Everything I know about security I learned in kindergarten and I've been updating ever since

I know many of you remember that in kindergarten we learned to play fair, share tools, put things back in “the cubbie” where they came from, put your name on your stuff, be quiet during nap time and in general to be good neighbors.  Well, I learned something else, too.  LESSON LEARNED: HE WHO HAS THE TOYS GETS TO CONTROL THE GAME AND IS THE BOSS OF THE OTHER KIDS.

Fast forward to the third grade, I learned that if someone was bullying me,  I had to fight them to get them to stop or get someone else who would do that for me.  I know, can you believe that this beautiful face was getting bullied in the third grade.  Well, it’s true and all because I kissed a girl who was a fifth grader.  So I did what every skinny, respectable guy would do – I got her to beat him up. LESSON LEARNED: GET SOMEONE ELSE TO DO YOUR DIRTY WORK!

When I was in the fifth or sixth grade, my criminal career started and ended in a span of a few minutes.  You see, there was a pack of rubber bands on the shelf at the Ben Franklin store and I really wanted them but I didn’t have the money.  I put some in my jacket pocket and left the store.  As soon, as I was walking out a county sheriff car pulled into the parking spot directly in from of the store.  The store had a revolving door, which allowed me to reenter the store without ever really exiting.  I put the rubber bands back on the shelf and waited for the sheriff to leave the store before I went home, scared to death.  I have to admit, every time I’d see a police car while growing up I always wondered if “they knew about that” incident. LESSON LEARNED: ONCE YOU’VE DONE IT YOU’VE DONE IT FOR LIFE.

And then upon entering the military, I became an Air Policeman.  God works in crazy ways.  Since I was mostly stationed in Europe from the time I was twenty until I retired in 1993, my biggest security lesson was tracking terrorist activities and fighting the “the Communist, the bastards”.  LESSON LEARNED: THERE ARE BAD PEOPLE OUT THERE WHO WISH ME (US) HARM.

Later in my career, I thought and was taught to think this way, that all you had to do was put a camera on it to watch or post a guard and crime would stop.  Your stuff would be protected. Neither a camera or a guard will prevent, they may deter, and unless the response force is within a reasonable distance to respond they probably won’t deter either.  I’ve always wondered why organizations spend thousands and still get “ripped off”.  Upon analysis it usually comes down to them using the wrong mitigation strategy for the wrong threat or the security is “so tight”  it becomes a burden or tax and people don’t want to pay the tax, even those who are authorized to do so.  They’ll find a way around it so that life is convenient. So, unless your security system is specifically designed to deter and prevent unwanted behaviors, it won’t do that. Sure there is always some deterrence but a dedicated aggressor will not be detoured.  They will bring the tools they need.  Also, if there isn’t a dedicated response force, all you’ll be doing with your fancy system is taking pictures of what happened. LESSON LEARNED: SECURITY IS SUPPOSED TO BE ABOUT DETERRENCE/PREVENTION AND INSTEAD IT’S ABOUT CONVENIENCE.

Well, after my heart attack a couple years ago, my cardiologist said I’d probably live another 30 years.  I’ve used three so far, so who knows what I’ll learn in the next 27?

4 Spring Cleaning Tips for Keeping Criminals from Acting Criminal

I’m sitting here in my office writing this Blog post, while wearing a surgical mask.  My wife says, “I don’t have to wear it because I’m not out in public”.  I answered, “Well, I’ve heard my computer can get a virus, and I don’t want it to come from me, lady”. Touché


Like every good spring cleaning job, you have to set some goals.  My wife’s  - windows.  Mine - not falling off the ladder.


When it comes to security spring cleaning though, our first goal needs to be keeping criminals from acting criminal around my property.  Here are 4 tips:


Understanding that your property has a number of layers that you can use to you advantage is essential.  Those layers, if you have them are: property line, internal fence-line (if present), building facade and special spaces within the house.  For instance, I don’t have a fence in the front of my house but I do on the sides and back of the property, so my property line and fence-line are one in the same.  So for that reason, I look at every layer I do have and determine if I can deter, delay, detect and defend against a would-be aggressor breaking in and stealing my stuff.


