The Myth About Size – It Doesn’t Matter

 

Most small businesses and homeowners, for that matter, think that due to their small size they are exempt from conducting analysis of their crime risks or other threats.  Larger organizations; however, understand the necessity to conduct a formal vulnerability assessment and risk analysis review on a regular basis – usually once a year or sooner if necessary.

Every organization, large or small, MUST conduct a formal assessment of their risks.  If they don’t they won’t know what their risks are or what mitigation strategies to employ. The process doesn’t have to be too complicated or lengthy or expensive.  But some type of formal analysis MUST be done.  When conducting a risk assessment, the formula goes something like this; assess the criticality of the asset (see definition below), determine what threats there are (both natural and man-made should be considered), and what vulnerabilities there are.  Once you’ve done that you have your risk.  For you math geeks the formula is written C x T x V = R.

Asset

Assets are anything of value to the owner and can also be anything the owner has that is of value to someone else (the bad guy, for instance).  A diamond ring, a house or a store full of products – anything of value.  You also have to determine how critical the asset is to you.  So, yes, even your kids and other relatives.  Although some of my relatives I wouldn’t mind if they were to get taken by aliens. 

Something else to remember, assets can have many parts that should be evaluated; i.e., a gas station - has gas pumps, a cashiers cage, and retail space.  Each piece of the asset should be evaluated, so that a clear picture of what needs protecting emerges.  I found it best to use, a quantitative system, using numbers to assign value.  One to ten works fine but one to 100 works, too.  Find a numbering system that works best for you.

Threat

Next, what are you protecting your asset against (threat).  Threats come in all shapes and sizes.  I can in very short order come up with several dozen natural threats and almost as many man-made threats.  And, as the recent incident in France just showed us, threat scenarios can be almost limitless.  Suffice it to say, concentrate on the one or two most likely to occur AND the ones that would be the most disruptive.  Again use a numbering system to assign value.

Vulnerability

Another way to look at vulnerability is to ask the question, “How much trouble am I in”?  Vulnerabilities can be physical in nature; i.e., a fence isn’t high enough to deter a burglar or it could be procedural, we don’t lock the gate to the backyard for example.  Both are vulnerabilities that can and will be exploited by a would be perpetrator.

Risk

These factors combined are your risk.  The risk tells you how much trouble you’re in. 

Solutions

Once you know what kind of shape you’re in, you need to develop mitigation solutions, determine the cost benefit (like you wouldn’t put a $500 lock on a $100 bike) and what solution you are going to do first.

I recommend implementing solutions that produce the highest reduction in risk to the largest number of people first. 

The Trap

Don’t fall in to the trap of thinking the solution to mitigate all threats is to buy and install a close circuit television camera (CCTV) system or home security system.  While CCTV can be a very effective solution, it has to be connected to a response force of some type that is capable of responding to the treat in an adequate amount of time.  A recent article in the Chicago Tribune revealed that CCTV solves crimes less than three percent of the time.  This is primarily due to the fact that the cameras are not continuously monitored or responded to when bad behavior is detected.  If you rely on a police agency or security company to respond, you need to make sure they guarantee response within 5 minutes.  Research conducted by the National Institute of Justice in 2015 revealed that a burglar spends about seven minutes on average on site.  So if the responding force doesn’t get there when the bad guy is there, there’s a 97 percent chance he won’t get caught.  This is the reason large organizations have dedicated security forces on site.

Ultimately our goal and that of every asset owner is to deter, prevent and respond to a variety of threats, regardless of the size of the organization.  Whether large or small, everyone asset owner MUST conduct a formal assessment to know what their risks are.  So size, doesn’t matter.

Other risk management strategies and assessment methodologies will be discussed 6 – 8 September in Jacksonville, FL.  Call 805 509-8655 for more information about seat availability.

On-line assessment tools for small businesses, homeowners and schools are available at https://hainessecuritysolutions.com/Technology_Improvements.html

Sex Trafficking and the Role of Facilitator

What is human trafficking?

