LADDER: Protective Security Specialists…

How long does it take for a lethal attack to occur against an At-Risk person?

Just 2 Seconds is the best selling book by Gavin De Becker. Along with his long time colleagues Tom Taylor and Jeff Marquart, they document how to use time and space to defeat adversaries.

There are some compelling insights gained from their research:

• In the US, attacks are most likely to be undertaken by lone assailants 87% vs. outside the US where attacks are typically the work of multiple assailants 71%.
• Attacks in the US are about as likely indoors (53%) vs. outdoors (47%).
• However, 64% of attacks happen when the protected person is outside in or around the car and 77% of these attacks are successful.

Most of these happen within a distance of 25 feet or less using a handgun. Corporate executives and their Protective Security Detail (PSD) already know these statistics and have trained together for these increasing risks.

Many have adopted the LADDER model from “Gavin de Becker & Associates” training academy:

> L ogistics

> A dvance

> D istance

> D eterrence

> E vacuation

> R esponse

The study of the motives and the psychology of why these actors pick their targets and choose the time and place has become a science. The methods and tools to assist corporate security in predictive analytics requires a substantial baseline of historical data and real-world experience.

Over 30 years ago Gavin and his team developed the MOSAIC Threat Assessment system. It is now in use with dozens of police and government agencies to help authorities and “Protective Security Details” to be more proactive and preemptive.

Protective Security Specialist’s (PSS) today are certified professionals utilizing intelligence in combination with the attributes of Time, Mind and Space to provide safe and secure travel for their clients.

The Science and the Art have converged to provide a fusion of data, strategy and ad hoc tactics to ensure the mission is completed without incident.

The profession doesn't stop there. Some Operational Risk Management firms who have these certified individuals on staff, go much further in their training and their vetting of employees.

We agree and recommend that you add these questions to your due diligence when obtaining Request for Proposals (RFPs) from these firms:

• Review all policy documents the firm has their personnel sign to become a PSS on staff.
• Review the firms hiring process and the prerequisites to join the firm.
• Review the operational standards and operating procedures to ensure 24 x 7 x 365 capabilities.
• Review the 3rd party agreements that encompass any transportation and private aviation suppliers.
• Review the firms technology and communications infrastructure including Internet, radios, information systems security controls and privacy countermeasures.

The profession has come a long way and people like Gavin de Becker & Associates have for decades established the baseline for others to compete. High net worth individuals, movie stars, public officials and corporate executives have much at stake and require comprehensive strategy execution.

Think of every assassination like attack you've ever heard about. For most people, a few of these major ones come to mind: Caesar, Abraham Lincoln, John Kennedy, Martin Luther King, Mahatma Gandhi, Indira Gandhi, Anwar Sadat, John Lennon, Israel’s Prime Minister Rabin, Pakistan’s Benazir Bhutto.

From start to finish, all of these attacks — combined — took place in less than one minute. And the hundreds of attacks studied for the book, all of them combined, took place in less than a half-hour.

Those thirty minutes, surely the most influential in world history, offer important insights that can help today’s protectors defeat tomorrow’s attackers...

People: Coopers Colors...

When was the last time your corporate travel department gave you some timely INTEL? Maybe you got a report on the current level of risk in the region, city or country you are now scheduled to visit in the next few days.

What are you going to do if everything goes “South” in a matter of seconds or minutes?

The Mission

In situations that require instinctive response, you have to go beyond the traditional travel management report on what to do and who to call. You have to act and make decisions on your own.

In order to survive, one must be trained on the authoritative, detailed description of the methods by which terrorist organizations, hostile intelligence services, and criminal groups select and target specific individuals. Individuals and a team must learn how they can detect and counter potential threats against them, and their sponsoring organizations to better manage these operational risks.

These threats could include recruitment by a hostile service, kidnapping or assassination by terrorist and criminal elements or espionage by business competitors. Combined with real-time INTEL, you must receive intense, real-time instruction in surveillance detection and counter-surveillance so that you can take appropriate actions.

