Known knowns and unknown unknowns

"There are known knowns" is a phrase from a response United States Secretary of Defense Donald Rumsfeld gave to a question at a U.S. Department of Defense (DoD) news briefing on February 12, 2002 about the lack of evidence linking the government of Iraq with the supply of weapons of mass destruction to terrorist groups[1]



This quote tells us something about risk management.  Basically there are threats we know about and there are threats we don’t know about and there are threats that we don’t know we don’t know about.



From a risk management standpoint, that’s pretty disconcerting. 



In order to understand the unknowns you have to look at things from the “bad guys” perspective.  In other words, see what the "bad guy" sees.  And to do that you must understand that there are four aggressor types of criminal/man-made threat groups; criminal (sophisticated/unsophisticated, organized/unorganized), protestors (organized/unorganized), terrorist (domestic/transnational/state-sponsored), subversives (saboteurs/intelligence agents [state/non-state sponsored]).  In an effort to design better mitigation strategies planners must understand the “bad guys” motives or the reason(s) behind why they do what they do.  There are also four primary aggressor objectives; inflict injury or death to people, destroy or damage facilities, property, equipment or resources, steal equipment, material or information and create adverse publicity.



So how can I plan to reduce their effects let alone mitigate them?  The answer is really easier than you think.   Traditionally in risk management, we look at things from a probability standpoint.  We ask the question. “Will it happen here, and if so, what will the impact be”?  I believe, likelihood has little influence on risk.  I believe likelihood comes into play when talking about funding.  Our risk management methodologies assume the threat will be successful 100 percent of the time.  We calculate likelihood when it comes to cost benefit.



Our Asset Based Risk Analysis (ABRA) and Critical Asset and Infrastructure Risk Analysis (CAIRA) methodologies combine the aggressors motives and objectives with what the asset owner sees; thereby, giving a complete picture of risk.  



More about ABRA (Platinum GOVIES Award 2017 for Best Government Security Risk Methodology) https://view.joomag.com/march-2019-ast-magazine-march-2019-ast-magazine/0952115001553308799/p4?short



More about CAIRA (Platinum 2018 ASTOR Award for Best Risk Analysis Methodology in Homeland Security) https://view.joomag.com/july-2019-ast-magazine-ast-july-2019-magazine/0612002001563068627/p60?short



More about risk management and developing mitigation strategies can be found in my new book, The solutions Matrix: A Practical Guide to Soft Security Engineering for Architects, Engineers, Facility Managers, Planners and Security Professionals.  Order here  https://americansecuritytoday.com/dont-surrender-to-fear-new-book-the-solutions-matrix-by-doug-haines/

---

[1] Full quote: Reports that say that something hasn't happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don't know we don't know. And if one looks throughout the history of our country and other free countries, it is the latter category that tends to be the difficult ones.

Getting Everyone to Speak a Common Language

A couple weeks ago, I was teaching a class about using building design to deter criminal activity, including terrorist attack, and when it fails reduce its effects and prevent mass casualties.  After the obligatory introductions, I said something to the effect, that building design is a matter of reducing risk whenever and wherever possible.  But in order to do that you have to the know your “DBT”.

Based on the blank stares, I got back, I knew something was wrong.  So, I said it again.  Still the deer in the headlights looks.  So, I said, “Everyone knows what DBT stands for, right”?  Still nothing.  Not one person raised their hand.  I was taken aback.  After all the class was made up of seasoned architects, engineers, planners and security folks.  I would have thought, at least, one or two would have known what I was talking about.

So, we spent the new few minutes talking about Design Basis Threat or DBT, if you will.  DBT is identifying your threats, their tactics, the tools they may use and then designing your building to deter or prevent them from happening, in the first place, and understanding that if they do happen you can reduce their effects if you’ve included reduction strategies into the design.

