An Argument Not about Civil Rights but Competence
When NSA, DITU (more, below), and other technical collectors of electronic data engage in gathering up every e-mail and telephone communication they come across, then they are engaged in data vacuuming, not intelligence. Why? By definition, intelligence is analytical, selective, and differentiated from mere accumulation of data. What distinguishes intelligence is the infusion of analysis with a focus on satisfying collection requirements that serve the national interest. In other words, intelligence is akin to asking a relevant question, taking down the answer, and corroborating and weighing that answer before weaving it into a report on (usually) foreign activities in order to inform the decisions of our own national leaders. (For a distinction between intelligence and information, consult a brief, accessible monograph by the U.S. Coast Guard, Coast Guard Publication 2-0, Intelligence, May 2010, available at http://www.uscg.mil/doctrine/CGPub/CG_Pub_2_0.pdf )
When the National Security Administration, a domestic signals interception arm of the FBI called the Data Intercept Technology Unit, or any other government service sets itself to collecting every available signal first, in hope of sifting through it later for potential intelligence value, this process turns into routine fishing in a boundless sea. (See this November 21 article in Foreign Policy for fresh details: http://www.foreignpolicy.com/articles/2013/11/21/the_obscure_fbi_team_that_does_the_nsa_dirty_work ) The process takes on the appearance of a horde of minions too unsophisticated to ask questions and work with the answers who instead resort to copying and scanning every book in sight on the theory that someone, somewhere will find some important answers in all this -- eventually. After all, if there is enough horse manure, there must be a pony here, somewhere.
What perpetuates this rote collection is that data vacuuming like this is not entirely without value. It may indeed supply some intelligence yield once sifted, analyzed, and, where possible, woven into an overall fabric that forms the larger tapestry of a meaningful intelligence estimate. Absent this weaving process, a step easily bypassed in the zeal to vacuum all data in sight, this data collection threatens to turn into a perpetual pulling of loose threads to stuff into a room which takes on the character of a hoarder's clutter rather than an executive's reference library. This recalls the kind of problem that may have led management authority Peter Drucker, in his final years, to observe that in modern information technology (or IT), there is a tendency to find more T than I (Management Challenges for the 21st Century, NY: HarperCollins, 1999, pp. 97-99).
The problem is that just because technology enables doing something on a massive scale this does not mean that the doing will necessarily result in a worthwhile yield. Indeed, one must ask whether the modest or unassessed yield is in proportion to its cost, whether that cost be measured in dollars, staffing, civil rights, public confidence, or all of these. When it comes to thwarting terrorist attacks like that of the Boston Marathon bombings, a dispassionate observer could argue that all the signs were there and yet all the capacity to intercept communications of or about the bombers failed to deliver a protective or preemptive yield. To say that these attackers got lucky, fell through the cracks, or otherwise eluded preemption because no system is perfect is to nevertheless highlight how massive post-9/11 data vacuuming appears to leave us with the same vulnerability that existed before we had this capacity. Maybe we have lost our focus. Perhaps we are diverting too many resources to solving the wrong problem. Making intelligence serve preemption may be a higher value than data vacuuming for its own sake.
Just because someone gives you a crutch, you don't have to break your leg. In a sense, data vacuuming on a massive scale is to NSA what behavioral detection has become to TSA (about which more earlier this month in this blog under Blame Detector, Not Behavioral Detection): a potentially useful tool being misapplied. What remains to be seen is whether this tool is an instrument of intelligence or an unfocused, unaccountable exercise in wielding technology just because it is there. Intelligence is more than raw data; it presupposes interjection of mind into the swirl of events, and not just the promise of eventual synthesis and analysis. Mere data vacuuming on a massive scale hardly measures up well in passing for intelligence.
-- Nick Catrantzos
Monday, November 25, 2013
Wednesday, November 20, 2013
Knockout Game Defense
Recent media coverage of unprovoked attacks by urban teen males against unsuspecting targets center around the brutish pastime of felling a passerby with one punch while at least one confederate captures the action via mobile phone video. Look up "knockout game" in Google and YouTube for descriptive details and videos. In terms of personal security, however, such topical treatment of the attacks does little to inform one's defenses. Where does one look for ideas on how to minimize the chances of becoming victimized by a knockout game enthusiast?
Consider other violent attack trends across the years and continents, and enough common features emerge to enhance diagnostics and defensive prescriptions. In the 1800s in India, thugs started murdering British expatriates, combining ritualistic strangulations with mercenary theft in the process of disposing of their victims. Eventually, the British focused legal and military resources to eradicate within six years a thug threat that had persisted for more than two centuries. However, before this eradication campaign could begin, the British first had to recognize the problem, and it took over a year to admit its existence. One can only imagine that, after Clive had missed multiple polo matches, gins and tonics, and the occasional business meeting at the East India Company, his colleagues raised an eyebrow. After Simon and Nigel similarly disappeared within a few months as well, their murders must have become impossible to write off as misadventure from getting lost in the bush. (For illuminating details on this thug experience, consult J. Coloe's 2005 master's, thesis, "Government actions in the demise of the Thugs [1829-1835] and Sikh terrorists [1980-1993] and lessons for the
United States," Naval Postgraduate School, Monterey, CA.) For our discussion, however, the first point is this:
1. Recognize the problem and the threat.
The difficulty in applying this lesson to the knockout game is that news reports vary widely in how they characterize these attacks. Some say that the attacks are completely random and are performed by "troubled" youth. It is unhelpful to defenders that such reporting glosses over descriptions of attackers and often omits similar identification of targets, ostensibly to protect identities of minors who are carrying out the attacks and to protect the privacy of victims. However, as reporting starts to produce more specifics, a pattern emerges, as noted by expatriate New Yorker Thomas Sowell, a celebrated economist, emeritus professor at Stanford, and Harlem native who overcame more than his share of prejudice while growing up in a tough neighborhood. Sowell points out that the attackers are blacks and their targets are Jews, at least in New York (details at http://nypost.com/2013/11/19/thugs-target-jews-in-sick-knockout-game/). Other targets to date have included women, the homeless, and unsuspecting white and Asian passersby, so Jews are not the only targets. The one common element that keeps resurfacing, however, is that the attackers are young, black males. Sometimes they appear in groups, with one breaking away to sucker punch an unsuspecting victim. At other times the attacker appears to be striking solo, while a confederate captures the punch on video. The emerging picture is that the assailant carries out the attack within the viewing range of his videographer, a peer who can frequently be overheard complimenting the attack once it gets posted onto Facebook or circulated via social media.
2. Spot the preconditions for an attack.
Based on attacks described so far, the knockout game needs an audience, a target, a viewing angle for video capture of the attack itself, absence of potential defenders or attack disrupters, and maneuvering room for the attacker(s) to approach and depart the scene with enough rapidity to minimize the chance of being caught or thwarted. This now begins to yield useful information for defenders.
The foregoing details allow us to infer, for example, that a knockout game attack is unlikely to take place in a boxer's gym, a fire house, or a cop bar hosting a promotion party for a favorite SWAT team member. Why? These are all places likely to be inhabited by people with good reflexes and trained response capabilities. Not only are they likely to see an attack coming, they are likely to engage and counterattack, leaving attackers worse off than they started. If this is true, then we may also reasonably infer that knockout game participants are risk averse. They do not look for a level playing field or a fair fight.
Similarly, we may infer that such an attack is unlikely to take place indoors or in a crowded area which would impede rapid exit. Getting away without a hitch is one of the unstated preconditions.
