Does Aviation Security Actually Work? “So why do I have to get naked to fly?”

By

-

May 2, 2012

Previously, we identified that the individual nation, or Chicago Convention, contracting state is responsible for enacting regulations that will be binding on the aviation industry entities that are based in that state and the travelling public. We also discussed the requirement for states to standardise, as far as possible, their application of the Standards and Recommended Practices (SARPs) that are provided by the International Civil Aviation Organisation (ICAO).

This allows us to discuss a little more about these SARPs including how they are developed and supported, and also how states might react to them. Before getting on to this it is also worthwhile to just think for a moment about the global aspect of aviation security.

Airlines are often considered as national flag carriers, possibly because many aircraft liveries actually include a small national flag! Regardless of an airline’s ownership, they are symbolically and legislatively considered as an extension of the state of registration. So, all of those Australian Registered aircrafts with a VH- lettering or a New Zealand aircraft with a ZK- lettering are almost like a little bit of the country, no matter where they are. Consequently, a threat to a national interest may happen anywhere.

Similarly, the actual mechanisms of security systems and, more importantly, security weaknesses, may extend extra-territorially. For example, if you and your suitcase (checked baggage) join a flight departing Australia for South America, you may travel on an aircraft of three different airlines and three states of aircraft registration in order to arrive at your destination. Sometimes, through the emergence of global airline alliances and commercial agreements or code share operations, you can do a trip like this all on the same flight number on your e-ticket!

So, that bag that you checked in at Melbourne Airport, which is subjected to certain levels of security controls, may then be transferred and uplifted through three other states, and by various other airlines. It is obvious, therefore, that the global aviation security system really is an example of a chain of operations that is only as good as its weakest link. By the way, I don’t think Australia is even close to being that weakest link in the chain, but some states will be.

As we know, the International Civil Aviation Authority (ICAO) is made up of 190 contracting states. The organisation is based in Montreal, Canada, has a permanent secretariat (effectively the ‘headquarters’) and is controlled by a council of state representatives. The council is elected every three years at an assembly of all of the states, and the council then elects one of its members to be the President. The day to day running of the secretariat is controlled by an employed Secretary General. If you think this all sounds like the United Nations, then you are right. In fact, consideration for the United Nations and the Chicago Convention began at about the same time, in 1944.

The ICAO’s base in Montreal is supported by six regional structures at strategic locations around the world. However, much of the specialist technical aviation security expertise and experience rests within some of the individual contracting states. Many of these states also have a strong national imperative to see certain levels of security implemented globally, in particular going back to our chain/link scenario.

ICAO meets this situation by forming specialist teams of professional subject matter experts, or SMEs. These SMEs are volunteered by their parent state to be a member of a working group or a panel of experts. These terms are self-explanatory
and hierarchal.

The working group of SMEs meets fairly regularly, under the control of a full time ICAO specialist acting as the Secretary, and formulates suggested changes to the Standards and Recommend Practices (SARPs). The panel meets less regularly, vets the suggested changes and approves them to eventually be passed to the ICAO Council for approval. During this process the 190 contracting states are regularly informed of the direction and eventual wording of these changes so that they can both provide feedback and prepare to institute the SARPs when adopted.

The process sounds complex but is actually very workable, albeit lengthy. A routine change of this nature may take three to five years from original consideration to actual adoption however, in this timeframe, there are many quite lengthy periods allocated for states to provide comment. In times of crisis, such as immediately after the 9/11 attacks, the ICAO system can be made to work much
more quickly.

Actually, the 11 September 2001 attacks were two weeks prior to the three yearly ICAO Assembly with nearly 1400 delegates from over 180 states attending in Montreal. Given 9/11, the opportunity was taken to convene an Extraordinary Aviation Security Panel meeting during the assembly. While hectic, and lacking in solid intelligence, this panel meeting did a lot to put in place the needed direction, not only to respond to the specific likelihood of the future use of civil aircraft as weapons, but also to get global approval at the Assembly for an increased effort and adherence to basic aviation security standards.

Our question remains: “Why do I have to (almost) get naked to fly?” So let’s talk about some real events and actual security standards rather than a global bureaucracy.

Aviation security SARPs largely address known, likely or possible threats. As an example, when the prevailing aviation security issue was hijacking an aircraft in the ‘70s, a large number of SARPs were produced covering all of the ‘defences’ against hijacking, such as airport access control systems, ID cards, screening of passengers to prevent carriage of weapons and so forth.

These types of SARP slot in to Annex 17 Security under the general classification of ‘Preventative Security Measures’, forming Chapter 4. Also included in the Annex are:

Chapter 1 – Definitions

Chapter 2 – General Principles

Chapter 3 – Organisation

Chapter 5 – Management of responses to acts of unlawful interference (with civil aviation)

It is worthwhile pointing out here that ‘Acts of Unlawful Interference with Civil Aviation’ is how ICAO and its documents refer to the various different types of activities, which the SARPs are designed to prevent. This is so regardless if it is a bombing in an airport terminal, arson of an air traffic control facility, or an action in an aircraft; and regardless of whether or not the act is terrorist or criminally motivated.

As a result of an increase in hijackings perpetrated by armed individuals, one of the early SARPs put in place was: Standard 4.4.1 – “Each Contracting State shall establish measures to ensure that originating passengers of commercial air transport operations and their cabin baggage are screened prior to boarding an aircraft departing from a security restricted area.”

This sounds good, is easily understood and is very outcome based. It tells us ‘what’ is required and, when combined with the guidance material in the Aviation Security Manual, (Document 8973) gives examples of ‘how’ this might be done; it gives adequate information for a state to decide how to screen passengers and cabin baggage.

But then we come up with the other issues and, in particular, two things: The limits of technology and what the traveller will actually put up with.

Firstly, technology. The first reaction to Standard 4.4.1 by most States was to institute a regime of passenger and cabin baggage screening using existing technology and/or human resources. This meant that we all walked through what are alternatively called the ‘archway’ or ‘walk through’ metal detectors (WTMD), while our cabin bags were passed through X-ray machines.

There was an initial period of shakedowns around the world for this to become effective, and this included the institution of such things as equipment calibration systems, staff training and, later, effectiveness testing by either overt or covert means. The duration of this ‘shakedown period’ varied tremendously between states and, arguably, is still underway in some locations. Noting our previous comments about the global chain nature of Aviation security, this is still an issue for some states to address.

During this learning curve, passengers were subjected to queues, delays and, sometimes, more invasive techniques such as personal ‘pat downs’ and hand search of cabin baggage; all of which, in the eyes of some, has potential for invasion of privacy and infringement of civil liberties. That really starts to set some thresholds for us on our second issue of what the traveller will put up with, and this will be covered in more detail in our next article.

As a result of the screening initiatives we had in place, in a reasonable amount of time, a pretty good global system of detecting hand guns and knives on passengers; and of detecting the same items in cabin baggage. This, when combined with some quite aggressive ‘incident management’ of hijackings, immediately curtailed the number of such incidents. Mission achieved!

Not quite though. As what was soon realised was that explosives are not metallic, and were virtually not detectable by WTMD or early X-ray machines. So, the system that was instituted had achieved an initial objective, but had left a serious vulnerability in another way.

Subsequent development and deployment of second and third generation X-ray systems has dramatically increased explosive detection capabilities for cabin baggage. Various additional measures, such as a random percentage check of passengers by vapour detectors, have also been initiated both as detecting systems and a worthwhile deterrent.

But, to maximise the effectiveness of these systems, screening personnel are trained to have you remove, as far as possible, all coats, hats, wraps, belts, metallic objects, shoes and boots as a method of facilitating effective screening. Not quite ‘naked’, but sometimes inconvenient. And the next generation of equipment is more demanding!

This article has taken us some way towards understanding how SARPs are developed and implemented by states. However, the majority of this actual ‘security stuff’ is done by airline and airport operators.

Do Retailers Make Better Loss Prevention Managers Than Security Personnel? part2

By

Murray Taylor

-

May 2, 2012

Employing someone with a police or investigation background in the role of loss prevention manager was once seen as a logical choice for retailers: Faced with the realisation that people, both internal and external, were stealing company assets it made perfect sense to employ someone who was already catching thieves for a living. However, loss prevention has become a reluctant expense for many retailers due to the difficulty in actually quantifying the return/value loss prevention provides the business.

Retailers have never been more determined to squeeze every last piece of value out of the business and its staff than the present environment of diminishing returns. No longer are retailers accepting that a loss prevention manager’s role is just about catching crooks and interviewing staff. There is a growing expectation that the loss prevention manager can walk into a retail environment and have strong administrative skills around the back of shop and the running systems controlling stock flow/movement; an intimate understanding of the supply chain, stock-take process, mark down cycles, refund procedures and the process surrounding sales (voids, over-rides, cancellations, discounts and so forth). Add to this set of skills the ability to manage at a strategic level, deliver training across a diverse section of staff and management levels as well as carry out investigations and interviews, and you have a fairly extensive set of skills and requirements.

Which brings me back to the original question: Who would make a better loss prevention manager, somebody with a retail background or someone from a security/policing background? It is important to understand that every skill set required for this role is learnable; so in order to answer the first question, we need to answer this question – which skills are easier to learn?

On one hand, you look at the vastness of retail skills required for this position to succeed, and it would be very easy to jump to the conclusion that a person with a retail background wins hands down as the only skills totally outside of retail that have the ability to conduct an investigation; the capability to interview somebody and an understanding of how to put a brief of evidence together. It is easy to assume that these three things would be easier to learn than every aspect of retail.

Well, before you can cast your vote, you need to consider the requirements in more detail because, although there are more retail processes to learn, they are all just processes so, given time and a bit of capability, all of them can be learned with minimal fuss.

To a certain extent, the same can be said for the interview and investigation process.Conducting an investigation, particularly a preliminary investigation, is basically a fact finding mission with the facts put into a particular context allowing a decision to be made regarding the next step/s to be taken.

The investigation process is exactly that: A process and, in the classroom, or a controlled environment the process tends to run fairly smoothly with the desired outcome usually being reached. However when it comes time to actually sit down and conduct an interview with a staff member who you believe has stolen money or assets from the company the process can become very different.

Sitting across from a person who begins to realise that you may be on to them, and you may have just enough information to have them dismissed and possibly charged, becomes a very different situation than the interview training you carried out in the classroom. All of a sudden you have a person who could do any number of things: Become verbally aggressive or abusive, clam up and say nothing, get up and walk out or even become physically violent. This is the sort of scenario that needs to be considered when making the choice of who to select to head up a loss prevention department.

To give you an example – I had a loss prevention manager who came from a retail background, and he was very sound in all of the business’s administration and operational processes. The only process left to master was how to conduct an interview. I did all of the things that you do with a novice at conducting interviews: I had him sit in on interviews as a witness to purely observe the process, and I had him carry out countless mock interviews covering every scenario you could think of.

After a solid four weeks, he was confident and comfortable with his new found skill sets around interviewing, so he headed off to carry out his first interview which was a fairly straightforward
theft issue.

About ten minutes in, it all went pear shaped: The staff member didn’t like the way he was being spoken to and suddenly jumped up, ripped his shirt off and shaped up to fight my manager. After an aggressive verbal tirade, the offender ran out of the store. One month later and several sick days in between, my manager transferred out.

While this is an example of a retailer being unsuccessful in loss prevention, I’m sure that there are plenty that have been successful. Woolworths, one of this country’s largest retailers, has made a significant change in how loss prevention is run. Previously, the head of loss prevention for the Woolworths group came from a policing background and then worked up through the ranks of loss prevention to eventually hold one of the most senior loss prevention positions in the country.

When he retired last year, Woolworths made the decision to replace him with a highly competent and very successful retail executive. while his background wasn’t loss prevention, his understanding of retail and ability to manage people is at an extremely high level. Add to this the fact that he has highly competent national loss prevention managers across each brand (Big W, Dick Smith, Masters among others) who all have extensive loss prevention backgrounds, and this would appear to be a structure that is destined to succeed.

So is one better than the other? I guess only time will tell.

Drug And Alcohol Testing In The Workplace

By

Justin Lawrence

-

May 2, 2012

There is no more vexed issue in the workplace than alcohol and drug testing. Employers are entitled to be concerned about the sobriety of their employees whilst, at the same time, employees are entitled to maintain and protect their privacy.

Whilst, as a rule, drug and alcohol testing in Australia has not been as common as in the United States, this is beginning to change. This is because Australian businesses have now identified and quantified the damage that is caused to various levels of business productivity by drug and alcohol use in the workplace. Lost productivity, absenteeism, injury to property and person, damage to machinery, decreased morale and insurance issues amount to an estimated $6.2 billion loss of productivity each year in Australia.

Up until relatively recently, drug and alcohol testing was more common in industries where mental or physical impairment due to alcohol or substance use would present serious safety concerns. These industries often involved the use or operation of equipment or machinery that, used inappropriately, could endanger the safety of both the operator and other employees. Indeed, industries such as the railways have had drug and alcohol testing enshrined in legislation in some states for about fifteen years. The Rail Safety Act (NSW) prescribes a regime of blood and urine testing for drugs and alcohol for employees involved in rail safety operations in the New South Wales rail network.

As a general rule, there are a number of legal impediments to drug testing in the workplace. These include privacy, consent, relevance to the position, consequences of a failed test and relationships with unions and other employee representatives.

However, the main legal consideration for the workplace is occupational health and safety. If an employer fails to take appropriate action when an employee is adversely affected by drugs or alcohol the employer is likely to be in breach of its legal obligation to provide a safe workplace, free of all of the reasonably foreseeable risks that arise from time to time.

To ensure a safe and secure workplace, an employer might want to undertake drug testing of its employees at the time of hiring, following an incident in the workplace (in the same way that police breathalyse car drivers immediately after an accident), or when they have formed a suspicion that an employee might well be under the influence of drugs or alcohol. An employer might also wish to reserve the right to undertake testing at random times.

From an employer’s point of view, a testing regime provides a twofold benefit of proving drug or alcohol use on the one hand, and deterring future use of drugs and alcohol on the other. Of course, the proof element is particularly critical – even if an employee is apparently intoxicated or adversely affected by drugs, it cannot be conclusively proven unless a test positively confirms that this is the case.

Once employers are satisfied that it is appropriate for them to have a regime of drug testing within their workplace, it is appropriate for them to develop a specific policy detailing the framework for that testing.

The first issue to be enshrined into the policy is the method of testing to be used. Various options are available and all can (and ought) to be administered by external professional organizations. Testing of blood and urine are the most common testing mechanisms.

Blood testing often detects very recent drug or alcohol use, whilst urine analysis detects drug and alcohol use for a longer period of time. It is relatively easy to administer and usually provides very accurate results.

Hair tests are also an accurate, yet far less common, method of testing. In fact, because traces of drug and alcohol use can remain in a person’s hair for a long period of time after use, hair testing can be the most reliable method of testing for alcohol and drugs beyond a two week period or so. However, because of the rather prohibitive cost of the technology needed to undertake hair tests, this method is not often used in the workplace.

Saliva and breath tests are used, but more often than not, they screen the use of alcohol rather than drugs. It is, however, the most unobtrusive and least expensive of all testing methods.