Deterrence is kind of hard to define.  Mainly, because if the deterrent is perceived to be too tough, then it will get circumvented by those who are actually authorized, and then what’s the purpose of having it in the first place.  Besides, a dedicated threat will not be deterred.  He/she will bring the tools necessary to defeat whatever the deterrence is designed to do. Now, don’t get me wrong I’m not a defeatist.  I do believe you have to do whatever it is you can and evaluate what you’ve done honestly.  If there is still pain, do it some more.


Secondly, my goal is to slow a person down if they have ill-intent enough so that I can detect them.  So instead of a straight sidewalk up to my door, I have a sidewalk that meanders or crosses my front lawn, so while standing inside my living room or office I can see them as they approach.  If someone doesn’t follow the path of the sidewalk and traipses across my lawn then that is an indicator to me that something’s not quite right.  Now, it could be that the person is just lazy or too tired or it could mean something far worse.


Next remove all possibilities of hiding.  So bushes and shrubs that are within 10 feet of windows and doors should be removed.  If you simply must have them for aesthetic purposes, then they should be located away from the building so that as a person approaches they can see around them.  Bushes should be trimmed to a height of three/four feet above ground level and trees down to seven/eight.  Anything higher or lower causes opportunities.


And finally, check windows and doors, to make sure they close properly.  And, while cleaning the windows and gutters, check the outside lights, especially those on a sensor.   

Another thing, stand at your property line at dusk and see if someone can see inside your house while the lights are on and can see that you’re at home.  If they can, then even if you leave lights on to give the appearance that someone’s home they can see that you’re not.  We draw our curtains at dusk so that you can’t see through.


When I said, defend above I didn’t mean confront the bad guy and whip out a gun.  Trust me your stuff is not worth someone’s life.  On the other hand, if they are physically harming or threating harm to my family I can guarantee you that they’d wish that I only had a gun. 


Send me an email and I’ll send you a 28 question checklist you can follow.  FREE.

I Became a Meth Head, Won an Award and Am Now Recruiting Others

“Mom, tell him to stop”, I would hear that all the time from my son as he would tell his Mom I was obsessing over work.  I don’t hear that nearly as often now-a-days, not because I’ve stopped but because he doesn’t live with us anymore.  He’s in New York and we’re in California.  The other evening, while I was drying dishes, my wife said to me.  “You know you’re obsessed.  It’s like a drug for you”.  Perplexed, I said, “What do you mean?”  

“I’m telling you that the cat used the litter box and you’re telling me about bollards in Las Vegas”. 

OMG, she was right!  I can’t get it out of my system.  My every thought is about physical security design – both good and bad.  I’m always analyzing and comparing and thinking; does that work, is it effective, could they have done it cheaper or better?  My mind is on overdrive,  I had become a METHodology addict. 

My addiction was simple - use a proven assessment method to look at criticality, threats, vulnerabilities and subsequent risks of high occupancy buildings and their supporting energy systems.  I guess, that’s why I’m so fond of the Asset Based Risk Analysis (ABRA) and Critical Asset and Infrastructure Risk Analysis (CAIRA) methodologies (both Platinum Award winners; ABRA a GOVIE in 2017 and CAIRA an ASTOR in 2018).  Not because they won awards after having been recognized by teams of experts but because they take allot of the thinking out of the analysis process.  It’s pretty basic math and not allot of calculating.  It’s all already done with macros.  But, the final result answers the questions cited before, will the implemented security measure be truly effective in reducing risk, is there an alternative that can be just as effective and will it bring costs down to a reasonable price.

ABRA ARTICLE https://view.joomag.com/march-2019-ast-magazine-march-2019-ast-magazine/0952115001553308799/p4?short

CAIRA ARTICLE https://view.joomag.com/july-2019-ast-magazine-ast-july-2019-magazine/0612002001563068627/p60?short

Over the years, I’ve noticed that the best thing when it comes to thinking is not to start.  Once you get a thought, it seems to get out of control rather quickly.  “Kind of hard to put the genie back in the bottle”, as they say.  The thoughts just keep coming, no matter what I try to do.  So sorry, Honey, I can't turn it off.  

P.S.  I cleaned the litter box.

Security - It Really is a T or F Question

I know many of you when you read the title thought, “Yep, security is a true or false question.  You’ve either got it or you don’t.  Well, purposefully I didn’t spell out what the T and F stood for. It isn’t true or false.