Combining real-time intelligence with a focused surveillance and threat detection-training program is exactly what savvy corporate executives and Chief Security Officers are looking for from a single source. Personnel threat management is a prudent risk mitigation solution. This combination is one key strategy to mitigate the operational risks associated with key personnel in your organization.

Individuals whose occupations place them at risk may include people with access to valuable proprietary information or holders of high level security clearances, the wealthy and those responsible for their safety.

What may be more vital is the use of "Coopers Colors":

"By using a well-practiced, concrete, formulaic train of thought, it prevents the hesitation normally experienced when one is under threat of attack or actual attack, and this is the purpose of the code, to prevent unnecessary hesitation, and to apply only that force which is necessary to defend yourself." "The way Jeff Cooper explains it is:"

• White - relaxed and fairly oblivious of your surroundings, you should only be in this condition if you are at home or another secure setting behind locked doors.

• Yellow - the state of not only constant awareness, but the constant recognition of possible threats. In this state, you are observant of your surroundings, allowing you to recognize threats if they present themselves.

• Orange - in this state, you have recognized a potential threat, and are ready to defend yourself against this threat if necessary.

• Red - you are actively defending yourself or others against a threat that has presented itself to you.

It's not just about general awareness, it's about positively identifying potential and actual threats, as you go about your daily life. It is this threat identification and acquisition process that is so valuable, that reduces your response time to those threats, if they present themselves.

The Take Away

Combine two parts “Threat Detection & Management” with one part INTEL and you have the perfect combination to ensure the successful completion of corporate missions across the globe.

Extraordinary: Always Be Ready...

The G700 private jets were taking off from Winchester Regional Airport (OKV) and they roared just overhead as we approached the small business park off Front Royal Pike & Airport Road.

It was a another glorious Virginia Fall week, with the Maple and Oak trees in full colors.

The next training course was scheduled to begin at 08:00 sharp and you could feel the butterflies in your gut as you pulled into the small tree lined parking lot.

The 72 hour on-site course to achieve a “Personal Protection Specialist” (PPS) Certification (32E) in Virginia was just one facet of a continuous journey to learn more about what the definition of “Extraordinary” really means:

Extraordinary

adjective

1a: going beyond what is usual, regular, or customary.

2: employed for or sent on a special function or service.

Over the next six days we would be in this class room and also out in the local community applying new skill sets in real time. Day and night.

Our key areas of instruction, innovation, mastery and testing included:

• Personal Protection Orientation.
• Virginia Code and DCJS Regulations.
• Assessment of Threat and Protectee Vulnerability.
• Legal Authority and Civil Law.
• Protective Detail Operations.
• Emergency First Aid and CPR.
• Advances.
• Surveillance Detection.
• Defensive Preparedness.

Why?

So our instructors will observe our behavior, coach us in the moment of action in order to improve towards true achievement of “Extraordinary” service.

The mindset and all of the innovative professional skills that are learned this week, shall stay with you forever.

So how does continuous learning and practicing these skills as a "Quiet Professional" over a decade ago, apply to our particular world in 2023?

As just an illustrated example, perhaps you are responsible for transporting your Principal client from a hotel to the airport in an unfamiliar California city at the end of a two day corporate event.

Some may call it pre-planning, and yet it is referred to as the “Advance”.

You have never driven the route before and based upon the amount of orange cones and detour signs already witnessed, you know it could be a challenge. There is no chance for errors.

As you take a first look in Google Maps at your proposed starting point and destination, the route looks unusual. Heading South for a few miles to make a U turn when you know your airport is to the North seems curious?

So to get a local perspective, you then approach the “Hotel Concierge” and ask them for the best route to the airport from their point of view.

They immediately pull out the paper Map of the area and show you the path North along the local North bound detours to provide you on a visual orientation.

Fast forward to check-out. You are now in the vehicle transporting your client with substantial luggage while they continue to deal with the growing barrage of message alerts on their iPhone.

