Mythic Monday – Elfshot

Before the germ theory of disease, Celtic farmers occasionally experienced cattle that would mysteriously sicken.  At the same time, as they were clearing their land, they would find prehistoric arrowheads.  Combining these two observations with the belief that elves were ever-present and often interfered with daily human life, the idea of elfshot arose.

It made perfect sense at the time. Based on the theories of the time and the available evidence, it was completely logical. Even Robert Kirk, an Episcopalian minister, analyzed the situation and explained it thusly in his The Secret Commonwealth of Elves, Fauns & Fairies:

These arms (cut by art and tools it seems beyond human) have somewhat of the nature of thunderbolt, subtly and mortally wounding the vital parts without breaking the skin, of which wounds, some I have observed in beasts and felt them with my hands.

So, since they couldn’t conceive of any way that such small arrowheads could be made (and since they lacked a John Whittaker), they came up with an idea and it effected the regional culture for centuries.

Sadly, the same behavior still exists today. Many times, when there is a security incident, there are a few clues here and there as to what is going on. It is very common to have a theory about what’s going on and then try to make all of the evidence fit it. For example, we hear a lot about foreign attackers, so when a system starts to behave a bit oddly, we often look first for an intrusion. In fact, odd behavior could be due to many factors. It’s not unusual for some systems to experience problems at times. It’s also not unusual for attacks to come from inside. Focusing too early on but one scenario can blind you to what’s really going on.

It’s better to consider all of the data independently and then start coming up with and testing ideas. This would allow you to spend less time running down the wrong path and be more efficient in uncovering the problem. That way, instead of spending centuries working under a theory that might not fit the best, you can maximize your use of time… and avoid needlessly blaming the elves for something that wasn’t really their fault.