Saturday, April 10, 2010

Are Shortcuts Dangerous?

From today's front page: "Polish President Lech Kaczynski was killed early Saturday along with his wife, several top military officials, and the head of the national bank when their plane crashed ... [http://www.cnn.com/2010/WORLD/europe/04/10/poland.president.plane.crash/index.html?hpt=T1]"

After taking into account the elements of human tragedy and inevitable failure analysis sure to follow, what does a security professional see in this story? A costly reminder of why even B-grade corporations and institutions adopt policies that prohibit all executives from traveling by the same conveyance at the same time. In some cases, insurance policies and governing bodies bolster the reminder. Seeing top management as an asset that ties into the valuation of the enterprise, they insist that all these precious eggs not travel in the same basket.

Policy and reality frequently diverge, however. Even A-grade corporations and institutions with mature executive travel policies often end up placing their leadership at risk by ignoring this policy. Or, if not actually ignoring it, they rationalize it away as a priority to be seconded to the more pressing trump cards of cost, schedule, or efficiency. Respectively, the arguments go like this. One, the institution saves money by sending all the executives on the same flight. Two, given busy calendars, there is no time to fuss with scheduling separate flights for all the VIPs. Three, the executives must certainly be more productive if allowed to leverage travel time by talking shop and furthering their employer's business instead of napping or talking to themselves, as they might if deprived of familiar company while traveling.

Even security may be conscripted to the cause of defending this bad decision and policy violation. After all, one may argue that it diverts fewer resources to protect one limousine convey and secure one aircraft reserved for conveying VIPs from one secured location to another. Cheaper, too.

Both arguments fall apart if one takes the long view. The real cost comes not from distributing one's risk instead of risking all assets together, but from considering what it takes to recover from self-facilitated decapitation. And if, by any chance, a loss-producing event like this plane crash involves not mere chance but calculation, dispersing the targets would have limited the attacker's chances of attaining the sought-after combination of means, target, and certainty of success.

Once again, there is no smart way to be stupid, as this Polish tragedy will no doubt reveal in days ahead.

-- Nick Catrantzos