Once an employer has determined that it is an appropriate part of the workplace drugs and alcohol policy that testing be undertaken at certain times, all elements of that policy need to be adhered to. If a policy is formulated but not then followed, the employer’s legal obligation to provide a safe workplace will have been breached as the employer has, by formulating the policy, identified a risk which it has then failed to remove.

Privacy is a crucial issue for employees in respect to drug and alcohol testing. Not only is the actual test itself an invasion of the employee’s privacy (by the mere fact of the insertion of the needle or the production of a urine sample) but the method of collating, storing and reporting test results touches on significant privacy issues. These elements of the testing process are likely to be categorized as health information and, therefore, very sensitive.

The National Privacy Principles require that the collection of personal information be necessary when comparing the risk to the degree of invasiveness undertaken by the testing itself. This principle ought to be satisfied in workplace situations given the employer’s obligation to create and maintain a safe workplace environment. However, it will not relieve the employer of its important duty to retain and protect employees’ privacy at each stage of the testing process.

Once a test positively shows that an employee is under the influence of drugs or alcohol, the process should move quickly from the testing stage to the disciplinary stage. Employees must be fully aware of the consequences of a positive test and the employer must not be arbitrary or capricious in the handing out of disciplinary action. In order for the testing and punishment processes to be legally binding, the discipline ought to be prescribed in advance – that is, that all employees must be aware of what a positive test means to them and their position within the organization before the test is undertaken.

In addition, the possibility of an employee refusing to undergo a test must be considered. The employer should assess whether a refused test equates to a failed test. In so far as drink driving laws are concerned, this is most certainly the case. The penalty that applies to a motorist who refuses to submit to a breath test is the same as if the result of the test was that the blood alcohol content was at the highest recordable level. At law, an employer will have no right to force an employee to undertake a test if the employee refuses to do so.

To try to bring some legal weight to the situation, an employer might wish to make compulsory testing a condition of employment. The most obvious way to do this would be to incorporate the testing policy into the contract of employment. If the contract is assessed by the relevant workplace relations overseer (which at the time of writing is The Workplace Authority) as fair to both parties, then the employer will have the right to enforce the disciplinary mechanisms set out in the policy in the event that the employee refuses to undertake a test, or if a failure of the test occurs.

Employers also need to be wary of the fact that testing methods detect an employee’s exposure to drugs, often in the days (and sometimes, weeks) prior to the tests. Consequently, an employee who has used or come into contact with drugs in the days or weeks before testing might return a positive test notwithstanding that it has been some period of time since that use or exposure. This means that although an employee has tested positive to traces of a prohibited drug, he or she might not be impaired by that drug in any way due to it having entered the system some considerable time prior to the test. A drug such as cannabis is detectable in the system up to six weeks after use. Testing ought to, therefore, be more properly geared towards detecting the impairment of employees rather that detecting their use of or exposure to a particular drug. In any event, an employee might be within his legal rights to argue that his activities outside of work (whether legal or illegal in nature) should not in any way affect his employment situation unless those outside activities prevent him from properly undertaking his role at work. If testing determines only exposure rather than impairment, the employee’s argument is a reasonable one. As a minimum, the employer’s policy ought to prescribe that testing will be compulsory where a reasonable suspicion of impairment is held.

Conclusion

With all of these issues in mind, it is clear that if a company is thinking of testing its employees for drug and alcohol use or impairment, it must first establish a specific testing policy. Ideally, that policy would be formulated in consultation with the employees (or their representative organization) with a view towards an accepted and collaborative policy, rather than one imposed ‘from on high’. The policy would have as its essential elements information about testing procedures (including where, when, how and by whom testing will be undertaken), privacy information (such as where samples will be tested and stored and for how long) and consequences of a refused or failed test (including suspension or dismissal of employment or pecuniary penalties).

The policy ought to be formulated and agreed to before any testing begins. It ought to be documented in detail and circulated to all current and future employees. Ideally, it will form part of new employment contracts for all incoming employees and for existing employees entering now contracts of employment.

The policy should also detail a range of pre-detection procedures to enable susceptible employees to avail themselves of support and counselling services prior to drugs and alcohol becoming an issue in their lives and, therefore, in the workplace.

Cases decided by the Australian Industrial Relations Commission (AIRC) on the question of workplace drug and alcohol testing seem to be more inclined to uphold the legality of a testing regime where it is part of an overall drug and alcohol policy, and where the risk of affected or impaired workers represented a real danger to themselves and the workplace as a whole. The testing policies that have been approved by the AIRC have been determined to have been reasonable in the context of the objectives of the policy on the one hand, and the rights of employees to privacy and fairness on the other.

Employers have an obligation to provide a safe workplace and where workers are influenced by drugs or alcohol they face a risk to safety. Employers may wish to incorporate drug and alcohol testing into an overall plan to promote and maintain safety within the workplace. They will be legally entitled to do this so long as the benefits to safety outweigh all of the disadvantages that come from testing.

Preparing For Life After Security

By

John Bigelow

-

May 2, 2012

By Ray Whiting.

In 2000, my wife and I started an alarm installation, guard and patrol business in Victor Harbour, a seaside town 80km south of Adelaide, South Australia. I previously had ten years experience as a technician with companies such as Chubb and Wormald and a further 20 years experience as a guard. My wife, who has a good technical background, managed the office and staff. The business consisted of three alarm technicians, two patrol officers and several casual guards. Our core business was the electronics division the manpower division; evolved to service our existing clients.

Within five years the company dominated the market in our region as we offered a unique point of difference from our competitors. Once we had reached our 9th year, we found that our client base had grown to such an extent, that we needed to review our direction and commit to and plan our exit strategy. We had initially set a long-term goal to sell the business after 10 years, so it was good to see we were on track. Our decision to exit was a lifestyle choice based on our ages and desire to pursue other interests and goals, and to ensure we did not burn out or fall into the trap of working for so long that it would impact upon our health, and force us into a fire sale.

Once committed to selling the business, it was estimated that the process could take 12 to 24 months. This would include spring cleaning our operations, tightening the nuts and bolts, so to speak, as well as identifying potential buyers to whom we could market the sale. We enquired about the appropriate sale mechanisms and subsequently met with a conveyencer, a broker and a solicitor. We realised none of them had any knowledge of the industry, and decided to initiate the sale ourselves. This involved the preparation of a detailed company prospectus taken from draft to final presentation copy within a few months, with no outside help other than the insight gained from a couple of consultations and information available on the internet! This saved us the expense of set-up fees and commission. A solicitor was engaged at the final contract stage of the negotiations.

Before we could offer our business for sale we had to ensure all of our commercial, corporate and government clients were on a contract. When a contract is passed on from the vendor to the purchaser, a letter (novation agreement) authorising the handover of contractual agreements must be in place. This can be time consuming, I would recommend entering this as a clause within the initial contract with a client to ensure that contracts can be upheld upon sale of the company and, therefore, a separate novation contract would not be required and would preserve privacy throughout the due diligence period.

In providing due diligence to any prospective buyer, let’s not forget that they may also be a competitor. So, handing over details of your operations is a bit daunting. Once the vendor receives a reply to our prospectus (an ‘offer of intent’) and it is accepted, the signing of the confidentially agreement protects the vendor from the misuse of any information supplied to the purchaser, and is an indication you have a serious buyer. Be prepared for a buyer to request an exclusivity agreement that locks you into negotiation with them only.

The supply of more detailed information other than the general overview that the prospectus provides must now be furnished. Financial statements as well as departmental breakdowns detailing separate figures for service, installations, upgrades, monitoring, alarm response, patrols and guards must be provided. The prospective buyer may not have an interest in purchasing the entire business, and this will give the option of adjusting the sale to either electronics or manpower services as we did.

In our case, we only sold the big ticket item – the electronics / monitoring division – however maintaining the manpower side of the company provided support in the form of alarm response to the purchaser, and provided additional value to the sale of the electronics division, especially as it helped reduce attrition because clients still have a relationship with us after the sale. The manpower division also continues to provide us with an income at a fraction of the hours we used to work.

During the negotiations, it was important to consider the employees; as we were a family business with our eldest son and his schoolmate employed as technicians. We had an obligation to see that their future employment was secure. The purchaser did hire our son, and our other technician was placed with another company.

The purchaser, as part of due diligence requested to see three months of incident reports to see how ‘clean’ our systems ran, an easy enough task thanks to webquery access where we could access control room data directly without having to request it from the control room. The most desirable asset for acquisition is the number of monitored lines. Secondary, is additional contract service agreements for service and routine maintenance. The cut over of monitored lines will need to be seamless from the outgoing control room to the incoming control room, a review of your obligation to the outgoing control room in terms of notice and any other contractual obligations needs to be considered.

As a bureau it was paramount that we owned the dialler phone line number (receiver) that each clients alarm system reports on. Initially this was not the case for us. When we started our business, we were allocated a shared receiver number. Some 18 months later, at our request, the control room then allocated our own receiver number. The porting of clients is impossible if using the monitoring stations shared receiver number. It was a preferred requirement that the receiver number(s) be an asset for acquisition purposes. As we had a good relationship with the outgoing control room, they were cooperative with our request to provide the incoming provider with an electronic NTBC file, which was a download of clients from ADSW (Access Detection System for Windows, monitoring service software). This went ahead during the latter phase of negotiations as the file had to be uploaded and checked prior to the agreed sale/transfer date which was to be the date that the actual contract of sale was to be signed! So the main asset was already technically in their possession, but could not be officially cut over until the agreed date and time.

Before estimating the value of the business, we collated the last three years of financial statements and obtained current year-to-date estimates from our accountant. We used a formula we thought best suited our type of business with high annual growth rate to capitalise on that growth. These same figures were then readily available to be supplied to the purchaser on request.

Rather than offering our business to the general market place through standard advertising, we selected a handful of Adelaide-based companies that we thought would be in a strong financial position to purchase, and whom would benefit from expanding their existing enterprise into our regional area. With our company in a healthy state, we maintained confidence throughout the sale process. Our philosophy was that we did not have to sell. Our business, already known for its professionalism and tight geographical market and location, was highly desirable. This was not a forced sale. Our future lifestyle was dependant on a high yield, and we got it. We now have a fruitful relationship with the purchaser, and may have the prospect of selling them our manpower services down the track; which would be a completely new venture for them.

The negotiation part of the deal is always daunting, and you should go through the contract with experienced negotiators. Know exactly what you want before you enter negotiations, and do not agree to anything or sign anything without first going home to consider the offer. Request all offers in writing (email) then, if needed, consult your solicitor or accountant. I would expect four meetings before a final resolution is reached.

The one clause that will give concern is the ‘claw back provision’ – the retention of part of the agreed sale price for a set period during which any attrition of monitored clients can be offset at an agreed rate. In our sale, we agreed that the reverse should also be considered – that the same amount be added if additional clients were put online as a result of completion of jobs or referral. Retaining the manpower side to support the purchaser, we were confident of minimal attrition, and hoped that any attrition would be offset against new clients.

The company prospectus should have the following content:

Organisation Structure: List management and employee positions and duties.
Skill Retention: Detail qualifications, experience levels and scheduled refresher training required to ensure the skills of staff are maintained. Note allocation of responsibility as appropriate to each staff member – any new or additional responsibilities for staff members decided upon by the successor is to be documented and communicated to staff during the transition period
About the Directors: Brief overview of qualifications and experience of directors/owners
Business Profile: Comprehensive view of your beginnings, growth and current position, include overview of client base, number of commercial and domestic clients, preferred alarm equipment used and your point of difference that separates your business from the others in your area.
Company Profile: Company philosophy, memberships, accreditations, insurances and licenses
Marketing Plan: Advertising, marketing budgets, website, logos, letterheads, branding and future expansion.
Succession Strategy / Timetable: Short list potential successors, supply company prospectus and sale price, confirm interested successors, supply company information and due diligence, finalise sale price and contractual agreement and transition period .
Risk Management: Offer services of management for a predetermined time during the transition period to assist with all facets of the hand over.
Legal Considerations: Confidentiality form supplied by vendor, sale of business to be compliant with the “Sale and Conveyancing Act”, nominate legal services provider.
Contract Variables (Negotiable Considerations For Contract Of Sale): Five per cent deposit paid by purchaser, area of restraint of trade, period of restraint of trade, period of confidentiality, period of non-solicitation of employees, subject to finance approval by purchaser`s bank, land involved with sale of business, property that is currently part of the business, chattel mortgages, finance and personal vehicles, long services leave, personal leave and associated staff entitlements, exclusive agency, franchises and rights.
Plant and Equipment: Complete list of all assets to be included in the sale.
Client list: Government, Corporate, Commercial and Domestic.
Price & Terms: Replies to be lodged within 14 days from receipt of the document, all questions and enquiries to be in writing (email), exclusive rights to negotiate to be determined, price and conditions to be negotiated prior to accepting letter of intent.
Letter Of Intent: Deposit price as agreed, sale price and conditions as negotiated If accepted, full disclosure of financials supplied by the accountant, letter of intent will be accepted or declined within seven days of receipt, contractual agreement supplied by buyer to follow due diligence.
Current Value Of Business: Price Range calculated on Multiple of Cash Flow Method which is based on Sellers Discretionary Cash Flow (owners benefit)
annual pre tax profit + owners salary + owners benefits + interest + depreciation
Multiples then applied as required (x 1.5 / 2 / 2.5 / 3)
Percentages Of Above Formulae: 70% of current year to date; 20% of previous year; 10% of year prior to that [adjust the percentages over the three years to suit your best results, must total 100%]

Note: There are three main types of calculations broadly accepted by accountants:

Cash Flow Method Calculation: Add your profit before tax, add any salary for the year, add cash payments, dinners, trade shows with accommodation etc. Add any interest paid (loans etc) add depreciation on any vehicles or plant. The total for the current year is multiplied by 70%, do the same for the previous year and multiply by 20%, then do the same for the year before that and multiply by 10%. Add these together. At this point it is your choice to multiply that figure by 1.5, 2, 2.5 or 3. This should give you a fair indication as to what you can ask.Remember, if you go too high you will not get any offers. Once a price has been worked out then that should be your bottom price when you put forward your asking price. Word it as a “price range” between this and that.
Profitability Breakdown per Division: (Owners benefit calculation not used, Profit and Loss only)
Electronic services, monitoring, guards, patrols, cash in transit.

Note: Include (all figures supplied are approximate, exact calculations can be formulated on receipt of documentation supplied and certified by companies chartered accountants).

Business Review: Include phrases such as: “Well established business”, “sales and profit risen consistently over past three years”, “significant sales from repeat customers”, “revenue from recurring charges”, “management (in part) and staff to stay on if required”, “dominant market share, desirable geographical area of high growth”, “profitable projected performance”, “extensive client base, excellent growth capabilities”, “high return on investment.”

Confidentiality Agreement: Supply an agreement to all interested parties and have it signed prior to divulging any details about your company.

Summary: Finish the prospectus with a positive overview of the benefits of purchasing your business.

Disclaimer: The information contained here is based on the author’s experience and is not intended as legal or operative advice. It is supplied as a true account for example only.