What about a very dark street or site experiencing fog, rain, or blizzard? This won't work for the attacker, either. Such conditions negate the video documentation objective, which is essential for bragging rights. If the street is too dark, even a cell phone with a flash won't help because the flash would attract attention, possibly putting the intended victim on alert that something is amiss. With bad weather, filming opportunities become even worse.
3. Analyzing the preconditions, learn what to avoid.
Avoid looking vulnerable in an open area away from possible defenders where any youth can approach you rapidly. You look vulnerable when you are alone and preoccupied (as with a cell phone or with body language suggesting that you are oblivious to your surroundings).
Watch out for a team of at least two young males where one has raced in front of you and is holding a cell phone pointed in your direction, as if to video some event where you are about to be a featured performer. Watch out particularly if the approaching young males are black and you are not.
4. Change the preconditions to limit your attractiveness as a target.
If you must venture into areas that are prime for a knockout game attack, go with one or more companions. Scan your surroundings as you move, projecting awareness and self-assurance rather than diffidence and distraction. If you are trained in and legally able to carry defensive weapons, keep them where you can use them instantly. If not, carry anything legal that can nevertheless disrupt an attack. This can be as simple as a small pocket air horn to make a loud noise that startles the attacker or even an atomizer of the strongest-scented Avon product you can find. Pepper spray may be handier, though. Above all, at the first sign of alarm, move away as fast as possible. Knockout game players are no evil geniuses following intricate plans. Change the preconditions, and you will most likely defeat the only attack scenario in their inventory.
What Not to Do
Ignoring the common features of attackers and of attack preconditions on the theory that basing your defenses on these things would make you too judgmental would certainly be an option. It is an option to embrace only at your own peril.
-- Nick Catrantzos
Consider other violent attack trends across the years and continents, and enough common features emerge to enhance diagnostics and defensive prescriptions. In the 1800s in India, thugs started murdering British expatriates, combining ritualistic strangulations with mercenary theft in the process of disposing of their victims. Eventually, the British focused legal and military resources to eradicate within six years a thug threat that had persisted for more than two centuries. However, before this eradication campaign could begin, the British first had to recognize the problem, and it took over a year to admit its existence. One can only imagine that, after Clive had missed multiple polo matches, gins and tonics, and the occasional business meeting at the East India Company, his colleagues raised an eyebrow. After Simon and Nigel similarly disappeared within a few months as well, their murders must have become impossible to write off as misadventure from getting lost in the bush. (For illuminating details on this thug experience, consult J. Coloe's 2005 master's, thesis, "Government actions in the demise of the Thugs [1829-1835] and Sikh terrorists [1980-1993] and lessons for the
United States," Naval Postgraduate School, Monterey, CA.) For our discussion, however, the first point is this:
1. Recognize the problem and the threat.
The difficulty in applying this lesson to the knockout game is that news reports vary widely in how they characterize these attacks. Some say that the attacks are completely random and are performed by "troubled" youth. It is unhelpful to defenders that such reporting glosses over descriptions of attackers and often omits similar identification of targets, ostensibly to protect identities of minors who are carrying out the attacks and to protect the privacy of victims. However, as reporting starts to produce more specifics, a pattern emerges, as noted by expatriate New Yorker Thomas Sowell, a celebrated economist, emeritus professor at Stanford, and Harlem native who overcame more than his share of prejudice while growing up in a tough neighborhood. Sowell points out that the attackers are blacks and their targets are Jews, at least in New York (details at http://nypost.com/2013/11/19/thugs-target-jews-in-sick-knockout-game/). Other targets to date have included women, the homeless, and unsuspecting white and Asian passersby, so Jews are not the only targets. The one common element that keeps resurfacing, however, is that the attackers are young, black males. Sometimes they appear in groups, with one breaking away to sucker punch an unsuspecting victim. At other times the attacker appears to be striking solo, while a confederate captures the punch on video. The emerging picture is that the assailant carries out the attack within the viewing range of his videographer, a peer who can frequently be overheard complimenting the attack once it gets posted onto Facebook or circulated via social media.
2. Spot the preconditions for an attack.
Based on attacks described so far, the knockout game needs an audience, a target, a viewing angle for video capture of the attack itself, absence of potential defenders or attack disrupters, and maneuvering room for the attacker(s) to approach and depart the scene with enough rapidity to minimize the chance of being caught or thwarted. This now begins to yield useful information for defenders.
The foregoing details allow us to infer, for example, that a knockout game attack is unlikely to take place in a boxer's gym, a fire house, or a cop bar hosting a promotion party for a favorite SWAT team member. Why? These are all places likely to be inhabited by people with good reflexes and trained response capabilities. Not only are they likely to see an attack coming, they are likely to engage and counterattack, leaving attackers worse off than they started. If this is true, then we may also reasonably infer that knockout game participants are risk averse. They do not look for a level playing field or a fair fight.
Similarly, we may infer that such an attack is unlikely to take place indoors or in a crowded area which would impede rapid exit. Getting away without a hitch is one of the unstated preconditions.
What about a very dark street or site experiencing fog, rain, or blizzard? This won't work for the attacker, either. Such conditions negate the video documentation objective, which is essential for bragging rights. If the street is too dark, even a cell phone with a flash won't help because the flash would attract attention, possibly putting the intended victim on alert that something is amiss. With bad weather, filming opportunities become even worse.
3. Analyzing the preconditions, learn what to avoid.
Avoid looking vulnerable in an open area away from possible defenders where any youth can approach you rapidly. You look vulnerable when you are alone and preoccupied (as with a cell phone or with body language suggesting that you are oblivious to your surroundings).
Watch out for a team of at least two young males where one has raced in front of you and is holding a cell phone pointed in your direction, as if to video some event where you are about to be a featured performer. Watch out particularly if the approaching young males are black and you are not.
4. Change the preconditions to limit your attractiveness as a target.
If you must venture into areas that are prime for a knockout game attack, go with one or more companions. Scan your surroundings as you move, projecting awareness and self-assurance rather than diffidence and distraction. If you are trained in and legally able to carry defensive weapons, keep them where you can use them instantly. If not, carry anything legal that can nevertheless disrupt an attack. This can be as simple as a small pocket air horn to make a loud noise that startles the attacker or even an atomizer of the strongest-scented Avon product you can find. Pepper spray may be handier, though. Above all, at the first sign of alarm, move away as fast as possible. Knockout game players are no evil geniuses following intricate plans. Change the preconditions, and you will most likely defeat the only attack scenario in their inventory.
What Not to Do
Ignoring the common features of attackers and of attack preconditions on the theory that basing your defenses on these things would make you too judgmental would certainly be an option. It is an option to embrace only at your own peril.
-- Nick Catrantzos
Tuesday, November 19, 2013
Good Security from Lousy Jobs
Security is a negative that can never be fully established, even if its breach or absence stands out like a tarantula on a wedge of banana cream pie. Any dilettante may spot a security failure, but even the best security expert will hesitate to proclaim a site, person, or operation entirely secure. In this context, it comes as no surprise that security invites opinions from all, whether expert or oaf. Why? Security numbers among the basics in the hierarchy of needs, falling between love and hunger (if the ghost of Abraham Maslow will permit this interpretation). And, as we have established above, even the unschooled may at least comment accurately on security failures, albeit they may lack the capacity to fix them.