As many of you know, for some time now I’ve been advocating for a softer approach to security, especially when it comes to the design and layout of high-occupancy spaces.  And during my years of advocacy I’m come across some, who will agree, and others that play lip service and say, “Oh yea, that’s what we should do.”  And when they have their next opportunity to make the change they go back to their olds ways with the bigger, better, faster, stronger, in your face approach.

Recently, while collaborating with a local school district we took a softer approach.  After an active shooter threat (fortunately stopped prior to being carried out due to social media monitoring), parents wanted the District to heighten security by adding guards and cameras, and constructing fences on the perimeter.  They wanted this because that’s what they’ve been seeing on TV.  After every school shooting, there’s a rush to install more cameras, higher fences, and to hire more guards.  I don’t blame the parents; I blame the security companies who are selling their products with the idea that if one is good, two must be better – the more products sold the better for the bottom-line.  Some may argue that adding visible, in your face, deterrence works.  I’ll admit, there is some benefit; however, a dedicated threat will not be deterred – they will bring the tools necessary to circumvent whatever is in place. That said, we can argue until the cows come home about the benefits.  From my point of view, it’s not about effectiveness.  It’s about the psychological impact it has on our youth.  Recently, a local school board approved a bond for security upgrades.  The newspaper ran a picture of a ten foot metal fence gate to allow campus entry and mentioned that everyone would go through a metal detector.  I showed the article to a Latino friend of mine and he said, “They’re always looking at us like we’re all criminals.  The guys are in gangs and the girls are ‘ho’s.”  Is this the intended message?

Additionally, research shows us that “hardening” causes anxiety and even affects performance.  

https://network.aia.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=110227d5-dde4-9c0d-fa52-a23257148cca

Our approach is to add security features that are “hidden in plain sight”.  For example, instead of a fence to keep out trespasser we suggest a buried co-axial cable sensor system.  It provides a warning that someone has breached the perimeter, yet is unseen.  Another example, to keep unauthorized folks off of the roof we suggest placing large flower pots with bougainvillea near drainage pipes or next to other features that a person could climb to get to the roof.   Again, a solution that is unseen.

My article published in American Security Today magazine January 2020 https://view.joomag.com/2019-champions-edition-2019-champions-edition/0683429001578075665/p148?short

So which message do we want to send?  The message that we don’t trust you and we think there will be an incident or the message that we trust you, we expect you to act trustworthy and you can expect the same of others?

My book, The Solutions Matrix: a  Practical Guide to Soft Security Engineering for Architects, Engineers, Facility Managers, Planner and Security Professionals has a Quick Glance Checklist that will allow you to list your current security solutions and then list your ideas on how to take a softer approach.  Order your copy today via the CONTACT US link at https://hainessecuritysolutions.com

What Message Does Your Security Send – Fear or Trust?

In order to have proper physical security, mitigation strategist and those responsible must understand the types of aggressor groups, what motivates them and the tools they need in order to be successful.
  

Aggressors fall into four main categories: criminals (sophisticated/unsophisticated, organized/unorganized), protesters (organized/unorganized), terrorist (domestic/transnational/State sponsored) and subversives (intelligence agents [State/non-State sponsored]).


And, there are four main aggressor objectives; to inflict injury or death on people, to destroy or damage equipment, facilities or other resources, to steal equipment, material or information, and to create adverse publicity.


Tools on the other hand, don’t fall into any category and are virtually unlimited.


Unfortunately, the security industry has been approaching school security from the wrong angle.  We keep thinking, if one is good two must be better and we can harden our way to a perfect world.  We can’t.  School shootings and worse will continue, I’m sad to say, until we start eliminating the causes that promote this behavior. 


School systems have developed a variety of multi-disciplinary programs that address prevention and response to mental health issues if a student manifests behavior that might precipitate violence on a grand scale; i.e., bullying, addiction and interpersonal violence.  But this is still not enough.

Some security companies offer “social media behavioral monitoring” and are analyzing a person’s social media presence in “real time” and reporting actionable intelligence of patterns or suspicious behaviors to authorities, but this alone isn’t enough.  Using artificial intelligence, and deep learning are great but they’re just another tool.   And, just because a person manifests some type of anxiety or disruptive behavior it doesn’t necessarily mean they’ll act out and it doesn’t mean that that person will become a school shooter.


