|
When you hear the term counter-terrorism, it brings to mind images of law enforcement, military and the CIA.Today many western
countries have special units, designated to handle terrorist threats.Local police departments, firefighters, emergency medical
personnel (often called "first responders") as well as local governments have plans for dealing with terrorist attacks.
But few people would put corporations on that list of organizations counter-terrorism brings to mind.It is hard to believe
that behind red mahogany desks, professionals are now deeply involved in security measures to protect their organization,
employees and customers against terrorist attacks.This article will examine how corporations are involved in the fight against
terrorism.
What is counter-terrorism? It is defined as the practices, tactics and strategies that governments, militaries and other
groups adopt to fight terrorism.Counter-terrorism is not specific to any one field or organization; rather, it involves entities
from all levels of society.
There are a number of aspects to corporate counter-terrorism.This multi-part series will examine each of those aspects.(Other
subjects addressed in the series will include compliance, sharing information in the private sector and government, and testing
crisis management plans.) Two ways corporations are involved in counter-terrorism is in their development of security plans
and engineering and retrofitting facility designs so that security is built in rather than bolted on.Let's take a closer look
at physical security and business continuity planning in more detail.
Physical Security
Scanning briefcases, handbags, backpacks, boxes and packages that are hand carried in and out of a corporate environment
has become one component of physical security measures now in place at corporations around the world.By scanning individuals
with walk-through body scanners and handheld metal detectors, a corporation can significantly reduce the risk of a terrorist
attack.Some have even installed bomb detection equipment.But now engineering firms have joined the fight to protect the organizations
premises against terrorist attacks.These engineered means of protection include offsetting drive ways from direct alignment
with entrances.This is coupled with the use of crash barriers.
The picture below shows the entrance to a popular shopping mall.As you can see there are no barriers in front of the aluminum
and glass entrance doors which are all that stands in the way of a vehicle crashing through the perimeter and entering into
the main level of the shopping mall.This specific mall was named as a possible terrorist target about 18 months ago.The plot
was foiled by the FBI, and several individuals were arrested.But it leads to the questions as to why no protective measures
have been taken to prevent such an attack. Repainting parking lots and adding decorative planters that serve as crash barriers
are two economic measure that serve to protect the physical security of the facility.
The picture shows the entrance to a popular shopping mall.Photograph by author.
After the anthrax attacks on corporate and governmental facilities a few years ago, multiple organizations have examined
protective measures to guard against anthrax and other biological attacks.One such measure was the isolation of the HVAC (heating,
ventilation and air conditioning) systems in the mail room from all other areas of the building.This isolation serves to limit
the spread of any biological agents into other areas of the facility.
Another method of terrorism focuses on the corporation's customer. Customer intimidation is a popular form of terrorism
with eco-terrorists and other special interest groups.It is designed to deter customers from supporting a specific product
or corporation.Past acts of terrorists include poisoning food, and tampering with drugs and other products in an attempt to
spoil a company's reputation.Another terrorist tactic is arson.Setting fire to corporate facilities and disrupting the normal
flow of business hits them in the wallet. Sabotage is yet another tactic employed by terrorists.Terrorists have shut down
oil drilling platforms and have attacked factories. Occasionally, terrorists attack the customer directly in order to scare
them away.
The federal government is heavily involved in research and development of engineering techniques needed to safeguard facilities
against terrorist attacks.The government's efforts are centered at the U.S. Army Corps of Engineers, Omaha District.The district's
Protective Design Center (PDC) is the Center of Expertise for anti-terrorism and protection engineering support.
The PDC works in two mission areas - security engineering and hardened structures.The first deals with criminal and terrorist
threats, the second with military weapons.The district's sister office in Huntsville, Alabama, handles electronic security
systems.These efforts, plus advances in hybrid nano-materials, are producing innovative techniques and materials to make facilities
more resilient to terrorist attacks.
Results of a recent survey conducted by the author.(Click for larger image)
So what are the hot areas in the race to build in security and resistibility to terror attacks? That question is difficult
to answer due to the pace of change and advancements that are taking place in this area of engineering.We conducted a one-on-one
telephone survey of companies $1 billion and above.The chart below is taken from those results. Currently the list below
identifies the top five areas of applied research.
1. Blast mitigation
2. Immune building systems (Chem/bio agent containment)
3. Building intelligence
4. Invisible security and monitoring
5. Self-sustaining facility infrastructure
With each passing day, new techniques and ideas emerge that advance this field of practice.With each advance our facilities
are adapting to the threats of terrorism.But the work is not limited to the physical structure.Counter-terrorism design and
emergency response features are incorporated into site plans as well.As our survey suggests, these changes are not just for
new construction.Building retrofit projects are continuously kicked-off.