Whence comes the capacity to perform troubleshooting and apply innovation to security problems? The answer may not be as intuitive as for other professions. The protection business, after all, still struggles for legitimacy in the realm of academic standing and industry credentials. True, there are security degrees and certifications. However, their presence or absence seldom proves dispositive in the hiring process. Verifiable experience in the area of urgent need remains the most important criterion in filling security positions. Unsurprisingly, security training tends to be narrow and task-oriented. The practitioner earning a living as an alarm technician rides that narrow expertise into a vice presidency. The one who starts out as a guard remains a perennial solver of all security problems by proposing to add more guards to the operation at risk. The cyber security practitioner spends an entire career defending data in electronic form. The defense contract security specialist makes a living complying to contractual requirements whose principal focus is administrative herding of classified material and all those who lay hands on it. How do any of these practitioners learn to tackle a workplace violence situation, a terrorist threat, a case of industrial espionage, or a sabotage attack by a radical group fiercely opposed to their employer's existence?
They learn one of two ways, if not both. Either they awake one day and find themselves assigned to handle the emergent security problem in one of those games of cosmic tag that the Fates handed them on the job, or they actively pursue the broadening of their security experience by working for a consultancy. The first is an act of chance; the second, of volition.
Consulting turns out to be a lousy job for practitioners whose proclivities and capacity incline more toward problem-solving than business acquisition. On the plus side, a busy consulting portfolio exposes the practitioner to a broad array of clients, environments, and security dilemmas. Surviving in this arena is impossible without delivering value, which in turn compels the practitioner to learn more than the mantras of one security niche and to also employ critical thinking to address predicaments that bedevil clients. Thriving in this world, however, takes another set of skills, and these are only incidentally related to actually protecting people or property, namely, business development.
In other words, one must be able to sell in order to advance to the highest, best-compensated level of security consulting. Selling requires talking, listening, promoting, and persuading others to take a chance by engaging one's firm to provide services for which there is seldom an absolute guarantee. At its absolute best (which is an executive talent distinct from glad-handing, back-slapping peddling), this skill translates into becoming the client's trusted adviser who delivers intangible value beyond solving a single security problem. It takes finesse to do this well, and it sometimes takes a vast reservoir of confidence which suffers if needlessly burdened by doubts based on a deep understanding of security challenges. As a result, it often happens in the best of security consultancies that the person who sells the job and sustains the client relationship is not at all the same as the one who does the actual work and solves the security challenges. This situation can be hard on both the client-facing and problem-solving consultants, but it is harder on the latter.
To the security consultant in the business to protect and to solve problems, selling the work may appear unsavory or secondary, a lousy job. To the consultancy, however, getting business comes first. Without it, there can be no consultancy, no income, no professional staff to solve client security problems, no client -- nothing. The consultancy is a car where a business developing executive is the accelerator and a security expert is the brake. The car needs both to function effectively, but first needs an accelerator. Otherwise, it is not a car but a cart. And so the executive consultant whose greatest expertise is in selling services invariably bubbles to the top of the hierarchy, earning more compensation, status, and decision-making authority than the security practitioner who is expert at solving client problems but less proficient at capturing new clients. The practitioner in these circumstances makes his peace with his limitations of skills or career prospects, develops selling skill to match or exceed security expertise, or leaves for other work more suited to his capacities and tastes.
Security consulting can be a lousy job. It is by nature episodic, which means one is constantly biting into different problems without staying around long enough to digest an entire meal. Some practitioners find this aspect of the work too unsettling; they want to be on the ship when it sails. Others, however, find this work bracing and broadening. Success at security consulting brings with it exposure to more people, places, and protection challenges than a career with one or even a handful of employers would afford. It is a broadening experience akin to learning a foreign language and functioning in a new country. The practitioner who has been effective as a security consultant offers a broad knowledge base and aptitude for getting results when hired to direct the security department of a public or private sector organization. This is one way that even lousy jobs can ultimately contribute to better security: the consultant who is a refugee from those lousy security jobs appreciates the steadiness of the current employer yet brings a depth of experience unavailable to someone whose entire world view and knowledge base come from the same employer.
There is another value of lousy security jobs. Persevering through them to attain some objective measure of success eventually gives the practitioner a surer sense of self and more confidence in his or her own abilities. The net result is more security in one's own worth, a good thing to have that remains portable beyond a lousy job.
-- Nick Catrantzos
Whence comes the capacity to perform troubleshooting and apply innovation to security problems? The answer may not be as intuitive as for other professions. The protection business, after all, still struggles for legitimacy in the realm of academic standing and industry credentials. True, there are security degrees and certifications. However, their presence or absence seldom proves dispositive in the hiring process. Verifiable experience in the area of urgent need remains the most important criterion in filling security positions. Unsurprisingly, security training tends to be narrow and task-oriented. The practitioner earning a living as an alarm technician rides that narrow expertise into a vice presidency. The one who starts out as a guard remains a perennial solver of all security problems by proposing to add more guards to the operation at risk. The cyber security practitioner spends an entire career defending data in electronic form. The defense contract security specialist makes a living complying to contractual requirements whose principal focus is administrative herding of classified material and all those who lay hands on it. How do any of these practitioners learn to tackle a workplace violence situation, a terrorist threat, a case of industrial espionage, or a sabotage attack by a radical group fiercely opposed to their employer's existence?
They learn one of two ways, if not both. Either they awake one day and find themselves assigned to handle the emergent security problem in one of those games of cosmic tag that the Fates handed them on the job, or they actively pursue the broadening of their security experience by working for a consultancy. The first is an act of chance; the second, of volition.
Consulting turns out to be a lousy job for practitioners whose proclivities and capacity incline more toward problem-solving than business acquisition. On the plus side, a busy consulting portfolio exposes the practitioner to a broad array of clients, environments, and security dilemmas. Surviving in this arena is impossible without delivering value, which in turn compels the practitioner to learn more than the mantras of one security niche and to also employ critical thinking to address predicaments that bedevil clients. Thriving in this world, however, takes another set of skills, and these are only incidentally related to actually protecting people or property, namely, business development.
In other words, one must be able to sell in order to advance to the highest, best-compensated level of security consulting. Selling requires talking, listening, promoting, and persuading others to take a chance by engaging one's firm to provide services for which there is seldom an absolute guarantee. At its absolute best (which is an executive talent distinct from glad-handing, back-slapping peddling), this skill translates into becoming the client's trusted adviser who delivers intangible value beyond solving a single security problem. It takes finesse to do this well, and it sometimes takes a vast reservoir of confidence which suffers if needlessly burdened by doubts based on a deep understanding of security challenges. As a result, it often happens in the best of security consultancies that the person who sells the job and sustains the client relationship is not at all the same as the one who does the actual work and solves the security challenges. This situation can be hard on both the client-facing and problem-solving consultants, but it is harder on the latter.
To the security consultant in the business to protect and to solve problems, selling the work may appear unsavory or secondary, a lousy job. To the consultancy, however, getting business comes first. Without it, there can be no consultancy, no income, no professional staff to solve client security problems, no client -- nothing. The consultancy is a car where a business developing executive is the accelerator and a security expert is the brake. The car needs both to function effectively, but first needs an accelerator. Otherwise, it is not a car but a cart. And so the executive consultant whose greatest expertise is in selling services invariably bubbles to the top of the hierarchy, earning more compensation, status, and decision-making authority than the security practitioner who is expert at solving client problems but less proficient at capturing new clients. The practitioner in these circumstances makes his peace with his limitations of skills or career prospects, develops selling skill to match or exceed security expertise, or leaves for other work more suited to his capacities and tastes.
