Business Continuity and Asset Protection

Sound protection for data, Intellectual Property, real property, and other day-to-day assets companies and senior management must secure demands that plans and procedures recognize threats posed by employees with access to those assets. Security managers tend to spend effort on low probability events including, tornadoes, fire, civil unrest and others while ignoring the risks their own employees create.

In 2009 a programmer at Goldman Sachs stole code used by the bank to run their high-speed trading operations. Sergey Aleynikov worked as a programmer at Goldman Sachs, and left his job with “hundreds of thousands of lines” of source code. Although he was prosecuted, the charges were thrown out. From the Guardian, “Because Aleynikov did not ‘assume physical control’ over anything when he took the source code, and because he did not thereby ‘deprive [Goldman] of its use,’ Aleynikov did not violate the [National Stolen Property Act],’ the court wrote in its decision for United States v Aleynikov.”

More recently Syrian President Bashar al-Assad was betrayed by a security staffer who carried a bomb into a staff meeting. Syria is conducting a war and the senior leadership team has been holding frequent planning meetings. This is an organization that is already on the highest alert, yet the blast killed Defense Minister Dawood Rajiha, Deputy Defense Minister Assef Shawkat (al-Assad’s brother-in-law), and Hasan Turkmani, a security adviser and assistant vice president.

In case you think Syria is an extreme example consider this case. In December, 2009, another suicide bomber attacked a CIA operations center in Khost, Afghanistan which killed eight Americans. Most were CIA agents. Like the Syrian attack, the suspect was well-known to the people he targeted. A week after the bombing, NBC news published an article that identified the attacker as Humam Khalid Abu-Mulal al-Balawi, 36, a Jordanian Doctor and al-Qaida sympathizer from Zarqa. The CIA planned to use him to infiltrate Al-Qaida as a double-agent.

Internal threats are real and have potential to cause serious damage. And none of the expensive firewalls, access control systems, alarms, fire-suppression, locks, gates, fences and security systems companies are already sustaining can prevent loss from a Trojan Horse. You must consider ways to compartmentalize data and assets and limit the damage caused by theft or malicious destruction employees can do to a company or organization.

Risk Management

Duty of Care and Duty of Loyalty

Duty of Care is the idea that Corporations are responsible for the security of their employees during travel and when engaged in activities that support the company’s interests. The European Union’s Duty of Care Act is the most prominent regulation in Europe to codify this requirement. The EU spells out how companies should behave regarding employee safety and security, but the United Kingdom took this a step further with the UK Manslaughter Act that allows companies to be held criminally liable for harm that come to their employees. The regulation applies to UK employees abroad, or the non-UK Company employees while they are in the UK to conduct business. These regulations jump-started the Duty of Care industry in Europe and North American Corporations are still playing catch-up.

Duty of Care describes the set of behaviors, planning, and actions companies must take to safeguard their employees. Duty of Loyalty is the concept of employee compliance with their employers’ efforts on their behalf. If a company makes a car service available, or requires employees to meet minimum safety guidelines, Duty of Loyalty is the force that compels an employee to meet those standards. Companies that go out of their way to create a high quality of life for during employee travel and are proactive about serving travelers on the road will generate much higher loyalty. Companies undermine their employees loyalty through cumbersome or overly-restrictive policies and should strive to strike a balance that rewards loyal behavior while not driving the employee to another company.

Risk Management Travel Management

The Safest Room in Every Hotel

You will find the safest rooms on the third and fourth floors away from the front of the building and at least one room away from elevators or stairs. Why? Simple – fire. The most common, fire truck carried, tallest, three-section ladder only extends forty-feet, and weighs 220 pounds. Fire can spread through stairwells and elevator shafts quickly so a buffer room is a good idea and high rooms cannot be reached with most ladders.

