|     |     |  About Us   |   Archives   |   Contact Us |

Sign up for Security Debrief Newsletters



Archive for the ‘counterterrorism’ Category

Breaking: US investigates potential terrorist test run

Tuesday, August 31st, 2010

The news of two men arrested in Amsterdam on suspicion of terrorism is making its way across the news wire. Here’s the latest from AP.

US investigates potential terrorist test run – Associated Press

Two men arrested in Amsterdam may have been conducting a dry run for a potential terrorist attack, U.S. officials said Tuesday after a cell phone taped to a Pepto-Bismol bottle and a knife and box cutters were found in one of the men’s luggage.

U.S. investigators are pursuing leads in Detroit, Birmingham, Ala.; and Memphis, Tenn., according to officials speaking on condition of anonymity to discuss the ongoing investigation.

The arrests come at a time of heightened alert just days before the ninth anniversary of the Sept. 11, 2001 terror attacks.

On Sunday, authorities found the suspicious items — a cell phone taped to a Pepto-Bismol bottle, multiple cell phones and watches taped together, and a knife and box cutter — in one of the men’s checked luggage in Virginia. The man and his luggage were headed to separate international destinations, which also raised concerns.

Cyberspy Hunting al Qaeda Speaks to Security Debrief

Thursday, August 26th, 2010

Over the last decade, America and her allies have done a solid job of beating al Qaeda to a bloody pulp. We’ve hit them with everything we’ve got: troops on the ground; Predator drones in the sky; missiles from the sea; and we’re taking them apart piece by piece on the Web.

But it’s not just the government that’s running down al Qaeda. Even U.S. citizens are using some good-ol’-fashioned American initiative; citizens like Shannen Rossmiller, a citizen cyber spy.

A what?

Rossmiller’s no government agent. She’s just your average citizen with an extraordinary conviction to bring al Qaeda to its knees. Online she sounds like a terrorist, looks like a terrorist and walks like a terrorist, but in reality, she is anything but. Since 9/11, Rossmiller has been on the cutting edge of cyber counterterrorism, hunting and tracking terrorists online and sharing her findings with federal authorities.

Given that we are hunting al Qaeda relentlessly, one might think terrorists would take extra steps to hide their identity on the Internet. Rossmiller said no.

“People still believe they have anonymity online,” she said. “They don’t realize you can trace them and figure out who they are, using IP addresses and other means.”

And because of that belief, they’re willing to talk openly, she said. That’s how she gets them.

So what is cyber counterterrorism? It isn’t yet a defined practice area, though Rossmiller is making strides in that direction. She told us all about it when she spoke to a small gathering of industry specialists, a discussion hosted by Security Debrief and homeland security consulting firm Catalyst Partners.

Take the case of Ryan Anderson, an American National Guardsman who on the verge of deployment to Iraq was also online, using a different name and talking about jihad. Rossmiller identified him as a threat, and posing as an Algerian sympathizer, lured Anderson, over the course of numerous e-mails, into revealing details of his plans.

Rossmiller provided this evidence to the FBI, and with Rossmiller serving as a key witness for the prosecution, Anderson was convicted of attempting to aid and provide information to al Qaeda. He is spending the rest of his life in prison.

Rossmiller is many people in cyberspace, all of them supposedly eager to wage violent jihad. But they’re constructs, built through research and trial and error. She engages radicalized and potentially violent individuals in online forums and websites, slowly but surely writing in Arabic (not her native tongue). The lingo she uses smacks of al Qaeda-speak (whatever that sounds like), and clearly her efforts are effective as she’s pulling would-be terrorists into the open, teeing them up for our federal forces to finish the job.

Ready to sign up? Vigilantes beware. Rossmiller is particularly effective because she understands the law. As the youngest female judge in U.S. history, she has a keen awareness of what constitutes entrapment and what is needed for a conviction. Other well-intentioned but less legal-minded individuals may not be as effective in finding evidence that leads to convictions.

The discussion was moderated by Dr. David McWhorter, principal at Catalyst Partners and a former analyst with the Institute for Defense Analyses. Also helping lead the discussion was Security Debrief’s Steve Bucci, Cyber Security Lead, Global Leadership Initiative at IBM Global Services.

Electronic System for Travel Authorization Supports U.S. Security

Wednesday, August 25th, 2010

On August 6, 2010, in accordance with the requirements of the Travel Promotion Act (TPA), U.S. Customs and Border Protection (CBP) announced an interim final rule establishing a fee for the use of the Electronic System for Travel Authorization (ESTA).  The total fee, which goes into effect on September 8, 2010, is $14. Ten dollars will go towards funding the activities of the Corporation for Travel Promotion that is being created under the framework of the TPA. The remainder will be used by CBP to operate and maintain the system.

An approved ESTA is required for all individuals traveling under the Visa Waiver Program (VWP). ESTA approvals are generally valid for multiple entries into the United States for up to two years or until the applicant’s passport expires, whichever comes first.  (Note: travelers who apply for ESTA approvals before September 8 can avoid the $14 fee, as CBP does not require the individual to have immediate travel plans to apply.)

Leaving aside whether the fee will have its intended effect of boosting tourism, the successful implementation of ESTA is a critical security feature of the modernized VWP.  It provides DHS with the capability to conduct both advance and recurrent vetting of individual VWP travelers against appropriate law enforcement and security databases. It therefore helps the Department determine whether any risk exists in permitted travel to the United States. Currently, no airline will permit a VWP traveler to board if he or she does not have an approved ESTA. As a result, the ESTA compliance rate has reached 99 percent. In short, ESTA has enhanced the security of the United States.