Under U.S. law, human trafficking includes the unlawful practice of selling, soliciting, or advertising the sexual services of minors or of adults who have been coerced into commercial sex.  The term “coerced” can be through physical or psychological means. It is generally agreed that human trafficking generates billions of dollars globally each year in illegal proceeds. In the United States, over eight in ten suspected incidents of human trafficking involve sex trafficking. 

Online ads and constant transport of victims: high profits and low risk of detection.  What drives the proliferation of sex trafficking, often referred to as a form of modern day slavery?  According to the National Center for Missing and Exploited Children (NCMEC), the last five years have seen an 846% increase in reports of suspected child sex trafficking, “directly correlated to the increased use of the Internet to sell children for sex.”3 Online advertising has transformed the commercial sex trade and in the process has contributed to the explosion of domestic sex trafficking.  Sex traffickers can pocket profits of between $5,000 and $32,833 per week according to an Urban Institute report.

Sex trafficking business model includes the role of facilitator

Sex trafficking is like any other business and includes a seller, customer, and product. The commercial sex trade, however, involves an additional role, which I will refer to as the “facilitator”. In the context of human trafficking, a facilitator is sometimes defined in other ways. For this article, however, “facilitator” will mean persons and/or places that allow sex trafficking to occur, either knowingly or unknowingly, directly or indirectly.  Facilitators can be hotels, online marketplaces, friends or family, shopping malls, strip clubs, truck stops, airports, or the workplace. Sometimes a facilitator is completely unaware of illicit activity and other times complicit. Common facilitators include: online classifieds and adult services web sites, hotels, and shopping malls where illicit massage businesses operate (sometimes a front for sex trafficking).

Online marketplace for adult services

The market leader in online adult services classifieds is Backpage.com. According to Advanced Interactive Media Group, Backpage.com net more than 80% of all revenue from online commercial sex advertising in the United States. You might be wondering why authorities cannot merely shut down web sites that are suspected of advertising sex trafficking victims. (Age is asked but not verified.) It’s complicated. Recurring arguments revolve around the First Amendment Freedom of Speech and the anonymity of the Internet. To further complicate the matter, many adult services sites are hosted offshore, which is especially problematic for the U.S.  

Facilitators face risks of litigation and brand damage

Cynthia Cordes, a former Assistant U.S. Attorney who prosecuted human trafficking cases, discusses the private sector risks of inadvertently supporting the actions of traffickers. “As a federal prosecutor, I saw traffickers target businesses as unknowing participants in the crimes [of human trafficking]; these businesses often had an array of legal ramifications [as a result of] our prosecutions. This was especially true of businesses within the hospitality, food, agricultural and manufacturing industries.”

California’s Red Light Abatement Act allows a building or place to be fined and shut down if found to facilitate prostitution or human trafficking (Penal Code § 11225 – 11235). In 2012 under the Act, two motels in Oakland, CA were sued by the city and ordered shut down for a year following decades of prostitution and child sex trafficking.9  The Trafficking Victims Protection Act (TVPA) provides ways to prosecute entities and individuals, whether they played a direct role or not. Although most victims do not pursue civil litigation once they are free of their traffickers, sex trafficking presents an ongoing business risk. Businesses could see more instances of civil litigation in the future.

National Human Trafficking Hotline

If you or someone you know is in immediate danger, please call 911.

If you believe you have information about a potential trafficking situation, call the National Human Trafficking Resource Center toll-free hotline at 1-888-373-7888. Call Specialists are available 24/7 to take reports of potential human trafficking. All reports are confidential and you may remain anonymous. Interpreters are available. To submit a tip online, go to https://traffickingresourcecenter.org/report-trafficking

National Human Trafficking Resource Center (NHTRC), www.traffickingresourcecenter.org.