The very first thing to do is to assemble “the planning team”.  The idea that “it takes a village” needs to be used here.  The team should include architects, engineers, facility manager, security, end users and others.  It’s important to bring these folks together, so that they can discuss the parameters of what they are trying to accomplish and “buy in” to the project.  If done correctly at the beginning of a project, security costs can be kept to a minimum, usually somewhere around five percent of the total project costs.  If security comes in at the end of the project this cost may skyrocket to thirty-forty percent, because of the long term cost of equipment maintenance and especially, personnel costs.

Once the team is assembled, the first step is to identify the threat or threats.  Threats can be divided into two categories; natural and man-made.  Fortunately, laws and ordinances exist that address natural threats in building design; i.e., earthquake, flooding, fire, tornado, etc.  Man-made threats on the other hand – not so much.  Although, that is changing slowly.  Last year, federal legislation was signed into law that addresses the use of hostile vehicles as a method of attack in public spaces.  We’re still waiting for the DHS report the law requires and its subsequent findings and recommendations.  I’m particularly concerned that our government hasn’t the courage to attack hostile shooter legislation, when it is so needed.  But that’s another Blog topic for another time.

The second step is to identify the motives of the man-made threat,; i.e., causing injury or death, theft or unlawful removal of property or equipment, damage to property or facilities and causing adverse publicity.  Then we need to figure out what type of groups commit these acts; criminals (sophisticated/non-sophisticated, organized/unorganized), protesters (organized/non-organized), terrorist (domestic/trans-national/state-sponsored) and subversives.  

Then we look at the tactics they use; stationary or moving vehicle, different types of weapon usage, forced entry, etc.  Each tactic uses a different set of tools. That said, each type of tool use has a countermeasure available to reduce its effectiveness.

If we understand their motives, tactics and tools, we can design countermeasures into inhabited space that reduces the possibility that they will occur and when that falls short reduces their effects. 

My book, The Solutions Matrix: A Practical Guide to Soft Security Engineering for Architects, Engineer, Planners and Security Professionals, will be available in September.  It will outline the processes used to determine DBT, have a quick reference chart that outlines how to counter each type of man-made threat and provide examples of practical real-world solutions.  

THE EVOLUTION OF RISK MANAGEMENT,

WAS DARWIN RIGHT?

In the Theory of Evolution, Darwin suggests that evolution is about survival of the fittest.  Was he right?  While he was talking about the natural world, his theory also applies to the security business.

In order to survive in today’s world businesses must adapt to their environments.  The threats that were around twenty years ago have changed.  They’ve become more sophisticated and must be adapted to.  What worked before won’t necessarily work in today’s world.  Not only have threats scenarios evolved but with the increase in technologies so have a new variety of threats come about. 

It used to be that a person who wanted to commit a breach of security had to be physically present in the space in order to carry out the attack.  That is no longer the case.  Since just about everything that has a moving part to it is somehow connected to the Internet of Things (IoT), a hacker does not have to be present in the physical sense in order to disable a closed circuit television (CCTV) camera, for example.  This means, a new way of thinking about threats, vulnerabilities and risk is necessary.

Threats used to be pretty much two-dimensional.  That no longer is true.  Those involved in the risk management business must think in three-dimensional terms.  In fact, they need to think about security as if it were a cube or box.  It’s six-dimensional and the approach to risk management must be carried-out that way.  This will require, pardon the pun, “outside of the box” thinking.

Additionally, without the “it’s part of the culture” way of doing business threat scenarios will continue to be played out with varying degrees of impact – and, some will be catastrophic.  Since we cannot prevent threats from occurring one hundred percent of the time we have to get the results down to a level that we can accept and handle with available resources.  This requires us to include scenario that are improbable but the results will overwhelm resources.  I call this “impact centric planning”.   I know most of us will not encounter an active shooter situation within our lifetime but active shooter threats must be planned for wherever high concentrations of people gather.  The adage, it won’t happen here cannot be the flavor of the day.  You’re right it probably won’t happen here, BUT if it does?  What will be the impact?