Security consulting can be a lousy job. It is by nature episodic, which means one is constantly biting into different problems without staying around long enough to digest an entire meal. Some practitioners find this aspect of the work too unsettling; they want to be on the ship when it sails. Others, however, find this work bracing and broadening. Success at security consulting brings with it exposure to more people, places, and protection challenges than a career with one or even a handful of employers would afford. It is a broadening experience akin to learning a foreign language and functioning in a new country. The practitioner who has been effective as a security consultant offers a broad knowledge base and aptitude for getting results when hired to direct the security department of a public or private sector organization. This is one way that even lousy jobs can ultimately contribute to better security: the consultant who is a refugee from those lousy security jobs appreciates the steadiness of the current employer yet brings a depth of experience unavailable to someone whose entire world view and knowledge base come from the same employer.
There is another value of lousy security jobs. Persevering through them to attain some objective measure of success eventually gives the practitioner a surer sense of self and more confidence in his or her own abilities. The net result is more security in one's own worth, a good thing to have that remains portable beyond a lousy job.
-- Nick Catrantzos
Thursday, November 14, 2013
Blame Detector, Not Behavioral Detection
As the Government Accountability Office calls TSA to task for catching no terrorists and realizing no verifiable security benefit from its behavioral detection program, the popular temptation is to demonize the tool instead of its ham-handed implementation. (For details see http://p.washingtontimes.com/news/2013/nov/13/tsa-wastes-money-profile-passenger-behavior-report/ )
That would be a mistake, the kind that perpetuates the myth of racism reflexively attached to the term behavioral profiling out of a rash equating of all profiling with racial profiling. Let us begin by clarifying terms in order to put the pin back into the grenade that pejorative labels have become.
Racial profiling is stereotyping at its worst, usually associated with authorities singling out minorities for invasive attention or arrest on the basis of their skin color instead of on the basis of probable cause. This is reprehensible and inexcusable -- as is any abridgment of constitutional rights or due process under any smokescreen offered to legitimize it.
Behavioral profiling is altogether something else. Its only relation to racial profiling is that both terms use the word "profiling," which is not enough to make them synonyms. Otherwise, progressive agenda would be indistinguishable from conservative agenda, financial asset would be the same as financial liability, and confidence builder would be no different from confidence man. After all, one word is the same in each pair of two-word labels. Please acknowledge the weak logic behind making such definitional leaps.
No, behavioral profiling owes its place in the quiver of security arrows to Israeli security screeners for El Al, who are to TSA what a surgeon is to a butcher. The signature case establishing the security value of this technique involved catching a pregnant Irish woman with a bomb who looked nothing at all like an Arab and who did not herself know that she was carrying Semtex concealed in her luggage onto her flight to Tel Aviv. What happened? Her Jordanian boyfriend targeted this woman as an unwitting agent, wooed her, got her pregnant -- all purposefully in order to guarantee that she would fit no traditional stereotype. Consequently, detecting her by "racial" profiling would have been impossible if El Al screeners were only looking for young Arab males who fit some preconceived list of what a Hollywood filmmaker would ask Central Casting to use in advertising for someone who looks like a terrorist. So, the terrorist was himself betting on racial profiling and ready to bypass it.
Now we see where the behavioral clues took over to unmask this plot. The essence of the behavioral technique involves asking questions to pierce through the kind of cover story that villains must use in order to get through security screening. Using this technique is more akin to counterintelligence than police work. It takes a thinking questioner to drill down to the point of spotting where the cover story breaks down. And this requires a supple mind rather than the rote grinding through of a checklist. Thus, the El Al screener asks the purpose of the traveler's flight and engages in conversation to validate that the answers make sense.
In the case of the pregnant woman who was unwittingly carrying a bomb, her story just did not wash. She was going to meet her fiance's family, but he was traveling by separate flight. She was going to be met by people she did not know and did not have enough money even for cab fare. In reality, she was in love with the boyfriend and father of her child and, as a result, was understandably gullible. Not so for the El Al screener, however. Spotting the inconsistencies in her story, he used the behavioral technique to flag this passenger for extra scrutiny. This scrutiny, in turn, found the Semtex before it made its way into the cabin to detonate in flight and take over 300 lives. (For details on this particular case, look up the 1986 Hindawi affair and the name Ann-Marie Murphy, the pregnant woman, and her paramour, Nezar Hindawi. A place to start is http://en.wikipedia.org/wiki/Hindawi_affair)
Bottom Line: Behavioral detection works, if properly implemented.
Two big hurdles for the Transportation Security Administration limit effective TSA use of this technique. First, the persistently negative popular association that clings to every appearance of the word "profiling" makes it almost impossible to discuss this matter without unleashing a torrent of diatribes against the evils of racial profiling. Even when true, these accusations are beside the point and an argument unrelated to security screening. A related problem, though, is that the masters of this technique have a fondness for the word "profiling" when describing and teaching what they insist on calling behavioral profiling. To its credit, TSA has rebranded this method as behavioral detection, but the old term survives and all the baggage of "profiling" taints serious discussion of the technique's value and proper application.
Second, TSA implementation of behavioral detection is what merits closer attention than a technique itself which has been proven in the crucible of aviation security. If a technique works but the people applying it don't, we must ask what is wrong with the larger picture.
Behavioral detection is like a medicine capable of curing an infection. It is not enough to prescribe the medicine. It is also necessary to administer it properly, to take it the right way at the right time. An analytical observer would do well to see how an El Al security screener applies behavioral detection and then compare a TSA screener's approach. The screeners may be the same age and test at similar IQ levels. However, they operate in different environments, under different expectations, and with different enabling or constricting circumstances. The Israelis cannot afford to make a mistake. They live under omnipresent, existential threats. They also operate with more responsibility and with bosses and customers who trust them with life and death decisions. What about their TSA counterparts? Reports to date suggest that TSA screeners operate at a much lower level of discretion, responsibility, and applied judgment. Behavioral detection requires more than just following a checklist, more than a go-to-the-freezer-and-get-the-box mentality that sets apart a chef from a warmer of TV dinners. Both screeners may ultimately come from a gene pool that is more similar than it is different, but their management and training are critical in distinguishing between success and failure when it comes to applying a useful technique.
The GAO indictment of behavioral detection is misplaced. It is not the technique that deserves to be questioned so much as the management and context of its implementation.
-- Nick Catrantzos
That would be a mistake, the kind that perpetuates the myth of racism reflexively attached to the term behavioral profiling out of a rash equating of all profiling with racial profiling. Let us begin by clarifying terms in order to put the pin back into the grenade that pejorative labels have become.
Racial profiling is stereotyping at its worst, usually associated with authorities singling out minorities for invasive attention or arrest on the basis of their skin color instead of on the basis of probable cause. This is reprehensible and inexcusable -- as is any abridgment of constitutional rights or due process under any smokescreen offered to legitimize it.
Behavioral profiling is altogether something else. Its only relation to racial profiling is that both terms use the word "profiling," which is not enough to make them synonyms. Otherwise, progressive agenda would be indistinguishable from conservative agenda, financial asset would be the same as financial liability, and confidence builder would be no different from confidence man. After all, one word is the same in each pair of two-word labels. Please acknowledge the weak logic behind making such definitional leaps.
No, behavioral profiling owes its place in the quiver of security arrows to Israeli security screeners for El Al, who are to TSA what a surgeon is to a butcher. The signature case establishing the security value of this technique involved catching a pregnant Irish woman with a bomb who looked nothing at all like an Arab and who did not herself know that she was carrying Semtex concealed in her luggage onto her flight to Tel Aviv. What happened? Her Jordanian boyfriend targeted this woman as an unwitting agent, wooed her, got her pregnant -- all purposefully in order to guarantee that she would fit no traditional stereotype. Consequently, detecting her by "racial" profiling would have been impossible if El Al screeners were only looking for young Arab males who fit some preconceived list of what a Hollywood filmmaker would ask Central Casting to use in advertising for someone who looks like a terrorist. So, the terrorist was himself betting on racial profiling and ready to bypass it.