15 miles North and 25 minutes or so later after keeping the visual orientation in mind with your Google Maps talking in the background, you safely arrive on time at this foreign airport.

As a PPS in your particular role of your small team, business organization or agency, just continue to remember this.

You learned and trained to be “Extraordinary”.

“Always Be Ready”…

Observation: Sensory Informed+Aware+Ready (SIAR)...

In a focus to be more innovative in your particular business or vocation, which of your own human senses are you using most effectively today?

• Sight.
• Sound.
• Smell.
• Touch.
• Taste.
• Pain.
• Hunger.
• Thirst.
• Pleasure.

Anything else?

How well are you using your complete observations that combine these senses with other brain functions to create new insights, new intelligence or safety knowledge?

How many steps are there from your front hallway up to your second story in your residence? If you know the answer, why?

Your observation skill sets are combining human senses and other brain functions to provide you with new insights, knowledge and domain awareness.

Or you may already know the answer of how many steps are in your home because you are handicapped or blind.

You many also know the moment that someone in your house is boiling water on the kitchen stove, because of a unique smell. And you probably know who that person is.

You many know the moment a next door neighbor leaves their garage, based upon the sound of their vehicle.

We are continuously combining our sensory functions and brain functions all the time, even without thinking about it.

"Yet how observant are you really? Do you store your sensory information somewhere for retrieval later? In case you need it?"

What if you became more actively conscious about this by practicing it each day. How might this new observant talent be of a vital use to you and others?

Operational Risk Management requires multi-sensing information processing and response 24x7 by you, not just by your machines.

By you as a standalone human.

If you had to operate for a whole day without your iPhone with you on next Friday, what might you observe? What might you learn?

How might you better increase your own personal knowledge on this Friday.

With the observation of human senses of Time? Of Direction? Of Temperature? Of Weather? Of even a lack of “Knowledge” of what your friends, followers or family are doing each hour of their day.

So what?

Your future abilities of human observation will enhance your innovation capabilities as you continuously adapt to your hourly and daily environment.

Your enhanced personal “Operational Risk” skill-sets will keep you more Sensory Informed, more Aware and more Ready (SIAR) than so many others…

Onward!

Superhuman: Mission Possible...

Each new day is a real opportunity to make yourself better. It can be another day of new discovery, curiosity and learning.

Are you Superman?

Living day by day, going to work and/or finding the truth, as you talk with other people to hear what they have to say and then perform the tasks to improve your own world or the enterprise.

What about conquering evil the moment you see it or feel it, by using your God given talents in order to protect others and defend people from harm and to provide for their daily needs.

Are you a Father or Mother?

Then you too may be a “Superhuman” (Superman or SuperWoman) and now you truly understand what it really means to be a good responsible parent.

It is difficult to know the feeling and experience the emotions of being a Parent, until you actually are one.

You won’t be able to ever comprehend being a parent by just becoming a singular representative, manager, analyst, chef, teacher, banker, author, artist, supervisor or landlord.

You can learn about what to do or not to do, by watching your sibling or your own parent, a friend or by reading a parenting book or even just watching CoComelon on YouTube.

Yet it is not until you are actually performing and experiencing the moments in your own motherhood or fatherhood, that you will truly understand.

Yes, you will need to be “Superhuman” to achieve a level of true excellence that others will say you are a good and responsible Mom or Dad.

So what?

You alone as a “Superhuman” parent have a duty and mission.

The mission will change your life forever and so you too, have only one person to rely on.

On your next Childs birthday, take the time to reflect. Take the time to think about the journey so far.

Say another prayer.

You know that each birthday of your child is another opportunity for you to show your own super powers as a parent. No matter how old they are on this day.

"Love. Patience. Friendship. Encouragement. Forgiveness. Faith. Love."

Onward!

Social Engineering: CxO Leadership for BEC...