Unfortunately terrorism is another risk hotel guests face; room locations away from the building’s main entrance tend to offer better protection against blasts, overpressure shockwaves and projectiles. Blasts occur disproportionately on the street level in front of the lobby entrance. In high risk locations, it makes sense to keep your drapes closed (to catch broken glass), and sleep on the bed away from windows (when two beds are present). You should also remember to carry a small doorstop with you and secure your room when you’re in it.

It’s easy to remember to stay low in case of fire, but most people don’t understand how quickly the super-heated gas a few feet above the floor can cause severe burns to delicate lung tissue. Think about the heat you feel from an oven at 350°F? Now think about what one deep breath of air heated to 900°F could do? If you do need to leave your room during a fire, don’t use elevators and don’t leave skin exposed; put a wet, cotton t-shirt around your head, and a pair of cotton socks (not synthetic) on your hands as an impromptu pair of gloves. Touch doors and doorknobs with the back of your hand before you open them, and don’t stand in front of the opening until you know it’s safe to do so.

A few more hotel tips – it’s a good habit to make your first trips to the lobby via the primary and alternate emergency exits closest to your room (you’ll be familiar with them should you need to use them in the dark).

Never take metal keys with you when you leave the hotel – leave them at the front desk and have a staff member give it back to you when you return. And don’t leave room keys in sleeves marked with your room number or the hotel name. Always leave a note addressed to yourself or a colleague at the front desk when you leave by yourself. List your intended destination, who you’re meeting with and when you intend to return. This will give potential rescuers an enormous head start should something unplanned happen.

This isn’t a complete list, but adopting these habits will give you an advantage if you’re ever faced with an emergency or crisis while you’re away from home.

Featured Risk Management Travel Management

Recipe to Riot: How the LAPD Keeps the Peace

The US Supreme Court recently upheld the right to videotape Police in action by denying an Illinois request to review a Federal Court’s decision to prohibit Cook County from prosecuting people for “eavesdropping” on Police. See more here. This is an important decision – it means that citizens and watch groups may monitor law enforcement through photographic methods and continue to disseminate their findings via social network sites like twitter, youtube, facebook and instagram – all with first amendment protection.

Videotapes and photographs showing Police in action have an important history. Sometime in early 2007 I became acquainted with William Bratton, Chief of Police, and his senior staff including Chief Earl Paysinger. A few weeks after our first introduction Chief Paysinger asked me to review the Police Departments’ customer service procedures and make recommendations about how they might improve service to the citizen’s of Los Angeles. Earl thought my previous law enforcement experience, combined with my experience dealing some of American’s best customers, the movie studios, offered a good backdrop to draw from. Over the following months and after a series of interviews and ride-alongs, including one with Sergeant Al LaBrada with the Gang Crimes unit, I felt comfortable that I understood the LAPD’s general operations, but I wrestled with actionable recommendations that could make a meaningful difference.

Service levels or satisfaction scores as defined by typical corporate surveys or ratings didn’t feel like the right metric to capture what Earl had asked for, but within weeks something happened that clarified the problem for me. On May 1, 2007, a large group of people marched in MacArthur park to protest for citizenship for illegal immigrants. The march and skirmishes between police and protesters have come to be known as the May Day Melee. There was clear videographic evidence that depicted excessive force by the LAPD against peaceful protesters and reporters. The tapes were aired repeatedly by local media and led to widespread criticism of the LAPD’s actions from a broad spectrum of Angelenos.

The LAPD manages thousands of public contacts each day and responds to millions of 9-1-1 calls per year, but only periodic incidents that lead to rapid escalation and threats to life and property. The “customer service problem” was not about how to say “please” or “thank you” during daily transactions. It was far easier. It could be distilled to a command problem about how to respond when Officers are involved in a long tail event. Moreover, it wasn’t just a ‘problem’ where Officers were involved. There were even more ingredients that could be isolated to help the LAPD identify and predict future events.

