Remembering 9/11: 2026-Teaching the Children...

Where were you on the morning of September 11th, 2001? Everyone seems to remember...

On a cool sky blue morning, 25 years ago in Northern Virginia, we are sitting in a Reston Town Center Hyatt hotel restaurant having breakfast around 8:00AM with a business colleague. A little over 40 minutes into our discussion, we heard some people talking quite loud in the bar next to us as they were then watching CNN to see the World Trade Center Twin Towers attack. As cell phones rang around us, they were all loved ones checking in and urging us to hurry home.

Walking to the parking lot, the proximity of our kids elementary school and middle school to the CIA campus created a feeling of great internal anxiety and it soon turned to fear.

Unknown to us at that moment, five terrorists were also onboard American Airlines Flight 77 that had already departed from Dulles (IAD) at 8:20AM headed to Los Angeles (LAX).

Little did we know that the AAL77 hijackers onboard that Boeing 757 flight had slept the night before a half mile from us in a Herndon, VA motel.  30 or so minutes into the flight over Ohio, with the terrorists now in control and the aircraft transponder off, it would make its turn back to Washington, DC to attack the West side of the Pentagon at 9:37AM.

We could now see the smoke rising in the distance on the Eastern horizon.

What this September 11th day is about every year beyond these memories, is the renewed vow of vigilance. A time to revisit all the reasons why you have made the decisions you have since that Tuesday morning twenty-five years ago. Never Forget that day. Never Forget why you wake each morning.

9/11 vigilance is about being adaptive. It is about resilience.

For those of us who have never paid the same price as those who have served, supported and are the mothers, fathers, brothers, sisters or relatives of those who have, we can never know or really feel what they have. We can only pledge our vigilance in continuing our respective missions.

Most of all. The mission is not America's alone and the entire planet understands this. As they teach the history of 9/11 in the schools of New York City, Haiti, Chile, Pakistan, India and even Saudi Arabia, what do you think the lesson is about?

If it is not about vigilance and resilience, then we are doing our children a disservice. We must be preparing them for the future threats that this globe will be facing in the years and decades before us.

Whether it is the wrath of "Mother Nature" or the evil planning of AI or ordinary people does not matter. We can never predict exactly the day the hour or when and where the next attack will occur. Whether it will impact our buildings, bridges, rivers, schools or the Internet is unknown.

If all of us on this 3rd rock from the sun, have done our job teaching our kids about “Vigilance and “Resilience”, then we should all be able to have a peaceful nights sleep. Devoid of nightmares.

Remember that Tuesday in September across the globe, for the lessons we have all learned since that infamous day in New York City, Washington, DC and Shanksville, Pennsylvania.

For the children, teach them the truth…

Innovation: Truth in Data Provenance...

For years mathematicians and computer scientists have written about the trustworthiness of “Data Provenance”.

Relying on the integrity of data collection, transport and of course the source of data is a real science.  Our modern day zeros and ones span all aspects of our lives and Operational Risk Management (ORM) professionals have encountered the questions surrounding trust and the process of decision making long before the invention of computing machines.

At the root of decision making with integrity the source of data is questioned.  The reliability and history of previous data from the source.  As the data was transported from Point A to Point B was there any possibility that the data was altered, modified or corrupted.

Couriers and the use of a "Hawala" type system have been used by traders and terrorists for hundreds of years.

"Truth in Data Provenance" is the question mark that enables trust decisions.  This is why modern day cryptography is at the center of so many arguments and debates, when it comes to the topic of trusted information.  Yet hundreds of years ago, long before telecom and ICT was invented, the trustworthiness of data provenance was a vital factor.  The use of transposition ciphers were in use by the ancient Greeks.

So what?  In 2026 what does the truth in data provenance have to do with our business commerce, our transportation, our banking, even our abilities as governments to maintain our defense against attack?

The topic is vast and deep and worth exploration at the top level of human decision-making.  Yes, it is vital that our computing machines have high-assurance data integrity, in order for our global systems to operate day-to-day.

Yet what impact does trusted information have with humans in an environment of work and daily collaboration?  How does truth in data provenance, affect our decision making and the environments we work in?

