were staying at Caesars Palace. The event was inside the Marquee nightclub at The Cosmopolitan, a 30-minute walk away. David and I covered that ground in 15 minutes. Running. In Las Vegas. Down the strip, in front of the Bellagio fountains. Dodging tourists. While each of us carried 50 pounds of gear on our backs. In 100-degree desert heat. I admit I had a few close calls, while shouting constantly like a maniac, “Coming through! Coming through!”
Speaking of near-disasters: I had mentioned Dustin Childs, helping me backstage, and Emily Anderson, helping us on-stage with the presentation. Just as the key moment arrived, as the winner was about to be named, Dustin blew past me, rushing onto the stage. I grabbed Dustin by the arm to stop him and pull him back behind the stage. I didn’t hear what he said, but I saw the urgency on his face. Emily was standing directly in front of an enormous confetti cannon that was seconds from going off. When I saw that, it was my eyes that went wide, and I let him go. Emily got the message, and casually moved aside right before bedlam broke out.
Despite months of meticulous planning, these events are never fully predictable. With the right people, the right partners, and the right set of circumstances, anything is possible. It’s not about the budget, it’s about the desire and professionalism of those involved; the willingness to see it through.
When reflecting on that “mad night” in Las Vegas in 2012, the professional, marketing side of me feels vindicated as the “owned content” of the ceremony and the quick-turn video did exactly what I promised it would- it garnered enormous attention for The BlueHat Prize and became “earned content” in it’s own right, embedded in media publications around the world. Three years ago, there were many who doubted if the content would be leveraged in news reports and blogs.
On a personal level, however, it was so very rewarding to work with tremendous people. Shortly after we published, still on an adrenaline rush, and thirsty, I headed down to a private party where the winner of the “mad loot”, Vasilas Pappas, was crowded around an iPhone with his friends. They were watching, and re-watching, that confetti moment, on the video I just published, and invited me over to enjoy it with them. Although I had seen that clip about 17 times by that point, I couldn’t resist their invitation to join them, and watch it an 18th time.
The headlines may fade, the news cycle may move on, and the next campaign always beckons. However, the smiles from my friends and colleagues on that “mad” night in Las Vegas are what I will always remember.