A review of the May Day events at MacArthur Park, combined with a quick look at previous flare ups and riots including the acquittal of LAPD Officers charged with assaulting Rodney King during a traffic stop in 1991 (the beating was videotaped and led to widespread anger at the LAPD) provide clues about the circumstances that lead to these events.

The May Day Melee was embarrassing to the City of Los Angeles, but it should be viewed as a bad situation that was defused successfully. Within days of the initial event William Bratton suspended senior Officers, and acknowledged what most people could see clearly on the evening news – the LAPD was wrong, they had overreacted, and they were going to change. Chief Bratton’s treatment of his organization wasn’t without complaint. There were Officers who criticized his handling of the department in the aftermath, but videotapes allow anyone with youtube access to question Ground Commanders’ actions – and sometimes Officers make the wrong call.

My recommendations to the LAPD follows: keep doing what you’re doing, but be alert for situations that include the following ingredients:

  1. Predisposition to mistrust the Police.
  2. Incident occurs that a majority of residents see as an abuse of police power or overreaction.
  3. A video tape or photographic evidence exists. The video removes all reasonable doubt about the facts in the case.
  4. The public views the recording repeatedly with quotes from community leaders that condemn the acts and call for justice or retribution.
  5. A muted/hollow or tone deaf response from the police.

When all five conditions are present Police, Military Commanders, and Government leaders must break away from the script and change number 5. They must get in front of problems – and leaders don’t make them better by ignoring public opinion.

Looking back at the acquittal on April 29th, 1992, is useful. The response was immediate and it triggered six days of rioting in Los Angeles, led to more than 50 deaths, and caused over $1 Billion in property damage. It’s worth thinking about – a careful plan, executed well might have minimized it.

Risk Management

Vehicles Are Deadly

Vehicles are Deadly. The distinction between Cover and Concealment is an important starting point. Concealment occludes visibility to a target, while cover provides material to protect the target from projectiles. Bushes, curtains and plastic garbage bags could provide concealment, but only eighteen inches of dirt, sand or rock will stop a .50 BMG or fragmentation from a 155MM High Explosive shell. Most homeowners underestimate how soft the drywall and studs are in contemporary homes. In fact, a standard 9mm full metal jacket (FMJ) round fired from a 4” Glock19 can pass through four walls before stopping in the fifth. Some rifles can do the same thing to cinderblock. These results do two things: first, prove that walls do not offer cover; and second, demonstrate that many gun owners are unrealistic about where their rounds will end up once discharged.

The Box-O-Truth Web site is a terrific resource to learn how ammunition really behaves after it leaves the barrel. The Author and host, Don, known to readers as “Old_Painless”, is a retired Police Officer and gun enthusiast. He spends a lot of time to create realistic situation to test ammunition against targets with real-world applications. You can find his work here: http://www.theboxotruth.com/. You should spend some time on his site.

Vehicles are Deadly. They offer the illusion of safety (since so many people think they provide cover – but they don’t), but vehicles are deadly for another reason. They concentrate fire. Let’s use a car with four occupants as an example. Each occupant merges to become one target in the vehicle. One or more shooters will engage a car before firing at a single dismounted target. Vehicle occupants are subject to accidental hits – if the driver is targeted, but rounds hit another occupant, the shot is still a “Hit” but it was accidental. If four suspects ambush a vehicle, all four weapons act to destroy it.

Dismounted targets are discrete and not usually pursued with the same concentrated fire. When an occupant dismounts they will simultaneously draw fire away from the vehicle, and offer a much smaller target. As they move farther away from each other they become separate targets and much less susceptible to accidental “Hits.” Distance is a good defense since people able to double their distance from a shooter will reduce their surface area by 75%.