Now we see where the behavioral clues took over to unmask this plot. The essence of the behavioral technique involves asking questions to pierce through the kind of cover story that villains must use in order to get through security screening. Using this technique is more akin to counterintelligence than police work. It takes a thinking questioner to drill down to the point of spotting where the cover story breaks down. And this requires a supple mind rather than the rote grinding through of a checklist. Thus, the El Al screener asks the purpose of the traveler's flight and engages in conversation to validate that the answers make sense.
In the case of the pregnant woman who was unwittingly carrying a bomb, her story just did not wash. She was going to meet her fiance's family, but he was traveling by separate flight. She was going to be met by people she did not know and did not have enough money even for cab fare. In reality, she was in love with the boyfriend and father of her child and, as a result, was understandably gullible. Not so for the El Al screener, however. Spotting the inconsistencies in her story, he used the behavioral technique to flag this passenger for extra scrutiny. This scrutiny, in turn, found the Semtex before it made its way into the cabin to detonate in flight and take over 300 lives. (For details on this particular case, look up the 1986 Hindawi affair and the name Ann-Marie Murphy, the pregnant woman, and her paramour, Nezar Hindawi. A place to start is http://en.wikipedia.org/wiki/Hindawi_affair)
Bottom Line: Behavioral detection works, if properly implemented.
Two big hurdles for the Transportation Security Administration limit effective TSA use of this technique. First, the persistently negative popular association that clings to every appearance of the word "profiling" makes it almost impossible to discuss this matter without unleashing a torrent of diatribes against the evils of racial profiling. Even when true, these accusations are beside the point and an argument unrelated to security screening. A related problem, though, is that the masters of this technique have a fondness for the word "profiling" when describing and teaching what they insist on calling behavioral profiling. To its credit, TSA has rebranded this method as behavioral detection, but the old term survives and all the baggage of "profiling" taints serious discussion of the technique's value and proper application.
Second, TSA implementation of behavioral detection is what merits closer attention than a technique itself which has been proven in the crucible of aviation security. If a technique works but the people applying it don't, we must ask what is wrong with the larger picture.
Behavioral detection is like a medicine capable of curing an infection. It is not enough to prescribe the medicine. It is also necessary to administer it properly, to take it the right way at the right time. An analytical observer would do well to see how an El Al security screener applies behavioral detection and then compare a TSA screener's approach. The screeners may be the same age and test at similar IQ levels. However, they operate in different environments, under different expectations, and with different enabling or constricting circumstances. The Israelis cannot afford to make a mistake. They live under omnipresent, existential threats. They also operate with more responsibility and with bosses and customers who trust them with life and death decisions. What about their TSA counterparts? Reports to date suggest that TSA screeners operate at a much lower level of discretion, responsibility, and applied judgment. Behavioral detection requires more than just following a checklist, more than a go-to-the-freezer-and-get-the-box mentality that sets apart a chef from a warmer of TV dinners. Both screeners may ultimately come from a gene pool that is more similar than it is different, but their management and training are critical in distinguishing between success and failure when it comes to applying a useful technique.
The GAO indictment of behavioral detection is misplaced. It is not the technique that deserves to be questioned so much as the management and context of its implementation.
-- Nick Catrantzos
Wednesday, November 13, 2013
Security-free Pedigree for Heads of DHS
A subtitle could be DHS Execs: Video Gamers in a Contact Sport.
The ostensible leadership of the federal monolith charged with protecting the United States against existential threats at home continues to fill its executive ranks with people whose security expertise is either inflated or undetectable. The net result is akin to appointing a couch-addicted video gamer as quarterback for a team entering the Super Bowl. He may be fragile, but at least he has no arm, no legs, and no grace under pressure, even if his thumb-to-joystick coordination is world-class.
Enter Jeh Johnson, the latest attorney and bureaucrat to contend for stewardship of the Department of Homeland Security without the burden of ever having been responsible for actually protecting people or property. Raising campaign funds, prosecuting felons, haggling with other lawyers, and occupying sinecures doled out after successful political campaigns by grateful principals may certainly qualify an individual for patronage and the trappings of high office. Nevertheless, these talents fall short of bringing subject matter expertise to the job of protecting America from existential threats at home.
In this lack of anything properly describable as professional capacity, however, Mr. Johnson is neither unique nor especially reprehensible. Just because he has no experience protecting anything, this does not separate him markedly from his predecessors for one main reason: Neither were they. After all, prosecuting felons, the closest most of them have come to what the media confuse as a security role, has as much to do with preventing an attack as an autopsy has to do with saving a patient's life.
Prosecution does not happen until after a loss has occurred. Consequently, it does nothing to prevent the loss. At theoretical best, prosecution serves a societal objective of making villains pay for their misdeeds and perhaps -- a big and oft-debated perhaps -- deter future malefactors from committing the same crime. Thus prosecution may contribute to public safety. It does little for protection, for security. This is why, at least in the private sector, security departments earn their keep by preventing losses from occurring in the first place rather than by chasing down the people responsible for causing those losses. Prevention, in other words, trumps apprehension. In the vast majority of cases, the time, resources, and expense of hunting down the people responsible for causing a loss are wildly out of proportion to the return for such efforts. Not only is an ounce of prevention worth a pound of cure, but in security the prevention is desired and affordable while the cure is a luxury that comes too late if the patient, i.e. the business, is already dead or on a morphine-drip after a catastrophic loss or attack has taken place.
So, why hire non-security professionals for what may well be the nation's top security job? Given the consistency in the pedigrees of all DHS secretaries to date, one must infer that the real recruiting criteria are not so much about protection and prevention as about other things. What are those other things? I submit that there are three true qualifications in demand.
1. BELTWAY PILOTING SKILLS. A South Korean general who pinned on his first star within a year of Jim Clapper, before either foresaw the latter's rise to Director of National Intelligence, once told me this: "Colonel is military rank. General is political rank." The top DHS job takes and confers political rank. Any office holder expects to spend more time testifying before various House and Senate committees or managing the relations between DHS and Congress than actually doing productive work in his or her office. Consequently, in order to navigate successfully through such waters, the Secretary of DHS must be a pilot who knows the political shoals and landscapes. He or she best does this by, well, being cut from the same cloth, by being one of them. And most of them are lawyers who have spent the bulk of their careers in the public sector -- just like every Homeland Security top executive and candidate for that office.
2. PERSONAL RELATIONSHIP AND SUBORDINATION TO THE BOSS.
The only possible exception to this criterion -- and only to a part of it -- was the first DHS executive, Tom Ridge. He was more of a peer to President Bush, having met and interacted with him when both were state governors. Consequently, when the out-of-office Governor Ridge needed a job and President George W. Bush needed the first DHS cabinet secretary, Ridge came in as a known to Bush. The two eventually grew to have their differences, but Ridge never directly showed insubordination to his boss. Subsequent incumbents were clearly more subordinate and beholden to their patrons. Michael Chertoff owed Presidents Bush (father and son) for some of his career appointments, and he was arguably the most cerebral and accomplished of DHS secretaries and candidates to date. Janet Napolitano, unlike Chertoff, had been elected to higher office as a governor, yet had no ostensible time in a peer relationship with her patron, President Obama. She did endorse him when he was a presidential candidate, as did Jeh Johnson, the latter also having raised funds for Obama's campaign. Both Napolitano and Johnson supported and benefited from ties to the Clinton administration and Democrat party affiliation, just as Ridge and Chertoff did from Bush and Republican ties. Manifestly, then, political acceptability and familiarity to the appointing boss, whether Democrat or Republican, appears to be a more important selection criterion than, say, demonstrable security expertise.