The VWP advances security in other ways as well. VWP participants are required to be close partners in security and law enforcement matters. In a networked world, efforts to guard against terrorism while enhancing travel and trade depend upon the type of close collaboration and cooperation that is the hallmark of the VWP. By insisting on high standards for information sharing, border security, and travel documents, the VWP helps to prevent travel by terrorists and transnational criminals.

The VWP also has significant public diplomacy and economic benefits. Since its inception, it has fostered better relations between the United States and participating countries. Increasing the flow of business people and tourists through open and secure travel provides a foundation on which close foreign policy, commercial and cultural ties can flourish.

By contrast, the often cumbersome and expensive visa process can impede significant personal as well as commercial exchange. Large numbers of potential visitors – from Latin America, for example – may be discouraged from traveling to the United States by this process. Similarly, Americans may be discouraged from visiting Latin American countries because of the reciprocal visa requirements imposed on them.

VWP designation decisions are made on a country-by-country basis and each country must qualify on its own merits. Nevertheless, interested countries from Europe, Latin America, Asia and the Middle East should consider joining together to press their respective cases for inclusion in the program. Such a coalition – comprised of both governments and interested business groups, such as chambers of commerce – could present a compelling argument on security, economic and public diplomacy grounds for an expanded VWP.

The National Cyber Awareness and Education Campaign

Tuesday, August 24th, 2010

Those who read my Security Debrief posts or my Tweets will recognize (maybe with a groan) that one of my “issues” is the lack of action in Awareness and Education with regard to cybersecurity. It is not a sexy, nor a potentially lucrative issue, but I believe with all my heart that it is the foundational piece of any eventual “solution” to our cyber woes. We will never really “solve” this, but if we are to remain in the game with the bad guys, we must do better than we are now.

Last week I participated in a conference hosted by NIST. It was designed to progress forward with the National Initiative for Cybersecurity Education (NICE – a really unfortunate acronym). For two days, we discussed the Awareness efforts being led by DHS, examples of seemingly successful education efforts in the Maryland area and some points of view from industry.

The NICE program has four pillars:

  • Awareness (for the general population);
  • Education (aimed mostly at K-12);
  • Training of the Federal Work Force; and
  • Professional Certification.

I will comment on the first three, as I do not consider myself truly qualified to opine on the Professional Certification program.

In regard to Awareness, DHS clearly recognizes the importance of the program. They have put some serious assets against this need, but frankly, it is way too little and way too slow (one hopes it is not too late). They are planning six town hall-style events for the coming year. Yes, I said SIX. When I questioned Bruce McConnell, the counsel to the Deputy Under Secretary for National Plans and Programs, as to this paucity of engagements, he sheepishly admitted that it was not enough, but it was all they could do at this time.

I have said before that based on my experience in speaking outside the Beltway, the Feds could deploy speakers to every local Chamber of Commerce, every Kiwanis Club, and every PTA meeting in America to do a basic presentation on the cyber threats, general issues, and basic cyber hygiene methods, plus Q&A. It would be eaten up by the American public, who is starving for information in this area. DHS’s answer is to solicit volunteer “Ambassadors” to do this task. Great idea, but nowhere near sufficient.

Education is likewise weak at this time. We need a course on cybersecurity taught to every student K-12 and college, every year. The dynamic nature of the subject is such that you never “arrive,” so we need to teach it over and over. The goal is not to make everyone a computer engineer but to reinforce best practices and basic skills that would make the entire system more resilient. Dribs and drabs will not work and will be less than a band aid.

Work Force Training for the federal work force is probably fine, but NICE should also push for Work Force Training writ large. There is no distinct line between the Federal system and the networks of all their private sector partners. Therefore, we need to develop workforce training programs for the American Work Force, not merely the Federal one. I recognize the magnitude of this, but we will get what we pay for.  Additionally, we must acknowledge that this sort of training is needed by the entire workforce, not only for the IT folks. If we target only those who are already technologically proficient, we will have failed.

Bottom line of Bucci’s rant is this: we need to make Awareness and Education a real priority and expend the money, time, and personnel to do it correctly. Simply put, the present NICE plan is good but too small. God bless the folks who are working so hard to make this successful. Let’s give them the assets and backing to succeed.

Homeland Security Still MIA on EMP

Tuesday, August 24th, 2010

As Matthew Harwood’s August 5, 2010 article in Security Management reminds us, Homeland Security has not “taken seriously the threat that a high-altitude detonation of a nuclear weapon could fry the nation’s power grid[.]”

As the article notes, Dr. Michael J. Frankel “warned the Judiciary Subcommittee on Terrorism and Homeland Security that a terrorist organization or a rogue state could detonate a nuclear weapon either above the United States or close to its shores, creating an electromagnetic pulse attack that could severely damage the country’s electronic infrastructure.”

Frankel is executive director of the EMP Commission, which was created in 2001 to study the national security threat an EMP attack could pose to the United States.

While most of its work is classified, the commission has released two unclassified reports: one in 2004 and another in 2008. According to the article “Frankel believes DHS has the expertise in-house to tackle EMP preparedness but needs a Senate-confirmed leader to lead the charge. Already DHS has taken action against nuclear terrorist attack scenarios but continues to ignore the threat of an EMP attack, he said, even though the commission provided the department with 75 unclassified recommendations to mitigate vulnerabilities and promote resiliency in U.S. critical infrastructures.”

