Remembering 9/11: 2026-Teaching the Children...

Where were you on the morning of September 11th, 2001? Everyone seems to remember...

On a cool sky blue morning, 25 years ago in Northern Virginia, we are sitting in a Reston Town Center Hyatt hotel restaurant having breakfast around 8:00AM with a business colleague. A little over 40 minutes into our discussion, we heard some people talking quite loud in the bar next to us as they were then watching CNN to see the World Trade Center Twin Towers attack. As cell phones rang around us, they were all loved ones checking in and urging us to hurry home.

Walking to the parking lot, the proximity of our kids elementary school and middle school to the CIA campus created a feeling of great internal anxiety and it soon turned to fear.

Unknown to us at that moment, five terrorists were also onboard American Airlines Flight 77 that had already departed from Dulles (IAD) at 8:20AM headed to Los Angeles (LAX).

Little did we know that the AAL77 hijackers onboard that Boeing 757 flight had slept the night before a half mile from us in a Herndon, VA motel.  30 or so minutes into the flight over Ohio, with the terrorists now in control and the aircraft transponder off, it would make its turn back to Washington, DC to attack the West side of the Pentagon at 9:37AM.

We could now see the smoke rising in the distance on the Eastern horizon.

What this September 11th day is about every year beyond these memories, is the renewed vow of vigilance. A time to revisit all the reasons why you have made the decisions you have since that Tuesday morning twenty-five years ago. Never Forget that day. Never Forget why you wake each morning.

9/11 vigilance is about being adaptive. It is about resilience.

For those of us who have never paid the same price as those who have served, supported and are the mothers, fathers, brothers, sisters or relatives of those who have, we can never know or really feel what they have. We can only pledge our vigilance in continuing our respective missions.

Most of all. The mission is not America's alone and the entire planet understands this. As they teach the history of 9/11 in the schools of New York City, Haiti, Chile, Pakistan, India and even Saudi Arabia, what do you think the lesson is about?

If it is not about vigilance and resilience, then we are doing our children a disservice. We must be preparing them for the future threats that this globe will be facing in the years and decades before us.

Whether it is the wrath of "Mother Nature" or the evil planning of AI or ordinary people does not matter. We can never predict exactly the day the hour or when and where the next attack will occur. Whether it will impact our buildings, bridges, rivers, schools or the Internet is unknown.

If all of us on this 3rd rock from the sun, have done our job teaching our kids about “Vigilance and “Resilience”, then we should all be able to have a peaceful nights sleep. Devoid of nightmares.

Remember that Tuesday in September across the globe, for the lessons we have all learned since that infamous day in New York City, Washington, DC and Shanksville, Pennsylvania.

For the children, teach them the truth…

9/11 Revisited: The Homeland Security Practitioner...

We are approaching the 9/11 anniversary and the images and memories will be revisited.

Many of us will shed a tear and millions will recall where they were and what they were doing, on that unforgettable Tuesday morning in September, 2001. 

The education of "Homeland Security" is taking place on a daily basis in the popular press and on the new social media platforms that have risen and now dominate the digital content since 9/11.

The academic and government institutions have strived for improving the standards, processes, rule sets and protocols for anti-terrorism policy. By education, we also need to explore what we are doing to collaborate at the academic institution level on a global basis, not just on a government basis. 

The "Homeland Security" curriculum at universities in the EU and the United States will soon be converging on several fronts and for good reason. The generation that will be starting their 1st year (freshmen) in college were not even born yet in 2001.

Their perception of what Homeland Security is today and the future for a life long career must be designed on a global basis, because this remains a global issue. 

The students who pursue an education in languages, political science, international affairs, history and science have just as much a stake in the future of Homeland Security as others. Those who are now getting a degree in emergency management, criminal justice or risk management, or information security are well on their way, yet still may lack the knowledge and tools their liberal arts colleagues have learned to be better analysts, intel targeters or linguists. 

A flash back to this article on "Homeland Security Intelligence" (HSI) , reminds us that regardless of the university education one receives, the future of effective strategies across the world will stem from intelligence: 

(27 February 2011 HSI: Homeland Security Intelligence…)

“What is the modern definition of U.S. Homeland Security Intelligence (HSI)? Many would differ on the jurisdiction, sources and nexus with specific intelligence that falls outside U.S. borders. The future of sharing relevant pieces of the vast mosaic of information may well lie with the definition and the interpretation of Homeland Security Intelligence.