About the author

By Linda Lange, Director, Cyber Safety Talk– specializing in consulting, open source research, & training.  Linda is involved as a human trafficking community advocate on her local D.A.’s Human Trafficking Task Force. She was invited to testify before the Human Exploitation & Trafficking Institute (H.E.A.T.) in February 2016, where she presented “Online Sex Trafficking in Our Communities.” She holds an M.S. in Organization Development and was awarded a scholarship in 2013 to study Cyber Security Law & Policy through Syracuse University College of Law, Institute for National Security & Counterterrorism. She holds certificates in Internet Crime & Identity Theft, Information Systems Security, and Human Trafficking. Contact: linda@cybersafetytalk.com

References: 

1 See 18 U.S.C. § 1591(a); 27 U.S.C. § 7102(10).

2 U.S. Dep’t of Justice, Bureau of Justice Statistics, Characteristics of Suspected Human Trafficking Incidents, 2008-

2010, at 1 (Apr. 2011), http://bjs.ojp.usdoj.gov/content/pub/pdf/cshti0810.pdf.

3 Testimony of Yiota G. Souras, Senior Vice President & General Counsel, National Center for Missing & Exploited

Children, before Permanent Subcommittee on Investigations, at 2 (Nov. 19, 2015).

4 Urban Institute, Estimating the Size and Structure of the Underground Commercial Sex Economy in Eight Major US

Cities, at 234 (March 2014), http://www.urban.org/uploadedpdf/413047-underground-commercialsexeconomy.pdf.

5 Polaris, “Illicit Massage Businesses”, available at http://polarisproject.org/initiatives/illicit-massage-businesses

6 Advanced Interactive Media Group, Prostitution-ad revenue up 9.8 percent from year ago (Mar. 22, 2013),

7 Stephen Koff, “As Rob Portman and Senate prepare to bring contempt-of-Congress charge, Backpage.com says ‘Bring it on’” available at http://www.cleveland.com/open/index.ssf/2016/03/as_rob_portman_and_senate_prep.html

8 Cynthia Cordes, “Human Trafficking: Corporate Responsibility for Modern Day Slavery”, available at

http://www.tmtindustryinsider.com/2014/05/cynthia-cordes-authors-human-trafficking-article-for-the-st-louislawyer/

9 Kristin J. Bender, Oakland Tribune, “Judge shutters two prostitution-plagued East Oakland motels”, 5/31/12,

available at http://www.insidebayarea.com/top-stories/ci_20754910/judge-orders-two-east-oakland-motelsclose-pay

HOW TO AUGMENT EMERGENCY PLANNING EFFECTIVENESS

SETTING DESIGN PARAMETERS OR “TRIGGERS”

The price of doing the same old thing is far greater than the price of change.

If we want the outcome of our emergency plans to be different then we probably need to take a different approach to how we design communities.  Right now, the buzz word is “smart” cities.  What we really mean is efficient cities.  Cities that allow for free exchange of movement between different sectors of the cities is essential especially with the growth rate of the world’s population.  Smart cities philosophies are easiest to incorporate when building new communities but what about the “old” city centers and residential areas.  Creating an environment where people want to live work and play is critical.  People want to be in areas not because they are efficient, yes that helps, but the real reason is because they feel safe with their families.

With that in mind, we can establish criteria now for the way we are going to design and construct our communities of the future.

I suggest setting the new design protocols for any pre-planning of neighborhoods, facilities or utility systems, especially if the goal is to decentralize poverty and to reduce crime. With that in mind all new construction after a certain date should fall into this category.  For existing facilities and communities, then we should set “triggers” or thresholds that once they occur we design and construct using the new criteria we’ve established. 

For buildings, those “triggers” could be as simple as; when there is a change in usage, or during major renovation that exceeds 50% of the plant value cost or there is a significant increase in floor space. 

For communities, they could be during major renovation projects when 50% of the system or community is destroyed or damaged and needs replacing, and during community-wide scheduled renovation projects when 50% or more of the infrastructure or buildings are being upgraded.

WHY CHANGE THE STATUS QUO

How’s the old saying go, “If we always do what we’ve always done, we’ll always have we’ve always had”.  

IMPACT CENTRIC PLANNING

Planning for Low Probability-High Impact Events

TRADITIONAL RISK MANAGEMENT METHODOLOGIES

The traditional mindset of most leaders, whether government or civilian (yes, even in the corporate sector) is that a crisis, situation or event that has the potential to disrupt service or mission capabilities can be planned for by writing a comprehensive emergency plan.  Once that’s done, when an event, situation or crisis occurs, they’ll simply pull out the plan and follow it.  This thought-process is flawed from the beginning.  While plans are a good thing to have they are not what they are made out to be unless the crisis follows it.  Unfortunately, most crisis haven’t seen what you written and won’t do what you’ve outlined for it to do.