The Weak Link

By

John Bigelow

-

May 2, 2012

By Lamie Saif.

Looking at the CCTV camera market today, we can see that it is booming in three areas: Hardware, software and, most importantly, demand. While the hardware and software side of the industry has made significant advances in the last decade, as have the requirements of the customer, the planning and installation companies do not appear to be progressing at the same rate. In fact, many integrators still approach CCTV system design and installation the same way they did when CCTV systems first appeared in the market.

Planning and installation procedures remain unchanged, with a mix of site-gathered information and personal experience used to plan the CCTV surveillance project.

The project’s requirements are often based on little more than an estimation of the number and type of cameras needed, and the choice of mounting locations; but such guess work often leads to uncertainty and extra work during the post-installation phase.

The post-installation man-hours required can be significant because of the need for testing, using testing models and/or using mini monitor-testing devices. Many readjustments may be required to correct height, angle of view, focus and lens selection – the camera itself might even need changing.

Many camera companies provide calculation tools for use in the mounting of their products but a lot do not; other than a simple lens calculator that provides little help in choosing the camera’s optimum height or its angle of view.

To understand what a downward-pointed camera can see and cover, I will illustrate its properties with the help of some sketches.

Fig. 1 is a side view of a tilted camera. The inner and the outer red lines represent the upper and lower limits of the camera’s vertical view angle. From this illustration, we can also see the camera’s maximum and minimum horizontal limits at ground level, as determined by the camera’s parameters (lens, sensor) and its mounting parameters (height, angle of view).

So the camera can see only the feet of a person standing on the edge of the camera’s maximum viewing limit and the whole body, but not the feet, of a person standing on the edge of the camera’s minimum viewing limit.

Fig. 1

Fig. 2 (2-D top view) sketch shows the exact shape of what the camera can see, or the true field of view, (FOV) covered by the camera at ground level.

Fig. 2

Changing the detection level to one other than ground level, will change all of the camera view distances according to the detection level height.

Fig. 3 is a side view of a tilted camera. The inner and the outer red lines represent the upper and lower limits of the camera’s vertical view angle. From this illustration, we can see the maximum and minimum horizontal limits at object level (the object level in this article’s sketches is two metres) as determined by the camera’s parameters (lens, sensor) and mounting parameters (height, pointing angle).

So the camera can see the whole body of a person standing on the edge of the camera’s maximum viewing limit at object level, but only the top of the head when that person is standing on the edge of the camera’s minimum viewing limit.

Fig. 3

Fig. 4 (2-D top view) sketch shows the exact shape of what the camera can see or the true FOV covered by the camera at the object level.

Fig. 4

By comparing Fig. 2 and Fig. 4 we can see how the FOV size and horizontal distances have been changed by changing the height of detection level from ground level to an object level of two metres high.

Looking at distances referred to in these examples, we can see that the camera can detect a person entering the monitored area at 17.1 metres from the camera but we can only see his face at 8.6 metres.

The other factor that affects the quality of monitoring is the depth of field (DOF). As shown in Fig. 5, it is not enough to detect a person, but this person should also be in focus at the detection distance.

Fig. 5

Graph 1

Two important factors that should also be taken into account are recognition and identification. These are related to the camera resolution level which, together with other camera parameters such as lens, height and pointing angle, can result in unacceptable image quality.By looking at the following graphs, we can see that even slight changes in camera parameters can result in very large differences in distances.

We can see in Graph 1 how the camera’s height influences the maximum (max0) and minimum (min0) ground level detection distances.

We can see in Graph 2 how the camera’s height influences the maximum (max2) and minimum (min2) object-level detection distance (object height in this case is 2m).

Graph 2

We can see in Graph 3 how the camera’s pointing angle influences the maximum ground-level detection distance at different heights.

Graph 3

We can see in Graph 4 how the camera’s pointing angle influences the maximum object-level detection distance at different heights (object height in this case is 2m).

Graph 4

We can see from these graphs that small changes in camera height or pointing angle can result in big changes as to what the camera can see.

An article published in a UK newspaper states that about half of the UK’s CCTV cameras are not properly installed, while here in Sweden, a company says that the police are happy with their cameras because they can provide very good identifiable images.

However, when looking at what type of camera they are using, we can conclude without doubt that it is capable of delivering high quality results because it is an 8-megapixel camera. But when talking price, this type of camera may not be the right choice, because if we know what is needed and what the camera can deliver, then we might only need one that is half the price of an 8–megapixel camera.

To conclude, it is obvious that today’s estimation methods cannot visualise what the camera can see during the installation phase, and reaching a level of accuracy depends very much on the installer’s experience and his ability to visualise camera views.

In order to solve today’s camera installation problems, here are two suggestions:

Many tests and re-adjustments should be carried out during the post-installation phase to reach the required level of monitoring.
Choose high-end, expensive hardware that can help to reduce inaccuracies.
This means that today’s planning costs are much higher due to the need for more man-hours to complete the task, as well as the need for more expensive hardware.
This problem can be solved by using mathematics, not estimation.
The following example shows how calculations can help to accurately determine how a monitored area can be covered by a PTZ camera. I have chosen to give an example with only two lens settings (min 20mm and max 180mm) and with only two tilt-angle settings (10 degrees and 4 degrees) to make the example easier to understand.
The sketch shows the top view of the PTZ pan movement arcs. Each arc is related
to certain parameters but I will not explain them all.
The outermost arc at 217.3m is where the camera can detect an object entering the monitored area.
The second important arc at 184.7m is where the camera can detect the face of a person entering the monitored area. For both arcs, the lens setting is at 20mm and the tilt is 10 degrees.
The third important arc, at 180.1m, is where the camera can detect the face of a person entering the monitored area at a lens setting of 180mm, with a tilt of 4 degrees.
The fourth important arc at 182.3m is where a person’s features can be detected.
The fifth important arc at 148.3m is the minimum limit of DOF.

So, to identify a person, he should be within the 180.1m arc so that the face can be seen and, if the number of pixels is enough, a true identification can be made within that arc of 182.3m, and before the 148.3m minimum DOF limit has been crossed.

Lamie Saif is from L. S. Data & Monitoring Consulting. Lamie can be contacted by email at:lasaif@lssurveillance.com or www.lssurveillance.com

Maintaining Professional Competency. How Effective Is Your Training?

By

John Bigelow

-

May 2, 2012

Recent research revealed that many suspects believe officers train two to three times a week with their firearms. In reality, most agencies only train about once or twice a year, averaging less than 15 hours annually. In contrast to this frequency of training, those same suspects revealed that they practised on average 23 times a year (or almost twice a month) with their handguns.

If you ask officers how often they train with their duty weapons, the standard response will be ‘to requalify’ – most likely only once a year. However, firearms training needs to be relevant and realistic and it must also be conducted regularly, occurring close enough to incidents to assist officers in making proper tactical decisions.

So the question is, “How often should officers be training with their duty firearms?”

No court of law has ever addressed that specific question. While there are a lot of cases that have addressed the content of training, no court has come right out and said how many times officers need to actually train or qualify. Most often, that magic number is left to the various state regulators and most only address ‘basic’ firearms training.

Notwithstanding those mandates, officers should train at least four to six times a year with their firearms. The International Association of Law Enforcement Firearms Instructors, a body of professional firearms trainers, set that level of training for good reason; the psychomotor skills needed for firearm manipulation is such that without constant and frequent reinforcement, those skills will deteriorate. Many legal authorities suggest that annual, or even semi-annual, firearms training is insufficient for the purposes of avoiding liability.

If you fall into the category above – having firearms training once or twice a year – you may want to take a look at what authoritative bodies are saying about that level of frequency in addition to the substantive issues regarding that training.

Content

What should be covered during these training sessions? In addition to classroom instruction of deadly force policy and procedure and other topics, most trainers suggest the range work should include:

Clearing stoppages with either hand
Drills that simulate malfunctions
Emergency tactical reloading with either hand
Manipulation of safeties and de-cocking levers with either hand

As well as the usual and customary range topics like:

Low-light and judgmental (decision-making) shooting
Shooting while moving to cover
One-handed firing
Giving verbal challenges
Firing and clearing malfunctions from various ‘officer down’ positions
Engaging multiple targets

In the US, the message from the courts is that training should cover ‘whatever officers can reasonably be expected to confront’, and therefore include at minimum:

Frequent training
Moving targets
Reduced light
Judgmental training
Use of cover
Realistic environments
Policy reinforcement
Force level integration and transitions
Relevance to assignments

New research by the Force Science Institute indicates that time and cost concerns ‘significantly compromise the suitability and sufficiency’ of current physical force training. The findings result from a three-year assessment of public safety training in the US, Canada and UK. The research evaluated the foundation of training paradigms, curriculum and teaching methodologies for officer safety performance in use of force situations, and offered recommendations for improvement. To create a meaningful context, the status of training in several countries was assessed, as public safety practices across western societies are generally very similar.

The average officer, within months of leaving initial training, will be able to describe how a given control technique should be used, but will have ‘little ability to actually apply it effectively in a dynamic encounter with a defiantly resistant subject’. At the rate training is typically delivered, it could take the average officer up to 45 years to receive the number of hours of training and practice in officer safety techniques that a student athlete gets in competitive sports during the usual high school career.

Many training programs are not employing modern research-based methods of successfully teaching psychomotor skills, a shortcoming compounded by the fact that current record-keeping fails to capture even the most elementary relevant information about the dynamic nature of real-world assaults on officers. Wherever they are based, if officers are unprepared to meet the various threats and levels of resistance and violence they face, it can impair their ability to make good judgments, to affect control, and to avoid injury or death to themselves and to innocent civilians.

The research team included internationally recognised authorities in biomechanics, kinesiology, exercise physiology, forensic psychology, and other relevant disciplines. Their bottom-line conclusion: time and cost concerns are so restrictive that they significantly compromise the suitability and sufficiency of current physical force training. An unintended consequence is that current training may leave officers more vulnerable, despite the best attempts by trainers and agencies to deliver an effective training package.

Competency Obligations

Creating training with appropriate content and ensuring it is conducted regularly for appropriate skill acquisition and maintenance is a critical first step that needs to be seriously addressed. The next step is in putting officers through the training and determining competence at the other end.

‘Competent’ implies that they are capable of ‘doing the task required’. However, there is a vast difference between ‘passing a course’ and being ‘operationally competent’. The key difference lies firstly in the validity of the training content relative to the job task, and secondly in the decision of what ‘standard’ is deemed to be competent.

The goal of a tactical instructor is to prepare officers for that aspect of their jobs that has the potential to put them in harms way: To prepare officers to survive violent confrontations. This can be expressed as three essential criteria – safety, survivability, consequence. To prepare officers any less is to fail to prepare them at all. A critical aspect of fulfilling this obligation lies with assessing competence in all aspects required for effective operational duty.

If an officer has good physical skills, but doesn’t understand the operational guidelines regarding when and how they may use these skills, they are not yet competent as they do not possess the complete range of required skills. Conversely, if they have a comprehensive understanding of operational guidelines, but their physical skills are not up to the required standard, they are not yet competent as they are still missing an essential part of the required content. If they have good skills and competent knowledge, but don’t posses the ‘character’ to make critical decisions within the context of violent confrontations, they are, again not yet competent for certification to operational status.

Instructors would be remiss in their professional duty to that officer, other officers, and the public, if they certify an officer to operational status for use of force if they are not yet competent in some aspect of the training. If they are not ready the instructor has an obligation to make the decision to deem them ‘not yet competent’, pending remediation and/or counselling.

To maintain competenct, realistic, appropriate and regular training combined with proper attitude and awareness is essential. Strategies should be tested under stress to see if they will work under realistic conditions similar to those encountered on the job (stress inoculation). If officers don’t train this way chances are they won’t be prepared for the reality of a violent confrontation.

The current industry requirements for officer safety, while an improvement on past standards, still falls short of the mark to adequately prepare officers for ‘operational reality’. Compare this with law enforcement and military agencies around the world, which utilise tactical and reality-based training to properly prepare their people for real operations. While most public safety agencies undertake training of this nature, and therefore obviously recognise the benefits of it in preparing officers, this doesn’t flow on to the security industry. Many instructors and training providers fall short of fulfilling their duty of care to officers by not training them appropriately. In the future this aspect will no doubt raise concerns and may well be tested in courts, as it has already in the US.

Violence is violence, and while the context of application may vary between job role and function (the skills for empty hand, handcuffs, batons, firearms being consistent) the better trained officers are, the safer they and the community are, and the more professional their workplace conduct will be.

The Future Of Alarm Response In An Increasingly Technological World

By

John Bigelow

-

May 2, 2012

The future is an amazing place full of wonder, mystery, possibilities and intrigue. However, it is also full of change. One only need look at what has taken place in the security industry over the past decade to see to what degree things can change in a very short period of time. As recently as 1995, the internet was a relatively new phenomenon and not unlike an ethical politician, in that many people spoke about it with wonder and hope, but few people had ever seen such a thing.

Now, less than twenty years later, the internet pervades every aspect of our daily lives. We use it for work, personal communications, shopping, social interaction – it has become as much a part of our daily lives as the air we breathe. It has also had a significant impact on security. The past decade has seen traditional analogue technology such as CCTV, access control, intrusion detection and the like migrate to the digital realm. We have seen the rise of IP surveillance and video analytics, biometrics and remote monitoring – all things that a mere ten years ago would, to many, have seemed the stuff of science fiction.

There can be no doubt that the future brings change, which begs the question, “What does the future hold for the alarm response and patrol sectors?” The response and patrol functions, along with cash escort, crowd control and security guarding, has always been one of the pillars upon which the security industry was built. However, recent developments such as the rise of remote monitoring, the increasing costs of training to both entrants to the industry and training providers ,and the introduction of significant new barriers to entry into the security industry, have precipitated a significant change in the security landscape. If left unchecked, will these developments herald the end of the once-thriving response and patrol market?

Some industry experts believe it is already underway; that ten years from now, the alarm response and patrol function will be irrevocably altered as service providers lean more heavily on technology and less on actual people – opting instead, to utilise tools such as remote monitoring and video verification. The big question is, are we seeing a short-term trend in response to changing market conditions, or is it a longer-term move towards cutting costs and rationalising resources?

According to Nick Frangoulis of Wilson Security, any shift away from the traditional use of security personnel towards a more technical solution should be more directly attributed to a decrease in the quality of the services offered by many (but not all) providers in the industry over the past ten years; as opposed to any real desire by the customer to embrace technological change.

“People generally don’t like change. They will stick with what they know unless they feel they have no choice but to change. This might be because they simply cannot find a service that they are happy with at a price point that is acceptable, or it might be because the alternative offers a significant enough cost-saving to make the transition worthwhile. However, as a general rule, people will stick with what they know. That said, over the past decade, more and more patrol companies have begun subcontracting to other licensees. It might be in an effort to save money or to cut corners – either way, it is a practice that is neither good for the customer nor the industry. Having seen many of these subcontractors over the years, it is no wonder that some customers might consider alternative solutions.