One thing is certain about this topic of debate. If the information is being utilized to determine the nature of a threat within the confines of the U.S. Homeland, then that information will be treated according to the laws of the United States. This brings us to the next question. Are the current laws an impediment to more effective Homeland Security Intelligence (HSI) processes, methods and outcomes? The following areas must be addressed in order to get closer to the truth. 

• Governance
• Policies
• Regulatory and Statutory Concerns
• Civil rights and Liberties

Yet the question begs the discussion on the structure and the purpose of the Intelligence Community (IC) itself.”

Whether the homeland security incident is a natural catastrophe or a man-made threat, there are several components that all people pursuing a profession in the discipline should be developing with increased competency, including risk mitigation, legal framework, ethics, communication/collaboration, alternative analysis, supply chain, critical infrastructure, emergency/crisis management and terrorism. 

Those kids who were not even born yet on 9/11, may have a different perspective on what might be important these days in order to detect another attack of the same magnitude during these times of heightened digital and mobile awareness.

They grew up with the Internet and they don't need a class in Social Media 101 or how to use TikTok. They might however, also need some training in AI or the Deep Web, if they want to support the HSI infrastructure, or understand the adversaries modus operandi. 

The definitions of Homeland Security Intelligence (HSI) and what comprises the spectrum of relevant and legally obtained information may differ from country-to-country and state-to-state.

Is it legal to perform digital triage on an iPhone that has been part of a lawful search and seizure in the State of Ohio, USA? 

The education for Homeland Security professionals beginning with the university must take into consideration the requirements that exist for collecting, analyzing and sharing relevant and legally obtained information. The next step is to determine the correct skills that must be developed, before the newly minted student is filling out their first job applications or interviewing for their first internship. 

As we reflect on the 9/11 25 year milestone, we can all admit the journey has not been easy. It is still far from over.

Let the next decade produce our next generation of Homeland Security professionals who may decide that Social Media and Internet AI expertise is just as vital to the curriculum as Privacy and Civil Liberties.

Watch this area to converge dramatically over the course of the next few years and for the Supreme Court in the United States to make some landmark decisions…

Asymmetric Warfare: Board Room to Battlefield...

The planet Earth is experiencing a multitude of historical and 21st century "Asymmetric Wars" from the Board Rooms of the Global 500, Internet Cafes of Third World countries and the Miranshah.

Operational Risk Management (ORM) doctrine will continue to be a factor:

a·sym·met·ric

   [ey-suh-me-trik, as-uh-]  Show IPA

adjective

1.

not identical on both sides of a central line;

"Asymmetric warfare" can describe a conflict in which the resources of two belligerents differ in essence and in the struggle, interact and attempt to exploit each other's characteristic weaknesses. Such struggles often involve strategies and tactics of unconventional warfare, the "weaker" combatants attempting to use strategy to offset deficiencies in quantity or quality.^[1] Such strategies may not necessarily be militarized.^[2] This is in contrast to symmetric warfare, where two powers have similar military power and resources and rely on tactics that are similar overall, differing only in details and execution.

The Irish Republican Army (IRA) perfected the car bomb against the British.  Now "Improvised Explosive Devices" (IED) and suicide bombers continue to be the single greatest threat to U.S. troops in Afghanistan as we withdrew and in Iraq as we engage once again. The Middle East has been embroiled in conflicts with the modern use of "Social Media" and an asymmetric rebel element to initiate change in labor laws or to overthrow a nation states leadership.

A laymen may not understand the relevance of "Asymmetric Warfare" on the corporate battlefield. Some would describe the age old tactic of industrial espionage, competitive intelligence or even patent litigation as a method for a small unknown company to gain an advantage over a much larger and established institution. This is a strategy of Asymmetric Warfare, nothing new.

In any case, the perception is that the small and agile still have the means, tools and tactics to defeat the large and overbearing with the benefit of time, resources and the will of the people.