Vehicles are not a substitute for adequate cover. They offer concealment only, and vehicles tend to draw heavy weapons. If disciplined aggressors have small arms and one heavy weapon – they will put heavy fire on a vehicle before engaging soft-targets. The proliferation of .50 Cal BMG rifles reinforces everything described here. To learn more check out Don’s review titled the “Buick ‘O Truth” a car that gave him a chance to examine damage from small arms fire and penetration by high-powered rifles. The results will encourage you to hide somewhere else, as any bullet can penetrate the car and even the engine offers little protection.

Risk Management

Safe Schools

In early January a 34 year old English teacher, and mother of three, was talking with two students as they left baseball practice at a public High School in a trendy neighborhood. A few minutes into their conversation the group was approached by two men. Both were in their early thirties, one had prior convictions for aggravated assault, while the other was released from prison a week earlier after serving nine years for kidnapping and rape. There was little the teacher and two students could do to defend themselves from the unexpected assault – a violent attack which left them unconscious in a parking lot until an assistant coach found them later and called 9-1-1.

Two days earlier I met with a school Superintendent to discuss the rationale and logistics to allow licensed teachers to carry their legal firearms to protect themselves and defend their students against an active shooter. It was instructional for me as I learned first-hand how this senior administrator sought to satisfy his constituent’s desire for security. He argued that since parents and residents had not asked to arm teachers, he felt it was his duty to provide security through other means. He pointed out the hundreds of cameras that were recently installed and funded through a bond issue. The Superintendent was excited about having a recording of any event. He was more comfortable telling parents there was nothing he could do than to deal with another “distracting program” or the possibility a teacher might lose control of a weapon inside one of his schools. He did not understand the difference between safety and liability, and although he acknowledged security could only be offered through an immediate response to danger, he chose to support solutions measured in minutes on a timescale that must be mapped to seconds.

This Superintendent preferred optics to action and logic and reason were wasted on him. Moreover when he asked us what data existed to show that armed teachers provided a safer environment he cut us off before we finished explaining that police stations and other offices where guns were frequently available had a much lower incidence of gun violence – his response was “Those people are trained.” That’s a lot of faith in a curriculum he’s never seen, but it also dismisses the possibility that Safe Schools could require the same level of training required for law enforcement Officers.

Gun Free Zones are a misnomer. They imply security where there is none. Most arguments in favor of gun free zones simply ignore that by definition a criminal will not follow the rules. Rules that in most cities prevent teachers from defending themselves, even while many of them are capable of maintaining the skills required to carry a concealed weapon and apply good judgment about situations where they may be needed. Safe schools would mean qualified teachers can carry without diminishing the educational environments administrators, teachers and students strive for. Let me show you how.

The Federal Flight Deck Officer Program is an excellent proxy for arming teachers. This is a cost effective program that places responsibility for safety with potential victims and recognizes that seconds count. Following 9/11 pilots were allowed to carry fire arms in the cockpits of commercial aircraft, as long as they met the training and licensing criteria to be an FFDO. This continues to be a voluntary program and at one point almost half of all commercial pilots flying for major US carriers were enrolled. The FFDO program has overwhelming support from passengers, Government officials, and the public. It serves as an existence proof that pilots can do their jobs and flights depart and arrive on time safely. Guns in the cockpit have not proven to distract pilots’ attention from their core responsibilities. What makes teaching so different? Do we view pilots as old marine corps fighter jocks – they’re men and they can handle a gun, while teachers are thirty year old Moms who drive mini-vans to work and don’t know the difference between a revolver and an AR-15? I suspect stereotypes play a role.

Members in both the FFDO program, and the Sky Marshals, those dedicated armed special agents in the sky, have lost or discharged firearms since 9/11, some inside security, but none of those situations led to disaster, and it’s unlikely that a voluntary program that allows teachers and administrators to carry concealed in school would have a different outcome, but it would put potential shooters on notice – This School is NOT a gun free zone.