“The key to a successful patrol and response business is to be able to offer your clients a high-quality service that is sustainable over the long term at a price that is competitive. That can only be achieved through the use of employee-based networks, not through subcontracting. When you subcontract, you lose control of your quality,” said Nick.

According to John McMellan, Chief Executive Officer of Wilson Security, the future viability of a patrol and response business will depend largely on two factors: The quality of the business’s service offering and the business’s ability to recruit and, just as importantly, retain the right staff. “All the best systems, procedures and technology in the world won’t help if the business doesn’t have the right people to oversee, drive and deliver its service,” he said.

The traditional employment practice within the industry has always been to recruit people who already hold a security licence. However, the inherent flaw in this practice is that the HR or operations manager is limited in his or her choice of candidates. They can only choose from a small pool of available and qualified applicants. A more prudent practice might be to find the right people and then have them trained. It is a practice that has been common in military special forces units for decades. Rather than recruiting regular infantry soldiers, despite the fact that such people may already have good experience and a strong knowledge base upon which to build, many special forces units would rather recruit cooks, mechanics and clerks where possible. The theory is that such people come to the unit with a good attitude, a desire to learn and be better, but no preconceived notions of how things are supposed to be done.

The same might be said for a security provider. Where possible, hire on attitude rather than skill or experience as it is much easier to teach skills than it is to teach someone the right attitude. Similarly, a recruit with the best skills and a bad attitude will most likely only ever be a poor investment.

Once you have the right people, the key, according to Nick, is to keep them. There are two keys to retention: The first, is to provide employees with a vision; a clear career path that shows that person that he or she has a future within the organisation. The second, is to provide that same person with diversity and a wide range of skills and experience. A patrol officer who spends lengthy periods every night travelling around in isolation, conducting patrols and alarm responses, will burn out in a reasonably short period of time if left to his or her own devices.

People need to be kept fresh, to be stimulated and challenged. To do this, they need to be occasionally rotated off of the road and given stints in other positions such as working in the control room or the office. This not only keeps the employee fresh, it also gives them multiple skills and makes them more valuable while also giving the business a greater redundancy of systems.

It also helps to minimise the attrition rate within an organisation because staff are less prone to becoming bored. Furthermore, when more senior positions become available, you will have internal people that can fill them because they will have the necessary knowledge and skills across multiple areas of the business.

Technology

To try and ignore technology or claim that it is not going to have a significant impact on the future of the patrol and response sector, much like it has upon the rest of the security industry, would be akin to trying to claim that swimming won’t make you wet. Technology will undoubtedly revolutionise the patrol and response function, but not necessarily in the way that most people think.

Of course, remote video monitoring will have a significant impact on the alarm response market in the coming years but it is unlikely that the industry will see a dramatic shift away from human resources to electronic resources. A video alarm is great in that it can help to increase officer safety by limiting situations where patrol staff blindly walk into a situation. It can also help to decrease false alarms while speeding up the deployment of police to serious incidents. However, alarm response and, more particularly, patrols are about more than simply catching an offender. A good patrol service should be proactive. It is the role of the patrol officer to identify and negate potential issues before they become a problem. For example, to identify a door that has been left unlocked so that a break-in cannot occur, or to turn off machinery, taps or lights that have been accidentally left on, thus minimising the risk of theft, flood and fire. Regular patrols also act as a deterrent to would-be offenders.

Therefore, as it is unlikely that the future will see patrol officers replaced entirely in favour of video alarms. The greatest impact technology may have on the patrol and response sector in coming years will most likely be to help make human resources more effective. For example, a combination of GPS systems, customer management systems and workflow allocation software would enable a security company to know where all staff are at all times, what jobs require immediate attention and which jobs need to be reallocated, ensuring an efficient workflow. This would ensure that officers do not have to rush from one side of town to the other to get to jobs, and that patrols can be allocated to another officer if the assigned officer is delayed, and so on.

This technology also enables a layer of accountability that was not previously possible. It enables companies to track how long patrol routes are taking, how many visits each client receives each night and, therefore, how many patrols to bill, how long an officer was onsite and when. All of this information can be compiled at a moment’s notice and given to the client so that the client can see what they are actually paying for.

Furthermore, technology is providing more sophisticated, significantly-enhanced levels of officer safety. Mobile computer and communication systems mean that officers can communicate more effectively with control room staff, that officers can be tracked and monitored during incidents and that, in an emergency, officers can be located and given assistance in the fastest possible time.

The next few years will see significant change in the alarm response and patrol market, and those who wish to survive will need move quickly to ensure that they are in a position to take advantage of new technologies such as video monitoring, as well as improvements in officer safety, workflow management, transparency and accountability. Cutting costs and subcontracting or offering cheap services will always win a few clients in the short term. However, in the face of emerging technology, it is an unsustainable business model that will eventually lead to collapse as larger, smarter clients look for security organisations that can provide a stable, sustainable, accountable and transparent high-quality service.

A Deadly Game: How Outlaw Motorcycle Gangs Are Infiltrating And Manipulating The Security Industry

By

John Pettit

-

May 2, 2012

In the post-war era of the late 1940s members of the working class were drawn to the freedom and risk offered by the motorcycle lifestyle. Having just returned from the war many young men found themselves alienated from society. Forever changed by the horrors of war these men soon became society’s misfits and outcasts. Searching for somewhere to belong many gravitated to the motorcycle culture to replace the camaraderie, excitement and danger that they had become accustomed to during the war, something that mainstream society no longer offered.

Members of the biker culture soon became known for their beloved Harley-Davidsons, social non-conformity, and loyalty to the biker group above all else. Thus a new social institution was born. This social phenomenon was repeated to some degree after the end of the Vietnam War 30 years on. More recently a motorcycle sub-culture has emerged that attracts members of society alienated by criminality and lawlessness rather than the ravages of war. These days, groups associated with this motorcycle sub-culture are colloquially known as Outlaw Motorcycle Gangs or OMG’s for short.

Typically these biker sub-cultures are headed by a small core group of individuals who ultimately derive all the financial prosperity from the organisation’s criminal enterprises at little personal risk. In contrast, the rank and file members receive little in the way of financial benefits while accepting all the related risks from being associated with an unlawful sub-culture. The rank and file appear happy to be linked to the ‘brotherhood’ and the associated tribalism that membership of this exclusive club brings. Their rewards are the good times, excitement, danger, risk taking and the sense of belonging that comes from the outlaw lifestyle.

The OMG lifestyle not only attracts blue-collar workers, but white-collar professionals as well. Membership for professionals who yearn to dabble on the wild side comes at a price. They are expected to provide their professional services in lieu of direct criminal involvements to advance the clubs’ criminal enterprises. For example, doctors are called upon to administer medical treatment to seriously injured members whose injuries would attract unwanted attention of the authorities had mainstream treatment been sought. Accountants provide advice on such matters as company structures and tax avoidance schemes. Chemists supply glassware to assist in the manufacture of illicit drugs and knowledge of the processes involved in its manufacture. Solicitors assist OMG’s with legal representation for club members and money laundering using their trust accounts as a clearing house for proceeds of crime. There are also known incidents of members of the law enforcement community providing information relating to ongoing investigations into the activities of OMG’s. OMG’s are apt at cultivating relationships with these professions using friends and family connections. Whether providing their services directly or indirectly, these professionals act as enablers of organised crime.

More than 35 different OMG’s are known to operate within Australia, most having multiple state chapters. It is estimated that there are over 3,500 fully patched club members together with another 20,000 associates and nominees. The Gypsy Jokers, Rebels, Coffin Cheaters, Bandidos, Black Uhlans, Hells Angels and the Finks are known to have the most nefarious reputations. Many of these OMG’s now have international affiliations. The lure of quick and easy money has cemented the link between OMG’s and organised crime. Traditionally these OMG’s have sought to exploit drug trafficking, firearms importation, counterfeiting, tax evasion, extortion, money laundering, trafficking in stolen goods, prostitution and wildlife smuggling to generate income. Their commercial endeavours have not been limited to criminal enterprises, but have also extended into legitimate businesses. Often these businesses are used as fronts for illegal activities.

In many respects the business structure and operations of OMG’s are not dissimilar to those of legitimate businesses. As a business entity OMG’s actively search for criminal opportunities that they can exploit to make money. OMG’s are not indisposed to seeking criminal opportunities under the umbrella of legitimate businesses. Some years ago OMG’s infiltrated the pharmaceutical industry to facilitate the legitimate importation of pseudoephedrine for the illicit manufacture of amphetamines. Police sources estimate that OMG’s now control 75% of the Australian methamphetamine trade.

Recently reports have emerged of OMG’s attempting to infiltrate the security industry, in particular the crowd control sector. While newspaper reports suggest that this situation dates back to at least 2004 it is highly probable that this situation predates the crowd control industry being subjected to regulation and licencing. Revelations from the Australian Crime Commission suggests that there is now a significant organised crime presence in the private security industry that controls entertainment venues in Melbourne, Sydney, Perth and on the Gold Coast.

Crowd control is now one of the largest sectors within the security industry. The last decade has seen the Australian security industry grow by over 41%. There are now over 2,400 security businesses operating in Australia and the industry employs around 90,000 full-time and part-time staff. Today, security personnel outnumber police 2:1. Revenue from the security industry is estimated at $3 billion dollars annually, while profits are estimated at around $90 million dollars per annum. New South Wales represents 43% of the security market, followed by Victoria with 21%, and Queensland with 16%. Crowd control represents 38% of the marketplace, followed by guards & patrols at 23%, and 13% for cash-in-transit operations. As the largest security market in Australia, it is reasonable to assume that New South Wales security market is the most vulnerable to criminal infiltration by OMG’s, followed by Victorian.

The nightclub scene has always been associated with illicit party drugs such as ecstasy and amphetamines. According to the Australian Crime Commission, the hospitality industry is a crucial market for the national drug distribution network. As a distribution system, it is not surprising that the OMG’s would want to exploit nightclubs as a point of sale for their illicit drugs, thus completing a synergy between drug manufacture and distribution. The question for the OMG’s has been how to take control of this potential distribution network. In the past it was not uncommon for several drug dealers to compete for business at the same nightclub. Not being ones to share, for the OMG’s this situation was an untenable business arrangement. It soon became apparent to the OMG’s that in order to exploit and monopolise the nightclub industry as a drug distribution network they had to exclude all other drug dealers from the venues. To do this they had to control the doors. In order to control the doors they had to infiltrate the security industry. So began the infiltration of the crowd control industry by the OMG’s.

The introduction of licensing for the crowd control sector of the security industry has done little to prevent OMG’s from infiltrating the industry. OMG’s have been quick to identify vulnerabilities in the system and have been only too willing and able to exploit these vulnerabilities in order to circumvent the new licensing regimes. OMG’s realised that by simply having what appeared to be an arms-length transaction between security and drug dealing they could operate their drug distribution network with immunity under the guise of a legitimate business. In order to avoid attracting the undue attention of the police and liquor licensing the OMG’s have financed a number of start-up security companies, enlisted the services of associates without criminal records to obtain the appropriate licenses to act as front men, while controlling the companies from behind the scenes. Today these security companies controlled behind the scene by the OMG’s act as arms-length facilitators of illicit drug distribution rather than being directly involved in the drug distribution network.

The profit margin for the distribution and sale of illicit drugs is very high. Add to this the fact that these businesses do not pay tax and you have the makings of a very profitable business model. OMG’s have exploited the overly competitive nature of the security industry to gain a foothold in the trade by offering crowd controllers at rates that legitimate security businesses cannot compete against in order to win contracts. Any losses are later offset by the distribution and sale of drugs by the OMG’s at the venues. Even after offsetting any losses associated with the under bidding of security the OMG’s are still able to turn a healthy profit from their drug business.

To a certain extent, nightclub management has also been complicit in the infiltrations of the security industry by OMG’s, as they have been only too willing to accept these seemingly uncommercial rates without hesitation. This calls into question how much knowledge nightclub management have of this infiltration. Given the nexus between drugs and nightclubs, one must also acknowledge that the availability of drugs at certain nightclubs could be seen as a drawcard for the venue as it could conceivably increase patronage. This in itself could be considered as an inducement for nightclub management to turn a blind eye to the infiltration of OMG’s and drugs into their venues, especially given that recreational drug use is widely considered to be a matter of personal choice rather than a crime.

The dangers of illicit drug use to personal health and to the community cannot be overstated. Illicit drug manufacture is not known for its quality control. The drug is often cut with toxic chemicals to make it go further, and there is no guarantee that the dosage of active ingredients is safe for ingestion. Other risks for the user include reduced inhibitions leading to unprotected sex and its consequences, the risks associated with sharing needles and the long-term mental health risks associated with drug use. The impact on society is the high cost of maintaining healthcare, corrections and criminal justice systems to manage those involved in the illicit drugs culture.

One of the unintended consequences of the infiltration of OMGs for the legitimate security industry, apart from the damage to its reputation, is the artificial downward pressure on prices. Unlike OMG’s who operate on healthy profit margins and who can afford to subsidise their security operations, the legitimate security industry cannot sustain another attack of price-cutting without being driven to the wall. If this is allowed to happen it will create a further power vacuum that the OMG’s will be able to exploit to gain an even greater hold within the industry. In order to prevent this from occurring, the government needs to act decisively and swiftly to protect this legitimate segment of the security industry from collapse. It is unlikely that the present practice of regular and random inspections of licensed venues by police and liquor licensing authorities will make any great impact on the infiltration of the security industry due to the arm-length relationship OMG’s have established between their security businesses and their drug dealing operations.

There are a number of factors that inhibit investigation of security industry infiltration by OMG’s. First, there is the ‘code of silence’ that OMG’s operate under. Insiders are unlikely to disclose the extent of the OMG’s involvement in drugs or the infiltration of the security industry. Secondly, illicit drug users are unlikely to disclose the extent of drug distribution in nightclubs due to their complicit involvement. Thirdly, legitimate security companies adversely affected by the infiltration of OMG’s are fearful to speak out for fear of retribution by the OMG’s. Finally, the clubs don’t wish to acknowledge their involvement with the distribution of drugs as it may jeopardise their liquor licence. Until those who would be affected start speaking out, the infiltration will continue.

Recently there have been moves by various state police forces to introduce laws restricting the activities of OMG’s in an attempt to create a much more difficult working environment for them. In the past, OMG’s have exploited jurisdictional inconsistences in state laws to advance their criminal activities. One such example has been the different state laws governing precursor chemicals. Precursor chemicals are the base chemicals that are required to make illicit drugs. Thankfully this anomaly has now been corrected with the harmonisation of the respective state laws governing such chemicals. Unfortunately, recent legislative efforts to curtail the illicit activities of OMG’s have been overturned by the High Court, which ruled the anti-bikie laws unconstitutional.

The Australian Crime Commission admits that it is difficult to estimate the current level of infiltration of the security industry by OMG’s. It is, however, a significant and ever present threat. In 2009, the Australian Government launched the Organised Crime Strategic Framework to combat the OMG’s infiltration of the security industry. Over the coming years their tactics will be to strengthen multi-jurisdictional approaches, improve information sharing, and undertake joint initiatives to combat organised crime. Time will tell if these new government initiatives are too little, too late, to protect the legitimate security industry.

