Tuesday, January 03, 2017

Being An “Expert”

In the security profession  – or in any discipline really – being an “expert” or “expert witness” is usually not a position to which one aspires at an early age.  It often comes first as an ancillary endeavor, then perhaps as a full-time profession.  It usually comes mid-career, and often endures past career prime and even past normal retirement time.  So how does one “become” an expert?  Is there a course or test that must be taken to “become” an expert?  Here’s the reality:
One does not necessarily seek recognition as an “expert;” and “expert” is not a connotation or designation bestowed on oneself – it is status or standing in one’s profession as attested to and recognized and conferred by others.  Therefore, there is – and really can be – no course of study or training program or test that culminates with the title of “expert” since a true “expert” does not become so until the expertise is recognized by others.
An “expert” is generally recognized for a composite of professional education, training, experience, expertise, analytical skills, writing skills, presentation skills, involvement in professional organizations, involvement in professional activities as a volunteer, professional and personal integrity, professional and personal credibility – and having a good track record in all the aforementioned.  And in addition to these attributes, “experts” usually have some other traits that are acknowledged by others:   He is the “go-to” guy within his organization;  he is a “go-to” guy within one’s industry and/or among one’s professional peers;  he is actively sought to help with resolving problems or improving operations or developing strategies or developing policies and procedures – being sought to do for others what they should/could be doing for themselves.  He is regarded as the person who will almost undoubtedly do the right thing or have the right answer at the right time.
So being the smartest man in the world by self-appointment – even if true – does not make one an “expert” as the term is being used here.  Rather, it is the acknowledgement by others that one is the right person to do a particular job that distinguishes one as an “expert.”

Wednesday, June 29, 2016

Words To Live – Or Stay Living – By

In the world of security, as in many facets of life, an old adage is absolutely true:  It is better to have it and not need it than to need it and not have it.

Thursday, January 28, 2016

The Concept Of “Reasonable Security”

Every organization has a legal obligation to provide a safe environment, based on the concept of “reasonable security.”  The owner/landlord does not have to guarantee absolute security.  However,  reasonableness and adequacy of security must be affirmatively demonstrated.  This basic concept is founded in most states’ case law (and, in some states, in statutory law).  In today’s world, there is virtually no place that can claim that no security is adequate.

The implementation or existence of a security program in and of itself does not guarantee that the program is adequate and sufficient, since the standard by which a security program will be judged is reasonableness with regard to foreseeable threats and risks at a specific place.

“Reasonable security” has been consistently defined by premises security case law to mean that appropriate security measures must be implemented commensurate with risks which are reasonably foreseeable at a specific place.  And a reasonable consideration of foreseeability has been determined to include the nature of the premises; the history of incidents at the premises; the history of incidents in geographic surroundings; and  any relevant industry standards.

Adequacy of security is legally defensible only when  vulnerabilities and risks are assessed via some conscious or formalized process to determine foreseeability, and commensurate security measures then  implemented to reasonably address those identified foreseeable risks (this is the usual standard by which adequacy and sufficiency of security is determined by courts).
A good process for developing a sound security strategy has dual benefits:  The program will be designed to protect the organization’s assets; and the program will be legally defensible should it be challenged in court.


Friday, June 12, 2015



good security means doing things that are not politically correct – you can’t always have it both ways;

doing the right thing is more important than following the rules or being politically correct;

the perception of good security is as good as or better than the reality;

there isn’t a good choice – sometimes you must choose between the best of the bad choices;

the end does justify the means;

it’s better to be judged by 12 than carried by 6;

popularity of an issue does not equate to fairness or justice;

a verdict has nothing to do with a good or bad prosecution strategy or a good or bad defense strategy –sometimes a verdict is based simply on facts and evidence;

“justice” fueled by public opinion and media and political pressure is not really justice;

“justice” is not what someone wants it to be – sometimes justice is simply what is;

the cutest puppy has the meanest growl and the sharpest teeth;

you get what you want, but sometimes you get what you deserve.


there is virtually nothing that is purely or simply black or white.

Wednesday, February 11, 2015

Value In “Dummy” Surveillance Cameras?