If anything, Frankel underplays the scope of the threat. The catastrophe would not stop at our borders. Most of Canada would die, too. Its infrastructure is integrated with the U.S. power grid. Indeed, without the American economic engine, the world economy would quickly collapse. Much of the world’s intellectual property (half of it is in the United States) would be lost as well. As a result of these loses, the Earth would likely recede into the “new” Dark Ages.

It is doubly strange that DHS has dedicated so little to this threat in that similar devastating effects could occur as part of a natural disaster. For example, scientists have long held that intense solar flares could produce similar effects. In addition, there are many other kinds of disasters – from cyber attacks to storms – that can incapacitate infrastructure. Furthermore, preparing for “worst case” scenarios would also improve America’s ability to cope with lesser disasters.

DHS should start to take practical steps now to mitigate the damage inflicted by the most catastrophic disasters imaginable later.

What is a Law Enforcement Fusion Center?

Monday, August 23rd, 2010

Fusion Centers are a fairly new concept in law enforcement, and many people don’t know the purpose they serve or how their local law enforcement agency should be engaging these centers. If you ask 20 people for a definition of “fusion center,” you’ll get 20 different answers. Some might even think these centers are making frozen coffee concoctions or protein drinks.

Fusion centers are an attempt to deal with the fact that clues related to criminal activity often remain undiscovered in disconnected law enforcement databases. These centers address that challenge by bringing the data into one place or making it accessible from one place, typically on one software platform where analysts can connect the dots.

Much of the rationale for developing these centers comes from the post-9/11 realization that we knew a lot about the terrorists, but the data points were scattered and didn’t raise any red flags in isolation. Many agencies had a piece of the jigsaw puzzle but not enough to form a picture of a credible threat.

So in recent years, as a national grassroots initiative developed, in part, from a joint project with the federal intelligence community, including DHS and DOJ, about 50 of these fusion centers have been created across the United States. Each is staffed with personnel from multiple agencies that help facilitate local, state, county and federal data sharing.

While almost every fusion center has a slightly different mission, most people agree the goal is to bring a lot of data together to form a complete picture of criminal activity.

Based on what I’ve seen working in over a dozen of these centers, some are simply amassing numerous data stores in one location for quick and efficient query used to support tactical investigative activity. This approach allows instant access to various data sources, but minimal analysis occurs. In contrast, some fusion centers focus on strategic analysis, with officers and analysts collecting and analyzing the data, and then making assessments of the threats posed and the potential for criminal activity.

Contrary to popular “blogosphere” opinion, these fusion centers are not “big brother.” The rules for private and protected personal data have really not changed. State and local police still need court authorization to access an individual’s telecommunications records, credit card transactions, Internet activity and similar confidential information.

Fusion centers that are doing strategic analysis are best positioned to prevent criminal acts. Trained intelligence analysts in these centers look at a local tip or Suspicious Activity Report (SAR) and then use advanced search tools across many databases simultaneously for indications that the tip could be part of a much bigger “iceberg” hiding below the surface. These analysts are trained to develop a hypothesis and test it through search, data analysis and proper vetting.

Often, an analyst determines there is no cause for concern, but occasionally, the outcome is a finding that there is a clear and present threat, in which case the analyst publishes a “product,” which is a finished intelligence report for review by law enforcement command. While analysis of this kind has been done for years, new technologies for unstructured data search, automated workflows, and better data sharing drive more efficiency and deeper results.

If you are working in law enforcement, it’s wise to know who to contact at your regional fusion center and designate a contact point within your agency. Also, by linking your local databases to these centers, it’s possible that a traffic stop in your area could possibly help crack a bigger case.

Let’s Not Talk Nonsense About Cyber

Friday, August 20th, 2010

A recent blog post on Wire.com by Kevin Poulsen, “Cyberwar Against Wikileaks? Good Luck With That” was brought to my attention by a good friend. She nominally just wanted my thoughts on the provocative article, but in effect, challenged me to blog on the subject. So here goes.

The genesis of the “controversy” was not the release of the mountain of leaked documents by the WikiLeaks folks, but rather, some of the response it had provoked, and that created a connection to cyber. A pundit had opined in the Washington Post that the U.S. Government had the cyber capability to “prevent WikiLeaks from disseminating those materials.” He was referring to the slightly smaller mountain of documents that have been so far held back (on the advice of newspaper leadership types). These specific articles are apparently potentially more injurious to innocent folks than those already released.

OK, so the pundit was suggesting that President Obama authorize government entities to turn WikiLeaks computers into silicon bricks? Come on folks, educated people should not talk nonsense. Could we “attack” the website’s servers, computers, and other digital infrastructure? Yes, we probably could. That defined a target is well within the capabilities of several different parts of the government, but why in the name of all that is anchored in reality would any President ever do it?!?

Even if you skip right over that pesky free speech and freedom of the press stuff, just from a policy standpoint, it would be entirely self defeating. Using cyber capabilities to silence those with whom we disagree is exactly what privacy and civil liberties advocates fear most about the development of our cyber defenses. If anyone in the administration convinced the President to do this, it would forever torpedo the efforts to husband these capabilities for use in protecting the nation from our external enemies.

Was the release of the Afghanistan documents harmful? Yes, but not hugely so. The documents are for the most part low-level tactical reports at the SECRET level – not exactly the Pentagon Papers of this generation.

What the young soldier who released the documents did was illegal. He had a security clearance and had signed numerous non-disclosure agreements that go with official access to classified material. He knowingly broke federal law and the Uniformed Code of Military Justice. He should and will be prosecuted. But the military failed in its screening of this individual and in its supervision of him. As a result, he took actions that he may regret in the future.

