Keeping Security in Shape

Intelligence Management

Understanding Intelligence Management

“ Jet Liner Goes Down”
“ Labor Strike in France”
“Underground Explosion in San Francisco”

These headlines are examples of what we read, watch, or hear through open media sources. For some
people and organizations, these incidents may directly impact their business process or livelihoods
requiring them to act (intelligence), and for others these headlines are considered simple news items.
A common problem facing many senior security managers is the feeling of being overwhelmed with
the constant influx of information via the Internet, broadcast media, the corporate intranet, and coworkers.

There is also the unspoken added pressure the chief security officer puts on him or herself to be the guy or gal who is expected to know everything that is happening anywhere in the world at any given
time. Unfortunately, some managers, fall into a trap of subscribing to every conceivable security oriented e-mail list possible, with the hope of finding something “actionable”. Casting a wide net in the hope of catching a single nugget of actionable intelligence will tax corporate or organizational
resources, demand many hours of analysis, and clog up the security department’s communication
infrastructure.

How does one actually assess what it is
considered intelligence and what is non-essential
news to that organization’s business continuity or
security? How does one navigate through a
plethora of information sources? The answers to
these questions and other’s can be found by
understanding how to manage the intelligence
process. Valuable time, money and even
reputations can be saved by knowing what the
intelligence needs of an organization are first and
then designing a plan to capture the intelligence.

For the rest of the article click on: http://www.sfasis.org/PDF/Newsletter/nl-q2-2009.pdf

What's your status?

I don't remember the sociologist, it may have been Emile Durkheim who promoted the master status theory. This theory contended that in any given social setting an individual possesses a superior status that may identify him from others within the same environment. Let's say we take 10 real estate salesmen and put them in a room, it is now unremarkable that they are real estate salesman, but if one of them was formerly a fighter pilot, this fact changes his status in the group and chiefly identifies him from the others. If we put 10 fighter pilots in the room, but one of them sold real estate on the side, his real estate job would be his master status amongst his fighter pilot friends. 

Our parents always told us we were special, but they said this out of unconditional love. It is the company that you keep who determines how special you are. I may have a diverse professional background, a deep and solid education, but the fact that I served in the Israeli army generally dominates all other traits about me in the US. In Israel, the fact that I served is unremarkable, what identifies me in Israel is that I came from the US to serve in the IDF not my service. 

Don't think of how you identify yourself think of how others identify you.

Economic Downturn - What it Means for the Security Industry

The financial crisis in the US is the leading topic of discussion in America more so than the upcoming election for US Preseident.

The security industry, like any business sector, will suffer in some segments, but not in all. Due to some severe budgeting in the months to come, many corporate security departments will see the axe fall on many security programs and or jobs.

I predict the casualties for corporate security to include:

1) Any upgrades to current physical security equipment - the $70,000 new video surveillance or access control system will get left off the budget.

2) Reduction in managerial manpower -as is the trend, many corporate security managers may have their jobs rolled into Environmental Health & Safety or a department such as  Real Estate & Transportation.

3) Positions for perimeter security officers may be reduced. Fewer security officers will have more responsibilities at facilties.

4) Executive Protection programs will defintely suffer not just for budgeting reasons but for the reason that this expense is often categorized under Executive Compensation, and with impending oversight from the federal government, corporations may view this function as a perk and not a necessity.

5) High end or elite contract security firms will suffer due to the reasons mentioned above. In wanting to do more with less budget, risk managers and CFOs will seek the lowest bidder and not the best service for future security contracts.

The likely winners within the security industry during this economic downturn will include:

Alarm companies, fence and gate companies, small sized physical security integrators, and low end security service firms.

The reason for a positive outlook for such companies is due largely in part to what happens during an economic downturn: people steal.  For example: A warehouse, with no previous history of being burglarized, is robbed of some goods and has the copper fittings of a heating system stolen.  The warehouse in wanting to prevent further burglaries contacts a local alarm company or security integrator and spends money on new security equipment (not top of the line) and also decides to install fencing.  If the general economy was more robust, perhaps this warehouse may not have been robbed if due to the greater liklihood of the thieves having other means avaliable to earn a living. So the winner in this instance is the small sized security company making profits in a downward economy.

Deterrence vs. Response Vol 1.