I believe we need to get to the cause of the angst.  Why does a “perfectly normal kid” decide to go to a school and shoot it up?  Does the “prison look” of many schools contribute to this phenomenon?  Is it possible, that the chain-linked fence surrounding the school yard, the metal detector that everyone passes through and the roaming armed guard all contribute in some way?  Now, just because that has become the “new normal” it doesn’t mean every kid will grow up and commit a criminal act, but there is no doubt that they will carry this angst with them into adulthood.


You don’t have to look very far to see examples of the “big dog” in your face approach and the subliminal message of something bad is expected to happen.  

We can address behavior in the built environment in a non-traditional way as a substitute to the confrontational in your face kind of way.  The approach must be more subtle, in fact, the more transparent it is the more effective it will be.  

Normally, to deter crime, we put up signs that say, “Cameras in Use” and some folks get creative saying, “Smile you’re on camera”.  For access control, we usually mark our territory by placing a chain-linked fence or some other type of “barrier” on our boundary-line.  It has a limited effect because a dedicated threat will bring the tools needed to circumvent it.  Build a big fence; they’ll bring a bigger ladder.  Make it even higher and they’ll bring an even bigger ladder or tunnel under it.  Sure, there is somewhat of a deterrent, but the reality is, a dedicated “bad actor” will bring the tools needed in order to be successful.   


In the early “90’s, Crime Prevention through Environmental Design was introduced to connect these two worlds – unwanted behavior and a physical deterrent.  Research shows that the concepts of natural surveillance, natural access control, territorial reinforcement and maintenance contribute to the deterrence and reduction of criminal activity.  CPTED is not the sole reason, but it helps. https://www.cptedtraining.net/


The basic concept of CPTED is if we can design the space so that it is almost always under observation “bad actors” won’t act bad.  I believe it needs to go further than that.  Not only do we need to design the space using these concepts, but we also must design the space so that “bad acting” can’t occur.  Additionally, in the off chance it does the built environment should help to reduce its effects and not contribute to its severity.  


A couple of years ago researchers in the European Union conducted a survey.  They asked elementary school kids who had emigrated from a country where there was war to draw what they considered safety or security to be.  The kids drew pictures of fencing with razor-wire and “gunships” overhead.  Then the researchers asked the same question to kids from Europe who had not be exposed to hostile environments and those kids drew houses with trees, stick families, a dog and sunshine.  Shouldn’t we be striving for the “sunshine” scenario?


The harder we make it for the “bad guy” to do things the more of a deterrent there is.  There is some truth to that but on the other hand, if security is a tax your people won’t pay it and they will figure out a way to circumvent it.  This in turn defeats its purpose.


Getting away from hardening schools after every incident by using “big dog” philosophies will take time, nonetheless, we can begin immediately.  I submit that beginning this school year, administrators should use the checklist provided by the Partner Alliance for School Safety (PASSK-12) www.PASSK12.org to conduct a physical security risk assessment of their campus and whenever possible replace traditional mitigation solutions they would normally opt for with a hardscaping, landscaping or art strategy.  Creativity and student, staff and community involvement are essential.


Success in security is sloppy.  It’s entangled.  It’s very hard to distinguish where detection, assessment, policy and procedures, response and engagement begin and end.  Addressing behavior must be coupled with addressing the physical environment.  They require a different amount of time, effort and commitment to produce positive results but nonetheless are equally important.  In order for students, and later as adults, to thrive we must create environments, internal and external, that address the need for “well-being” in both the social and physical ecosystems, and if we can do that in a more aesthetically pleasing way, then why not?

More about a softer approach to security: https://www.securityindustry.org/2018/04/05/the-puppy-movement/

My Book The Solutions Matrix: A Practical Approach to Security Engineering for Architects, Engineers, Facility Managers, Planners and Security Professionals is on sale at https://www.hainessecuritysolutions.com  

Haines Security Solutions is a contributor to the Security Industry Association’s education platform, “Center of Excellence” at https://www.securityindustry.org/center-of-excellence/

Known knowns and unknown unknowns

"There are known knowns" is a phrase from a response United States Secretary of Defense Donald Rumsfeld gave to a question at a U.S. Department of Defense (DoD) news briefing on February 12, 2002 about the lack of evidence linking the government of Iraq with the supply of weapons of mass destruction to terrorist groups[1]



This quote tells us something about risk management.  Basically there are threats we know about and there are threats we don’t know about and there are threats that we don’t know we don’t know about.