So what are some good examples of modern day asymmetric conflicts:

• Apple vs. Google
• NATO vs. Putin
• Sunni vs. Shiite
• BMW vs. Jaguar
• Earth vs. Anonymous
• Taliban vs. Afghans
• United States vs. Jones

Each of these represent a conflict between two able parties, regardless of the perception of who is the "David" and who is the "Goliath". So what can your organization or nations state do to prepare yourself for the inevitable risks that will be associated with doing business or operating your enterprise across countries and in hostile environments?

By providing your employees and stakeholders the best education, research, training and exercise programs; technology test and evaluation and capability improvement programs that your resources can offer.  Why?  In a few words, to make faster and more informed "Trust Decisions".

The desire to Deter, Detect, Defend and Document is prudent doctrine in Operational Risk Management (ORM). You may call these steps or tactics by other names in your particular process; such as Observe, Orient, Decide Act (OODA). What matters most is that the environment and landscape for the "Asymmetric Threats" and "Asymmetric Warfare" will continue to be challenging and dynamic.

BY ASSOCIATED PRESS June 16 2014

WASHINGTON — Judges around the country are grappling with the ripple effects of a 2-year-old Supreme Court ruling on GPS tracking, reaching conflicting conclusions on the case’s broader meaning and tackling unresolved questions that flare in a world where privacy and technology increasingly collide. 

The January 2012 opinion in United States v. Jones set constitutional boundaries for law enforcement’s use of GPS devices to track the whereabouts of criminal suspects. But the different legal rationales offered by the justices have left a muddled legal landscape for police and lower-court judges, who have struggled in the last two years with how and when to apply the decision — especially at a time when new technologies are developed at a faster rate than judicial opinions are issued. 

The result is that courts in different jurisdictions have reached different conclusions on similar issues, providing little uniformity for law enforcement and judges on core constitutional questions. Technological advancements are forcing the issue more and more, a development magnified by a heightened national debate over privacy versus surveillance and the disclosure of the National Security Agency’s bulk collection of Americans’ telephone records.

LADDER: Protective Security Specialists…

How long does it take for a lethal attack to occur against an At-Risk person?

Just 2 Seconds is the best selling book by Gavin De Becker. Along with his long time colleagues Tom Taylor and Jeff Marquart, they document how to use time and space to defeat adversaries.

There are some compelling insights gained from their research:

• In the US, attacks are most likely to be undertaken by lone assailants 87% vs. outside the US where attacks are typically the work of multiple assailants 71%.
• Attacks in the US are about as likely indoors (53%) vs. outdoors (47%).
• However, 64% of attacks happen when the protected person is outside in or around the car and 77% of these attacks are successful.

Most of these happen within a distance of 25 feet or less using a handgun. Corporate executives and their Protective Security Detail (PSD) already know these statistics and have trained together for these increasing risks.

Many have adopted the LADDER model from “Gavin de Becker & Associates” training academy:

> L ogistics

> A dvance

> D istance

> D eterrence

> E vacuation

> R esponse

The study of the motives and the psychology of why these actors pick their targets and choose the time and place has become a science. The methods and tools to assist corporate security in predictive analytics requires a substantial baseline of historical data and real-world experience.

Over 30 years ago Gavin and his team developed the MOSAIC Threat Assessment system. It is now in use with dozens of police and government agencies to help authorities and “Protective Security Details” to be more proactive and preemptive.

Protective Security Specialist’s (PSS) today are certified professionals utilizing intelligence in combination with the attributes of Time, Mind and Space to provide safe and secure travel for their clients.

The Science and the Art have converged to provide a fusion of data, strategy and ad hoc tactics to ensure the mission is completed without incident.

The profession doesn't stop there. Some Operational Risk Management firms who have these certified individuals on staff, go much further in their training and their vetting of employees.

We agree and recommend that you add these questions to your due diligence when obtaining Request for Proposals (RFPs) from these firms:

• Review all policy documents the firm has their personnel sign to become a PSS on staff.
• Review the firms hiring process and the prerequisites to join the firm.
• Review the operational standards and operating procedures to ensure 24 x 7 x 365 capabilities.
• Review the 3rd party agreements that encompass any transportation and private aviation suppliers.
• Review the firms technology and communications infrastructure including Internet, radios, information systems security controls and privacy countermeasures.

