The magic of Disney MagicBands

Leveraging security to enable staggering business results

Disney has taken something mundane that most people find boring or irritating—physical security—and turned it on its head, making it easy, cool, and convenient. They are using it to enable better service and have even—get this—turned it into a new revenue stream.

Security in most organizations is a necessary cost center at best. We in the industry make the argument that security has enabled entire new industries and business lines—no one would buy things online without appropriate security—but for security to actively earn money for its host company is almost unprecedented. Yet this is what Disney has done.

The Disney MagicBand is a wrist band with a chip carrying a unique identifier and a radio which sends and receives RF signals both through contact sensors and through long range sensors in the parks and resorts (bands do not carry personal information). Disney combines the band with a guest’s fingerprint (and PIN for some things) as positive identification of a guest’s identity and uses it to provide a wealth of services and capabilities that are enabling guests to experience Disney in a new way.

[ Malicious advertisements on major websites lead to ransomware ]

Disney explains some of the benefits on the MagicBand page:

  • Unlock the door of your Disney Resort hotel room.
  • Enter theme and water parks (with valid admission).
  • Check in at FastPass+ entrances.
  • Connect Disney PhotoPass images to your account.
  • Charge food and merchandise purchases to your Disney Resort hotel room. In fact, it allows parents to assign money to their children, allowing them to buy things up to a limit controlled by the parents.
  • It is waterproof, allowing you to visit water attractions and leave your wallet in your hotel safe.

But because there are location features in the band as well, there are more features and benefits for Disney and for guests:

  • They actively add to the prestige of the Disney brand and the allure of a Disney trip. Just see how much tumblr activity there is with MagicBands!
  • Lost children or other members of your party can be located.
  • Elsa or Mickey (or any other character) can greet your child by name, increasing the magic and fantasy.
  • The bands allow people to sign up for front-of-the-line access at a specific time for major attractions or characters, thus reducing the time that they spend in lines and increasing the amount they can do (and spend). This increases their enjoyment of the park, a benefit to the guest, and increase the opportunity that they may spend more on concessions or vendors, a benefit to Disney.
  • Traffic flow patterns through the park can be analyzed in real time, allowing Disney to set up events or send out characters to alter flow and better distribute guests around the park, thus helping control lines for minor attractions and vendors.
  • MagicBands have allowed an unprecedented level of service at hotels. For guests who sign up with Disney's Magical Express, the hotel is alerted when their airplane lands so that hotel staff can confirm that their room is ready and prepare the registration documents so when the guest arrives, they are assured that their room will ready with less time in the check-in line. This improves service not only for MagicBand guests but for other guests as well. The bands can be used to unlock your room, pay for meals and other things, freeing you from having to carry your wallet, reducing the opportunity for loss or theft.

Detractors point out that the band is linked in Disney’s systems to your name, address, credit card number, and now your fingerprint and a PIN that is likely the same PIN you use for your bank (if you are like most people). That is a lot of information and as 2014 proved over and over (ahem: Target, Home Depot, and others), no company can guarantee 100% security for the data we entrust to them.

So this system will almost surely be a target for the bad guys. On the other hand, those bad guys have a lot of other resources. Anyone at a bar or restaurant can steal your fingerprint (and if you think this is not going on what with the advent of fingerprint readers in iPhones, guess again). Your name, Social Security number and credit card are almost guaranteed to already be on, and you can (and should) choose to use a unique PIN for your bank.

Others find the “NSA-style” location tracking to be creepy or worse. But this really doesn’t bother me. Is this any different than it has always been? Parks are a high-population, semi-closed, high-value system and thus have always been high-risk.

From simple things like lost children or inventory loss control to escalatingly serious issues such as pickpocketing, kidnapping, and terrorism, parks must be very conscious of security. One could argue this is particularly true of Disney as a very brand-conscious and high-profile symbol of U.S. imperialism and capitalism. They have always had cameras and other tools to see what is happening and track people.

This solution is doing that job, doing it better and, unlike many other solutions, is giving many direct benefits back in return. Disney does understand that privacy is a concern and provides full disclosure of what they collect and how it is used.

The new system wasn’t cheap, but it enables a host of services and capabilities that make visiting the ever-popular tourist destinations easier, better, faster, and safer than ever before. Operating profit at Disney Parks increased 17% in 2013.

These bands are, at their heart, security devices; they primarily solve the issue of access control and identity verification. The free versions (free only if you stay on site) come in only limited colors and styles, but (oh, Disney!) you can pay for a more customized and “cooler” band in a wider variety of colors, with your favorite character on it, etc. Thus a security device has become not only a business and service enabler, but a new revenue stream in its own right. Take a moment to soak that in.

Yes, there are a few privacy and security considerations here – some of them worth legitimate thought and informed choice – but security is always a balance of risks and, for me, the benefits to the guests and the business are astounding and the risks are low enough (or are the same as they have always been) that I am comfortable with the trade.

We in the security industry need to be designing transformational opportunities like this. This to me is a beautiful case study of Convenient Security.

Copyright © 2015 IDG Communications, Inc.

How to choose a SIEM solution: 11 key features and considerations