In a report by LRN, the subject of trust in the work environment as a motivator has become more apparent:

Another fascinating result of the study had to do with two squishy-sounding characteristics of a company: character and trust. Companies deemed by employees to have both strong character and inspired trust performed almost four times better, using the metrics mentioned earlier, than those that had other positive cultural attributes, such as collaboration and celebrating others. (This applied to all three types of companies, though, naturally, culture and trust were much more prevalent in the self-governing ones) What’s more, “high trust” organizations were 11 times as likely to be called more innovative than their competitors. Trust, the How Report suggests, is more important than virtually any other characteristic.

How organizations address the trustworthiness of data provenance is still a new frontier in this day and age.  The use of new sensors, sophisticated analysis of "Big Data" by computer algorithms (AI) and the pace at which new data is generated by the "Internet of Things" (IOT) makes this a significant area of focus for our current executives and enlightened organizational leadership.

Why?

But what does that really mean? How does one measure the absence or presence of something as abstract as trust? The How survey defines it as “a catalyst that enhances performance, binds people together, and shapes the way people relate to each other.” High trust groups encourage risk-taking, which in turn is what is necessary for true innovation to occur. When innovation fails, it’s because companies don’t put enough faith in employees to let them take risks. The industries with the highest amount of trust were “computers/electronics,” followed by “software/Internet.” Coming in last? Government.

At the most fundamental level, the culture you are operating in has all to do with the trust that exists or is absent.

It has all to do with the trustworthiness of data provenance.  Leadership in any organization, must see the relevance between trust and innovation.  Between innovation and risk-taking. 

Your future and your culture depends on it...

Trust Decisions: Future Risk Architecture...

Leadership within the enterprise requires "Trust Decisions" that they can count on.  Operational Risk Officers have a fiduciary duty to provide top executives with the confidence that the data and information they provide is trusted.

So how do you assist any corporate leader, who has the responsibility and accountability to the Board of Directors to make informed and sound decisions?  The answer is, that it depends on how willing the CxO's in the enterprise are to engineer a "Trust Decision" model and framework for the business.

The truth is, most executive managers have their own way of doing this.  The process that the CEO makes decisions, is quite different from how the CFO makes decisions and the COO may have a documented and tested way to make their decisions.  The point is, that major "Trust Decisions" for the good and welfare of the enterprise are being made by people who are each doing it differently.  These human decision makers are relying on a number of ways to get to the final answer.  The decisions from leadership are not as trusted and reliable as they could be.

As an Operational Risk executive charged with making timely and correct decisions you have no choice but to have the tools and the trusted sources to enhance your situational awareness.  The safety and security of the facility, information or peoples lives are at stake.  That is why you test and continually improve the process so your analytics dashboard, intelligence feeds and data sensors are all operating with integrity and in real-time.

You are relying on information that changes by the nanosecond and a system designed to provide decision support.  Intelligence-led investigations or reacting to the latest incident requires systems designed and tested to support human "Trust Decisions."  Now back to the executive leadership and their process for decision-making.  What is it?  How does the CEO make the final decisions for the future wealth of the company and it's stakeholders?  Are they trustworthy?

Unless you have seen the "Trust Decision" process and trusted data framework engineered for your enterprise, then probably not.  Think about all of the leadership level projects and how they turned out.  How did executive leadership decide to buy that other company or merge with their favorite supplier?  What process did they use to ensure all of the due diligence data was correct?  Why are the sources of data trusted?

We have the opportunity to improve and to arrive at a point where we make "Trust Decisions" our priority and a prerequisite.  After all, our employees, customers, shareholders and even mankind deserve it.  The challenge begins.

Whenever you encounter your next major business decision with your CxO, ask them how they arrived at the decision.  Ask them to explain the process they used and the sources of trusted data they relied on.  Ask them why they think the architecture of the decision at hand, is the most sound and trusted decision that can be made with the time available.

You are now well on your way to better understanding the power and the future risk architecture of TrustDecisions.

Asymmetric Warfare: Board Room to Battlefield...

The planet Earth is experiencing a multitude of historical and 21st century "Asymmetric Wars" from the Board Rooms of the Global 500, Internet Cafes of Third World countries and the Miranshah.