As both a former Director of Security and now an independent security consultant, I have rarely been a proponent of using “dummy” cameras as part of a security strategy.
Real cameras are used for several general purposes:  To monitor areas/events in real time to (hopefully) initiate appropriate response as needed; and/or to record areas/events for investigative/documentation purposes; and/or to provide a visible deterrent to inappropriate activities;  and/or to provide a heightened sense of security to the area’s legitimate users.
With that being the case for real cameras, here are the operational downsides of using “dummy” cameras:  Obviously, there is no real-time monitoring of areas/events possible, so appropriate response to problems is not possible (and it would be cost-prohibitive – and economically foolish – to try to replace cameras with personnel); and obviously, there is no recording of events for investigative/documentation purposes (the chances of personnel being able to provide comparable information are slim).   On the plus side, there might be a comparable visible deterrent to inappropriate activity, especially if the cost savings of “dummy” cameras vs. real cameras is used to provide additional “dummies.”  But even that deterrent value might be negated if poor-quality “dummy” cameras (an oxymoron?) are used which are easily identified as “dummies” because of no lights or wiring connections.  (NOTE:  the only time I have ever used “dummy” cameras was to add the impression of even more cameras to an application of real cameras which already covered everything I wanted covered.
But to me, the primary problem with the use of “dummy” cameras is an unnecessary and thus unacceptable  increase in liability.   The heightened sense of security for legitimate area users is totally negated when it is learned that there is no real protection being afforded. Legitimate users will feel betrayed and tricked when the truth is learned (and it will be – someone will find out somehow). And the worse-case scenario will be when an incident occurs and a victim questions and learns why there was no ready response or at least visual documentation of the event.  I have been involved in such cases as an expert witness (this would most probably evolve as a premises security liability lawsuit based on inadequate security) and have been able to opine that the “dummy” cameras created a false sense of security that did not truly exist, and this is actually worse than having no cameras of any kind:  at least if there are no cameras present, legitimate users will not have any expectations as to the level of security and may thus be more aware of their own responsibility for personal security; where on the contrary a legitimate user may be less aware of personal security issues since he believes that he is being “helped” by real cameras.
Bottom line for me:  “Dummy” cameras have the potential to cause more problems than they solve.

Thursday, November 13, 2014

“Predicting” Violent Behavior

We currently live in a society that is “an environment conducive to criminality:”  virtually all aspects of the most popular forms of entertainment involve violence and anti-social behavior (movies, television, video games, etc.); the news media thrives on violence and anti-social behavior (count the number of such stories versus “good” or “nice” news); society by and large has come to accept violence and anti-social behavior (we abide such behaviors in our neighborhoods and schools, our criminal justice system is virtually an ineffective revolving door, etc.); and we expend resources to protect ourselves usually only after a tragic event has occurred.  In other words, we may not like it, but we actually do – or can do – little about it.
We try to find reasons for violent behavior, and try to find ways to “predict” it in hopes of preventing it.  But is such a lofty goal even possible?   Or does the concept of preventing problems exist only in theory, not reality or practicality?  Consider:
“Behavior modification” is a great term and concept – provided that we have some idea as to whose behavior we are attempting to modify.  When the threat is external to an organization, how can we begin to know which of the next 732 persons to enter a facility is the one whose behavior needs modifying?  How can we begin to know if the “behavior modification” techniques that might work on 731 of those persons will work on the 1 who will actually be the next shooter?  If none of those 732 go on a shooting rampage today, does that mean that our “behavior modification” techniques were successful – or that none of them simply chose today as the day to shoot?   Etc. etc. etc.
We see examples of our efforts to find a new way to predict the next shooter every time another incident occurs (and by the way, nothing PREDICTS behavior – certain behaviors may be indicated, but none can be PREDICTED).  But the reality is that there is virtually nothing we can do because, even when some people see the signs, nothing is done because “if you see something, say something” is not socially acceptable, or is contrary to HIPAA (when the see-er is a mental or medical health professional), or is something that “…I was going to do later…” or whatever.  Families, bosses, co-workers, fellow classmates, etc. see things every day that are indicators of potential violent behavior, but do nothing because it is simply not politically correct or they’re busy or they did not realize what they were seeing or a million other excuses.
After every new incident comes another discussion of the same things, and the results are always the same – nothing gets changed, because nothing can really be changed.  Because even when problems are indicated before they occur, we still almost never do anything about them until after they have occurred.
Security professionals do not control organizational purse strings or the magic key to the CEO’s psyche, so we cannot implement the things which we know will pretty much stop the bad guys from doing most bad things most of the time.  And all of the studies and nice terminology and fancy graphs will never change that fact.  (And while agencies such as the U.S. Secret Service do a great job of behavioral analysis, remember that they have an entire division of professionals who do nothing but behavioral analysis and have the resources to investigate and check out their findings and leads and have to “only” protect a handful of key assets.)
So in the end,  all we as security professionals can really DO (as opposed to discussing theory and hypothesis) is do the best we can with resources our bosses choose to expend – that is, protect to the best of our abilities, with whatever resources we have been allotted, whatever our bosses have decided are our key assets. Period.


Friday, October 03, 2014

Academic vs. Practical Security Knowledge

Regardless of the extent of knowledge acquired via formal education or academic pursuit, it is almost always most beneficial to retain a security consultant or expert witness who has practical, hands-on experience in the subject matter at hand.

When a particular situation or case needs someone to interpret or present information that is based solely on scientific or theoretical fact, an expert with only an educational or academic background might be most suitable.  But in circumstances requiring expert OPINION – knowledge of specialized information and its application to a specific scenario – an expert with practical experience is most valuable.  In such cases, an expert who has been personally involved in the application of the relevant subject matter to a variety of diverse situations will be best able to provide the comprehensive insight that is needed to best assist the organization or attorney because he has had to not only know the subject matter, but has had to apply that knowledge to the situational nuances of the real world (a skill not generally found in experts who only possess academic or theoretical knowledge).

The primary value that a security consultant or expert witness brings to an organizational situation or legal case is his ability to apply general security principles to a specific situation because he has been there and done that.