Wednesday, March 12, 2008

Security Standards

There is a widespread misperception related to the concept of “security standards.” So this message will attempt to clarify the issue.

As an expert witness, I am frequently asked to assess existing security measures in relation to “security standards.” In fact, such standards do not exist, at least not in the narrow sense of universally accepted, required or codified principles (the exception being standards for Government buildings and its contractors’ buildings).

Because security is both science and art – the science being the paraphernalia, technology and techniques used in protective efforts; the art being the proper and appropriate application of that “stuff” to a given situation – there are frequently a variety of ways to achieve reasonable security. And since reasonableness of security is judged vis-à-vis the circumstances of a particular situation, reasonable security is by definition different in every situation. So in truth, a “standard” is nothing more than a best practice that some reputable body has endorsed and/or embraced; but even an accepted “standard” is not – and in fact cannot be – the appropriate security measure that can or should be applied in every circumstance.

The biggest difficulty with “standards” is not in their identification or interpretation, but in their application. Courts across the country have taken the most realistic approach to the concept of standards: While Courts will recognize that standards (in the broadest context) exist, Courts usually will then go a step further and require evidence that the standard was applied to a given situation in the most appropriate way, and was the most suitable solution to the security problem.

As an example: A Court may recognize that there is a “standard” for the appropriate minimal height, configuration and installation of a chain link fence. But then that Court will take that “standard” and seek evidence as to whether that particular standard was suitable, appropriate, adequate and sufficient for the fencing around the facility where the actionable incident occurred.

So in other words, standards are fine; but they are not – and cannot be – universal in terms of one-size-fits-all-in-every-circumstance application. Every situation is different, so security measures will of necessity be different.