From a risk management standpoint, that’s pretty disconcerting. 



In order to understand the unknowns you have to look at things from the “bad guys” perspective.  In other words, see what the "bad guy" sees.  And to do that you must understand that there are four aggressor types of criminal/man-made threat groups; criminal (sophisticated/unsophisticated, organized/unorganized), protestors (organized/unorganized), terrorist (domestic/transnational/state-sponsored), subversives (saboteurs/intelligence agents [state/non-state sponsored]).  In an effort to design better mitigation strategies planners must understand the “bad guys” motives or the reason(s) behind why they do what they do.  There are also four primary aggressor objectives; inflict injury or death to people, destroy or damage facilities, property, equipment or resources, steal equipment, material or information and create adverse publicity.



So how can I plan to reduce their effects let alone mitigate them?  The answer is really easier than you think.   Traditionally in risk management, we look at things from a probability standpoint.  We ask the question. “Will it happen here, and if so, what will the impact be”?  I believe, likelihood has little influence on risk.  I believe likelihood comes into play when talking about funding.  Our risk management methodologies assume the threat will be successful 100 percent of the time.  We calculate likelihood when it comes to cost benefit.



Our Asset Based Risk Analysis (ABRA) and Critical Asset and Infrastructure Risk Analysis (CAIRA) methodologies combine the aggressors motives and objectives with what the asset owner sees; thereby, giving a complete picture of risk.  



More about ABRA (Platinum GOVIES Award 2017 for Best Government Security Risk Methodology) https://view.joomag.com/march-2019-ast-magazine-march-2019-ast-magazine/0952115001553308799/p4?short



More about CAIRA (Platinum 2018 ASTOR Award for Best Risk Analysis Methodology in Homeland Security) https://view.joomag.com/july-2019-ast-magazine-ast-july-2019-magazine/0612002001563068627/p60?short



More about risk management and developing mitigation strategies can be found in my new book, The solutions Matrix: A Practical Guide to Soft Security Engineering for Architects, Engineers, Facility Managers, Planners and Security Professionals.  Order here  https://americansecuritytoday.com/dont-surrender-to-fear-new-book-the-solutions-matrix-by-doug-haines/

---

[1] Full quote: Reports that say that something hasn't happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don't know we don't know. And if one looks throughout the history of our country and other free countries, it is the latter category that tends to be the difficult ones.

Go Where there is No Path. But, I Can't, I'm Afraid of Snakes

A few months ago, my wife and I were shopping and came across this saying on a night shirt, “Go where there is no path”.  When I showed it to her, her reaction caught me a little off guard.  She said, “I can’t I’m afraid of snakes”. And, of course, being the person I am, I immediately translated that into a language I can understand – security-ish.  My first thought was, that explains why people don’t conduct risk analysis or even more importantly why they don’t even start the process.  They don’t tread into uncharted territory because there are snakes hiding in all that tall grass, so they stay where they’re comfortable – on the path.  Doing what is comfortable causes two problems.  

First, as Defense Secretary Don Rumsfeld, said, “We don’t know what we don’t know”, which translates into, we’re only protecting ourselves against what we can see, expect and believe is likely to occur.  Since, we don’t know what we don’t know, we’re not planning on dealing with its affects either.  This can be extremely more sinister because a lack of action could result in someone getting seriously injured or worse.  

Fortunately, there are methodologies out there that can get rid of the snakes.  I’m consulting on security matters with a local school district.  During our initial meeting, the District Superintendent, said, “Okay, where do we start? With an assessment to see where we are?”  Absolutely! 

Risk management is about managing risks.  In order to do that, you have to accept five factors:

1) You can’t prevent or deter everything

2) Protection from one threat may allow for some protection against another unrelated threat

3) Protection options must be in place before the event occurs

4) Risk Management must address the following pillars; detection, assessment, plans and procedures, response and engagement

5) Risk management and the assessment process is continual and is just part of what we do.

For ways to tame the snakes, read related articles here:

https://view.joomag.com/march-2019-ast-magazine-march-2019-ast-magazine/0952115001553308799/p4?short https://view.joomag.com/july-2019-ast-magazine-ast-july-2019-magazine/0612002001563068627/p60?short