John Pettit has been a security practitioner for over a quarter of a century. As a mature aged student, John attended Edith Cowan and Bond Universities where he read Security Science, OHS and Criminology. He is also a Board Certified CPP and PSP. John welcomes referrals and requests for advice. Contact him on 0418 720 187 or send an email to jpettit@security-advisor.com.au. Visit John’s website at www.security-advisor.com.au

Graeme Cunynghame served in a number of areas including the Fraud Squad, Corporate Affairs Commission, DEA, NCA, and NSW Crime Commission.
As a mature aged student, Graeme attends Edith Cowan where he reads Security Science. Graeme is a member of ASIS and ACFE. Graeme welcomes referrals and requests for advice on fraud and security risk management matters. Contact Graeme on 0408787978, or send an email to pripol@pripol.com.au. VisitGraeme’s websiteat http://www.pripol.com.au

Australian Security Medals: Recognising Excellence In Security

By

John Bigelow

-

May 2, 2012

By John Bigelow.

The 25th of February 2012 saw close to 300 professionals from across the security industry come together to celebrate excellence in security at the second annual, ASMF dinner and awards ceremony.

Now in its second year, the ASMF continues to highlight outstanding performance through the Australian Security Medal of Valour (ASMV), recognising acts of bravery and initiative, and the Australian Security Medal (ASM), recognising contributions to security professionalism and providing examples of outstanding citizenship, positive leadership, insights or influence at a strategic management level.

The evening’s celebrations commenced with an announcement from the ASMF board that the Foundation was launching a new benevolent fund designed to assist security officers who have fallen in the line of duty.

This marks the realisation of an extremely important goal for the board and is a major step forward for the security industry. The fund is similar to the police Blue Ribbon initiative in that it will provide support and aid to the families and loved ones of those who may have been injured or killed in the course of performing a security role.

While the specifics regarding the name of the fund and the mechanisms behind how it will be administered are yet to be announced, it should be viewed as a great success and a significant step towards improving the professionalism of the industry.

The major focus of the evening was the presentation of this year’s medals to the three recipients of the Australian Security Medal of Valour and the three recipients of the Australian Security Medal.

Gol (Mohammad) Amiri, a security officer stationed on the Sydney Harbour Bridge was the first to receive the Australian Security Medal of Valour for his courageous actions in saving the life of a young man intent on doing himself harm.

In the course of carrying out his normal patrol, Mohammad noticed a young man on the Harbour Bridge acting in a suspicious manner. As he approached, the man attempted to flee, climbing a barbed wire fence and sustaining numerous cuts and scratches to his head, face, arms and legs in the process.

Realising that the man was trying to reach an area of the bridge that was well known as a preferred location for people intent on suicide, Mohammad quickly chased and restrained him, whereupon the man informed Mohammad that he was an AIDS carrier. In spite of this, Mohammad continued to struggle with the man and restrain him, despite being repeatedly smeared with the blood flowing from his many cuts and scratches. When emergency services arrived, 20 minutes later, Mohammad’s only concern was for the man he had prevented from harming himself.

The second ASMV recipient of the evening was Drew Ioanne, a highly valued member of the Westfield Mount Druitt Shopping Centre security team with which he has worked since March 2006.

On the 4th of February 2011, Drew was instrumental in preventing a conflict between two rival factions at the shopping centre in Sydney’s western suburbs while also disarming and arresting a knife-wielding assailant. Drew’s quick thinking and courageous actions, executed in a calm and controlled manner, not only prevented serious injury, but also served to calm a rapidly deteriorating and potentially volatile situation.

The third ASMV award of the evening went to Adam Motum who, without regard for his own safety, placed himself between a man wielding a bloodied meat cleaver and the attacker’s victim in order to protect the victim from further harm.

Over a period of minutes, Adam also deliberately placed himself between the attacker and campus staff and students on multiple occasions and shepherded the attacker away from other potential targets, despite being threatened and screamed at by an extremely aggressive and agitated attacker still wielding the meat cleaver.

Adam also provided first aid and instructions to other security officers at the scene and played a key role in restraining the offender until police arrived. As a result of his actions, Adam has also been nominated for a NSW Police Bravery Award.

The first of the three Australian Security Medals was awarded to Darren Kane, Director of Telstra’s Corporate Security & Investigations Group for his hard work, leadership, vision and dedication to the protection of children from online child exploitation through the launch of the Cyber-Safety Programme at Telstra.

Darren’s team provides ongoing support to law enforcement investigating online crime and, in 2005, Darren was a founding partner in the Virtual Global Taskforce, a group comprising police forces from around the world working together to fight online child abuse. The Taskforce also seeks to build an effective, international partnership of law enforcement agencies, non-governmental organisations and industry to work together to prevent and deter online child abuse.

The Second ASM of the evening was awarded to Paul Maihi, Head of Crisis & Security Management for Westpac Banking Corporation, for his tireless dedication to the mentoring of young security professionals and the influence this has had on the development of industry professionalism and the bridging of the gap between the security industry, government agencies and law enforcement.

The third ASM medal, and the final award of the evening, went to Paul Retter, Executive Director of the Office of Transport Security at the Department of Infrastructure and Transport, for his unmatched, sustainable and significant contribution to the security industry. In the course of his duties, Paul has worked relentlessly to enhance the security professionalism of the industry, set new benchmarks for security and protect and serve the Australian community.

Paul’s outstanding dedication, commitment, leadership and drive are demonstrated by the extent to which Australian transport security outcomes are recognised globally.

The board of the Australian Security Medals Foundation would like to once again congratulate all the medal recipients and would ask that anyone interested in nominating a recipient for the 2013 medals, or wishing to make a donation to the ASMF fund for the welfare of fallen security professionals, to please visit: www.australiansecuritymedal.com.

Portrait Of A Modern Security Manager

By

Paul Maihi

-

May 2, 2012

There has been discussion in the industry for many years about what is required for people to become a security manager or take that next step in their career. One of the challenges that we have as an industry is the variety of roles that constitute security functions because security has so many different meanings to so many different people. It is a real challenge to actually define what security is. Search the word, security, online and you will come up with some 2,650,000,000 results.

In the media, on any given day, you would likely find references to national security, food security, security guards and international security. This is not just a definitional challenge but a real opportunity to discover a diverse and wide-ranging set of activities and services that make up the security industry. The people in our industry come from varied backgrounds.For many, security is a second or third career choice; or security responsibilities are tacked onto another role they may have, so we also have a wealth of experiences and perspectives to draw from. This is the canvas that we have for our portrait.

Harnessing the varied roles and backgrounds of security personnel is the beginning of the equation. We then need to match them to the needs of our customers. There are increasing demands put on the security manager to have or acquire specific skills to supplement their experience and knowledge base. Again, a security professional framework gives our customers confidence that the security practitioner has a level of knowledge and experience to undertake his role.

It can be argued that the diversity of roles in our industry is not an issue as long as the industry has an overarching professionalism, such as that of medicine, for example. Medical practitioners must have a foundation qualification. They can then take up a speciality such as surgery, general practice, emergency medicine and anaesthesia, so a wide variety of medical services can be catered for. The same can also be achieved by the security practitioner in his industry. Now we have the frame in which our canvas can sit.

Many people in the security industry have come from a law enforcement or armed forces background and a lot of people have been ‘on the tools’ or have a technical background. The modern security manager needs to complement this background with the right attitude to manage a security function and not be afraid to be passionate about what he or she does. If you cannot be excited about what you do, how can you expect the rest of the organisation to be?

I used to have a manager who would regularly comment on how passionate the security team was. He said that this helped everyone feel confident about their security. This is part of the vibrancy and colour that we have in our portrait.

It can be easy to fall into the trap of allowing the organisation to view security as a cost and not a revenue-generating activity. On a good day, we may even be viewed as a necessary evil. We all know that value is like beauty – it is in the eye of the beholder. The challenge in demonstrating value is complex, but I have undertaken a number of things that have lessened this perception. We must invest in our brand – brand security, and be prepared to keep reinvesting in our brand.

Get to know your organisation and what really makes it tick. Understand the lexicon of the language and culture of the organisation and dive into it. Become a part of the organisation, break down barriers that may exist and be prepared to be open and frank about what you do. The ability to influence and to be able to draw on a wide range of soft skills is required by the modern security manager. This can help the critics to better understand the portrait we are painting.

In my own experience, there are always challenges in persuading people to change their perception about security and the value that it adds. One tool I have used with a number of organisations I have worked for is the ‘three C ‘approach. I make sure that security is:

Consistent
Constant
Caring

The organisation will know exactly what it gets from its security services because the outcomes are understood. Security is available 24/7 and you will be able to talk to us when you need to because we are ever present. We do care about what we do and we have a customer focus, whether it is dealing with lost property, giving directions, administering first aid or dealing with a crisis situation.

It makes sense that an organisation cannot value something it doesn’t understand. Our job is to ensure that we promote our services and we remain open and transparent.

A key demonstration of value is in the execution of what we do. We all know that planning and thinking about what we need to do is important. However, it is the execution and the delivery of our services that really makes the difference.

One of the most valuable tools I have used was to connect security to the organisation through the use of a common lexicon. In one case, the lexicon of risk management was refined to a language understood by the business. This enabled the security team and the business to use a common set of principles with which they could work to manage security risks.

Break down the barriers and be open and transparent. This is really important for our internal business units and our suppliers of security services. I thought for a while that I was becoming a professional coffee drinker! Face time, one-on-ones, informal meetings, whatever you want to call it. It is important that people get to know you and what you are interested in, and for you to know what they and their business do.

I also decided to take a different approach with our security service suppliers. We get together with all our suppliers for a day and we talk about the organisation’s strategy, the strategy for my team and, most importantly, we ask the suppliers how we are performing and how we can be a better team to work with. This openness and transparency has improved their understanding of what we do and their service delivery.

When discussing some of the key skills that the modern security manager should have, it is also important to consider the need for formal training and qualifications. It is necessary for our industry to embrace the need for better qualifications to supplement the skills and experience of our people. Accordingly, the move from acting professionally to becoming a true professional is under way, and the generational change that the industry is making will enhance the skill set of the people in the industry and attract more candidates to it. A set of foundation qualifications is an essential component of a professional standing and I would, therefore, encourage everyone to undertake formal training to achieve such qualifications. With foundation qualifications in place, there is an opportunity for further specialisation within your chosen field.

The security industry provides a demanding and fulfilling career for those with a wide array of skills. The ability to influence, network with and listen to your customers is a fundamental, soft skill set. Foundation qualifications that enable your technical skills and demonstrate your competency help to further build your value. But, to complete the portrait, the onus is on the modern security manager to own his business and be passionate about what he does.

Enterprise Security Risk Assessments. What Are We trying to Protect And Why?

By

Don Williams

-

May 2, 2012

Executives and managers understand the need to protect the assets of the organisation, and to do this they engage guards and security managers/supervisors at the local level. An enterprise security risk assessment (ESRA) is about looking at security in a different, broader way – supporting organisational capability.

An enterprise security risk assessment is an assurance tool utilised at the highest level possible to assess if the assets and functions of the organisation are protected. It can also be used to consider the security of future activities.

This article outlines the concept and value of the enterprise security risk assessment and is based on enterprise-wide security risk assessments conducted for a range of government and corporate clients.

Enterprise Security Risk Assessment

To gain an oversight of what is encompassed by the concept of ESRA, it is of benefit to review each element of Enterprise – Security – Risk Assessment, in reverse order.

Risk Assessment

As per ISO 31000 and the earlier, AS 4360, a risk is. An event that could occur, the results of which may be beneficial or harmful. Risk Assessment is a methodology for defining what could happen, why and when, the effects of such an occurrence and to identify mitigation treatments to reduce unwanted risks to the lowest reasonable level. An assessment of the risks lead to the ability to manage the risks.

The usual matrix-based methodology requires the identification of the context, the identification of assets and threats, the definition of the risks, the determination of likelihood and consequence and their alignment on an agreed matrix to determine the risk rating. The resultant rating provides the basis for priority of treatment.

The risk is mitigated by either reducing the likelihood of the event occurring (by fixing some or all of the exposures identified in the Likelihood part of the assessment) or reducing the Consequences should the risk be realised. In all cases, the proposed risk mitigation treatments must be related to the observations in the assessment.

Once the mitigation treatments have been identified, the residual risk, should the proposed treatments be implemented, can be calculated, based on the reduced likelihood and/or consequences.

An enterprise security risk assessment uses a similar approach but differs primarily in the breadth of the assets and functions considered, and of the existing and potential mitigation treatments reviewed. The enterprise security risk assessment seeks to ensure the entire organisation is protected from all reasonable security threat vectors.

Security

The definition of the term, security, as used here, is protection from deliberate, malicious human action or Human Initiated Threat (HIT). Other management disciplines protect against human error, mechanical failure and alternate sources of damage and loss to the organisation as shown in Figure 1.

Figure 1 Threat – Asset Relationship

An organisation can use a number of tools to assess its security:

Risk Assessments
Compliance checks
Threat assessments
Vulnerability assessments
Loss estimates

These are all elements of an enterprise security risk analysis.

Enterprise

An enterprise-wide assessment requires looking at issues from the organisational perspective: What are we trying to protect and why? The what are the key assets and functions that support the business. The why is to align security to the strategic goals of the organisation.

At the tactical (guards) and operational (supervisor/manager) levels, security measures relate to the assets and threats in the immediate area of responsibility. Enterprise thinking requires a broader view. It requires the consideration of:

The organisation’s aims, goals and image.
Not only assets, but the functions protecting what we do as well as what we have.
An understanding of other skills/disciplines and how they relate to security. For example:
Emergency management,
Workplace health and safety,
Human resources such as post-incident counselling,
Facility management,
Business continuity/resilience planning,
Media management and
Environmental management.

Once an ESRA has been completed for the entire organisation, the same methodology and mindset can be used to assess each main business unit (BU) by asking:

Does the individual BU, because of its assets, functions and threats, have all of the enterprise risks identified for the organisation? If not, which do not apply?
Does the individual BU have additional key risks not identified for the organisation? If so, what are they? (Perhaps there is a particular asset that only exists within this BU, or overseas staff, or within particular compliance requirements?)
Does the BU have particular mitigation measures that alter the organisational risk rating in their particular context? Or, are they limited after applying some of the organisational mitigation measures?

Examples include the differences between a BU that conducts bulk storage and one that has retail activities, or the considerations for a corporate headquarters, as opposed to a mining or manufacturing BU.

Enterprise can also relate to a new opportunity or endeavour. When the organisation looks to take on new activities or assets, it is of benefit to conduct an assessment to determine what security exposures will be generated and what new threats may result. New locations, new business processes, new relationships, all deserve a security assessment.

Another case for an enterprise security risk assessment is to pre-plan for an event that might occur where the specifics of the event cannot be known but the general nature of the threat can be predicted. An enterprise security risk assessment can provide general guidance as to what protective and response measures may be required. The specific details of the measures can be further determined if the event becomes more likely and the location can be identified. The security considerations for an organisational response to a natural disaster might fall into this category.