WikiLeaks, however, made no such non-disclosure agreements. I am not defending what they did, and I wish they had not done it. Their actions have hurt the reputation of this country, our efforts to free the Afghan People from an oppressive ideology (however imperfect those efforts may be), and may in the long run get innocent people killed. If the online outlet’s ambitions to publish the documents in full had not been tempered by more mature and experienced news people, it would have been worse.

Basically, the U.S. Military must suck this one up and do a better job of securing its classified documents (they are far easier to steal and transfer than ever before). Clearly, if we have legal recourse to keep other documents from being leaked, we should take them, but nothing more. We must also work even harder at screening our personnel and then monitoring them for signs (public Web postings for example) that they might be considering illegal actions. If anyone is considering taking extra-legal actions involving our cyber capabilities, PLEASE put that option aside. Nothing good would come of it, and lots of damage would be done.

Hertiage’s Homeland Security Panels – Bucci Speaking on Cyber and Maritime

Wednesday, August 18th, 2010

Next week, the Heritage Foundation will host “Homeland Security 2010: The Future of Defending the Homeland.” This will be a week-long series of panels aimed at providing a good background for Congressional Staffers new to Homeland Security issues. Heritage did this last year, and it was an excellent event. It should be informative and helpful for the folks who provide the leg work for our Legislative Branch.

This program is diverse. The event begins on Monday, August 23, focusing on maritime security. Two panels will look at this huge area from the civilian and military standpoints.

I will sit on one of the panels and will look at the immense task of achieving maritime security and what has been done so far in pursuit of it. My time as the Deputy Assistant SecDef for Homeland Defense included a great deal of focus on this crucial defense domain.

On Tuesday, the attention will shift to Science and Technology, with two panels looking at the role of fundamental science in security, specifically bioterrorism. Day Three’s panel reaches out to the private sector on its pivotal roll in Homeland Security. It will cover Critical Infrastructure Protection (most of which is privately owned), and the expanding role of the private sector in response since 9/11, Katrina, and the Gulf Oil Spill.

Thursday turns to my favorite – cybersecurity. The actual titles of these panels are intriguing: “Big Brother and the Civilian Network” and “Cyber Nukes: War and Terrorism in the Cyber Domain.” I will be presenting on the latter panel and will look at one of my pet subjects, the growing potential for cyber terrorism once terrorists are enabled by cyber criminal networks.

The five-day program is rounded out with panels looking at the role of state and local government in our response to terrorism and the overall preparedness, response and recovery system.

This outreach to the Staffers is a laudable and worthy task. These (mostly) young citizens are highly educated and very motivated to serve their members in the task of creating an effective legal underpinning for our Homeland Security efforts. By gathering together a diverse group of academics, practitioners, industry types and pundits, Heritage provides an excellent menu of topics from which the staff personnel can choose to augment their knowledge, and with whom they can debate and discuss the issues.

I am very happy to have been asked to participate, and I will be prepared for a great deal of learning and free flowing discourse.  The panels are open to the public and all are welcome. I highly recommend it.

You can RSVP for the panels and find out more by visiting The Heritage Foundation’s website.

For Victory over al Qaeda, Build the Mosque at Ground Zero

Monday, August 16th, 2010

By Justin Hienz

Radicalization and violent jihad are phenomena intimately linked to the United States’ homeland security efforts. Those who buy into transnational terrorism’s violent ideology are threats to America, but just as important to U.S. security is how the American public understands and responds to Islam.

On Friday, President Obama weighed in on the continuing debate over whether to allow construction of an Islamic Center near Ground Zero in New York City. Celebrating the Islamic holy month of Ramadan with invited guests during a Friday dinner, the president said:

“I believe that Muslims have the same right to practice their religion as everyone else in this country. That includes the right to build a place of worship and a community center on private property in lower Manhattan.”

A strong statement. A bold statement. A statement of leadership on our country’s values. In commenting on the proposed mosque (albeit indirectly), Obama sent a message to the country – the mosque should be built because our national principles demand it. Well said, Mr. President.

But then, on Saturday, Obama amended his statements for reporters. Quoted in the Wall Street Journal, he said:

“‘I was not commenting and I will not comment on the wisdom of making the decision to put a mosque” near Ground Zero. ‘I was commenting very specifically on the right people have that dates back to our founding.’”

Did I miss something? His position on Friday seemed fairly clear, particularly because the mosque-in-NYC issue had been made so salient by constant media coverage. What else could he have been talking about? Yet on Saturday, the President’s stance was far less sure.

For those unfamiliar with this matter, the debate revolves around whether an Islamic Center can be housed in a building planned for a location two blocks – 45 Park Place – from where the Twin Towers once stood. The building would be open to all faiths, and the proposed name, Cordoba House, refers to a Spanish city where Muslims, Christians and Jews once lived together in peace.

Nevertheless, headlines have focused on the key words “mosque” at “Ground Zero” because it grabs attention and sells. This has served to inflame a national debate, with known opponents of the mosque sticking dead on message, peppering remarks with dramatic key words. There have also been other instances throughout the country where communities have argued against the construction of a mosque in their neighborhood.

A CNN/Opinion Research report shows that 68 percent of those surveyed oppose the mosque. While the question’s wording is somewhat leading, 68 percent is still a significant number, even with a wide margin of error. The ongoing debate reveals a great deal about how some Americans view Islam.