Constructing a physical security infrastructure has to 1) be compatible with the nature of the protected business and or facilty, (no frisking at day care centers) 2) be sustainable economically and operationally, and 3) deter or counter threats and vulnerabilities in the most efficient manner.

Deterrence is a psychological phenomenon. A perpetrator will assess his or her chances for success prior to any crime; and if fearing an unsuccessful outcome, will abandon the action.  The purpose of erecting security measures is to prevent crime and thus alter a potential offender's thought process by introducing severe doubt of success.

Some facilities, events, and organizations put a lot of money and resources into crime prevention with out first understanding what "success" means in the mind of the perpetrator.

A bank robber who sees SWAT teams deployed outside a bank, as in the case of lower Manhattan Post-9/11 will be deterred from achieving his goal because he knows that there will be an immediate and quick repsonse and he will lose in a hostage situation. This is a case of the response having a deterring effect on the motivation of the perpetrator.

Conversely, a suicide bomber will not be deterred by a SWAT team because to him, they are just more victims. In the case of the suicide bomber, deterrence is achieved by having such preventive security measures in place that the bomber will realize he will not succeed in killing as many people as he would like to and will try another day thereby exposing themselves for potential capture. Suicide bombing prevention is more of a question of having measures in place that can identify suspicious behaviors of the bomber, deny the bomber the ability to arrive to his destination, or deny the bomber(s) the access to the necessary materials. Rarely will suicide bombers be psychologically deterred except if their actions will not result in the success of killing scores of people.

Unfortunately, in the private sector at least, some organizations/facilities/events put all of their efforts on prevention of a particular incident, crime or crimes that when an unwanted event does occur, "active shooter" for example,  no adequate means of response exist and in the end the crime has a deeper impact. More to follow...

Security and the Environment

A recent article in the latest Security Management magazine brought attention to the "Going Green" phenomenon and the challenges to security. 

http://www.securitymanagement.com/

Depending on which state a facility is located, tax breaks can be given to businesses that employ "Green" technology or adhere to energy saving practices. The article points out several obvious conflicts that will arise between protection of assets versus protection of the of the environment. (No sooner did I think of writing on this topic; then an article gets published, a day late and a dollar short). 

Some issues that can be obstacles between the security and the green camps are trees and lighting. Trees sometimes obscure the field of view of CCTV cameras, removing the trees may be a solution but a building may forfeit a tax break by such an action. Lighting is a key tool in mitigating instances of premise liability as well as for identification but there is a cost in running lights overnight as well as an carbon foot prints. 

The article talked about new lighting fixtures that will use less power as well as be more directed to a particular area, eliminating the need for blasting too much light.

Corporate and municipal risk managers will no doubt conduct cost benefit studies on energy/environment protection strategies versus security strategies.

  

US Infrastructure Security - Geography

There are several types of industrial infrastructures in the US that as citizens, we depend on daily to live. Such infrastructures are Agricultural, Telecommunication, Transportation, Energy, Financial, Political, & Defense. Shall any one of these infrastructures be damaged or severely threatened, Americans will find themselves thrown into a frontier like mode of survival.

Some of our national infrastructures are centralized geographically in certain regions. 

Agriculture: beef, wheats & grains - Midwest, vegetables & greens, Monterey County, CA, fruits - California, Florida. Dairy products are generally produced in close proximity to where they will be delivered. 

Financial: NYC, The San Francisco/Bay Area is number two based on the fact that the headquarters of several financial firms are located in SF and that many Fortune 500 companies are situated nearby in Silicon Valley.

Energy: Louisiana,Mississippi Delta, Texas, New Jersey, Northern California. Though much of America's energy infrastructure is based on the delivery of foreign oil, many oil refineries required to make gasoline are located in the US.

Currently we are witnessing some our infrastructures under threat by natural made disasters or harsh weather systems. The flooding in the Midwest is damaging crops, undermining the local housing infrastructure, and effecting the transportation of goods sent from local farms and distributers to national markets via shipping on the Mississippi River.

Wild fires or brush fires through out California are threatening much of the produce crops that supply much of the country. In this age of "global warming" awareness we can't spare to lose any more trees - not that I am a "tree hugger" or anything.