Definition Of ESRA

If enterprise security is ensuring the organisation is free to meet its goals protected from deliberate, malicious human action, then the purpose of an enterprise security-risk assessment is assurance.

Assurance that adequate levels of protection are in place.
Assurance that appropriate response measures are in place.
Assurance that future activities and assets will be protected.

What Are Enterprise Security Risks?

Defining the risk is often the most difficult part of the risk assessment process. Often risks are (incorrectly) expressed in terms of the threats, such as terrorists, which is actually a source of risk. Or, in terms of consequence, such as tools are stolen from the workplace. This is not the risk but a consequence of a risk, such as a failure to protect tools.

Risk should be expressed in relation to the asset or function being protected. Enterprise risks relate to the entire organisation, or at least a complete business unit. It is suggested that Enterprise risks may include:

Failure to protect people.
Failure to protect information.
Failure to protect equipment.
Failure to protect reputation (Collectively referred to as PIER)
(Each of the above is in the highest grouping that can effectively be assessed).
Failure to identify a security incident.
Failure to respond appropriately to a security incident.
Failure to comply with (specific security-related requirements).

Figure 2 shows a potential breakdown of People as an asset at the highest levels possible for a security risk assessment. In this case, the environment is a judicial court system where four distinct populations have been identified, with each having its own threats, exposures and vulnerabilities. To enable an accurate assessment, two of the populations are further refined due to their movements, locations and specific security considerations.

Figure 2 Example of Asset (People) grouped at the highest level suitable for assessment

ESRA Process:

The process for an enterprise security risk assessment is:

Identify the organisation’s goals and aims.
Define the scope: Inclusions/exclusions.
Define the physical, temporal and organisational boundaries.
Agree on definitions for: Likelihood, consequences, risk ratings.
Identify the key assets and functions.
Identify threats.
Define enterprise risks in terms of key assets and functions.

For each defined enterprise risk:

Assess the effectiveness of existing (or proposed) protective measures on a systems basis.
Assess the effectiveness of existing (or proposed) consequence mitigation measures on a systems basis.
Define the likelihood of risk occurring, and the consequences should risk be realised.
Rate the risk.
Identify and recommend treatments to mitigate likelihood and consequences.
Rate the residual risk if treatments are implemented.
Draft risk management plan to implement recommended treatments.

While the above elements may be considered part of any matrix-based risk assessment, an enterprise security risk assessment specifically includes:

Emphasis on policies, procedures and processes.
Assessing treatment measures as systems rather than individual components.
The identification and recognition of inter- and intra-organisational relationships, responsibilities and protocols.
Considering the effect of other managerial disciplines on the security of the organisation’s assets and functions.
Considering the implications of treatments on the organisation’s goals and image when developing recommendations.

An enterprise review does not assess individual, technical or other measures; it reviews the system that includes the particular technology or process. Rather than checking if cameras are used, the question should be, are the cameras effective? For example, in relation to CCTV, the following could be assessed:

Has the intended purpose of the cameras been stated?
Is the equipment being used suitable for the stated purpose?
Are the sight lines and lighting correct?
What are the monitoring capabilities procedures/training/qualifications?
What recording and evidentiary capabilities are provided?
What are the response measures and how are they verified?
What maintenance and repair contracts are in place, and what are the associated maximum downtimes?
What other CCTV systems overlap areas of interest, and are arrangements in place to access their recordings?

Many security systems are based on deterrence and detection. A key consideration is, “What will happen when we find that for which we are looking?” For each detection capability, there needs to be associated response measures to ensure that the event is recorded, reported, contained and controlled with the minimum possible disruption to the organisation’s goals. Those goals may include maintaining its reputation for providing a safe and secure environment.

Likelihood

Given that there are assets or functions that are important, there may be those who wish to take or damage them. Threat is related to motive – why would they want to do this? It could be for financial gain, for business advantage, political reasons, personal gratification, or other reasons. The question is whether those who may wish to do us harm (the intent) have the capability. And this relates to whether we encourage them to attack by exposing our vulnerabilities.

While a local or tactical security risk assessment must be aware of the various threats and threat vectors (i.e. how each threat source may attack), an enterprise security risk review can adopt more of an all hazards approach. Rather than trying to identify a protective measure for each potential attack, an all hazards approach ensures that the asset is protected from all reasonable vectors, regardless of motive. If appropriate measures are in place to protect the item from the known and identified threats, then they (usually) will deter or detect attacks from other threat sources that are less easy to identify or quantify.

The preventative measures in place, both physical and procedural, should be reviewed to determine if they are effective barriers to the threat vectors. An enterprise review should be an honest and objective assessment of the entire system, not just a compliance check.

A security risk assessment will review available data and statistics, noting that security often deals with low likelihood/high consequence events and therefore a statistical basis for likelihood calculations may not exist and the likelihood rating may rely on qualitative rather than quantitative assessments. Exceptions to this generalisation may include events such as retail theft and graffiti. Statistics will indicate how many events have been recorded, not where the vulnerabilities are or which events were not detected or reported.

Likelihood is usually expressed in terms of how frequently the event may occur within a given period of time. It is essential the temporal boundaries be defined. For instance, over what period of time is the risk being rated? At an enterprise-level, this is more likely to be over a longer period. For example, over the expected life of a facility or activity. An enterprise review can also be used to validate detailed, integrated planning for a specific short-term event, such as a shareholder meeting.

Consequence

The consequences, should the risk be realised, must be identified, based on what will be lost and usually expressed in terms of people, financial value, time and reputation. This can be altered depending on the business under review.

Response to a security event may rely on management areas outside security personnel and processes. An understanding of the related skills and disciplines and how they relate to security is an essential element of an enterprise security risk assessment, including emergency management, workplace health and safety and facility management. Each of these, as well as being able to assist security, may also present security vulnerabilities that need analysis.

For example, how is the site to be secured once it has been evacuated? Also, in relation to the courts environment (as shown in Figure 2), it is essential that the judiciary, witnesses, juries and prisoners all be considered in the evacuation plan to ensure they are separated and controlled. If not, the security of prisoners may be reduced, witnesses and juries may come into contact with each other and they may be exposed to those who would seek to influence them. In all cases, the trial or hearing will most likely be compromised because of a lack of security input to an emergency management plan.

For all organisations, how they manage the after-event media will be critical as an expected consequence will be a drop in business activity as clients migrate to competitors. Even for organisations where there is less competition, such as government departments and international airports, there may still be a reduced confidence in the capability to protect assets and functions and increased disruption due to investigations and inquiries.

Risk Rating

By comparing the likelihood and the consequence, the Risk Rating can be determined. The risk rating indicates the importance of the risk, the priority with which it must be reduced, who will be responsible for reducing the risk and who will monitor the risk reduction. For an enterprise review, the level of responsibility is likely to be higher than for a tactical security risk assessment.

Enterprise Risk Mitigation

In an enterprise assessment, the mitigation treatment measures may be directed to management areas other than security. Potential enterprise security mitigation recommendations might include:

HR revising its ability to provide post-incident counselling;
Contract management considerations for lighting, cleaning, chemical storage;
Inclusions or exclusions in staff induction training;
Alterations to business continuity and resilience plans;
Facility management and environmental considerations that affect how long staff and visitors can be held on the site during an external event; or
Revision of emergency plans to provide security during and after an evacuation.

Treatments have to be cost-effective (i.e. cost less than the assets they are protecting) and fit within the image and operating environment of the organisation.

The following are generic observations on risk mitigation treatments but are particularly pertinent to an enterprise review.
Each risk will usually require a number of treatments.
One treatment may address a number of risks (e.g. appropriate access control procedures/polices/practices/training/hardware may treat the likelihood element of a number of risks).
It is usually easier to reduce the likelihood. That is,. to prevent access to the asset than to mitigate the consequence once the event has occurred.
At the tactical level, it may not be possible to reduce the consequences: if the event occurs this will happen. But, at the enterprise level, reducing the consequences may be possible through the application of other resources, such as media management, legal support, HR and counselling support, and BCP.

Observations On The methodology:

The traditional matrix-based methodology, while effective in assessing assets, is not particularly useful when assessing risks related to processes. That is, what happens if we do more or less of an activity? What if we put in too much or too little or the wrong element into the flow? What if we slow, stop or speed up the process? Risks related to processes may be better assessed using different methodologies.

The matrix methodology also has difficulty expressing extremely low likelihood/very high consequence risks such as those (usually) posed by terrorism. Based purely on statistics, it would hardly seem cost-effective to employ some of the current preventative measures. But, it is understood that if existing protective measures are reduced, the likelihood of such attacks will increase and the consequences of even one successful attack will be horrendous. Therefore, risks of extremely low likelihood can be assessed by considering the threat (the intent and capability of the perpetrator) and the exposures to the assets – usually related to weaknesses in the physical and procedural security measures.

Summary

ESRA is an assurance tool to provide those responsible for governance with a snapshot of whether the key assets and functions of the organisation are, or will be, protected from deliberate human action.

ESRA can be used to assess the security implications of future activities.

ESRA is not a check of locks and doors but more of a corporate assurance tool that not only protects but also supports the organisation’s goals and image.

Security In The Education Market – Opportunities for Growth

By

John Bigelow

-

May 2, 2012

By Ben Hattersley.

The security industry continues to grow, year-on-year, due to many factors, not the least of which are associated with persistent financial uncertainty, political instability, and competing religious ideologies around the globe. Public and private sector organisations continue to invest in security initiatives as a means of countering the threats they face during routine business operations. One area that is receiving increasing focus is the security of educational facilities, including schools and tertiary institutions. As education administrators seek to improve the safety and security of their clients, opportunities for security professionals to engage with the education sector will likely result in further growth within the security industry, both within Australia and abroad.

The risks that are prevalent in educational facilities on the international stage, particularly in the United States, are well documented. A number of well-publicised shootings on high school and university campuses in America have resulted in a comprehensive upgrade to the security at many of those institutions. Schools have seen the deployment of security personnel, who are responsible for ensuring the safety of students and staff, while some of the larger university campuses have their own police departments that provide a 24-hour security presence. Investment in security initiatives is not confined to public and private policing however, as physical and electronic security measures have become integral to the overall security management methodologies employed by these types of organisations.

As with other business environments, the security strategies that are ultimately endorsed and integrated with normal operations should be based on the outcomes of a methodical security risk assessment (SRA) process. The SRA enables security managers to plan for, and design, security measures that address specific and genuine threats that are applicable to the particular business environment in which they are operating. While it would be difficult to justify the same level of investment in school security programs seen in the United States, from a risk perspective, governments in Australia are beginning to identify security vulnerabilities within the education sector that require additional resources.

Under the Labour Government, approximately $1.9 Billion dollars has been channelled into schools across Australia over the last four years as part of the Digital Education Revolution. This program has seen the distribution of laptop, netbook and tablet style computers to students from years 9 through to 12 as well as the installation of a wide range of education technologies from interactive whiteboards through to data projectors, audio visual systems and more. With so much technology now powering classrooms across Australia, one has to ask what, if any, security upgrades have been made to schools to protect all of this investment?

Another section of Australian society that has perceived a threat to the safety of its students is the Jewish community. The Jewish school system has a well-organised security program that monitors the operations of its schools and synagogues through the use of private security firms and dedicated security groups within the Jewish community; with support from teachers, parents and scholars. Security awareness is promoted extensively within the Jewish school system and students are well accustomed to seeing armed guards controlling access to their schools. While opinions vary about whether the security risk to Jewish students in Australia substantiates the placement of armed guards at the entrances to their schools, Australian security firms are benefiting from the decision to do so.

While it could be argued that the Jewish community faces a higher level of risk than other groups within our society, particularly post 9/11, and may be able to justify a requirement for a large security guard presence at their schools, for the most part, Australian schools generally face lower level risks such as theft and vandalism. These risks can be mitigated through the consistent application of the widely accepted protective security principles of deter, delay, detect and respond. Protective security approaches may include a combination of physical security treatments such as fences, gates and signage, to deter and delay; electronic security measures, in the form of intruder alarm and CCTV systems for detection. Capital works, such as those that are typically required to improve the level of security within schools, are not generally accounted for in normal operating budgets and, therefore, commonly necessitate additional private or public sector backing.

One example of the type of investment that is occurring in this area at a Federal level is the Secure Schools Program (SSP). This program, administered by the Attorney-General’s Department, aims to assist ‘at risk’ religious, ethnic, and secular schools around Australia through the provision of funding for security related infrastructure including CCTV, security lighting, fencing and gates. The program is open to both public and private schools that are able to demonstrate the potential for security incidents to impact on the safety of students and staff as well as the security of physical assets.

Applications under this program are assessed by the Department in accordance with proven SRA processes and guidelines developed by the Australian Federal Police. Successful applicants are granted up to $250,000 in funding, which must be spent in addressing the specific security risks identified through the risk assessment process. Having previously allocated $20 million, the Australian Government has committed an additional $15 million over three years from 2011 to 2014 to continue the SSP. While these figures may represent only a small percentage of the total security market in Australia, they do demonstrate an increase in the demand for, and financing of, security initiatives in education. The onus is on security firms to position themselves in such a way as to benefit from these and other business opportunities as they arise.

Under the SSP, funding recipients are required to engage the services of security contractors in order to complete the scope of work that has been agreed under the funding arrangement. While this process may be less regulated for private industry, public sector procurement guidelines have become quite prescriptive, as a result of concerted efforts to eradicate the sort of corrupt activities that have traditionally plagued public sector procurement in the past. In general, these guidelines support the framework for procurement activities and include such directives as the requirement to obtain a certain number of quotes, dependant upon the capital cost of the project, or to select from a panel of approved suppliers that have already satisfied particular selection criteria.

Requests for tender that stem from the SSP and similar initiatives are generally advertised on State and Commonwealth Government websites, examples of which are NSW eTendering, QLD eTenders and AusTender, the Australian Commonwealth Government Tender System. Any business owner can register with these websites to receive notifications of business opportunities of relevance to them. This method of tendering promotes full transparency, ensuring that the process is equitable and that no one supplier receives an unfair advantage over another. Public sector tendering seeks surety that contracts are only awarded to reputable businesses and, in order to maximise the chances of success, it is imperative that any organisation wishing to tender for these opportunities has all of the necessary qualifications, licences, and insurances. It is also advantageous if contractors can demonstrate previous success on projects of a similar nature, both scope
and size.

With Commonwealth Government funding on offer through the SSP, and additional capital available through similar State Government initiatives, there should be no shortage of Principals keen to take advantage of opportunities to improve the level of security in their schools. If the experiences of educational establishments in the US are anything to go by, the demand for security within educational institutions in this country will continue to grow. And while the catalyst for growth in the education security sector in the US is alarming to say the least, the consequential business outcomes, for those who are engaged in the security profession, have been positive.

Most pundits agree that we can expect increasing demand for security in the vast majority of business market sectors over the coming years, and education should be no exception. Security consulting firms, fencing contractors, electronic security manufacturers, and integrators that can demonstrate the necessary expertise and capacity to acclimatise with public sector procurement processes, will be well placed to benefit from any injection of funds into the domestic security market. These are volatile times we live in and there appears much to gain from security firms partnering with the education sector.