Operational Risk Management (ORM) doctrine will continue to be a factor:

a·sym·met·ric

   [ey-suh-me-trik, as-uh-]  Show IPA

adjective

1.

not identical on both sides of a central line;

"Asymmetric warfare" can describe a conflict in which the resources of two belligerents differ in essence and in the struggle, interact and attempt to exploit each other's characteristic weaknesses. Such struggles often involve strategies and tactics of unconventional warfare, the "weaker" combatants attempting to use strategy to offset deficiencies in quantity or quality.^[1] Such strategies may not necessarily be militarized.^[2] This is in contrast to symmetric warfare, where two powers have similar military power and resources and rely on tactics that are similar overall, differing only in details and execution.

The Irish Republican Army (IRA) perfected the car bomb against the British.  Now "Improvised Explosive Devices" (IED) and suicide bombers continue to be the single greatest threat to U.S. troops in Afghanistan as we withdrew and in Iraq as we engage once again. The Middle East has been embroiled in conflicts with the modern use of "Social Media" and an asymmetric rebel element to initiate change in labor laws or to overthrow a nation states leadership.

A laymen may not understand the relevance of "Asymmetric Warfare" on the corporate battlefield. Some would describe the age old tactic of industrial espionage, competitive intelligence or even patent litigation as a method for a small unknown company to gain an advantage over a much larger and established institution. This is a strategy of Asymmetric Warfare, nothing new.

In any case, the perception is that the small and agile still have the means, tools and tactics to defeat the large and overbearing with the benefit of time, resources and the will of the people.

So what are some good examples of modern day asymmetric conflicts:

• Apple vs. Google
• NATO vs. Putin
• Sunni vs. Shiite
• BMW vs. Jaguar
• Earth vs. Anonymous
• Taliban vs. Afghans
• United States vs. Jones

Each of these represent a conflict between two able parties, regardless of the perception of who is the "David" and who is the "Goliath". So what can your organization or nations state do to prepare yourself for the inevitable risks that will be associated with doing business or operating your enterprise across countries and in hostile environments?

By providing your employees and stakeholders the best education, research, training and exercise programs; technology test and evaluation and capability improvement programs that your resources can offer.  Why?  In a few words, to make faster and more informed "Trust Decisions".

The desire to Deter, Detect, Defend and Document is prudent doctrine in Operational Risk Management (ORM). You may call these steps or tactics by other names in your particular process; such as Observe, Orient, Decide Act (OODA). What matters most is that the environment and landscape for the "Asymmetric Threats" and "Asymmetric Warfare" will continue to be challenging and dynamic.

BY ASSOCIATED PRESS June 16 2014

WASHINGTON — Judges around the country are grappling with the ripple effects of a 2-year-old Supreme Court ruling on GPS tracking, reaching conflicting conclusions on the case’s broader meaning and tackling unresolved questions that flare in a world where privacy and technology increasingly collide. 

The January 2012 opinion in United States v. Jones set constitutional boundaries for law enforcement’s use of GPS devices to track the whereabouts of criminal suspects. But the different legal rationales offered by the justices have left a muddled legal landscape for police and lower-court judges, who have struggled in the last two years with how and when to apply the decision — especially at a time when new technologies are developed at a faster rate than judicial opinions are issued. 

The result is that courts in different jurisdictions have reached different conclusions on similar issues, providing little uniformity for law enforcement and judges on core constitutional questions. Technological advancements are forcing the issue more and more, a development magnified by a heightened national debate over privacy versus surveillance and the disclosure of the National Security Agency’s bulk collection of Americans’ telephone records.

Continuous Continuity (C2): Organizational Survivability...

The modern enterprise that effectively manages the myriad of potential threats to its people, processes, systems and critical infrastructures stands to be better equipped for sustained continuity. A Business Crisis and Continuity Management (BCCM) program is a dynamic change management initiative that requires dedicated resources, funding and auditing. Corporate Directors must scrutinize organizational survivability on a global basis. 

Corporate Directors are ultimately responsible for Continuous Continuity (C2) of the Enterprise and Organizational Survivability is a Board Room issue. 