To be sure, those objecting to the Islamic Center are opposed not simply to the new place of Muslim worship but to the idea that anything related to Islam can safely exist so close to the site of al Qaeda’s greatest victory, without dishonoring the dead. This viewpoint is flawed, because it is based on a misunderstanding of religion generally, Islam specifically.

Islam, like all other religions, is dynamic, not static and monolithic. It is diverse across regions and has changed throughout history. More importantly, the concept of “Islam” (much like the concept of “Christianity,” et al.) is not standard across the world. An individual’s religious beliefs are unique to themselves because how a person interprets their faith is guided, in part, by forces in their environment, such as economy, lawlessness, poverty, etc. No person’s belief is identical to another’s, and so, to understand Islam as a singular idea and motivator is incorrect.

There is no legal, ethical or American justification for refusing the right to build an Islamic Center at 45 Park Place. It is ridiculous to oppose a house of prayer on the grounds that it is Islamic, citing the terrorists who brought down the Twin Towers as evidence of Islam’s inherent problems.

Denying the Islamic Center is tantamount to denying the construction of a Christian church (of any denomination) near the site of the destroyed Alfred P. Murrah Federal Building in Oklahoma City. Timothy McVeigh (the man responsible for blowing up the federal building) was Christian, but do you expect we would hear the same outcry if the site of a proposed church was adjacent to where that building once stood?

What we are encountering here is an emotional response, fanned by the media, revealing that, even a decade after the attacks on September 11, some Americans still just don’t get it. They don’t understand that al Qaeda and other terrorists are the Timothy McVeighs of Islam. Radicalized believers draw no more support from Muslim communities than militant Christians do from the global Christian population.

Debate is healthy. It’s one of the best attributes of the American social tradition. But if this debate leads to either 1. An action that prevents the construction of the mosque or 2. Further anti-Islamic attitudes preventing an American Muslim’s basic rights, then we have dishonored the memory of those who died on 9/11.

It means we have allowed Osama bin Laden, his followers and other enemies of America to construct a false opposition between Islam and America. “The Narrative,” a monstrous ideology advocating an inherent conflict between Western society and the Muslim faith, is what al Qaeda and other enemies of America believe. We must not perpetuate this lie by suspecting and fearing Islam. We must see clearly that the tragedies on September 11 were the product of terribly misguided people. The bastardized interpretation of Islam that they used to justify their actions does not reflect what most of the world’s one billion Muslims believe. Period.

If this mosque is not built (or if it is protested after it is built), then Osama’s greatest victory was getting Americans to believe what he believes – that there is a war between America and Islam. But if the mosque is built, we honor those killed, because it shows that we are continuing to triumph over bin Laden’s lies. Neither he nor his ideology has a home in America.

Had the President not made those weak-willed statements on Saturday, his initial endorsement of the mosque would have been a step in the right direction for the American people’s perception of Islam. Now more than ever we need authoritative voices to take a consistent stand and guide the public towards a more nuanced and accurate understanding of the Muslim faith.

Justin Hienz is Managing Editor for Security Debrief and a Senior Account Executive at Adfero Group.

Justin Hienz is Managing Editor for Security Debrief and a Senior Account Executive at Adfero Group.

Potential Change in the Nature of TSA Enforcement?

Monday, August 9th, 2010

Since its inception in 2001, the Transportation Security Administration’s (TSA) approach to enforcing its rules generally has been a cooperative one. Recognizing the burdens on industry from new security regulations and a difficult economic environment, and understanding that harsh enforcement actions can be counterproductive, TSA generally has sought to educate and train rather than punish. Monetary fines have been uncommon, and serious punishment – steep fines or greater severity – have been rare. While this approach has worked reasonably well, there is reason to believe it will not last forever.

  • A common catalyst to a “harder” enforcement approach (e.g., more frequent and larger fines) is public focus on instances of noncompliance.

A recent example of such a catalyst is the oil spill in the Gulf of Mexico, which has transformed the Interior Department’s Minerals Management Service into the new “Bureau of Ocean Energy Management, Regulation, and Enforcement” – enforcement is now part of the name.

  • The likelihood of public focus on noncompliance is related to at least two factors: the passage of time and the industry’s ability to affect a broad cross-section of the public.

Both factors weigh in favor of an eventual turn toward harder enforcement. First, TSA is still a new agency but, as time passes, the likelihood of a significant rule violation by the regulated industry increases. Second, TSA interacts constantly with a broad cross-section of the public, which is one of the reasons that TSA problems quickly draw broad public attention.

  • Another possible catalyst to a harder enforcement approach is the growth or diversification of the regulated industry.

When the regulated industry grows and/or diversifies, regulators may be more inclined to take a harder approach to enforcement as a way of signaling seriousness to industry participants.

Hard enforcement actions are often an efficient way for regulators to deliver a message to a large or diverse set of industry participants. When the participants are few in number or homogenous, education and training by the regulators may be sufficient, but a “severe fine” warning message is more likely to be carried quickly (by the trade press, lawyers and others) to a large or diverse set of industry participants.

The industry regulated by TSA has been growing and diversifying quickly. Among the recent additions are businesses newly regulated under the Certified Cargo Screening Program (CCSP). These businesses, now approaching 1,000 in number, have to be regulated by TSA without a proportional increase in TSA resources, making an eventual resort to a harder enforcement approach more likely.

For all of these reasons, TSA-regulated companies would be wise to focus on compliance efforts as though TSA were going to take a harder approach to enforcement.

The Battling Bills of Chemical Security – Much Ado About Nothing?

