Security Gone Soft

               What do you think of when you hear the phrase “gone soft?”  You probably picture something along the lines of a former body builder who has stopped working out and is starting to get flabby.  Or at least something along those lines.

               In the post, Security Gone Wild, I listed some of the problems when security goes over the top and is too excessive.  But another problem is just the opposite – when security is too soft.  Just like the former body builder, when security goes soft, it is no longer able to do the heavy lifting it once did.  It becomes ineffective and is as much of a danger as security gone wild.

               Those who know me or read my posts know that when I refer to security, I am looking at how security (or the lack of) affects organizations or personal security / self-defense issues.  Today, I am referring to a broader definition of security – macro-security, if you will.  Simply, that is the impact of security on society as a whole, such as public safety or law enforcement.

               There are two main ways that security goes soft.  The first way is to be symbolic only.  The second is lack of enforcement.  Two recent news stories highlight each of these problems.

               The United States imposed sanctions against Venezuela’s state-run oil company, PDVSA.  This was a political move to protest Venezuela’s ongoing trade with Iran, despite sanctions against Iran for its continuing efforts to build a nuclear program.  On the surface, this sounds like a reasonable and appropriate step.  However, the sanctions are almost entirely symbolic and do not actually restrict or stop oil shipments from Venezuela to the U.S.  There are some limits on financing and government contracts, but that is all.  In fact, Hugo Chavez’s response has been to insult and threaten the U.S., building up his own popularity with Venezuelans.  He has threatened to stop oil shipments to the U.S. despite the fact that 45% of his country’s oil exports are to the U.S., which would be economic suicide. 

               This is not only ineffective, but it could become a more dangerous position.  The largely phony sanctions give Hugo Chavez an enemy to rally his people behind and at the same time make the U.S. look weak and unproductive.

               So the risk of the political posturing could actually fail to accomplish what was hoped for and even backfire.

               The second sign of soft security is lack of enforcement.  This is a little different from a symbolic measure that is meant to sound tough, but purposely designed without a penalty.  Lack of enforcement comes when a law is ignored or not enforced for one reason or another. 

               A recent example of this happened in Colorado.  A driver passed a state trooper on a traffic stop and flipped off the trooper as he passed.  The trooper noted the license plate and the driver was later issued a summons for harassment.  Under Colorado law, harassment is a defined as a public display designed to harass, annoy or alarm the person targeted.  Certainly, flipping off anyone is going to be annoying at best, possibly alarming and definitely bothersome.  The ACLU became involved and the State Patrol dropped the charges.  In a way, that was perhaps a safe move to avoid a legal defeat in court, setting a new precedence.  On the other hand, I find the whole idea completely offensive that someone can drive around and flip off anyone, much less law enforcement, and it can be defined as a form of freedom of speech.  Our Founding Fathers must be turning over in their graves.  I’m sure that they did not put their lives, their homes, and everything they had on the line for some future jackass to claim that he had the right to insult others with impunity. 

               Freedom of speech was built on the concept of peaceful assembly and public discussion, not to protect insulting gestures that are certainly not peaceful.

               The risk with this decision not to enforce legitimate laws is the undermining of our public safety and law enforcement.  What are law enforcement personnel to do now?  They are already putting their lives on the line and now have to stand by while being abused without any recourse.  On a side note, next time you happen to be in court for a traffic ticket or even jury duty, exercise your freedom of speech and flip off the judge.  I’ll be curious to hear about the results as I imagine what is good for the goose is not good for the gander.

               So what are the lessons learned from these examples?  Both are out of our control, but do offer some valuable ideas.  One lesson is to understand the risk of security gone soft.  It undermines your overall security program and causes a loss of respect and support for security initiatives.  It is an ineffective use of resources. 

               These mistakes can occur at the organizational level.  Think of a policy in your workplace that is symbolic only and does not actually accomplish anything.  Even easier, think of a policy that is not enforced and is therefore routinely ignored.  Examples could be as simple as propping open a door during a smoke break despite signs warning of the risk of robberies at a restaurant.

               If something is important enough to stand for then it is important enough to do so in a way that works, is effective and produces real results.