The mindset of most folks charged with developing the emergency management policy, procedures and plan focus on most likely scenarios first.  They do this because of limited resources, usually in the form of funding.  It’s always about the money! So they plan for what’s most likely and then hope and pray “the BIG One” doesn’t happen on their watch.

UNCONVENTIONAL CRISIS AND THE READINESS FACTOR

Crises can be divided into two categories – conventional and unconventional.  Their nomenclature pretty much says it all. 

Conventional events occur daily somewhere and we’ve usually prepared for them in terms of resources, training and response.  Mainly because we are used to dealing with them, so we make sure we have the resources on hand.  And if we can’t have our own resources then we set up mutual aid agreements with agencies in our neighborhood of the country to provide support.  Unconventional events on the other hand, are a completely different animal.  They are either so rare or so great we have no way of planning or containing them.  Severe novelty events occur infrequently – they are novel, at least we think that.  Honestly, they occur all the time somewhere.  Just watch the news and you’ll get a sense of how common they are.  So the other half of the definition is severe.  Unfortunately, when combined with novelty sever events can immediately overwhelm local resources, know-how and response.

How often do we hear community leaders say, “we never thought it would happen here”?  This attitude causes a failure in “readiness”, communities are “prepared”; i.e., resources stockpiled and training’s been conducted but really are they ready to handle to event because it is outside of their scope of possibilities. 

Community leaders often get paralyzed and delay critical decisions until the crisis fits into a more recognizable model they can get their arms around.  The delay in action causes a delay in achieving “on the ground” superiority over the event.  This in turn can perpetuate the condition, make it worse and cause for a longer timeline in gaining the upper hand.

OFF-SET OR WELL BANKING

Since managers cannot fund every project or procedure that will cope with a crisis scenario there is a way to program money into future planning and that’s through a process called “off-set” or “well banking”.  Think of it as money set aside for the “what if – worst case” scenarios that we have every intention on spending once we’ve programmed it into our budget cycle and we’ve saved enough.  I contend that corporations, communities, and other entities can set aside a small portion of their budgets for these worst case events.

More about Impact Centric Planning and other methodologies discussed during workshop at Naval Air Station Jacksonville 14-16 June.  Contact us at 805 509-8655 or https://hainessecuritysolutions.com to register.

Beyond the Email Scandal

How To Properly Design and Construct

a Sensitive Compartmented Information Facility (SCIF)

I don’t know your political affiliation and honestly, I don’t care.  But one thing I do care about is, the way some political beings believe they are above the rules or beyond the approach of the rules.  The recent incident with Hilary and her emails highlights this phenomenon.  Even though I don’t have any “insider” information I can almost assuredly bet that several procedural and policy protocols were circumvented.

Since, there seems to be a common thread throughout the investigation that emails that were not classified upon further examination should have been.  So that’s the first issue.  Correct classification.

Second, I question how, were those emails physically stored.  Rumor has it there was a secure server.  If that’s the case, where was the server located and when dealing with classified was it done at the kitchen table or within a secured space that had been authorized for the handling of classified or, at least, sensitive material?

Almost certainly, there were printed copies of those emails, where were they physically stored? Due to her position I’m sure she had a SCI type clearance.  If that’s the case, did the space where she worked and stored the classified meet technical specifications of IDC/IDS-705 and other pertinent, guidelines?

Like I said, I don’t know for sure but I’d speculate they didn’t since there seems to have been a lackadaisical approach to the classification portion of the process; I would suspect the rest of the approach was “short” too.

We discuss the proper design and construction of a sensitive compartmented information facility (SCIF) which meets official government requirements for a secure area where classified information is handled. The stringent physical security requirements; such as, access control systems, thickness of doors, the strength of concrete and the use of alarms, and acoustical controls which prevent eavesdropping, information exposure or “jamming”, and surveillance prevention will be discussed.  The use of electronic media within the facility will also be explored during a 3-day workshop, held at Willow Grove Air National Guard Base (Horsham, PA), 24-26 May. 