Friday, August 6th, 2010

Late last week, the Senate Homeland Security and Governmental Affairs Committee (HSGAC) unanimously approved a bill to extend the DHS Chemical Facility Anti-Terrorism Standards (CFATS) program for an additional three years. The bill will next move to the Senate floor sometime before the end of this congress for a showdown with a bill passed out of the House sponsored by Congressman Bennie Thompson, Chair of the House Homeland Security Committee. At that point, you’ll probably see some additional amendments that could change the current complexion of the bill to make it more palatable to draw more votes. What the senate bill doesn’t presently incorporate are many of the features of the House bill. The Thompson bill includes several contentious provisions, including “inherently safer technology (IST)” review, chief among the attention-getters.

IST is great idea in theory – and is actually a fairly straightforward and simple concept.  You take one chemical process that involves a “high-risk” chemical, you identify a “lower risk” chemical that provides a similar functionality, and you do a switcheroo.  Disregarding the costs of the lower risk chemical as well as the costs associated with re-engineering the process to accept the new chemical, IST sounds pretty simple, right?

Maybe, maybe not – here’s an example that illustrates the additional costs and considerations of chemical process re-engineering that should hit home for those in the National Capital Region (or the DMV, as I’ve recently learned).

DC’s Blue Plains Water Treatment Facility, one of the nation’s largest water treatment facilities, elected to change its disinfection mechanism from gaseous chlorine to sodium hypochlorite after an evaluation of the unique operational and risk characteristics of the facility. The utility’s process change did not come cheaply, perhaps as much as (if not more than) $12.5 million in capital expenditures and an annual chemical cost increase from $600,000 (for chlorine) to $2 million (for sodium hypochlorite). But the Blue Plains folks did not make this decision because they were forced under a regulatory program – they made the decision based on an evaluation of the threat, vulnerabilities and potential consequences of a chemical release. And the most interesting wrinkle to this process change? The decision to switch was made before September 11, 2001.

Looking at IST in the larger scheme of chemical facility issues, IST is really just a component of a more complex trade off assessment, going well beyond merely switching out chemicals. Internal business decisions happen every day that include a variety of factors – including process evaluations – that ultimately consider the true “cost” (whether directly financial or indirectly risk-driven) associated with an action or process. Essentially, when costs are too high, they are addressed.

For example, following the enactment of CFATS and the passage of the Secure Handling of Ammonium Nitrate Act of 2007 (DHS is in the final stages of developing a regulatory program for AN), a not-to-be-named-company in the farm supply business ran the numbers and determined that the cost of compliance with the two DHS programs was just too great, so they stopped selling AN in bagged form. They just stopped selling it and consequently removed the regulatory exposure entirely. Now there’s a business decision – just drop the product because the margin that was previously thin in an unregulated environment evaporated. Net effect? The end user is going to have to find another company that has either accepted the reduced or non-existent margins, or they’ll just have to find a replacement chemical. That’s what I call a “top-down” approach to IST.

On the flip side, here’s a “bottom-up” example of IST. As it stands now, there’s a chemical covered by CFATS that has a very close “chemical family” relative (so to speak) not covered by CFATS. The folks that manufacture and sell that unregulated chemical are having a field day with this competitive advantage.

Think about it, the costs of compliance have to be recouped somewhere. They’re not going to be internalized, so the regulated product price goes up and the consumer bears the burden of compliance. The unregulated chemical? No compliance costs, no burden on the consumer, so the consumer is going to make a decision on its own and go buy the unregulated chemical. Not because it’s necessarily safer but because it’s cheaper.

So what does the company selling the regulated chemical do? Probably go out of business or stop selling that chemical, as in the example above. The most interesting thing about the entire situation? There’s empirical evidence indicating the two chemicals are pretty darn close when it comes to explosive energy, so while the chemicals are essentially interchangeable from an application standpoint, they’re also theoretically interchangeable as an IED precursor.

What’s my point?  IST happens every day; process decisions are made every day out in the chemical supply chain. Despite Congressman Thompson’s position on whether the Senate did the country a disservice (and to be fair, he could have been referring to the other provisions, like closing the water security and maritime security gaps), IST decisions happen right now without any regulatory requirements and are a natural result of the mere existence of CFATS. And to be clear, the IST provision in the House bill doesn’t mandate IST in most cases; the bill just requires IST reviews for the higher-risk facilities and provides the Secretary authority to direct an IST in certain highest of high risk cases.

The higher level message here is that you don’t have to bake an IST requirement into the regulatory structure to ensure chemical companies make trade off assessments and the corresponding decisions. So there’s no real loss by not having a stringent IST requirement included in the Senate bill. Companies are going to make IST-like decisions anyway in order to cut costs and reduce regulatory exposure; in fact it’s already being done!

As soon as you introduce a regimented process that requires a third party to assess an internal IST evaluation, you further handcuff the process. Not to mention the fact that there are other mechanisms already in the CFATS program that can ensure the security of those high-risk chemicals, namely the security standards. On that note, if DHS is concerned about certain high risk chemicals at certain sites, they can leverage the ambiguity of the security performance standards to set a security bar so high for the facility of concern that the costs of compliance for physical security will be overly burdensome. Once it’s too costly to secure, the facility will identify an alternative process with less burdensome security measures. The net effect is an IST decision. That right there is an IST lesson learned from CFATS compliance to date – companies will drop chemicals if they can avoid compliance costs.

To wrap this whole thing up, for those out there sitting on pins and needles as the CFATS expiration deadline looms – CFATS isn’t going anywhere. Besides, too much effort has been put into building the program, both in the public sector (inclusive of the Executive and the Legislative Branches) and in the private sector (inclusive of the regulated companies and the cottage consulting industry resulting from the program).