Ben Hattersley, CPP is a Senior Security Consultant with Aurecon in Sydney who holds a Bachelor of Science (Security) and a Master of Security Management.
His expertise is in security operations management, security risk management, and security management consulting across a broad range of business environments.
Ben can be contacted on (02) 9465 5133 or ben.hattersley@aurecongroup.com.

Beyond Bin Laden

By

Kenneth Baker

-

May 2, 2012

The Implications of Osama Bin Laden’s Death For Counter Terrorism Over The Longer Term

The following looks at the implications posed for counter-terrorism by the killing of Osama Bin Laden on 1st May, 2011, by a covert US Special Forces team inserted into Pakistani sovereign territory without Pakistan’s prior approval or knowledge. This action raised several uncertainties that will have varying consequences for Western societies.

1st of May 2011, a team of highly trained US Navy Seals raid deep into Pakistani sovereign territory. Their target, a private residential compound in Abbottabad, north of Islamabad; their mission, bring to an end the 13-year manhunt for the most wanted person on the planet, Osama Bin Laden. The operation was a significant success in the United States of America’s ongoing counter-terrorism campaign, representing the culmination of years of work by intelligence agencies that resulted in Bin Laden’s death.

US President, Barack Obama, states in his congratulations to the intelligence community on the 20th of May, during a visit to the CIA, that Bin Laden’s involvement in the Al Qaeda core was both symbolic and operational:

“We not only took out the symbolic and operational leader of Al-Qaeda, but we walked off with his files, the largest treasure trove ever seized from a terrorist leader.”

The death of Bin Laden will have sent Al Qaeda’s remaining leaders diving for cover with increased anxiety from this major security breach. Their number already decimated by constant drone attacks and with no safe mode of communications open to them, Bin Laden’s lieutenants must be concerned that intelligence gathered from captured documents taken from Bin Laden’s compound, will lead the United States closer to their apprehension or destruction, and impede current operations.

The two main schools of thought regarding the implications of Bin Laden’s death for counter-terrorism include, firstly, that his death will be a largely symbolic event due to the development of Al Qaeda as an ideological movement with him as the inspirational leader and, secondly, that Bin Laden maintained an active role in directing the Al Qaeda core and its affiliates in implementing attacks .

Other uncertainties that will further flow from the US action include:

Will Bin Laden’s symbolic status or his strategic and operational involvement within Al Qaeda core have the greater impact on counter terrorism?
What is the outcome for Al Qaeda’s affiliates? Does Ayman al-Zawahiri, the new leader for the Al Qaeda core, have their continued support and allegiance? Has the likelihood of attacks from lone wolf or home-grown radicals increased? Do Al Qaeda’s affiliates attempt to emulate them?
What are the implications from the US’s Special Operations surgical strike into Pakistani territory without prior approval? How will it affect the continued relations between the two nations?
Will the US rethink its strategy? Does this mean they will draw down from Afghanistan sooner? Will they develop a more sustainable counter-terrorism plan?

The short-term future will no doubt see Bin Laden’s death directly affect operational matters. That is, we may see acts of revenge and retribution or, more likely, acts portrayed as operations by Al Qaeda or other Islamist groups as retaliation for the death of their Sheikh. In the long term, we are more likely to see operations fuelled by the legacy Bin Laden developed, a strategy of warfare based on a sequence of low-cost events – inexpensive, well-planned and well-implemented actions formulated to undermine and disrupt the infrastructure and systems vital to the US economy.

Osama Bin Laden: Strategic And/Or Symbolic?

For years, Bin Laden was thought to have only a peripheral role in directing Al Qaeda as he was presumed to be so isolated for his own safety that he could barely communicate with the outside world; widely seen as little more than a figurehead. However, it seems the opposite was more likely. Bruce Hoffman in Foreign Affairs believes Bin Laden “played an active role at every level of al Qaeda operations: from planning to targeting and from networking to propaganda.”

This is further supported by a senior intelligence official at the Pentagon on the 7th of May, 2011 who refers to information collected from the Abbottabad raid:

“The materials reviewed over the past several days clearly show that Bin Laden remained an active leader in Al Qaeda, providing strategic, operational and tactical instructions to the group and continued to direct even tactical details of the group’s management and to encourage plotting. The materials show that Bin Laden remained focused on inspiring and engineering international terrorism and specifically on attacking the US.”

While Bin Laden was more operationally active than previously believed, this position would be far easier to fill than his role as a symbolic figurehead for what has become a network of affiliated and allied groups, as well as a wider movement of sympathisers. Praised for his humility and generosity, as well as his courage under fire in Afghanistan, he was widely respected in jihadist circles. When individuals and other groups joined Al Qaeda, they swore allegiance directly to Bin Laden, rather than his organisation, making him the focal point for a network built on personal loyalties.

Al Qaeda’s Leadership

Bin Laden’s leadership, guidance and overall importance for Al Qaeda and the adverse effects his death will have on the group could not be exaggerated. Although his operational role diminished post 9/11, Bin Laden was the epitome of a jihadist leader within Al Qaeda. Having devised the group’s strategy, he was a strong symbol of resistance and it was the power of Bin Laden’s charisma that allowed Al Qaeda to survive after 9/11 and become the brand name that attracted individuals and other Islamic radical groups.

Ayman al-Zawahiri, Bin Laden’s replacement as the head of the Al Qaeda core, has what seems to be the perfect resume for an aspiring terrorist leader; having formed his first terrorist cell in 1966 at only 15 while plotting against the Egyptian regime, and then spending several years in an Egyptian gaol after the assassination of the President in 1981. He then placed himself at Bin Laden’s side in 1988, when Al Qaeda was founded. Al Zawahiri has been labelled Al Qaeda Number 2, but there is no guarantee of his remaining in control after the succession. He is still perceived as rigidly opinionated, argumentative and authoritarian – in stark contrast to the conciliator that Bin Laden was reported to be.

The Al Qaida core in Pakistan has been clearly weakened operationally post May 1 and deemed less capable of planning and carrying out significant attacks by US experts, while its affiliates have gained strength and consequently diversified the broader threat geographically and ethnically. General Carter F. Ham, the chief of the US Africa Command, indicated during a September interview that the rise of regional affiliates of Al Qaeda is especially worrisome .

The biggest danger to Al Qaeda in the long run is its irrelevance; it was dying politically before Bin Laden’s death. Its ideology remains irrelevant to the revolutions of the Arab Spring. While Bin Laden plotted how to kill Americans abroad and at home, protestors across the Middle East demanded democracy and an end to corruption and economic opportunity. They didn’t seem interested in a continued war with infidels or the restoration of the caliphate.

Al Qaeda’s Affiliates And Retribution

The Al Qaeda core is suffering and attention is increasingly focused on its affiliates. The most notable of these include Al Qaeda in the Arabian Peninsula (AQAP), Al Qaeda of the Islamic Maghreb (AQIM) and Al Shabaab in Somalia. In an article published on the 2nd of May, the day after Bin Laden’s death, analysts from Stratfor Global Intelligence stated:

“[the Al Qaeda core] central group including leaders like Bin Laden and Ayman Al Zawahiri, has been eclipsed by other jihadist actors on the physical battlefield, and over the past two years it has even been losing its role as an ideological leader of the jihadist struggle.”

The Stratfor analysts elaborate that the new primary threat is now posed by Al Qaeda franchise groups such AQAP in Yemen and AQIM in northwest Africa.

AQAP sits atop the affiliates list and continues to demonstrate its growing ambitions and strong desire to carry out attacks outside of its region. The AQAP leader has publicly proclaimed his group’s allegiance to Ayman Al Zawahiri as the new amir of Al Qaeda in July 2011.

The most recent edition of Inspire, AQAP’s propaganda publication, was dedicated to Bin Ladin’s memory and martyrdom and it clearly endorses Al Zawahiri as the leader of global jihad saying, “now Shaykh Ayman carries the banner” of jihad.

AQIM is attempting to associate itself with Al Qaeda’s transnational struggle yet remains an organisation that continues to carry out the majority of its attacks against security forces in the north-east of Algeria. However, no group has made a bigger name for itself in the kidnapping-for-ransom business than AQIM; it is one of the foremost sources of revenue for Al Qaeda-related groups. AQIM has also sworn allegiance to Al Zawahiri. In an interview on the 7th of July from Abu Ubaidah, a member of the group’s shura restated their allegiance to Al Qaeda post May 1:

“In the name of myself and my brothers in the organisation, I renew my oath of allegiance to our favoured emir, Sheikh Abu Muhammad Ayman al-Zawahiri, and we say to him: ‘O wise sheikh, for as long as you are our leader on the path of truth and jihad in the name of God, we swear to you that we will listen and obey.’”

In the Horn of Africa, the Al Shabaab, an organisation composed of a range of groups with varying motivations and interests, conducted its first major attack outside of Somalia last year when it claimed responsibility for twin suicide bombings that killed 76 people during the World Cup in Kampala, Uganda.

Al Qaeda’s presence within Al Shabaab is increasingly leading that group to pose a regional threat with growing trans-regional ties to other affiliates, and to participate more actively in Al Qaeda-inspired violence.

In addition, Al Qaeda has forged closer ties with some of the other militant groups in the South Asia region; for example, Tehrik-e Taliban Pakistan (TTP) and the Haqqani Network, providing the group with additional capabilities to draw on.

Al Qaeda is likely to become an increasingly loose network of jihadist groups with conflicting priorities, rather than the centralised organisation headed by Bin Laden. Bin Laden’s death could undermine the leadership’s centrality in what has developed into a network of regional affiliates, allied groups and sympathisers. However, with strong, adaptable affiliates pledging their allegiance to Al Qaeda’s core and Zawahiri, it is posing an interesting development to analysts as it implies a continuation of Bin Laden’s ideology and the willingness of these affiliates to continue the jihadist struggle as a centralised network.

It is likely Al Qaeda will seek to carry out some dramatic act of revenge in retribution for Bin Laden’s death and to demonstrate to its followers that Bin Laden’s death does not end the terrorist campaign. [Continued in Part 2.]

Structured Decision – Making In IT Security

By

John Bigelow

-

May 2, 2012

By Kim Khor.

IT security requires refined decision-making skills and decision-making is a dynamic and potentially-complex activity.

Generally, we need to make efficient decisions. This means that we must balance our priorities quickly. We can’t afford to think about things forever.

Systemising decision-making allows us to standardise and improve performance. Removing the clumsiness of unsophisticated decision techniques leaves us free to concentrate on the increasing quality and consistency of our decisions. The clumsiness can include over-analysis, thoughtless rushing, fear, anger, checklist-blindness and indecision over competing priorities (one cannot serve two masters).

Some people have good, gut-instinct decision skills and will understandably find this discussion boring and unnecessary. However, they may have trouble if their gut instinct fails to kick in with an answer, or the coroner asks them to explain a decision.

There are three scenarios where decision systemisation provides value:

Making decisions with appropriate speed, consistency and effectiveness.
Regaining balance and alignment when decision-making goes out-of-tune.
Reviewing and substantiating decisions.

Decision systemisation in IT security is a lot like athletic preparation or artistic rigour:

We must practise the elemental, dynamic skills involved. Making dynamic activities conscious and sequenced allows us to improve and refine them. Then they can be set back to automatic.
We must gain and retain match practice. This is a heightened state of awareness and muscle-memory when performing the activity.
We need methods for steady improvement and performance review.

The method used by the writer is called ‘Decision Sequencing’. This provides a framework within which to practise and sharpen, to the point that the skills become subconscious, muscle memory. The process can be used in broad strokes or in fine detail, depending on your need.

The Decision Process

Generally, a decision process comprises three stages:

Reasoning (logic)
Judgement (probability) and
Final decision (utility)

Reasoning identifies, and assigns relevance to, elements of the decision.

Judgement assesses probabilities and estimates outcomes, efforts, obstacles and so on. Here, we might run hypothetical scenarios to perform mental experiments.

The final decision is weighing up the information obtained from the previous stages and making a selection, not necessarily knowing it to be right or wrong, but simply as a step in the overall constructive process.

Reasoning

We must first identify relevant priorities and decision criteria in our mind. For example:

The doctrine of my profession (such as, do no harm)
The mission of my organisation or team (achieve this outcome)
The welfare of my teammates/subordinates/stakeholders (do they suffer harm? Has their position improved?)
Our preparedness for the next likely few steps after this (like a footballer making a good pass)
An appropriate budget for solving this problem.

The Decision Sequencing Compass. Use this image as a guide for shifting your perspective as you move through the problem at hand. Look left/right, and then look up/down. Just briefly, then move on. Repeat as necessary.

Secondly, assess the available options and rough out some descriptive numbers or proportions that are meaningful to you. For example:

My appointment is in 20 minutes.
If I continue this way, I should be there in 10 minutes.
There’s a railway crossing on the way. I could be stopped there for 10 minutes.
There’s another route with no crossing but that’s 20km long.
I will either be late, or I won’t be. There’s no grey area.
If I know 10 minutes prior, that I’m going to be late, I can manage that situation for an acceptable outcome.

If you don’t know something important, just note it, insert a tentative answer and move on.

Thirdly, consider change. There are many ways to effect change. When configuring performance improvements, we do them gradually, one at a time. Otherwise, we can’t keep track of what changes when. On the other hand, if we change a password, we change abruptly. What style of change is appropriate for the current situation?

Judgement

Before assessing things, we must first get organised. We need to arrange the decision information we’ve collected into a useable configuration. Consider the minutes of a meeting. They provide context and familiarity with brief and efficient information. They provide a digestible snapshot and prepare us well for a subsequent meeting. Similarly, we need a method of arranging our decision information in our minds.

The military of last century provides the customisable five paragraph order (also known in other forms as SMEACS, or similar). This gives relevant and structured information to efficiently describe a task or problem. I use this framework because it is so versatile when used for problems large or small, simple or complex.

The concise and efficient arrangement of decision information facilitates rapid and accurate sequencing of the decision process is the essence of this system.

Assessing Options

The basic maths of proportions and probabilities allow us to scope outcomes and flow-on effects and their costs. More modern systems, such as Bayesian probability, provide alternative perspectives. For example, how does knowing about one outcome alter our consideration of an alternative outcome? (Coincidentally, this is also a classic question seeking to expose error-causing psychological bias.)

Sufficient familiarity with the concepts can be gained without studying the details – start with Wikipedia. Ignore the equations and just read the executive summaries. You’ll find that a lot of this maths just describes how gut instinct might work.

Developing the ability to perceive proportions gives most of the value anyway. We want awareness of relative sizes, rates and probabilities, and the perspective from which we judge those. Look for a way to see proportions that is comfortable for you.

For example, what does a 10% versus 60% likelihood really mean? In what situations can I afford to ignore the 10% probability?

When it won’t be hard to fix?
When it won’t be my problem?
When the cost of simply suffering the adversity can be absorbed without too much pain?

Considering questions like these provides a refinement in our knowledge that will allow us to more confidently make reflex decisions.

