Lessons Learned vs. Armchair Quarterbacking

One of the best ways to develop new countermeasures and enhance your personal or your organization’s security is by studying security incidents that have occurred to learn both from the mistakes of others and also from what they did well.  Rightly or wrongly there is often a tendency to focus on the mistakes and things that went wrong as these sometimes provide the most cogent lessons learned.  When doing this we need to do it dispassionately and we need to avoid the appearance of blaming the victim.  All hindsight is 20/20 and it is easy to look at all the details of an event after it has transpired and pontificate about what someone did wrong and why we would have done it differently.  It is much different when the event is unfolding and you are wrapped in uncertainty and trying to make decisions under pressure.  It is also different when you don’t have the ability to see a threat clearly due to other events or distractions that may be going on.

The horrific school shooting in Newtown, Connecticut brings this principle to the forefront.  While information and details are still coming in as of this writing it demonstrates the need to study these events to look for areas of improvement and consider how things can be done in the future to mitigate the risk.   This is not intended to be a discussion of the Sandy Hook massacre as this is being covered extensively in other venues and discussed by people much more knowledgeable about school security and active shooter situations than I am.   Those of us who are parents though are searching for information and perhaps answers and solutions to make our children safer.   Interestingly it appears from current information that the Sandy Hook Elementary School did a whole lot right in terms of their security program and perhaps exceeded what is in place at many schools.  Still we need to do a close examination to see what might be implemented to reduce the risk at other schools in the future.

One of the most valuable things we can do is to look at case studies concerning criminal and terrorist incidents and look at why the victim was vulnerable and what they might have done to reduce or even eliminate that vulnerability.  If we are looking at confrontational crimes targeting individuals we might look at a robbery incident where the victims was distracted and fumbling with her car keys when she was approached and victimized.   Looking at a kidnapping we may find the victim habitually departed for work each day at the same time and used the same route.  We should also look at our own experiences where we had near misses or close calls and look at areas where we could have done something differently.  In these cases we need to be frank with ourselves if we were lazy, complacent, overconfident, disregarded our own intuition, or whatever.

What separates armchair or Monday morning quarterbacking from thoughtful lessons learned?  As much as anything it’s the spirit in which it’s done and the mindset.  Armchair quarterbacking is pontificating, sometimes accusatory and not done with a constructive goal in mind.  Analyzing lessons learned on the other hand is thoughtful, constructive and done with the intent of not repeating past mistakes or missteps – others or our own – but rather learning from them to develop new procedures tactics and approaches that will reduce the risk and make us more effective.




Cultural Awareness — the Security Dimension

Being culturally aware is important for anyone traveling abroad or conducting international business.  It’s important to recognize that not everyone around the world sees things the way we do and understanding others’ perspectives and customs will allow us to better relate and avoid inadvertently offending someone.

Noted cultural trainer Dean Foster recently wrote a piece about doing business in Brazil where he discusses “why the okay sign is not okay in Brazil” (if signifies an orifice).  It’s an excellent example of a gesture that is perfectly acceptable in the US but considered very obscene or offensive in Brazil.

The security dimension of cultural awareness is that failing to be culturally aware can put you in a potentially dangerous situation if your behavior is offensive to others.  No where is this more true than in male – female interaction.  Activity that might be perfectly acceptable in western countries may invite confrontation and even violence.  For example a man “checking out” or flirting with a woman in some of the more conservative Muslim countries in the Middle East, North Africa or South Asia may provoke a violent response from the woman’s male family members or even other male members of the society who observe it.  Likewise a woman traveling alone and wearing suitably fashionable clothes may be perceived of as promiscuous and may attract attention and unwanted sexual advances.

Public identification of your nationality may also attract unwanted attention as well.  It’s not only Americans who carry a stigma in certain countries.  At one time being Canadian was considered to be relatively harmless but with the active role Canada had taken in Afghanistan as part of the International Security Assistance  Force (ISAF) this is no longer true.  Likewise Scandinavians were once a “safe” nationality to be but after the controversial cartoons depicting Mohamed this has changed and Scandinavians are mire susceptible to being targeted.  French nationals have been targeted in Cote D’Ivoire and some other African countries.  For these reasons it’s important to adopt the persona of the “Gray Man” as we have discussed previously.

