Thursday, July 25, 2013

Lessons from Security Speed Dating


The notes which follow capture three memorable ideas, i.e. keepers, from an inaugural security industry forum in Tucson last week. Details of the event itself are at the end. The three points harvested fall into the categories of best self-introduction by a security director, best insight on active shooters, and best security-related product I wish I had in my last job.

1. Best Self-Introduction (as delivered by a retired police captain and current security director in Alabama):

"I protect people from the acts of Satan and the laws of Murphy."

2. Best Insight (about active shooters as noted in presentation by a senior security executive based on his experience in a number of fact-finding commissions after mass casualty incidents, including Columbine).

"Running away is a great option; every child who ran at Columbine is alive today."

The epiphany lurking in this observation is that it runs counter to the current trend to afford equal value to evacuation and sheltering-in-place as the default mantra security professionals have tended to chant when discussing basic options about what to do in any situation, including that of an active shooter attack. In reality, the statistics are starting to show that running away has a higher success rate than hunkering down, although that remains a second choice, and fighting is emerging as the third option to advise as a last resort. The bottom line is that running away deserves to take precedence.

3. Best Security-Related Product (as described by Sally Nordeen, Morpho Detection, snordeen@morphodetection.com, in a one-on-one session to answer questions): a handheld device for detecting anthrax and ricin that does the job in 40-90 seconds.

The product is about the size of a large cordless DeWalt drill (which means you can lock it up). It shoots a laser at the substance in question and can detect anthrax, ricin, and thousands of other substances on the spot. The device itself costs $35,000, which can be expensive or a phenomenal bargain. It operates on rechargeable lithium batteries and has a ten-year life. Its official name is the Street Lab Mobile. The manufacturer is Morpho Detection, a subsidiary of the French corporation, Safran. If these names are unfamiliar, it may be because the company started out as a unit of G.E. and was subsequently bought out by the French. Morpho's biggest customer is TSA, and its most recognizable products are the machines that detect explosives concealed in luggage at airports.

Why did I wish I had one of these in a previous life? Chemical and biological threats are hard to assess and usually require access to a Level 4 lab -- something few employers have. Most agencies must go through their local public health system, i.e. their local county health agency, to gain access to such capabilities. This in turn means a lot of time delay and multiple opportunities for bureaucratic missteps along the way, especially if there are several white powder reports raging through a given jurisdiction at the same time. About 95% of bomb threats turn out to be hoaxes, and the number goes up to near 99% for contamination threats. However, this does not reduce the need for a targeted organization to deal with the threats rapidly and effectively in order to limit hysteria, panic, and unintended consequences. If such a device works as advertised, it would have been a godsend when I was in charge of security at a regional water utility. It would have also spared my employer from the endless hassle of reminding local counterpart agencies that taking their suspected anthrax to our water quality lab was not the right way to solve their problem, since we had no classified toxic agents or their surrogates against which to make analytical comparisons and also had no lab workers eagerly seeking out the introduction of potentially lethal substances into their workplace on a futile errand.

Event Details

What was this event anyway? Officially, it was the inaugural session of the ASIS Diamond Club Security Buyers Forum, July 17-19, 2013, at Loews Ventana Canyon, Tucson, AZ. As conceived, this was a security industry forum intended to bring a cross-section of practitioners and suppliers together in the business equivalent of speed dating. An invitation-only event for about 50 security professionals and 30 or so vendors, this forum was an experimental alternative to the giant trade show that the security industry usually operates annually. However, this format was on a more human scale than conventions. By contrast, the annual security convention put on by the American Society for Industrial Security (ASIS), draws about 20,000-25,000 attendees and fills any convention center with the world's largest assortment of exhibits showcasing security products and services. Both events include professional education and networking sessions, and the value one derives from either is probably a function of business need, employer priorities, and personal taste.

-- Nick Catrantzos