The profession has come a long way and people like Gavin de Becker & Associates have for decades established the baseline for others to compete. High net worth individuals, movie stars, public officials and corporate executives have much at stake and require comprehensive strategy execution.

Think of every assassination like attack you've ever heard about. For most people, a few of these major ones come to mind: Caesar, Abraham Lincoln, John Kennedy, Martin Luther King, Mahatma Gandhi, Indira Gandhi, Anwar Sadat, John Lennon, Israel’s Prime Minister Rabin, Pakistan’s Benazir Bhutto.

From start to finish, all of these attacks — combined — took place in less than one minute. And the hundreds of attacks studied for the book, all of them combined, took place in less than a half-hour.

Those thirty minutes, surely the most influential in world history, offer important insights that can help today’s protectors defeat tomorrow’s attackers...

Memorial Day 2025: Remember Them...

On Memorial Day 2025 what do you think about and remember in memory of our fallen.

Those brave men and women in the USA who have defended our Flag and our Freedom for almost 250 years.

Walking through Arlington Cemetery anytime, or to a Funeral in Section 60 there, provides context on how much we value our country, our way of life and the people who call themselves true “Americans’.

“As we seek to shrink what remains of the Gap over the next several decades, we will rarely find societies adequately prepared—either intellectually or emotionally—for the travails that lie ahead. Instead, the elements most prepared will be the most willing to wage bloody resistance against this process: educated, worldly young men who are familiar with the future we offer and have already decided that it is corrupting beyond all reason. These revolutionaries and terrorists will wage wars of extreme perversity against both us and their own peoples, convinced as they are of their moral superiority in rooting out hypocrisy and heresy.”

The Pentagon’s New Map - BLUEPRINT For ACTION - A Future Worth Creating - Page 281- Thomas P.M. Barnett 2005

Over twenty years after reading this book, we are still at war. Memorial Day each year and many years ahead of us will be about our American citizens, who have served in our U.S. Military and lost their lives.

This Memorial Day weekend as you see the military ceremonies, or hear the fighter jets flying in formation over your city...now think about all those who have served behind the front lines, Visible and Invisible.

The “Quiet Professionals” in the United States who provide a spectrum of services, supplies and continuous information in support of securing our valuable freedom.

As you reread chapters of "BLUEPRINT FOR ACTION" while you watch our Flag waving in the wind, Remember Them…Never Forget, Always Be Ready!

Security Governance: Corporate Emergency Response Team (CERT)...

You can be a proud CxO if you can confidently say that in the event of a "Crisis" your employees are trained and ready to handle it.

You can never predict human behavior in the face of a sudden and shocking incident.

If your company doesn't have "Corporate Emergency Response Teams" (CERT) exercising test scenarios monthly or quarterly, you face the consequences of poor Operational Risk Management (ORM); losses that could have been prevented.

We are still amazed at how many “Executive Rows” we visit that still doesn’t have an AED within arms reach in the event of a heart attack.

Protecting corporate assets first begins with common sense and then expands exponentially from there.

How will you and your CxO’s provide your employees with the privacy as a U.S. citizen and remain vigilant with all potential insider threats?

Programatic Data Privacy and Integrity is the real issue at stake here.

“Enterprise Security Governance will provide the mechanisms and controls necessary for the Patriot Act to operate with the highest degree of assurance.”

Our civil liberties are still in force and will be there to protect everyone who is an American.

What we must not waiver on is the need to modernize, to re-equip and to create more robust "Correlation Centers”. Perhaps with AI and always with trained Intel Analysts.

The fact is, our intelligence analysts in enforcement are under attack every day by more savvy and increasingly powerful adversaries.

The establishment of a more robust, pervasive and technologically superior force to defend our Homeland today is still in the maturation stages.

What is paramount now at this stage of growth, is the framework for your own organizations “Security Governance” to be injected into each stakeholder.

The policies, ethics and controls must be there to guide those who are protecting our privacy while simultaneously allowing us to accelerate our countermeasures to Deter, Detect and Defend against those who will continue to attack us.

The Patriot Act will remain a powerful asset to those who wake every morning to ensure the Confidentiality, Integrity and Availability of information in our country and to protect the American people…

Private Sector: Proactive Continuity & Protection of Critical Infrastructure…

Before 9/11 who at your organization was responsible for the continuous “Continuity of Operations“ for the business?