The Decision-Sequencing Technique

Note the decision inputs (e.g. there are these streets, these obstacles, and these forces in effect…)
Note the possible choices and outcomes
Note your criteria — priorities, principles, doctrine, the law, etc.

For each potential final choice, assess the possible outcomes against your criteria and exclude any unacceptable options
Score the remaining few options, combining both likelihood of success and criteria compliance
Highest score option wins.

The structure may be varied to match the problem at hand as long as the spirit remains. We can pause, rewind and repeat as necessary.

As your structure becomes refined, and as practice turns into muscle-memory, you will find the process increasingly easy, tending to leisurely. Don’t be put off by the apparent complexity. Just do one bit at a time. You already do this kind of thinking when you make gut-feeling decisions. That’s why they’re often so good.

Speed

Gradually practise making decisions more quickly. It’s possible to make a fully-featured decision in less than half a second. This is like encountering an unexpected punch or a car crash.

We probably don’t need sub-second responsiveness, but everyone can be a little better and it’s interesting to see how many decisions are procrastinated out-of-existence, never to be actually made. This kind of awareness is just as valuable as the increase in speed we get from the practice.

Practice Makes Perfect

It’s just a matter of finding efficient ways to practise. Like the way many of us learned the phonetic alphabet by reading out car licence plates. Such methods cost no extra time and provide great results, quickly.

Practise assessing decisions in common activities, such as your morning routine. What should I do first? Why? What could be the benefit of changing this habit?

You will be surprised at how many decisions are based on skewed subconscious programmes, and you will have a lot of laughs getting to know yourself in this way. n

Kim Khor is a computer forensics expert. Kim consults on network security, incident response, risk & compliance, investigations and electronic evidence management in the Asia Pacific region and can be contacted at kimkhor@gmail.com

Professional Development: It’s Not Just For Doctors and Lawyers

By

John Bigelow

-

May 1, 2012

By Troy Johnston.

The journey to becoming a locksmith usually begins with the undertaking of an apprenticeship through which one studies at the local or interstate TAFE, in conjunction with on-the-job training to satisfy what are deemed to be trade qualifications within our chosen field. In most cases, this period lasts for about four years before we are then let loose on society as a qualified locksmith to do as we please.

But then what? Does our learning and development curve cease to exist? Unfortunately, with the exception of the daily challenges of the job, it does for some individuals, just as soon as they finish their apprenticeship or vocational training.

The physical and electronic security industry, like most things in life, does not stand still for long, especially with its rapid uptake of technology. More than likely, the products, technology and even the common business practices used over the years, as an apprentice or business owner, have slowly been used less and, in many cases, they have been completely superseded.

How does one keep up with these rapid changes in the security industry? In two words, professional development.

Professional development is not just for academics and what some members of society deem as professionals, such as doctors, lawyers and accountants. Yes, professional development has, in the past, been directed at these professions most likely due to the ever-changing rules of the industry they are in, and the various bodies that govern their qualifications.

The more common professions also want to project to the public that they are at the forefront of their industry; that they are current with all their legal obligations; and that they implement best-practice procedure for their clients.

Most of you reading this obviously have an interest in your chosen careers, businesses and the industry as a whole. So why not apply the same logic as a security professional that other professionals do in their chosen fields? Consider professional development as furthering one’s career, business and personal prospects to new levels while, in some instances, also attaining industry recognition and the ability to network as well.

Professional development may be modelled on various themes with the most common being one CPD (continued professional development) points issued for every hour of development undertaken — with a goal of 12 to 16 points being undertaken every year, depending on the industry and profession.

In fact, some professions have made it mandatory to undertake CPD on an annual basis to maintain their existing qualifications. This ensures that all participants are current with product, legal, regulatory and best-practice business procedures.

Professional development can be undertaken in a formal manner, such as striving for a new qualification associated with locksmithing or the security industry itself; or an informal style, such as workshops, meetings, product training and launches that are relevant to the industry.

Contact your local suppliers and enquire about any upcoming training they will be running throughout the year. This will allow your staff to be proactive in relation to product awareness which will provide them with more tools in their selling basket when dealing with clients.

From the business owner’s perspective, you would be right in wanting well-trained, knowledgeable and driven staff to grow your business. In some instances, if your business is large enough, you may well have a HR department that can look at incorporating and driving a CPD programme for your staff.

For those of you that are not in that boat, you can still drive a CPD programme with input from your staff. Think about what existing skills they already have and, where they are lacking, sit down with each staff member and discuss their options. Provide some CPD options that are relevant to you and the business and that can also enhance your employees’ work and personal life. Once the various options have been finalised, ensure that regular reviews are put in place to maintain the ongoing commitment from both parties.

For business owners, subjects of interest may include management, sales, accounting, tax, marketing and HR. A common complaint from business owners in the locksmithing industry is that of staff retention.

Why not look at undertaking a management or leadership course to help motivate and retain your good staff? While such courses might not appear to be industry–specific, they are essential knowledge pools that are ever-changing and constantly need to be updated to help ensure one’s business success.

One highly important aspect of professional development is that of keeping well-informed about regulatory changes to the locksmith and security industry as a whole. These regulatory changes affect your legal rights and obligations as both business owner and employee. They could range from security licensing through to changes made to fire doors or handling asbestos on the job. Knowledge of these changes is crucial to ensuring your business and employees operate in a legal manner at all times.

For employees, the opportunity to undertake new qualifications or enhance their existing repertoire usually adds some drive and vitality to what can often be a stale career for some. Look at your current position and skills in conjunction with your desired career direction.

If you are currently on the tools and looking for a change, consider some short courses in sales or project management to show your employer you can take it to the next level. Don’t forget the increased demand for IT skills in our rapidly-changing industry either. Regardless of the direction or subject you decide to choose, undertaking professional development will separate you from the pack in your locksmithing career for years to come.

Overall, professional development should not be considered as work that is additional to one’s already-busy schedule. CPD should be considered as an opportunity to lift one’s career and personal prospects to the next level to ensure continued success. n

Troy Johnston has been involved in various aspects of the locksmithing industry for thepast 17 years. He is currently based in QLD and working for LSC (Locksmiths Supply Company), Technical Sales and Support, Electronic Security. Contact him at: tjohnston@lsc.com.au or (07) 3252 1056

Recognising And Dealing With Post-Traumatic Stress Disorder

By

Tony McHugh

-

May 1, 2012

Post-Traumatic Stress Disorder (PTSD) is a psychiatric consequence of exposure to potentially traumatic events (PTEs); that is, events where the person experienced, witnessed, or was confronted by an incident involving actual or threatened death, serious injury or threat to the self or others. Such events include war and war-like occurrences, physical and sexual assault, serious accidental injury and (natural and man-made) disasters.

Who Gets PTSD?

While exposure rates to such events within the general community are often as high as 60-65% , and in some populations have been reported to be as high as 84% , these rates increase considerably in (serving and retired) members of organisations whose role routinely involves exposure to PTEs. This includes military personnel, security officers and members of emergency service organisations such as police, ambulance and fire services.

The prevalence of PTSD following exposure to PTEs is much less common than the occurrence of trauma. However, that can vary, with lower rates between 5-10% reported following non-interpersonal events, such as accidental injury and natural disaster. Higher rates of between 25-50% can occur following interpersonal traumas, such as combat and assault, with the highest rates being among those exposed to sexual assault . It is important to note, however, that the likelihood of developing PTSD increases with repeated exposure to PTEs .

Recognising The Signs And Symptoms Of PTSD

The Formal Definition

PTSD is understood to be characterised by three sets of symptoms. The first relates to the re-experiencing of the traumatic event and includes such phenomena as intrusive thoughts and images of the event, recurrent nightmares and physical and emotional distress at exposure to reminders of the event.

The second symptom set comprises avoidance and numbing symptoms. These include active avoidance of thoughts and feelings related to the event and places, or activities that act as event reminders, and interpersonal detachment and the numbing of feelings.

The final symptom set relates to the hyper-arousal symptoms. These include disturbances in sleep and concentration, exaggerated startle, hyper-vigilance and increased anger .

What People Typically Report

People can be reluctant to report such reactions, be it to a GP, work colleague, family member or friend. This reluctance can be motivated, among other things, by embarrassment, fluctuating wellness, difficulty in describing symptoms and clinician attitude.

Thus, people are more likely to admit to or exhibit clear signs of:

Disrupted sleep and consequent loss of concentration and problem-solving ability
Being unusually irritable
Relationship problems
Physical illnesses of a psychosomatic origin (e.g. gastro-enteric problems — a particularly noteworthy example being Irritable Bowel Syndrome)
Pain conditions (from physical injuries associated with or exacerbated by trauma)
Co-morbid problems or behaviours (e.g. alcohol abuse or problem gambling)
Risky behaviours (e.g. reckless driving or sexual encounters)

Co-Morbidities Of PTSD

While PTSD is a critical, Trauma-Related Mental Health Disorder (TRMHD), its symptoms rarely exist in isolation. In reality, co-morbidity is the norm rather than the exception. For example, co-morbidity rates in the often-studied military and veteran populations have been reported to be as high as 90% (Kulka et al., 1990; O’Toole et al., 1996).

The most common co-morbidities include depression, other anxiety disorders and substance use disorders. A range of broader, psychopathological features are also associated with PTSD. Such features include trauma-related guilt and anger.

Understanding How PTSD Works

PTSD will be more or less likely to occur depending on the operation of the following factors:

Trauma Characteristics

Trauma(s) can fall into any of four descriptive categories. That is, those relating to human-caused trauma, where acts are either intentional (e.g. crime) or accidental (e.g. road traffic accidents), and nature-related trauma that are complicated by human actions or not. Human-caused or complicated traumatic events are well known to have greater potential for traumatisation. Thus, person-implicated events that are horrific, prolonged or repeated, deliberate and malevolent, have the greatest capacity to negatively affect people.

Personal Characteristics

There are certain members of the community who are at greater risk of negative, psychological and functional outcomes following trauma. Known high-risk groups include women, the young and elderly, those with chronic illnesses and diseases (especially pain and mental health conditions), people who are economically, materially or socially disadvantaged and, as mentioned, those who have experienced cumulative, traumatic events.

Individual Response Characteristics

It is well known that response styles will help or hinder people in dealing with PTEs. For example, those who have highly-anxious, pre-trauma response styles and tend to avoid (especially through the abuse of substances or engaging in unhelpful behaviours such as problem gambling), and those with rigid response styles, are less likely to recover speedily or easily.

Those who have cynical response styles or who are self-critical and hence unable to respond to advice or offers of assistance with an open mind, are unlikely to aid their recovery process. Very angry, post-trauma response styles are also likely to interfere. Anger is known to be a powerful predictor of recovery — the greater the anger, the more difficult and delayed will be the coping and the process of recovery.

How To Help People Who May Be Suffering With PTSD

Exposure to trauma, as highlighted throughout this commentary, is common. Most people will have some psychological reaction(s) to trauma — fear, sadness, guilt and anger are common, possible feelings. The majority of people, however, re-establish functioning quickly. Similarly, the vast majority recover over time and only a small proportion go on to develop TRMHDs.

Health professionals, who are experienced in the treatment of TRMHDs, use the following simple questions as preliminaries to deciding whether someone who has been exposed to a PTE has PTSD:

Do you have vivid memories of an event?
Do you avoid things which remind you of the event?
Do you feel emotionally cut off?
Are you irritable or constantly on edge?

These are important signs for us all to consider when a colleague, friend or family member is not functioning normally after a stressful event. However, the task of the caring observer in the workplace, and beyond, is typically not that of a mental-health professional. There are, instead, vitally important roles we can all play after a colleague, friend or family member has experienced trauma. These are best summarised as:

Respectful and watchful waiting — as emphasised throughout this article, although most people will recover without the need for treatment after experiencing a PTE, some will not. It is important that those with a role to play in assisting people exposed to trauma, maintain an awareness of their variable needs. Some will display a lesser ability to cope to the point where specific assistance may be required. Some of the signs of the need for assistance are described below.
Making Psychological First Aid (PFA) available — we should not under-estimate the power of simple acts of caring to people who have experienced a significant stressor. The power of the cup of tea and metaphorical shoulder-to-lean-on to help, is a repeated finding from studies of refugees and disaster-survivors.

Psychological First Aid Overview

Emphasising the importance of maintaining normal functioning — presenting for work, engaging in family and social activities and even going dancing, to the movies or exercising, etc; etc; are not minor matters in maintaining wellbeing.

How To Reduce The Likelihood Of Vicarious Traumatisation

Knowing when to refer — interactions with workplace colleagues who are showing persistent signs of stress (see below) should, however, alert us to the importance of a referral to a professional who is an expert in the assessment and treatment of TRMHDs. Often, early referral can result in impressive gains after small amounts of treatment.

What Sort Of Support Will Help Someone Suffering From PTSD?

It is important to emphasise that people demonstrate, time and again, the capacity to survive traumatic/significant, stressful events and continue to live meaningful and satisfying lives. Thus we speak of PTEs, rather than traumatising events.

One of the most important factors in being able to come to terms with trauma and traumatic loss is what is known as resilience. Individuals who are resilient have been found to experience lower rates of depression, substance abuse and post-traumatic stress following traumatic events than their less-resilient counterparts.

Resilience is defined as the capacity of people to effectively cope with, adjust to, or recover from stress and adversity. Resilient people will not typically need a great deal of assistance post-trauma.

It is important to accurately identify the resilient from those who will need more assistance, without any sense of discrimination or judgement. Such assistance may include PFA or any or all of the five psychological recovery skills.

Skills For Psychological Recovery

For this group, it may be necessary to sensitively encourage them to seek treatment from a health practitioner who is an expert in the treatment of TRMHDs. Such action should be considered if the person, weeks after the event:

Still feels upset or jumpy most of the time;
Persistently exhibits changed behaviour compared to pre-trauma;
Has difficulty with normal activities
Has worsening relationship issues –especially because of anger
Has disturbed sleep
Keeps dwelling on the event(s)
Seems unable to enjoy life and appears numb or withdrawn
There is evidence of depression, persistent high anxiety or risky alcohol and/or drug use
There are concerns about risk to self/others or capacity to care for self and/or others

By Ray Whiting.

By Lamie Saif.

Content

Competency Obligations

Technology

By John Bigelow.

By Ben Hattersley.

The Implications of Osama Bin Laden’s Death For Counter Terrorism Over The Longer Term

Osama Bin Laden: Strategic And/Or Symbolic?

Al Qaeda’s Leadership

Al Qaeda’s Affiliates And Retribution

By Kim Khor.

By Troy Johnston.

Who Gets PTSD?

Recognising The Signs And Symptoms Of PTSD

The Formal Definition

What People Typically Report

Co-Morbidities Of PTSD

Understanding How PTSD Works

Trauma Characteristics

Personal Characteristics

Individual Response Characteristics

How To Help People Who May Be Suffering With PTSD

Psychological First Aid Overview

How To Reduce The Likelihood Of Vicarious Traumatisation

What Sort Of Support Will Help Someone Suffering From PTSD?

Skills For Psychological Recovery

Follow us on Instagram @securitysolutionsmedia

EDITOR PICKS

POPULAR POSTS

POPULAR CATEGORY