If you think there’s a lobbying effort out there that’s trying to water down CFATS, there would be another lobbying effort to ensure that CFATS remains and the cottage consulting and compliance assistance industry it generated doesn’t go anywhere. Which brings up an interesting point: after whatever law is enacted that extends CFATS, can the White House claim that it saved or created the jobs of all those CFATS consultants?

UAE Blocks BlackBerry for the Sake of Security, at the Cost of Liberty

Tuesday, August 3rd, 2010

By Justin Hienz

The United Arab Emirates (UAE) is home to bizarre sights. Man-made islands shaped like palm trees; the tallest building in the world literally reaching the clouds in Dubai; vending machines offering gold bars; 16 year olds driving the newest Mercedes, BMW or Jaguar. It is a strange place, and the veneer of extreme luxury certainly impresses (or fools) most tourists.

But when you pull back the curtain (and it doesn’t take much), the UAE is revealed as a developing country with many challenges, such as a rigid class system, pollution and of course, security. Don’t forget that the UAE is a stone’s throw from Iran, has hundreds of miles of unsecured coastline and is one of the few GCC States to have escaped an al Qaeda attack thus far. That is no easy security situation, and one that merits as much preparation, vigilance and strategy as the country can muster.

Yet, the Emirates’ approach to securing the country is not bound by the same rights as those granted to U.S. citizens – the UAE is a not a democracy, and what the ruling sheikhs say, goes.

On Sunday, UAE officials announced that it would block BlackBerry mobile services. The rationale: to improve security. Apparently, the experts at Research in Motion (RIM), the producers of the BlackBerry, have done an excellent job encrypting information sent to and from the smart phone. The encryption is so effective in fact that UAE security services can’t hack it, meaning they can’t monitor it in search of potential threats – hence the block on BB mobile services. Clearly, the UAE is striving for security in every way, but at what cost?

When I worked in the UAE, I became familiar with threats in the region and the steps needed to secure the country. A mighty task but one the Emirates take seriously. But this move to block BB services comes at a high cost to those seeking information in the UAE. Here is an example.

Currently, if you access the Internet in the Emirates and you are looking for information about human rights abuses that occur there, a quick Google search reveals that the Human Rights Watch website has a page dedicated to the UAE. Click the link, but whoops:

“We apologize the site you are attempting to visit has been blocked due to its content being inconsistent with the religious, cultural, political and moral values of the United Arab Emirates.”

I did this exact search while living in Abu Dhabi, and when I received that message, I went straight for my BlackBerry. The state-owned communications giant Etisalat can monitor and control Internet servers, but my BB helped me find the information the UAE government didn’t want me to.

It’s a fact of life in most Middle Eastern countries (and others around the world) that communications are monitored by the state. Looking at this from the Land of the Free, one might feel a sense of relief that we enjoy liberty and the right to read, write and say anything we like (within the law, that is) without fear of government intervention. But we must remember that maintaining our individual freedoms is a never-ending struggle.

A Washington Post article this week quotes the U.S. State Department, which is criticizing the UAE’s decision. Yet, as the reporter notes, in another Post article from last week we find that the Administration is attempting to provide the FBI with more authority to demand “electronic communication transactional records” without a court order.

Though our governing styles are starkly different, are our approaches to security really that dissimilar?

We’ve had our challenges reconciling security needs with individual freedom and right to privacy. I need not review the public reactions to the Patriot Act or other instances in our history where elements of the government have sought information to the perceived detriment of the American people.

Should al Qaeda land another blow, whispers of a right to privacy would likely die out quickly amidst voices shouting that we must do more to defeat our enemies. In this way, the ban on BB mobile services in the UAE is not as far from U.S. practice as it might seem.

Both countries are pursuing security for the sake of its citizens. But at what point does this good intention cross the line into excessive intrusion? And if undemocratic countries are levying security tactics that violate a right to freedom and privacy, and similar efforts are pursued here in America, what does that say about the legitimacy of our freedom?

Justin Hienz is Managing Editor for Security Debrief and a Senior Account Executive at Adfero Group.

Can Police Agencies Perform Meaningful Predictive Analysis?

Monday, August 2nd, 2010

It amazes me how “good theoretical concepts” in law enforcement and the “programs derived from them” consistently get diluted as they are put in place at the operational level. They usually look nothing like what was on the drawing board.

Why is this? One continually hears police executives talk about strategy and then spend their days and most of their time focusing on tactical activity and decisions. Usually the “strategy” goes out the window.

Police executives agree that strategic work like data mining and using advanced tools to predict crime are great things. But very few agencies are actually doing this operationally.  I know improvement is possible. Law enforcement agencies can create more actionable intelligence from the stores of information they currently hold by applying advanced analytical techniques to that information.

Understanding that information transforms into intelligence is the key. The vetting process that takes place during this transformation usually means that action can and should be taken.

Understanding what action should be taken is also important. Is it opening a full-blown investigation, conducting surveillance, or interviewing a witness or suspect? Something can and should be done, but what is it, and who is going to do it?

There are a lot of moving parts here. A typical intelligence cycle model shows a lot of information coming from myriad sources. Some part of a given agency does something to that information, and hopefully an intelligence product goes out.

But out to where? Ideally, processes are in place to send intelligence to command for strategic decision-making – and out to operations for tactical decision-making. And to case support as well for enhanced situational awareness in the operational environment.