Let's look at a scorecard of recent man made and natural disasters that have impacted key infrastructures in the US:

Financial/Political: Terrorist attack 9/11 - NYC/Washington D.C  

Energy: Hurricane Katrina - States bordering the Gulf of Mexico

Biggest Threat to key US infrastructures yet to happen is an Earthquake in Northern California which will cause severe flooding in the Delta region located on the Northeast SF Bay Area threatening Chevron and Valero refineries: National Impact: Energy

Structural damage to Fortune 500 headquarter buildings; National Impact: Financial, Telecommunication

Loss of livestock and produce emanating from fires, floods, and landslides: National Impact: Agricultural 

Now I am not a doomsday guru but my two cents says it is quite important to follow the US Boy Scout mantra and, "ALWAYS BE PREPARED."

 

Day Care Security

As a parent and security professional, we can't forget to protect our greatest asset.

A Checklist and Questions worth having for any concerned parent or protection professional. 

1)  Vetting the care giver:  

a)  How long in business? 

b)  Business license display 

c)  Referrals

d)  BBB listing

e)  Inoculations/health/ physical capability of care giver

f)   First Aid/CPR certification 

g)  Fluency in English (or dominant language of children)

h)  Hiring policies for assistants and employees

i)   Criminal history of care giver

j)   Adequate number of staff per number of children as related to age

k)  What is the extent of the care giver's business insurance? 

2)  Assessing the facility:

a)  Adequate baby proofing - electrical sockets plugged, spongy material on hard edges of furniture, anchored large furniture

b)  Distance to nearest hospital

c)  Fire extinguisher on site

d)  Inherent physical dangers - proximity to busy street, or high population center

e)  Physical security measures - any cameras, signage, gates, fences, intercom, or locks in place to deter intruders or grant access to parents

f)   A Megan's law query for registered sex offenders located near the facility

g)  Smoke detector on site

h)  Emergency supplies in case of event such as an earthquake, power outage, fire, or flood

i)   No hidden corners which can obstruct the view of the care giver or staff

j)   Emergency numbers listed in plain site for staff to call

3)  Policies and Procedures:

a)  Hiring policy and process

b)  Ability for parents to conduct spot checks

c)  If the facility is an in-home daycare center, policies on care giver's family's interactions with children

d)  Codeword policy if the pick up of the child is someone other than the legal guardian(s)

e)  Emergency response policies - shelter in place/evacuation

f)   Frequency of emergency drills 

g)  Administration of medication - how is this managed?

h)  Non disclosure agreements needed in cases where child maybe potential kidnap risk due to economic or social status of the parent(s)

i)   Sick child notification to parents if a child shows signs of illness that maybe contagious

 

Perimeter Protection

It's all about the perimeter as far as advertising the level of security at any property or facility. Would your average joe feel inhibited to approach a building or welcome? Is the perimeter defined by fences, gates, shrubbery, or a security officer? Throw on some cameras, motion sensors, and signs and then you have a security casserole that will taste good for the facility managers or business owners.

How many of you paid attention when I referenced "average joe"? An individual, intent on causing harm whether via violent act or industrial espionage, is not your "average joe." These types of individuals do their surveillance before striking. What ever security measures that may unnerve an average citizen from approaching a facilty will not always deter a person committed to a cause of some sort; whether it be personal, political. or financial.

So to keep out such committed individuals from causing harm, not only do physical security measures have to present a challenge to intruders to gain entry, so do the security personnel hired to protect the facility. Humans are an organization's greatest asset and greatest liability, so it is incumbant upon the facility or business that the security personnel who guard the perimeter are more than adequately trained to deter individuals with an INTENT to do harm.

The skill set perimeter security officers should posses include:

1) Above than average intelligence quotient

2) Above than average powers of observation and deduction

3) Critical thinking skills

4) Communication skills plus the ability, if possible, to speak the foreign language most common for the area

5) Physically able to stand for long periods of time as well be physically fit enough to run and evacuate people during an emergency

6) Posses verbal judo skills in order to subdue a possible confrontation

7) Self -Defense Skills

8) First Aid, CPR/ AED

Ancillary skills and abilities include:

9) Appearance

10) Customer Service

If the above skill set was MANDATORY for every perimeter security officer employed, crime would plummet, more lives would be saved during an emergency, and more businesses would be able to remain open.