3. MARQUEE VALUE BENEATH THAT OF THE BOSS. Again, Ridge may have been a partial exception to this criterion in that he entered the office after having been a peer of the president who appointed him. Nevertheless, he and all successors remain presentable to the media, Congress, and the public while never rising to the kind of prominence that would eclipse that of the Commander in Chief. To explore this criterion, consider who the Secretary of Homeland Security has not been. After 9/11, the most prominent and publicly intuitive pick would have been Rudolph Giuliani. Not only did he turn around crime-related decline in America's largest city, he showed leadership in the aftermath of the 9/11 attacks, earning the sobriquet, America's Mayor. Anyone with direct exposure to this individual, though, has also been exposed to an out-sized ego and work habits that were likely more chaotic and incompatible to those of President Bush. A look at Giuliani and at either Bush or Obama, however, soon foreshadows incorrigible unreconcilability. Having himself contended for the office of President, Giuliani would invariably threaten to steal the thunder of any Commander in Chief. Since the latter remains a political office, too, no incumbent would embrace as Secretary of DHS a person who might intentionally or otherwise redirect limelight away from the nation's chief executive.
With criteria such as the foregoing in play, is it any wonder that traces of actual security competence end up ranking so low on the list of selection criteria as to belong in the nice-to-have-but-not-essential category?
-- Nick Catrantzos
The ostensible leadership of the federal monolith charged with protecting the United States against existential threats at home continues to fill its executive ranks with people whose security expertise is either inflated or undetectable. The net result is akin to appointing a couch-addicted video gamer as quarterback for a team entering the Super Bowl. He may be fragile, but at least he has no arm, no legs, and no grace under pressure, even if his thumb-to-joystick coordination is world-class.
Enter Jeh Johnson, the latest attorney and bureaucrat to contend for stewardship of the Department of Homeland Security without the burden of ever having been responsible for actually protecting people or property. Raising campaign funds, prosecuting felons, haggling with other lawyers, and occupying sinecures doled out after successful political campaigns by grateful principals may certainly qualify an individual for patronage and the trappings of high office. Nevertheless, these talents fall short of bringing subject matter expertise to the job of protecting America from existential threats at home.
In this lack of anything properly describable as professional capacity, however, Mr. Johnson is neither unique nor especially reprehensible. Just because he has no experience protecting anything, this does not separate him markedly from his predecessors for one main reason: Neither were they. After all, prosecuting felons, the closest most of them have come to what the media confuse as a security role, has as much to do with preventing an attack as an autopsy has to do with saving a patient's life.
Prosecution does not happen until after a loss has occurred. Consequently, it does nothing to prevent the loss. At theoretical best, prosecution serves a societal objective of making villains pay for their misdeeds and perhaps -- a big and oft-debated perhaps -- deter future malefactors from committing the same crime. Thus prosecution may contribute to public safety. It does little for protection, for security. This is why, at least in the private sector, security departments earn their keep by preventing losses from occurring in the first place rather than by chasing down the people responsible for causing those losses. Prevention, in other words, trumps apprehension. In the vast majority of cases, the time, resources, and expense of hunting down the people responsible for causing a loss are wildly out of proportion to the return for such efforts. Not only is an ounce of prevention worth a pound of cure, but in security the prevention is desired and affordable while the cure is a luxury that comes too late if the patient, i.e. the business, is already dead or on a morphine-drip after a catastrophic loss or attack has taken place.
So, why hire non-security professionals for what may well be the nation's top security job? Given the consistency in the pedigrees of all DHS secretaries to date, one must infer that the real recruiting criteria are not so much about protection and prevention as about other things. What are those other things? I submit that there are three true qualifications in demand.
1. BELTWAY PILOTING SKILLS. A South Korean general who pinned on his first star within a year of Jim Clapper, before either foresaw the latter's rise to Director of National Intelligence, once told me this: "Colonel is military rank. General is political rank." The top DHS job takes and confers political rank. Any office holder expects to spend more time testifying before various House and Senate committees or managing the relations between DHS and Congress than actually doing productive work in his or her office. Consequently, in order to navigate successfully through such waters, the Secretary of DHS must be a pilot who knows the political shoals and landscapes. He or she best does this by, well, being cut from the same cloth, by being one of them. And most of them are lawyers who have spent the bulk of their careers in the public sector -- just like every Homeland Security top executive and candidate for that office.
2. PERSONAL RELATIONSHIP AND SUBORDINATION TO THE BOSS.
The only possible exception to this criterion -- and only to a part of it -- was the first DHS executive, Tom Ridge. He was more of a peer to President Bush, having met and interacted with him when both were state governors. Consequently, when the out-of-office Governor Ridge needed a job and President George W. Bush needed the first DHS cabinet secretary, Ridge came in as a known to Bush. The two eventually grew to have their differences, but Ridge never directly showed insubordination to his boss. Subsequent incumbents were clearly more subordinate and beholden to their patrons. Michael Chertoff owed Presidents Bush (father and son) for some of his career appointments, and he was arguably the most cerebral and accomplished of DHS secretaries and candidates to date. Janet Napolitano, unlike Chertoff, had been elected to higher office as a governor, yet had no ostensible time in a peer relationship with her patron, President Obama. She did endorse him when he was a presidential candidate, as did Jeh Johnson, the latter also having raised funds for Obama's campaign. Both Napolitano and Johnson supported and benefited from ties to the Clinton administration and Democrat party affiliation, just as Ridge and Chertoff did from Bush and Republican ties. Manifestly, then, political acceptability and familiarity to the appointing boss, whether Democrat or Republican, appears to be a more important selection criterion than, say, demonstrable security expertise.
3. MARQUEE VALUE BENEATH THAT OF THE BOSS. Again, Ridge may have been a partial exception to this criterion in that he entered the office after having been a peer of the president who appointed him. Nevertheless, he and all successors remain presentable to the media, Congress, and the public while never rising to the kind of prominence that would eclipse that of the Commander in Chief. To explore this criterion, consider who the Secretary of Homeland Security has not been. After 9/11, the most prominent and publicly intuitive pick would have been Rudolph Giuliani. Not only did he turn around crime-related decline in America's largest city, he showed leadership in the aftermath of the 9/11 attacks, earning the sobriquet, America's Mayor. Anyone with direct exposure to this individual, though, has also been exposed to an out-sized ego and work habits that were likely more chaotic and incompatible to those of President Bush. A look at Giuliani and at either Bush or Obama, however, soon foreshadows incorrigible unreconcilability. Having himself contended for the office of President, Giuliani would invariably threaten to steal the thunder of any Commander in Chief. Since the latter remains a political office, too, no incumbent would embrace as Secretary of DHS a person who might intentionally or otherwise redirect limelight away from the nation's chief executive.
With criteria such as the foregoing in play, is it any wonder that traces of actual security competence end up ranking so low on the list of selection criteria as to belong in the nice-to-have-but-not-essential category?
-- Nick Catrantzos
Friday, November 1, 2013
What Traffic Accidents Can Teach about LAX Shooting
In a nutshell, we must learn to calibrate our reaction thresholds to expedite timely return to business as usual. It worked for Churchill in WWII. It can work for America in the age of terror.