It’s important to understand that cultural awareness is important and the implications can be greater than just hurting somebody’s feelings or losing some business deal.  Failure to understand the local culture in the most extreme cases can get you beaten, stabbed or arrested.

3 Neglected Skillsets for Security

Today we are going to venture a little bit into the realm of corporate security.  I realize that many readers may not be as interested in this area and are focused more on individual protection.  No need to worry as two of the skillsets we are going to discuss are also very applicable to personal security and the third is tangentially related.

The three neglected skillsets or activities that are often underappreciated and underutilized in the corporate security world are:

  • Surveillance Detection & Counter Surveillance
  • Behavioral Analysis / Behavioral Profiling
  • Red Teaming

These three areas – properly applied – can be huge force multipliers in the corporate security world and can pay great dividends with a minimal expenditure of money (although a little expenditure of time).  Why then are they so rarely seen being employed in private sector security and why is it so difficult to get funding and support from senior management for these types of initiatives?  Are they too unconventional or exotic?  Do they force us to confront vulnerabilities we don’t want to face?  Is there not sufficient benchmarking from other organizations and industries?  All of these methodologies can be very valuable but they are rarely used and often difficult to introduce.  Let’s look at each one individually:

Surveillance Detection:  For our purposes we’ll use the term surveillance detection or surveillance recognition.  Counter surveillance has different definitions depending on who you speak to and their particular background.  Simply put surveillance detection is the method of recognizing when you, your facility or a person in your care is being watched or observed by a third party.  The purpose of this observation may be to plan an attack, to gather compromising information of some sort, etc.  We know that most attacks a preceded by some form of surveillance and we also know that this surveillance generally follows certain patterns that can usually be detected if the targeted person or staff at the facility or protective unit are watching for it and know what to watch for.  Surveillance detection can be passive or active.  It can be a dedicated duty or an ancillary responsibility.  Consider the value that training security staff and even other personnel such as maintenance and cleaning staff at your company’s facilities could have.  This takes some time and effort to both train and to maintain but it can go a long way to preventing a criminal or terrorist incident.

Behavioral Analysis & Profiling:  We know that studying and interpreting human behavior can be an effective way to identify people who might pose a threat before they can act.  Training personnel to key in on what we will call for lack of a better term “suspicious behavior” can allow us to better avoid or when necessary even confront a potential threat before an incident occurs.  Much as with surveillance detection this type of training can be a force multiplier making our guard force and even other staff more aware and more effective at countering threats.

Red Teaming:  Red teaming is adopting an adversarial viewpoint to look at a person, people or a facility to detect vulnerabilities and to simulate an attack against this target.  Red teaming can be done either analytically through desktop scenarios and table top exercises or in a “live” mode using aggressor forces to conduct penetration exercises or even force-on-force simulations.  Properly done red teaming can help us identify vulnerabilities and take corrective action and can also provide security personnel with stimulation and engagement that will help them stay focused on what can often be a tiresome, monotonous job.  Red teaming has yet to gain widespread acceptance in the private sector however due to liability concerns (with live exercises or with identified vulnerabilities that are not corrected), a perception of exoticness and the simple fact that at some fundamental level we often don’t want to be shown where problems exist.  Interesting red teaming has been more widely accepted within the IT realm than within the physical security realm.

When you consider how much money is typically invested in physical security projects such as access control and camera systems, barriers and lighting and guard force operations it’s a wonder these neglected elements which cost demonstrably less are not utilized more widely.  They will not fully replace physical security systems and technology but they can go a long way to making them more effective.

How can these be applied to personal security?  With the first two it’s a pretty direct application.  Detecting when you are being observed and recognizing behavior that may indicate a threat to you are pretty key components of any personal security program and probably more important than the combatives and shooting skills that so many people spend time developing.   Red teaming is less direct an application but is probably best applied as part of your personal risk assessment.  You could hire a consulting firm to do a red team exercise to help you to identify vulnerabilities in your routine and lifestyle but this is probably not economically feasible or particularly desirable for most people.   What you can do is to adopt an adversarial perspective and look at your daily routine and activities to determine locations and times where you are most vulnerable and consider what corrections or alterations you could implement to reduce your risk.