The committed individual intent on doing harm will more often than not be DETERRED from perpetrating a crime if the perimeter security is proactively engaged. Deterrence, Deterrence, Deterrence!

The ironic thing is that businesses jeopardize themselves when not deploying and paying for the highest quality of security officer. At the end of the day you get what you pay for, especially for security and protection services. 

Special Event Security

The city of San Diego can always expect lots of tourists throught the year; given its great weather and sea side attractions. This June, two major events are occuring the U.S. Open Golf Tournament and the BIO International Convention ( a bio-tech event). Both events couldn't be more different yet the organizers of the U.S. Open and BIO International Convention share a common concern for the protection of the particpants and attendees as well as the reputation associated with each event.

FBI, police prepare for U.S. Open, BIO

By Tony Manolatos

UNION-TRIBUNE STAFF WRITER

June 2, 2008

If terrorists plan to attack San Diego while the city hosts back-to-back headliner events this month, the FBI would likely know about it by now, an agent with the agency said.

The FBI's Joint Terrorism Task Force, which counts the San Diego Police Department among its partners, has been planning for the U.S. Open and the 2008 BIO International Convention for about a year.

“The prevention of a terrorist attack is our primary goal at events like the U.S. Open,” said Special Agent Darrell Foxworth, a spokesman for the San Diego bureau, the 14th-largest in the country.

The Open will take place June 9-15 at the Torrey Pines Golf Course. The BIO conference will run June 17-20 at the San Diego Convention Center.

Up to 50,000 people a day will descend on Torrey Pines, while the BIO conference should see 23,000 attendees each day. The prospect of those crowds presents myriad concerns for law enforcement officials.

To prepare, agents and police investigators conduct what they call threat assessments. It's a simple term for a complex operation, one that involves looking into confidential informants and analyzing terrorists' Web sites.

The officials also consider factors such as the size of the event, its location, its symbolic significance, media coverage and the presence of dignitaries.

“The FBI works with other federal, state and local law enforcement agencies to prepare a crisis management plan for the safety and security of the event and the citizens attending,” Foxworth said.

Despite the cautionary approach, the biggest problem at the Open likely will be unruly fans. A handful of protesters are expected at the biotechnology conference, which isn't open to the public.

“You have to prepare for everything from drunks to someone leaving a questionable package on the ground,” said San Diego police Capt. Walt Vasquez, who oversees special event operations.

The Open, one of golf's premier tournaments, has never come to San Diego, but the city is no stranger to large-scale athletic events. San Diego hosted the Super Bowl in 2003, 1998 and 1988, and baseball's All-Star Game in 1992 and 1978.

The BIO conference, which in the past has drawn protests from some animal rights groups, was held here in 2001.

“We had a few marches but no major incidents,” Vasquez said. “We've always been able to handle these events very professionally, and that comes down to planning.”

San Diego also was the host city for the Republican National Convention in 1996, which required significant planning and security.

The Open and the BIO conference each will be staffed with dozens of officers, including some in plain clothes. Most will focus on moving people and vehicles in a safe and orderly fashion.

As with other special events, overtime will pay for the bulk of the staffing.

Exact expenses won't be determined until after the events. At a minimum, it costs tens of thousands of dollars a day to provide proper security for major conferences and sports competitions, said San Diego Police Chief William Lansdowne.

U.S. Open and BIO organizers will reimburse San Diego for a percentage of the costs. If no significant security problems arise during the two events, Lansdowne expects his department to break even after receiving its reimbursements.

On all fronts, police officials hope for surprise-free operations.

“It better go smoothly,” Vasquez said. “All eyes are going to be on San Diego.”

Crowd control is at the heart of any major event, too much congestion leads to disatisfied attendees and perhaps to lost future income. Other dangers accociated with too many people crammed into too small an area are violence and car accidents.

The Bio event is not has recognized as the U.S. Open but it proposes a greater risk to the public because of its STATUS in the minds of potential protestors or animal rights extremists.

At the BIO event, security will have its hands full in welcoming attendees yet denying entrance to potential violent demonstrators at the same time.

Who is a Risk Manager

Following on the heels of who is a security specialist; who is a risk manager? Is an actuary a risk manager? Is a financial analyst a risk manager? Is an underwriter a risk manager? Is a security supervisor at a chemical plant a risk manager? What are your thoughts?