In communities where a highway fatality is rare, authorities reflexively close down an entire stretch of freeway to accommodate a painstaking and time-consuming accident investigation -- no matter what the expense or impact to commuters. In larger metropolitan areas where such events become so commonplace that commuters actually urge suicidal pedestrians to just jump off a highway overpass in order to end traffic congestion, the response tends to be different. Over time, seasoned patrol officers learn how to handle their investigation and protect the public while still managing to keep traffic moving. It isn't easy, but this latter response does take a certain finesse and savvy. It also takes judgment and insight to recognize the diminishing return of overreaction. Unnecessarily tormenting commuters with road closures to prolong an accident investigation is the kind of mindless move that telegraphs either insecurity or abuse of authority once such action begins to amplify more problems than it solves. There is a prudent middle ground between ignoring a corpse until after rush hour and choking all traffic to the point of turning a commute into a day-long experience. No thinking individual does either.
So what should a thinking official do when a shooter at an airport such as Los Angeles International (LAX) kills a TSA employee and wounds other unarmed people before himself being wounded and apprehended? The situation certainly dictates immediate tactics. Rapid cognition combined with savvy assessment should indicate whether this event has the markings of a terrorist attack with wider ramifications. On the surface of initial reports as of mid-day November 1, 2013, such indications were absent. Whatever targeting goes into a sophisticated terrorist attack, it is unlikely to be the work of a major terror plot if the only apparent casualties were TSA screeners and passersby. Any attack is tragic for innocent victims, but a strategic attack aims at a bigger target, more casualties, and a more shocking impact.
In the absence of such features, one must question the wisdom of shutting down incoming or outbound air traffic for LAX -- particularly if the attacker and weapon were both captured. If there were indications of an explosive device making it to an aircraft, of multiple shooters dispersed throughout LAX, of secondary attacks in progress, or of linkages to a coordinated attack against LAX or other airports, it might be wise to suspend airport operations long enough to protect people and render safe any dangerous devices. Absent such things, though, disruption of LAX operations under the banner of security appears more reflexive than wise. It is reflexive because, given a choice, authorities gravitate to the option that will shield them from liability and negative press. They don't want to face accusations of not responding vigorously to a visible threat, so the natural reaction is to make up for deficient planning and defenses by ostensible overkill.
Is the reflexive response the right one? An airport which averages one outgoing flight every 55 seconds and is the third busiest in the country cannot and should not embrace reflexive shutdown without regard for the cascading impact that this action produces nationwide for commercial aviation.
Sometimes the reflexive and convenient and risk averse response is precisely the wrong one. Shutting down flights and significant parts of LAX operations in knee-jerk response to this incident -- unless justified by threat intelligence not made public -- appears to be exactly the kind of response akin to closing down an entire big city freeway all day to investigate a single accident whose cause and effect have been 80% assessed within the first hour. On the surface, such overreaction appears less than wise.
-- Nick Catrantzos
In communities where a highway fatality is rare, authorities reflexively close down an entire stretch of freeway to accommodate a painstaking and time-consuming accident investigation -- no matter what the expense or impact to commuters. In larger metropolitan areas where such events become so commonplace that commuters actually urge suicidal pedestrians to just jump off a highway overpass in order to end traffic congestion, the response tends to be different. Over time, seasoned patrol officers learn how to handle their investigation and protect the public while still managing to keep traffic moving. It isn't easy, but this latter response does take a certain finesse and savvy. It also takes judgment and insight to recognize the diminishing return of overreaction. Unnecessarily tormenting commuters with road closures to prolong an accident investigation is the kind of mindless move that telegraphs either insecurity or abuse of authority once such action begins to amplify more problems than it solves. There is a prudent middle ground between ignoring a corpse until after rush hour and choking all traffic to the point of turning a commute into a day-long experience. No thinking individual does either.
So what should a thinking official do when a shooter at an airport such as Los Angeles International (LAX) kills a TSA employee and wounds other unarmed people before himself being wounded and apprehended? The situation certainly dictates immediate tactics. Rapid cognition combined with savvy assessment should indicate whether this event has the markings of a terrorist attack with wider ramifications. On the surface of initial reports as of mid-day November 1, 2013, such indications were absent. Whatever targeting goes into a sophisticated terrorist attack, it is unlikely to be the work of a major terror plot if the only apparent casualties were TSA screeners and passersby. Any attack is tragic for innocent victims, but a strategic attack aims at a bigger target, more casualties, and a more shocking impact.
In the absence of such features, one must question the wisdom of shutting down incoming or outbound air traffic for LAX -- particularly if the attacker and weapon were both captured. If there were indications of an explosive device making it to an aircraft, of multiple shooters dispersed throughout LAX, of secondary attacks in progress, or of linkages to a coordinated attack against LAX or other airports, it might be wise to suspend airport operations long enough to protect people and render safe any dangerous devices. Absent such things, though, disruption of LAX operations under the banner of security appears more reflexive than wise. It is reflexive because, given a choice, authorities gravitate to the option that will shield them from liability and negative press. They don't want to face accusations of not responding vigorously to a visible threat, so the natural reaction is to make up for deficient planning and defenses by ostensible overkill.
Is the reflexive response the right one? An airport which averages one outgoing flight every 55 seconds and is the third busiest in the country cannot and should not embrace reflexive shutdown without regard for the cascading impact that this action produces nationwide for commercial aviation.
Sometimes the reflexive and convenient and risk averse response is precisely the wrong one. Shutting down flights and significant parts of LAX operations in knee-jerk response to this incident -- unless justified by threat intelligence not made public -- appears to be exactly the kind of response akin to closing down an entire big city freeway all day to investigate a single accident whose cause and effect have been 80% assessed within the first hour. On the surface, such overreaction appears less than wise.
-- Nick Catrantzos
Dummy Cameras and Symbolic Security
The subtitle should be, "Whom do we think we're fooling, and how does this serve our security objectives?" Let us begin with a few cases from the real world.
A FACILITY IN THE WOODS
A research facility that once engaged my consulting firm to help defend against ecoterrorist attacks had some executives who wondered aloud about the merits of stretching their security dollars by putting up dummy video cameras interspersed among functioning devices installed for perimeter intrusion detection. This was a bad idea. Why? If they had accompanied their junior and middle managers to the field for a reality check, as I did, they would have seen that the only consistent attention drawn by such dummy cameras was for target practice. My local guide, a field supervisor and long-term company employee, pointed out how the only value realized from a former executive's bright idea about installing dummy cameras at the corner of a tree farm was that these devices drew most of the rifle fire that would have otherwise been aimed at a ground-level access hatch to a utility connection. The supervisor ruefully noted that executive management tended to ignore his input on the effectiveness of these dummy installations, perhaps because he lacked the organizational authority that comes with more senior rank. He wondered if the same advice from an external consultant, me, might not find a more receptive ear in mahogany row. So did I. It did. The executives quietly buried the dummy camera idea.
A SCHOOL IN THE DARK
A colleague found himself advising a public school on what to do about security lighting for a facility repeatedly struck by burglars and vandals at night. His client, having read up on crime prevention through environmental design, reasoned that protective lighting would deter intruders because it would increase their chance of detection, hence their risk of apprehension. So the client dutifully surrounded the school with extra floodlights, arranged them to avoid glare that would affect surrounding homes, and asked for the lighting contractor to make sure that the light was of the proper illumination and strength to provide deterrence. The intrusions and losses not only continued but started to increase. Unlike his client, my colleague actually went to the school at different hours of the day and night, first to measure the lighting strength in foot candles and then to determine whether there was an undetected flaw in coverage. Perhaps a gap in lighting had inadvertently surfaced to provide intruders with concealment that had gone undetected. No, that was not the case. What had happened? My colleague roamed around the school and the entire neighborhood before figuring out that the school lighting was acting not as a deterrent but as a beacon. It was attracting burglars and vandals, illuminating their target and facilitating their movement once on the premises. What did he advise? He had the school try shutting off the floodlights and all but a few motion-activated lights in order to see what would happen. As a result, intruders moved to other, better lit targets. Problem solved.