Last time your Board of Directors had their quarterly or annual meeting, was your compliance with the U.S. CII Act of 2002 on the agenda?

You know, the Critical Infrastructure Act of 2002 (CII Act):

“Under provisions of the Critical Infrastructure Information Act of 2002 (CII Act), information that is voluntarily submitted per those provisions will be protected from public disclosure until and unless a determination is made by the PCII Program Office that the information does not meet the requirements for PCII. If validated as PCII, the information will remain exempt from public disclosure.”

Critical Infrastructure Information (CII) is information not in the public domain and related to the security of CI or protected systems by either physical or computer based attack that harms commerce in the United States or threatens public health or safety.

Today, who in your particular organization is responsible for the PCII Program and are the entities that submit information:

• Private Sector companies
• State, local, and territorial government entities
• Working groups comprised of government and private sector representatives

"It is well known that over 85% of Critical Infrastructure is owned and operated by these organizations in the United States."

Consider this thought.

AI is increasingly being powered now by the Private Sector. Crypto mining is powered by the Private Sector. There are 16 more key CI Sectors.

The companies that are in your city, county or state that are directly tied to your Critical Infrastructure to provide Water, Electricity and Natural Gas, Emergency Services, Healthcare, Information Technology and Transportation are all components of the on-going safety and security of your community.

Who in your organization is responsible for the key relationships of all of the CI entities that you rely on to operate and serve your community each day?

Is it your CISO? Is it your CSO? Is it your CFO? Is it your CIO? Is it your COO?

If you don’t know that answer in your Board of Directors Meeting then add this to your To-Do list with your CEO.

Here are four key areas of focused leadership in your role to build resilience of Critical Infrastructure Protection in your organization:

> R_ecruiting

> E_ducation

> N_etworking

> S_haring Information

After you and your RENS team have prioritized "Critical Infrastructure Protection" and the safety of the American people at your organization, how will your own leadership be visible and proactive?

Never forget!

Future Risk: What is True...

On the dawn before the next large public gathering across the world, Operational Risk Management (ORM) professionals are on edge.  Readiness and contingencies are at their highest level in anticipation of any globally televised event.

The same crisis management environment exists four or more times a year within the confines of the Board Room and Executive suite.

Operating at the "Speed of Business" and effectively managing daily, weekly, and quarterly risk management tasks requires an adaptive and resilient culture.  A culture that has been born and evolved from its Genesis to a daily run rate based upon two main components.

• Trust is the first one and to many a given in any high performing environment.  To be able to trust the person to your left and to your right requires many tests.  It builds over time yet it must start with the right elements and be nurtured for it to flourish.

• The second component is far more complex.  It requires you to embark on a continuous discipline with yourself and the people to your left and right, to know "What is True."

"What is True" means one set of reality for you and perhaps something different for those around you.  Your mission is to get to a single version and reality of what is true faster than your competition, your adversary or your partner.  Survival will be a factor of your speed to understanding as a team, "What is True" and then your adaptive nature to the consequences of your actions.

Are you accountable for your outcomes?  Have you accepted the consequences of your behavior?  So what does all of this have to do with Operational Risk Management?  It has everything to do with it. The most high consequence event to any risk matrix, is the fact that people do not see themselves or others in a "True" perspective.  They are not operating in reality.

What is your willingness to bring current problems to everyone to dissect, understand and solve?  Those who continue to operate without a proactive problem-solving environment are headed towards disaster.  Surprises.  Being blind-sided.  Never saw it coming.

When you hear people saying these things.  You have someone who has not been proactive in the continuous identification of problems and communicating those problems to the team to be solved.

You see, leadership is about continuously testing, designing and improving the process or the product.  The thinkers and the doers, the blueprint and the construction, the designers and the operators must be in a synchronous harmony together.

Ask yourself; how is this movie unfolding compared to the script that was written?  How has the change and the rate of change had consequences?  What have I and my team done to adapt, by changing the design or the people to achieve the mission? 

The "Speed of Business" is the environment and the successful outcome we all seek and is captured in three words.  "What is True."