Since effective BCCM analysis is a 24/7 operation, it takes a combination of factors across the organization to provide what one might call C2, or "Continuous Continuity". A one-time threat or risk assessment or even an annual look at what has changed across the enterprise is opening the door for a Board of Directors worst nightmare. These nightmares are "Loss Events" that could have been prevented or mitigated all together.

According to the risk management best practices from sources such as the Turnbull Report1 and specifically Principle 13 of the Basel II Capital Accord, the Board of Directors and corporate management are responsible for the effectiveness of the Business Crisis and Continuity Management of an organization.

Certainly the largest organizations realize that the external threats are taking on new and different forms than the standard fire, flood, earthquake and twister scenarios. These historically large catastrophic external loss events have been insured against and the premiums are substantial. 

What it is less easy to analyze from a threat perspective are the constantly changing landscapes and continuity postures of the internal facets of the organization having to do with people, processes and systems. 

Corporate Boards of Director’s are now being consistently subjected to regulatory scrutiny across the globe to ensure the continuity and survivability of the enterprise. It is their duty and responsibility to their shareholders to make sure this occurs on a continuous basis.

The world can only hope that our Global 500 companies are well on their way to achieving C2 already...

USA 250: Trusted Decisions…

 Over the course of the past week navigating new neighborhoods in Virginia and old hiking trails near Great Falls on the Potomac River, the thoughts of 250 years as the United States of America (USA) was evident.

When you are watching the grand display of Fire Works on July 4th…what do you think about?

Our country remains increasingly resilient and our continuous mission remains so relevant.

We have supported the foundation of our “Founding Fathers” hopes and prayers for the past (250 x 365) 91,250 days.

Each day the sun rises across our 50 states of America, we know we have made the rest of the world curious about our history.

When you are old enough, you must read about our history.  You must have the true context of our days before the document was created and agreed upon.

The “Declaration Of Independence” has been studied for 250 years.  It remains our mission forever.

Watching the flowing water of the Potomac River in Great Falls, VA and thinking about all that has been created, discovered and protected as a result of one document, is simply faithful.

You and your life here, is all up to you.

The decisions you make everyday in the USA will provide you with all that you were destined to become here.

Looking back on your particular journey so far, have your life “Trusted Decisions”provided you with all that you have ever dreamed of…

Why?

On July 5th, as you enter your own particular place of Worship somewhere across your town in the United States of America, look up…

Godspeed!

Proactive: Acting in Participation...

How have you demonstrated your “Proactive” abilities this month?

Before you found your calling, were you spending wasted hours on social media or sitting places all alone.

After you became “Proactive,” the life changes were extraordinary and purposeful.

So what is the definition of PROACTIVE: “Acting in anticipation of future problems, needs, or changes.”

Whether you have joined other fellow colleagues with your Non-Profit (501c3) volunteer organization placing or picking-up hundreds of American Flags on the head stones of the “Fallen” after Memorial Day USA.

• Whether you have volunteered your days of time to help the Safety / Security presence at a Religious or Educational organization during an important service or meeting.
• Whether you engaged with others to attend a “Stop The Bleed” course to learn how to save other's lives.
• Whether you burned hours of your time for your Team on creating and planning an upcoming annual event for a thousand members.

How many Proactive hours of your time and expertise have you given free this month?

Being “Proactive” gives you the ability to learn new skills, meet new people and to provide valuable services to your community.

“People who tend to react to a problem only when it's gotten serious could be called reactive people. Until recently, reactive (in this sense) didn't really have an antonym. So proactive was coined to describe the kind of person who's always looking into the future in order to be prepared for anything.”

You see, this can provide you and your “Proactive Peers” with the heart felt satisfaction that you have a truly valuable purpose.

It provides you with the ability to engage with other like-minded individuals on the actions and the “Doing” that can truly make a difference in this world…

Godspeed!

OSINT: If Intelligence were a Baseball Game...

What is Open Source Intelligence (OSINT)? Why is it important to your security and safety? How can you really understand how it is the same or different than other types of intelligence? Let's use this clever baseball analogy:

If Intelligence were a baseball game....

IMINT takes a picture every day or so, trying to discern whose winning from sporadic snap-shots at different times of day, different angles of look.