Here’s a roadmap for real security:

  • Start with the goal – Allow capable teachers and staff members to carry concealed weapons in schools.
  • First, map your school districts decision-making structure: Principals, Superintendent, Board, City Manager, Police Chief, Security Manager or Security Consultant.
  • Next determine who understands the distinction between real security (responses measured in seconds vs. minutes or longer) and who has a desire to implement actual security measures.
  • Then determine who the decision-makers are, and what pressures (constituent, budgetary, human resources, etc) they are under. You must uncover how they are measured – graduation rates, test scores, etc.
  • Collect data about the number and percent of teachers and staff who have prior military or LE experience. Gather data about the number who have a CHL. Additionally, interview some of those teachers to get their opinions about an FFDO like program for teachers.
  • Meet with Superintendents and Board Members, but plan to “Teach” them how to “buy” from you.  Example: “we’ve met with other members of the board and a number of your teachers and parents and they support our position.” Share real stories from parents and teachers and the data you’ve already collected – these provide a great starting point for your discussion.
  • Continue to gather supporters until you have a security program that addresses the threats facing your kids.

There’s little cost to this program – unlike paid security guards (many unarmed), the teachers volunteer their time for a license and their money for equipment and training. You could even use a school fundraiser to donate ammunition for teachers’ quarterly qualifications, and the local police department should be engaged to conduct quarterly training and certification. All this is available immediately and places “first responders” where they’re needed – at the scene, without delay, and every school could do this without spending incremental funds.

The real story about the teacher attacked in the parking lot ended differently. In early January a teacher shot two attackers in a school parking lot. One of them died at the scene while another was transported to a hospital. How do you feel about this now? Does it matter that this seventy-year old teacher’s heroic actions actually enhanced the sense of security at his school?

He was walking two girls to their cars in the parking lot after Basketball practice when one of two attackers grabbed the chain around his neck. This took place in Detroit, and he was armed since he is a Reserve Police Officer.  Why should he be allowed to protect himself, while every other teacher in that school is prohibited from carrying a handgun? These are important things to think about and even more important to act on.

We’re anxious for your feedback – please share this article with your friends and tell us what you think!

Risk Management

Things Every Gun Owner Should Know

Things every gun owner should know.

  1. You are responsible to know the law; and to be knowledgeable about your gun’s operation.
  2. Treat every gun as if it is loaded at all times (only point it at things you want to kill).
  3. Your firearm must be stored in locked container or have a trigger lock engaged when it is not in your hands.
  4. Practice with your weapon UNLOADED to become familiar and comfortable with it.
  5. On semi-automatic handguns keep the slide locked rearward to prevent bad habits that ignore cycling action.
  6. Learn a two-handed grip that will allow you to walk with your hand gun and a flashlight.
  7. Do not conduct a search through your home or property with your gun in the lead.
  8. Use your free hand to open doors and keep your weapon close enough to prevent moving doors from knocking it away from you.
  9. Deadly force is justified only when undertaken to prevent imminent and otherwise unavoidable danger of death or grave bodily harm to the innocent.
  10. You are responsible for everything your bullet hits so you must know where it will land.
  11. 9MM handguns with a standard full metal jacket projectile can penetrate both sides of at least six interior walls before they stop. Brick walls will usually contain bullets from a handgun, but after the first shot all bets are off.
  12. Keep a firm grip on your weapon at all times and never put your finger on the trigger unless you are planning to fire at a target in your sights.
  13. If you use your gun to defend yourself or someone else – you are a threat to the Police. You must remember that they will treat you as they would any armed subject until they determine you are unarmed and not a threat.
  14. Describe what you’re wearing to the 9-1-1 operator and secure your gun before the Police arrive.
  15. Do not continue to carry it around after the threat is removed.
  16. After you call 9-1-1 You or a friend or family member should contact a lawyer to represent you.
  17. Do not answer any questions until your lawyer is present, and make it clear to the police that you want to tell them what happened, but not until you are represented.
  18. Study the Box-O-Truth Website for a realistic view of your gun’s capabilities. http://www.theboxotruth.com/index.html
Risk Management