Yes, they have got it right...food and trinkets are something that are great motivators for employees! Give people something they like, and they will often return the favor and do something for you.

Food, trinkets, and other semi-precious valuables can be used quite effectively in awareness activities.

Not everyone will like you doing something like this...you can't please all the people all of the time. But everyone WILL notice it and likely talk about it.

And that is the point of awareness. Making people think about an issue, and better yet, discuss it with their co-workers.

Now, I'm not saying you should go out and buy McDonald's biscuits and burgers, attach a security or privacy motto to them, and hand them out to everyone. Not only would the vegetarians likely be upset, but what company has an information security education budget to be able to afford that? Unless you could get the local McDonald's...or Culver's (my personal preference), or Dairy Queen, or Subway, or whatever...to donate enough of their tasty tidbits. Hmm...there's an idea...

Whenever I've organized awareness activities that included handing out some sort of take-away for the people involved, it was always successful in raising awareness.

One time I arranged to have an image of the company's information security mascot printed on the wrappers of chocolate mints, butter mints, and some sugar-free mints (with a different-colored wrapper). We bought a huge amount of these in bulk, thus getting them at a much discounted price, and were able to use them for multiple awareness activities throughout the year. Yes, they were yummy.

As I watch that McDonald's commercial now I imagine that instead of sausage biscuits someone is wandering through the office building telling people, "I'll give you some security candy if you don't post your password....if you encrypt the data on your laptop...if you shred confidential papers when you throw them away..."

Yes, in many ways that is the same as the McDonald's commercial; we are asking the other employees to, in effect, do our jobs...to protect the information assets of the company. After all, we CAN'T be successful in our information security and privacy initiatives if we DON'T ask personnel to also be data guardians in partnership with us.