These features do not come without significant expense.Therefore a risk based approach is used to determine what counter-terrorism
functions and features will be incorporated in the design.The approach first assesses how likely a target the facility represents
as well as facilities location in the close vicinity to the site.After the risk factor is calculated, an attack scenario vulnerability
analysis is conducted.This analysis examines multiple types of attacks and evaluates the degree of impact each attack would
have based on multiple design parameters.
Once the building is designed and erected, the counter-terrorism efforts are not over.Now an organization must determine
how it will operate if an attack does occur.Now we will turn our attention to resuming operations after an incident.
Business Continuity Planning
Most executive believe it is not a question of "if"¯ but "when"¯ another terrorist attack will occur.In
light of this heightened state of threat awareness, decision-makers are faced with a new reality: proactive counter-terrorism
planning.Business continuity planning is now an essential part of enterprise risk management.These plans may determine operational
continuity and corporate survival following a terrorist attack.In the recent past, continuity planning was typically limited
to the IT department.Today, corporations have significantly expanded continuity planning in areas of facilities, staff, production
capabilities and other resources.In January of 2006, one of the Fortune 250 is conducting an executive training program on
counter-terrorism for the corporation.This training will examine cyber-terrorism and bio-terrorism, and will include a table-top
exercise based on the bird flu pandemic.This is one of, if not the first, corporate program of its kind.Assessing and the
devising a business continuity plan that will lessen the impact of a terrorist attack requires scenario planning.
Scenario planning is a critical technique for intelligence analysis and continuity planning.Most business continuity planners
deal with traditional threats.Threats like power or computer outages, natural disasters, labor unrest and network failures
were all common scenarios. But today, with the threat of biological attacks, weapons of mass destruction, car bombs, suicide
bombers and other terrorist acts, corporate planners are finding themselves in unfamiliar territory.The complexity of these
new events, challenge even the most senior planners.
As you can see by the cover of the International Association of Counter-terrorism Professionals (IACSP) below, scenario-based
intelligence analysis is critical for counter-terrorism planning.Scenario planning involves identifying trends and characteristics,
and exploring the implications of a given event.The logical scenario planning process described below is designed to stimulate
creative thought, collect and analyze information and generate a series of scenarios.Scenario planning is not about predicting
the future.It is about exploring the future.If you are aware of what could happen, you are more likely to be able to deal
with it.As different trends are chosen and different combinations of forecast levels are combined, a whole new spectrum of
possibilities can be identified.
The author's cover story in a recent journal of International Association of Counter-terrorism Professionals.
Organizations are developing scenarios related to terrorist attacks and, as mentioned above, even a bird flu pandemic.They
use transdisciplinary intelligence engineering (TIE) techniques.TIE was pioneered by a company named Intelomics. So why are
businesses so concerned about the bird flu pandemic? While the bird flu is not a terrorist attack, it constitutes a significant
threat to the security and well-being of the country.In addition, the bird flu could be considered a dress rehearsal to a
bioterrorism attack.The financial implications of business disruption associated with a flu pandemic are extremely high.Recently
released figures from a government study (the GAO's study on the economic impact of the bird flu) show the impact a pandemic
could have.
If a pandemic were to occur in the U.S., the following could result.
* Up to 40% of the workforce could become ill.
* An estimated 92 million people will become ill.
* An estimated 2% of the workforce could die.
* Isolation could span weeks into months not days.
* Total economic impact could exceed $600 billion.
It is estimated that only about 17% of U.S.businesses have contingency plans for a bird flu pandemic.Most organizations
believe they can operate with about 12% of the workforce being out at any one time.The question is how can they operate with
up to 30% of the workforce being absent? U.S.officials are urging business leaders to create contingency plans to minimize
the financial impact and disruption to basic services and infrastructure.Many people recognizes it is just a matter of time
before the bird flu impacts the global economy.
Conclusion
While governments around the world have expended significant effort to guard against terrorist attacks, corporations,
indeed the whole private sector, faces significant challenges.It is no longer just about guns, guards and gates.Information,
intelligence and integration are equally as important.In the U.S., over 80% of our infrastructure is owned by corporations.These
corporations must take significant measures to protect the building, systems and resources and shoulder the financial burden.
Corporations in general are also under threat of attack by terrorist organizations.Many corporations have become the bane
of many terrorist organizations and are key terrorist targets.High ranking corporate officials are often assassinated, corporate
offices are blown up and company assets sabotaged.
Security is extremely costly when you bolt it on.Estimates of the cost to protect the private infrastructure approach
$200 billion annually. When security is engineered and designed in, it becomes much more affordable with a significant degree
of increased protection.So the question remaining is - do you have the time to make these changes before you experience an
incident?
|