SIGINT tries to bug the dug-out and discern how the game is going from comments by the players

HUMINT tries to recruit the batter, find out where he thinks he is going to hit the ball, and send a spy out to catch it if it ends up there.

MASINT tries to smell the player's armpits and the arc of the ball from leather secretly treated beforehand.

OSINT gives everyone in the audience a baseball glove, and counts the ball out if anyone in the stands catches the ball.

What's the point? OSINT is not a substitute for spies, satellites, or secrecy. It simply takes all the low-hanging fruit off the table so the secret sources and methods can focus. Put simply, OSINT changes the rules of the game--eliminates all the "home runs" by the enemy that need not occur if we harness the distributed intelligence of the audience--and allows the secret sources and methods to focus more carefully on what's left inside the playing field.

So what? Open source intelligence is available to everyone at the touch of a button, Google and others. Intelligent bots troll the net in search of its target. Looking for the answer to the algorithim created to answer the question posed by it's designer. When it finds what it is looking for it brings it home to the clandestine machine with Petabytes of RAID.

The people behind the question look for a pattern. The question or hypothesis is there to accomplish an important task. To find some relevance in a vast sea of “Zeros and Ones” beyond the human brains capability to grasp. No one person owns it and has the ability to keep it secret, forever. Somehow, someone will put this information into the open. Then it becomes OSINT.

The race isn't about keeping information safe from being stolen or revealed to others. It's about something else:

Jeff Jonas, the one time chief scientist and distinguished engineer at IBM’s entity analytic solutions group, had developed a means of sharing corporate data without revealing what that data contains.

This technology, called anonymization, effectively "shreds" information, making it possible for companies to share information about their customers with governments or other companies without giving away any personal data.

Over time, Jonas believed companies will increasingly use anonymization to defend their data, and corporate well-being, from competitors and identity thieves.

This story to be continued…

Memorial Day 2026: The Risk of Service is Understood...

 It is Memorial Day weekend in the U.S. and on this final Monday of May 2026, we shall reflect on years past.

In order to put it all in context, we looked back to our 2013 memories.  It was only a few weeks since a fellow colleague from Team Rubicon had ended his battle at home, after several tours of duty with AFSOC.  Neil had joined the ranks of those fallen heroes who survive deployment tagging and tracking the enemy in the Hindu Kush.  He was just one that day in early May that could not defeat the legacy of demons, that he fought each night as he fell deep asleep.

On Memorial Day 2026, we honor Neil again in Section 60 at Arlington Memorial Cemetery and all those other military members who have defended our freedoms for 250 years.

Simultaneously, we do the same for the "Stars" on the wall at Langley, VA for the officers who have done the same.

Whether you are on the front lines or inside the wire at the FOB.  Whether you are in Tampa, FL, Stuttgart, Germany or Arlington, VA.

Whether you are on your beat cruising the streets of a major metro USA city.  Whether you are watching a monitor at IAD, DEN or ORD.

Whether you are deep in AI analysis of Internet malware metadata or reviewing the latest GEOINT from an UAS.  We are all the same, in that the mission that gets each one of us out of bed each day.  Our countries "Operational Risk Management (ORM)."

The Operational Risk Management mission of the U.S. Homeland is vast and encompasses a spectrum of activity, both passive and kinetic.  Digital and physical.

It requires manpower and resources far beyond the capital that many developed countries of the world could to this day comprehend.  There are only a few places across the globe, where a normal citizen would say that the mission and the capital expenditures are worth every dollar and every drop of blood.

Memorial Day in the United States is exactly this:

Memorial Day is a United States federal holiday which occurs every year on the final Monday of May.^[1] Memorial Day is a day of remembering the men and women who died while serving in the United States Armed Forces.^[2] Formerly known as Decoration Day, it originated after the American Civil War to commemorate the Union and Confederate soldiers who died in the Civil War. By the 20th century, Memorial Day had been extended to honor all Americans who have died while in the military service^[3].

So this weekend as you walk among the headstones, reflect on our colleagues who gave their service and their own lives, we will stand proud.

We understand the risks.  We know why we serve.  In the spotlight or in the shadows.  The tradition and the mission continues...