In the context of cyber security, many practitioner experts are already familiar with the "Business E-Mail Compromise" (BEC).  Operational Risk Management (ORM) professionals know this:

"Amateurs attack machines, Professionals attack people"

The BEC is a global scam with subjects and victims in many countries. The IC3 has received BEC complaint data from victims in every U.S. state and 45 countries. From 10/01/20131 to 12/01/2014, the following statistics are reported: 

• Total U.S. victims: 1198
• Total U.S. dollar loss: $179,755,367.08
• Total non-U.S. victims: 928
• Total non-U.S. dollar loss: $35,217,136.22
• Combined victims: 2126
• Combined dollar loss: $214,972,503.30

The FBI assesses with high confidence the number of victims and the total dollar loss will continue to increase.

What executives at most organization understand, is that they are a potential target for all kinds of threats from inside and outside the company.  Fortune 500 companies already have sophisticated internal accounting controls and "Personal Protection Specialists" who are doing advance work, for travel that the CxO takes across town or overseas.  Yet what about the Small-to-Medium Enterprise with just tens of millions of dollars in annual revenues?  Are they prepared as they could be for the BEC?

It does not take much for the financial controls and the accounts payable process to break down for companies and organizations, that have not prepared for this continuous threat, by your own insiders (employers, partners, suppliers) cooperation.  The numbers tell the whole story.  Countless times each year, companies are convinced to act upon a simple e-mail crafted by clever "Social Engineering" experts, to transfer money out of their corporate banking accounts.

So what are you doing to prepare, educate and deter this continuous wave of "Social Engineering" attacking your employees and key stakeholders?  How many computers and iPhones in your business or organization receive e-mail on a daily basis?  Each one of these is a threat vector, along with each one of your employees who is the human factor behind the device.

What is amazing today, is that a cyber threat like this, that has been talked about for over a year, is still growing.  Perhaps it is a leadership problem.  Perhaps it is a public safety announcement campaign problem.  In either case, you have to realize, there are some very specific remedies that can be exercised by your organization to deter, detect and defend yourself from "Business E-mail Compromise" (BEC).

Executives and senior staff are busy.  They are running the business and rarely have time for that two hour or half day training session.  This is your largest vulnerability to begin with at your organization.  An apathetic CEO or senior staff is the perfect target for any transnational organized crime (TOC) syndicate on the other side of the globe.

As a CxO, when was the last time you had a campaign within the organization to address these threats?  Weeks, Months, Years?  Why haven't you incorporated a continuous program to keep your employees and staff up to date?  If you have 1247 employees, then you have 1247 vulnerabilities walking around in your enterprise.

When you look at the line item in the Information Technology budget this year for hardware, software, maintenance and cloud computing, look a little further.  Where is the line item for the education program and the tactical awareness, to keep your people on the leading edge of deterring the social engineering wave of attacks in your organization?

There has been a lot of news in 2016 about a particular species of phish, the so-called Business Email Compromise (BEC). In this scenario, the attacker poses as an executive of a company, asking someone--usually a subordinate employee--to perform a wire transfer or similar action. When the employee complies and completes the transfer, the company realizes--too late--that it has just given a large payment to a criminal. An investment company in Troy, Michigan, recently lost $495,000 from a BEC phish, so this is not a small matter.

It even hit close to my (professional) home: DomainTools’ CFO recently received a spear phish purporting to come from our CEO, asking her to make a wire transfer of funds. The sending email address was a clever look-alike of “domaintools.com,” using some substituted characters. Fortunately our CFO is very savvy and knew right away that her boss wouldn’t actually make such a request in that way. But it underscores how common this kind of BEC phish is -- and how easy it is for criminals to spoof legitimate emails.

This is just a small example, of the continuous trend across the small-to-medium enterprise landscape.  You have the control and the ability to make a difference in your enterprise.  The time and the services exist for you to keep your organization more safe and secure than it is today.  When will you decide it is your "Duty of Care" to protect corporate assets and to start using some of the tools to make "Business E-mail Compromise" (BEC) extinct?