Not only must we deal with threats that are likely but we also must deal with threats that would be catastrophic even though very unlikely.   An excellent example of a highly unlikely event is the Las Vegas shooting incident.  That event was so improbable that if I would have brought it up during a planning session those in the room would have thrown their coffee at me. 

In order to survive, we must ensure we are the fittest.  So, Darwin was absolutely right.

First Responders Require Specialized Training to Deal with

 Special Needs Individuals

By Patricia O’Connor (Guest contributor)

Death of individuals with alleged disabilities through the actions of law enforcement has been reported in the media and has contributed to citizens of the United States protesting and seeking changes in methods used by law enforcement agencies.

NBC News reported on March 14, 2016 that almost half the people who die at the hands of police officers have some type of disability. According to an investigation conducted by Portland Press Herald in 2012 approximately half of the 500 people killed each year by police were mentally ill.

Police officers have become the default responders for incidents, including those involving mental health calls. They often find themselves in situations where urgent medical care by trained and certified professional practitioners would be more appropriate.

Misdiagnosis of symptoms or the misinterpretation of displayed behavior as being aggressive, resisting arrest, or threatening by law enforcement and by medical responders has resulted in the unnecessary injury or death of persons with special needs. Communities are ultimately legally liable. The question for community leaders has to be, “Why is this misunderstanding occurring and how do we fix it?”

So let’s examine this phenomenon – lack of training for first responders.

FIRST RESPONSE

First, let’s admit first responders do not face the daily challenges of their jobs with intentions of hurting, maiming or killing individuals with special needs. They are merely faced with circumstances which are unfamiliar to them. These circumstances require specialized training and knowledge. So often initial training has not been conducted and certainly, on-going training isn’t provided either.

First responders are required to have specialized training in other areas of their complex duties; i.e., weapons training, first aid, social behavioral skills, etc. in their particular field in order to serve their communities and respond appropriately to the needs of those whom they serve. Individuals with exceptional needs require exceptional care. First responders must have knowledge and training with the appropriate skill sets to deal with specific disabilities and needs so that their response is suitable. Interaction with people afflicted with mental disabilities requires specific and focused interaction just as interactions with people having other medical disabilities require special treatment.

TRAINING, TRAINING AND MORE TRAINING

As they say in the real estate industry, it’s all about “location, location, location”, well in dealing with mental health issues it’s all about “training, training, training”. Training must be relevant, engaging and consistent. Training sessions including both theoretical application and practical “role playing” exercises work best. Training is a continuous occurrence. It needs to occur routinely but not so often that it neither detracts from everyday duties nor develops into something so mundane that it becomes stale and ineffective. Training would save lives, both for the individuals encountered by first responders and the first responders themselves, especially those arriving on scene first – law enforcement officers.

THE WAY FORWARD

Whether responding to a scuffle at a convenience store or a major natural disaster as witnessed recently in northern California those responding need to be equipped not only with the physical tools needed for the job but also with the mental tools for resolving these highly charged situations. People with mental disabilities present special challenges during these extreme emotionally events. First responders should be equipped to deal with them. We can prepare for these situations through a serious of preventive measures; such as, placing placards on doors or windows indicating that special needs individuals are inside, creating communication systems with access to databases that first responders can “call up” while responding in order to ascertain what they might find at the incident scene and to alert them to obstacles or challenges they may encounter upon arrival. Just knowing when and where won’t be enough. Responding units will need to have skills sets that de-escalate the situation and resolve them in an appropriate manner. Additionally, it is essential for communities (civil authorities, medical, fire, law enforcement and citizens) to come together to address these issues.

A humane society is measured by its care for those who are most vulnerable. How will we be judged?

AUTHOR BIO

Patricia is a Doctoral student in Educational Administrative, with emphasis on Special Needs Education. She regularly provides insight and input to the Department of Homeland Security as they prepare Federal Emergency Management Agency (FEMA) guidance for dealing with special needs issues during times of crisis.  She is the founder and CEO of SirenUSA, an on-line training tool for first responders. 

“I can do things you cannot, you can do things I cannot; together we can do great things” – Mother Teresa