A NUISANCE CORNER
A home I once had rested on a corner lot where trees and ivy looked presentable during the day but started attracting juvenile loiterers at night. The kids started gathering in that spot, leaving beverage cans, cigarette butts, and other detritus that only a future archaeologist might find noteworthy. Why? It was just out of the cone of illumination of the nearest street light. Thanks to the know-how of a visiting relative, I had the help it took to install floodlights along the dark corner of my home, but this project triggered a debate. My relative suggested using a motion-activated sensor to switch the lights on when kids passed the side of the house. I voted for a light sensor that switched them on automatically at night. Since the house and expense were mine to bear, my vote was decisive. This decision also worked and saved money. How so? My option worked like the street light that the kids were avoiding by hanging out at the side of my house. By turning on automatically as the street lights turned on as well, my new lights instantly removed the attraction that was drawing the kids to my corner. So they shuffled off somewhere else. If I had relied on a motion sensor, chances are the kids would have been able to figure out how to bypass the sensor and still manage to keep loitering in the same general area -- unless I installed a lot more motion sensors. Then they would have also had the option of entertaining themselves by seeing how many times they could trigger the sensors on and off. In any case, turning sensors on and off this way would sentence my family to the annoyance of constant clicking sounds and would likely wear out my floodlights faster, at greater expense. Turning the lights on automatically at night kept the loiterers from approaching in the first place -- something the motion-activated option would not do equally. One option was tailored to solve the problem. The other option was not as thought out as it was reflexive.
LESSONS
Symbolic security offers more value to its advocates than to targets needing protection. And it does this by generating two kinds of expense. First, there is the direct cost of symbolic security: the cost of installing, operating, or replacing dummy cameras, lights, and any other stage management expenses of security theater. Second, there is the less tangible yet more corrosive damage to security's credibility and to voluntary adoption of security recommendations by a targeted population turned into reluctant, jaded customers. That is the real cost: losing the people whose voluntary compliance is vital to defending against threats.
WIDER APPLICATION
Look at any overextended, intrusive, and costly program unburdened by metrics or demonstrable returns yet perpetuated under the banner of security. Some aspects of TSA screening and NSA data vacuuming come to mind. Are the programs delivering results in proportion to what they are costing us? Or, like dummy cameras and symbolic security, are they fooling only those who perpetuate them while the real villains safely smile from a distance, patiently devising the next attack and watching defenders chase their tails?
-- Nick Catrantzos
A FACILITY IN THE WOODS
A research facility that once engaged my consulting firm to help defend against ecoterrorist attacks had some executives who wondered aloud about the merits of stretching their security dollars by putting up dummy video cameras interspersed among functioning devices installed for perimeter intrusion detection. This was a bad idea. Why? If they had accompanied their junior and middle managers to the field for a reality check, as I did, they would have seen that the only consistent attention drawn by such dummy cameras was for target practice. My local guide, a field supervisor and long-term company employee, pointed out how the only value realized from a former executive's bright idea about installing dummy cameras at the corner of a tree farm was that these devices drew most of the rifle fire that would have otherwise been aimed at a ground-level access hatch to a utility connection. The supervisor ruefully noted that executive management tended to ignore his input on the effectiveness of these dummy installations, perhaps because he lacked the organizational authority that comes with more senior rank. He wondered if the same advice from an external consultant, me, might not find a more receptive ear in mahogany row. So did I. It did. The executives quietly buried the dummy camera idea.
A SCHOOL IN THE DARK
A colleague found himself advising a public school on what to do about security lighting for a facility repeatedly struck by burglars and vandals at night. His client, having read up on crime prevention through environmental design, reasoned that protective lighting would deter intruders because it would increase their chance of detection, hence their risk of apprehension. So the client dutifully surrounded the school with extra floodlights, arranged them to avoid glare that would affect surrounding homes, and asked for the lighting contractor to make sure that the light was of the proper illumination and strength to provide deterrence. The intrusions and losses not only continued but started to increase. Unlike his client, my colleague actually went to the school at different hours of the day and night, first to measure the lighting strength in foot candles and then to determine whether there was an undetected flaw in coverage. Perhaps a gap in lighting had inadvertently surfaced to provide intruders with concealment that had gone undetected. No, that was not the case. What had happened? My colleague roamed around the school and the entire neighborhood before figuring out that the school lighting was acting not as a deterrent but as a beacon. It was attracting burglars and vandals, illuminating their target and facilitating their movement once on the premises. What did he advise? He had the school try shutting off the floodlights and all but a few motion-activated lights in order to see what would happen. As a result, intruders moved to other, better lit targets. Problem solved.
A NUISANCE CORNER
A home I once had rested on a corner lot where trees and ivy looked presentable during the day but started attracting juvenile loiterers at night. The kids started gathering in that spot, leaving beverage cans, cigarette butts, and other detritus that only a future archaeologist might find noteworthy. Why? It was just out of the cone of illumination of the nearest street light. Thanks to the know-how of a visiting relative, I had the help it took to install floodlights along the dark corner of my home, but this project triggered a debate. My relative suggested using a motion-activated sensor to switch the lights on when kids passed the side of the house. I voted for a light sensor that switched them on automatically at night. Since the house and expense were mine to bear, my vote was decisive. This decision also worked and saved money. How so? My option worked like the street light that the kids were avoiding by hanging out at the side of my house. By turning on automatically as the street lights turned on as well, my new lights instantly removed the attraction that was drawing the kids to my corner. So they shuffled off somewhere else. If I had relied on a motion sensor, chances are the kids would have been able to figure out how to bypass the sensor and still manage to keep loitering in the same general area -- unless I installed a lot more motion sensors. Then they would have also had the option of entertaining themselves by seeing how many times they could trigger the sensors on and off. In any case, turning sensors on and off this way would sentence my family to the annoyance of constant clicking sounds and would likely wear out my floodlights faster, at greater expense. Turning the lights on automatically at night kept the loiterers from approaching in the first place -- something the motion-activated option would not do equally. One option was tailored to solve the problem. The other option was not as thought out as it was reflexive.
LESSONS
Symbolic security offers more value to its advocates than to targets needing protection. And it does this by generating two kinds of expense. First, there is the direct cost of symbolic security: the cost of installing, operating, or replacing dummy cameras, lights, and any other stage management expenses of security theater. Second, there is the less tangible yet more corrosive damage to security's credibility and to voluntary adoption of security recommendations by a targeted population turned into reluctant, jaded customers. That is the real cost: losing the people whose voluntary compliance is vital to defending against threats.
WIDER APPLICATION
Look at any overextended, intrusive, and costly program unburdened by metrics or demonstrable returns yet perpetuated under the banner of security. Some aspects of TSA screening and NSA data vacuuming come to mind. Are the programs delivering results in proportion to what they are costing us? Or, like dummy cameras and symbolic security, are they fooling only those who perpetuate them while the real villains safely smile from a distance, patiently devising the next attack and watching defenders chase their tails?
-- Nick Catrantzos
Subscribe to:
Posts (Atom)