Find out more about other physical security engineering workshops and our Physical Security Engineering Training and Certification Program at https://www.hainessecuritysolutions.com

3 COMMON MYTHS ABOUT

ACCESS CONTROL AND PERIMETER SECURITY

Most people think access control involves using technology or a guard who checks some form of identification to allow entry into a facility or building – a guard or electronics, and that it.  The security industry has made tremendous gains in the last several years with regards to increasing technology’s capabilities to enhance control at building or compounds.  While these advances assist they are not the cure all.  They are simply tools that assist in the detection of unwanted behavior.  

With that in mind here are three common myths about access control:

Myth 1 – The perimeter or boundary line must be robust in order to adequately provide access control.  This simply is not true.  The US Air Force uses a painted red line on the ground around its nuclear deterrent capable aircraft.  There’s no fence, there no standing guard – just a red line.  The line basically says to everyone, “If you’re on that side of the line, we don’t care who you are or what you do, but, if you want to come on this side of the line we want you to go down to the opening so we can check you out”.  So, really anything can be used – a rope, series of shrubs/plants or a painted line, something that says, here’s the line of demarcation that I care about.

Myth 2 – Fences are a deterrent – NOT!  It takes less than 4 seconds for an unskilled person to climb over a fence, including those with concertina or razor wire.  While adding some type of top guard makes them look formidable they’re really not very effective as a deterrent.  They’re real values comes in the form of detection.  They allow us to detect unwanted behavior.   Think about it, most authorized people will proceed to an access control point, they won’t climb the fence.  Only unauthorized people climb fences; therefore, it serves as a detection mechanism.

Myth 3 – The boundary line or perimeter is the only point available for security personnel to affect access control.  Actually, there are four layers of physical security and each can provide for effective access control, if used correctly.  The layers are; 1 – boundary line or property perimeter, 2 – exterior enclave, 3 – asset façade, and 4 – internal controlled or restricted spaces.  Each layer provides an additional opportunity for control, if used effectively.  Not every asset has a layer 2 or 4 but all have layers 1 and 3, even if, the asset is free standing.  In this case, the façade serves as both layers 1 and 3.  Each layer should be used to deter (albeit limited), delay, detect and allow for response.  This layered approach is fundamental to effective access control.

More access control and perimeter security tips at: http://issuu.com/securitymiddleeastmagazine/docs/sme_july-_aug_2015_web/33?e=3061242/14215610

We’ll discuss perimeter security and entry control facility design during a workshop 19-21 July near Tacoma, WA. For more information contact us at +1 (805) 509-8655.

What Makes Great Space?

What Makes Great Space?

Making Smart Buildings Wise

With the explosion of the Internet of Things (IoT) and the push for interconnectivity of devices we've been concentrating on making buildings, transportation, and every other facet of our lives "Smart".  Many conferences or symposiums are being held all over the world to discuss this phenomena.  In fact, I participated in the Smart Cities India 2015 Conference and Expo and provided input to the IFSEC Security Conference this past December and will again participate this coming May at the 2nd Smart Cities India 2016 Conference and Expo in New Delhi, India. 

Our discussion centered on the technological ability of connecting devices to more efficiently and effectively manage systems  - transportation, food supply, energy, etc.  I think we can go a step beyond that and say, "Efficiency is nice but what I really care about is the ability to raise my family somewhere where I don't have to worry about them being safe".

By shaping the built environment and integrating solutions, both physical and technological, that are transparent we can create neighborhoods where people actually want to work, live and raise their families- not because they are efficient but because the are safe.  As urban centers of the future increase in population so will the demand for functionality on a multitude of levels. 

One clear local example of the effective and efficient use of space is "The Collection" located at River Park area in Oxnard, CA.  The neighborhoods, both residential and retail, are vibrant with dynamic examples of "Great Space" usage. 

We'll discuss Crime Prevention through Environmental Design (CPTED) and other design principles that define "Great Space" with a 2 day workshop on  May 2nd and 3rd at the River Park Executive Suites, in Oxnard. Please join us. Click on https//hainessecuritysolutions.com for the latest details.