Mother Hubbard’s Cupboard, Supply Risks and National Security

               I know what you are thinking.  What could a nursery rhyme possibly have to do with national security?  Well, a lot actually.  You may recall what happened with Mother Hubbard’s cupboard.  She went to her cupboard, discovered it was bare, and couldn’t give her dog a bone.  There is no mention of what the rest of her family did, but the dog certainly had to go without. 

Unfortunately, we’ve seen a lot of potential risks recently, especially in regards to supply chain risk.  Supply chain risks are something that businesses have to deal with on every level.  School districts already looking at making budget cuts, still have to buy fuel for school buses.  Businesses need to buy supplies or goods to manufacture their products or to use in their businesses.  Even service companies have to deal with supply issues.  Imagine if you have uniformed staff and the overseas company that normally supplies a part of your uniform is no longer available.

Generally, these kinds of supply chain failings happen on a micro level and go unnoticed by most of us.  However, recently there have been a number of high-profile cases that stress the importance of supply chain risk management, not just on a small level that affects individual organizations, but also on a national level.  Some examples even affect our national security posture around the world.

First, there was the earthquake in Japan.  The financial aftershocks still rock businesses internationally.  Among all the horror stories and the loss of life, the impact on Japan’s economy has been becoming clear.  One example of the impact has been on the auto industry.  The line between American-made cars and Japanese cars has become more and more blurred in a global market and even American car companies realized that many of their parts were made in Japan and the supply was interrupted as a result of the quake.

As this was going on in Asia, the Ivory Coast has been embroiled in revolution and violence.  About 34% of the world’s cocoa beans for chocolate come from the Ivory Coast.  The exportation of cocoa has been on hold for months affecting the prices.  Some analysts think that the situation is nearing the end and cocoa prices have started to drop (of course, how much of the savings gets passed back to the consumer versus lining corporate pockets remains to be seen).  Who would have thought that political unrest in the Ivory Coast would influence the price of chocolate?

Last, there is the Middle East.  The civil unrest has been spreading from one country to another, Egypt to Libya, Syria, Yemen and even Jordan.  The clear risk lies in the supply of oil, a commodity that industrial countries cannot do without.  Even the risk of closing the Suez Canal sent fuel prices skyrocketing.

So what are the real life lessons?  Certainly, you cannot predict every potential problem.  However, this is where a risk assessment can help identify the risks associated with certain supply chains.  And more importantly, once you’ve looked at your risks, take the necessary corrective action.  As with many security issues, one of the biggest, often fatal, mistakes is to ignore the warnings and go own our merry way.  That is the equivalent as walking down a street and seeing a gang of thugs blocking the sidewalk and you decide to push right through.  Pride aside, the safer course would be to cross the street and avoid the problem – but who does that?

Once you have identified your risks, create a back-up plan – a business continuity plan.  What will you do if a key ingredient is missing?  It could be a simple solution or complex, depending on your organization.  If you run a coffee shop, what is the risk if the newspapers aren’t delivered before your morning customers arrive?  Minimal, maybe, but you still risk having a first-time customer not coming back.  What if you manufacture some type of good or product?  Do you have a back up in case a critical product piece is not available?  A snowstorm or natural disaster or dockworker strike could interrupt your flow from thousands of miles away.  Identify a replacement part from another supplier, preferably one that even comes from a different part of the world.

The simple, step-by-step process is:

1.      Review the goods that go into your business.  Do not overlook the small things.  Imagine shopping for Christmas, buying all the presents to give out, selecting the wrapping paper, go home to wrap on Christmas Eve, only to discover that you have no tape.

2.     Find out where your supplies come from.  How stable or secure are those vendors and also the regions or countries where they are located.  In turn, each of those vendors has suppliers of their own, so the ripples could run several layers deep.

3.     Develop a back-up plan.  Either have a plan to use alternate materials or build a store on hand for interruptions.

4.     Follow the plan.  All the best intentions in the world will do you no good, if you do not follow through.  It is the equivalent of having a great recipe for your favorite dinner, but no ingredients to cook it with.

            And as for our oil supplies?  Clearly, we are making a huge mistake being dependent on one region of the world for a critical supply where a large number of people want to destroy or fight against Western civilization.  The obvious alternative is to develop other sources of fuel; both for our current needs, such as oil, and also develop future sources of energy.  Otherwise, we will truly wake-up and find that our cupboard is as bare as Mother Hubbard’s.