Executive Security: Personal Protection Specialist...

Operational Risk Management (ORM) extends beyond the perimeter with some of your most valuable assets.  The Fortune 500 Chief Executive Officer and their staff team of subject matter experts are continually at risk.  Even if you are the co-founder of a new start-up with that new "Killer App" ready for testing with SOCOM, you may now require several full-time security risk professionals at your side.

In the corporate Protective Security environment, the "Advance Work" being executed by your ORM team will ensure your success or contribute to the embarrassment or injury of your client/principal. Professionals in Protective Security Detail's (PSD) realize that your site or lead advance agent can make or break the entire operational risk strategy, for your proactive and preventive security measures.

Thinking like the DEVGRU attacker and possessing a "Red Cell" mentality, is a valid approach for several aspects of the advance work necessary to ensure an effective "protective envelope". What ends up being the greatest threat to your operation, may be technology itself. Too much reliance on pervasive high tech tools such as "Google Maps" or even the standard-issue Garmin GPS, will create a vulnerability just at the point in time when your principal says, "Let's change the itinerary or the location of the next meeting".  A "15 Minute Map" comprised from a good old fashioned road atlas, can be the low tech tool that saves lives and potential chaos.

21st Century Executive Security and modern day Personal Protection Specialist's (PPS), who understand the value of the "Advance" and apply it effectively, will continue to keep their principal's safe and secure and with a high degree of professional client service. Corporations operating in countries where executives are required to visit critical infrastructure plants, manufacturing facilities or meet with government officials, have been incorporating more protective intelligence and advance work for good reason. The global business environment is increasingly more volatile and subject to rapidly changing political risks and subjective "Rule of Law" in many emerging democracies.

Whether it is weapons in close range or a distance, explosive IED's or kidnapping plots, today's global and mobile executive is ever more at risk.  Effective "Advance Work" is the most important and critical aspect of the security operation.  Site and route surveys, "eyes on" residences, airports and hotels, hospitals, police stations, restaurants and convention centers, are a mandatory component of the advance operations.

Surveillance Detection (SD) remains a vital facet of the advance work, including the ongoing SD as the Protective Security Detail agents run the operation. The Principal is potentially aware of such activity, yet is shielded from any lethal imminent threats as the days agenda unfolds.

What may be more obvious is the PSD's use of "Coopers Colors:":

"By using a well-practiced, concrete, formulaic train of thought, it prevents the hesitation normally experienced when one is under threat of attack or actual attack, and this is the purpose of the code, to prevent unnecessary hesitation, and to apply only that force which is necessary to defend yourself." "The way Jeff Cooper explains it is:"

• White - relaxed and fairly oblivious of your surroundings, you should only be in this condition if you are at home or another secure setting behind locked doors.
• Yellow - the state of not only constant awareness, but the constant recognition of possible threats. In this state, you are observant of your surroundings, allowing you to recognize threats if they present themselves.
• Orange - in this state, you have recognized a potential threat, and are ready to defend yourself against this threat if necessary.
• Red - you are actively defending yourself or others against a threat that has presented itself to you.

It's not just about general awareness, it's about positively identifying potential and actual threats, as you go about your daily life. It is this threat identification and acquisition process that is so valuable, that reduces your response time to those threats, if they present themselves.

Executive Security and the Personal Protection Specialist (PPS) becomes an even more vital asset in the OPS Risk portfolio, where the Board of Director's has authorized significant premiums for an executive's kidnap and ransom (K&R) insurance. Why?

Like many aspects of our society today regarding information privacy, one only wonders how information gets leaked from the confines of the corporate enterprise. Operational Risks involving people in your organization exist everyday.  Insuring against losses and protecting against personnel loss events is imperative. Utilizing the correct strategy, tools and professional human assets to comprise the entire security envelope including the effective use of Protective Security Details, can make all the difference in your organizations resilience factor.