Getting intelligence to command is relatively easy with few moving parts. Whether command does anything with it, however, is another story. Getting intelligence to operations is tricky with a lot of moving parts. How does it get to operations in a meaningful time-frame and in a usable format?

As you strive to get timely, meaningful intelligence to your operators, the question to ask is, “Do I have the appropriate technology and processes I need, in the hands of the right people in the organization to get the job done?”

If the Cargo is not Screened, It Does Not Fly

Friday, July 30th, 2010

By Adam Salerno

Businesses Reengineering the Supply Chain for 100 Percent Screening

When Congress passed the Implementing Recommendations of the 9/11 Commission Act of 2007, the law mandated 100 Percent Screening of cargo onboard passenger aircraft “commensurate with checked baggage.”  The deadline for that mandate is this weekend, August 1, 2010.  The law seeks to ensure that all 20 million lbs. of cargo is screened in advance of flights for explosive detection prior to transport.  As Douglas Brittin, the Director of Cargo Security at the Transportation Security Administration (TSA) says, “On August 1, if the cargo is not screened, it does not fly”.

In today’s economy, a vibrant supply chain can ensure that companies have instant access to overnight delivery to nearly 85 percent of the world’s population.  While a changing world dictates new necessities to secure the supply chain, the need for expedited trade is an important priority that must be maintained.  The U.S. Chamber of Commerce recognizes this fact, which is why we support a multi layered risk based approach to security which maximizes effectiveness and minimizes impact on businesses.

As with any unfunded mandate, the private sector was tasked with financing this effort and working with TSA to ensure this goal is accomplished. The cost has been dramatic.  Most air carriers estimate their costs to be in the tens of millions of dollars range. That figure does not include delays or increasing lead time in the supply chain. To add complexity to the issue, the mandate also included all incoming cargo from around the globe be screened. In short, the law forced companies to completely reengineer their supply chain.

To push the mandate out of the confines of the airport, TSA developed the Certified Cargo Screening Program (CCSP).  CCSP allows other trusted shippers in the supply chain to participate in the screening process, by securing their facilities, and the chain of custody from manufacturing to the belly of the aircraft.  This too proved extremely costly for industry, but something that businesses in all modes of transportation have stepped up for.

Once the domestic deadline is hit, the focus will shift to international inbound flights. TSA needs to step forward at this point and begin to recognize foreign screening methods.  Again, because of the nature of the unfunded mandate, it is clear that TSA has not had the resources to pursue this goal yet.  However, programs like the German Aviation Security Program or the newly released European Union Framework 300, Rule 185 are comprehensive programs that mirror the basic fundamentals of the TSA program domestically.  Working with the international community to ensure that our programs are mutually accepted is essential to ensure that businesses are not duplicating an already burdensome process.

It has been a long and costly road for industry, but with the August 1, 2010 deadline just days away, many are feeling cautiously optimistic that the deadline will be met. Thanks to the ingenuity of the freight forwarders, the airlines, and participants in CCSP, because without their time, effort, and serious investment, a dramatic halt of trade would have become reality. Their investment in security ensured that commerce will continue to move forward at the speed businesses rely on in the air environment.

Adam Salerno is a Senior Manager in the National Security and Emergency Preparedness Department at the U.S. Chamber of Commerce. He also manages the Chamber’s Global Supply Chain Security Working Group.

This piece was originally posted on The ChamberPost, the blog for the U.S. Chamber of Commerce.

Politics vs. Security – A Tale of Two Committees

Thursday, July 29th, 2010

Two Senate committees, three chemical security bills and one issue to rule them all – the role of so-called Inherently Safer Technologies (ISTs) in America’s approach to safeguarding communities from acts of terrorism.  With DHS’ Chemical Facilities Anti-Terrorism Standards (CFATS) set to expire in October, lawmakers in the Senate are taking steps to keep it alive. What form the program ultimately takes will depend on whether legislators choose to focus on politics or national security.

Here’s where members agree:
1. CFATS, at least in its general form, needs to be maintained
2. The exclusion of drinking water and wastewater systems from CFATS (or a CFATS-like regime) presents a “security gap” due to their use of hazardous chemicals, such as gaseous chlorine

Here’s where members disagree:
1. Whether the existing CFATS program should be made permanent
2. Whether CFATS should be expanded to include other provisions, such as a requirement that certain facilities assess and/or implement IST

Due to jurisdictional issues in the Senate, the Homeland Security and Government Affairs Committee (HSGAC) can only address provisions relating to chemical facilities. The Environment and Public Works (EPW) Committee can only address provisions relating to drinking water and wastewater systems.

Both committees held proceedings on chemical security this week. Here’s how things panned out:

  • HSGAC’s Ranking Member, Susan Collins (R-ME), chose to scrap her own bill (S. 2996, the Continuing Chemical Facilities Antiterrorism Security Act of 2010) in order to report out an amended version of H.R. 2868, the Chemical and Water Security Act of 2009 – which would now extend CFATS for three-years and excludes IST provisions. It passed 13-0 with bipartisan support.
  • EPW used Senator Frank Lautenberg’s (D-NJ) bill (S. 3598, the Secure Water Facilities Act) as a backdrop for its hearing.  S. 3598, which includes a strong IST component, does not have bipartisan support.  The hearing was used to extol the virtues of providing the government with IST mandate authority.

HSGAC, which spent most of its time addressing how factors such as risk, vulnerabilities, and consequence impact chemical security, passed a Republican-drafted amendment with unanimous support and moved us closer to establishing a permanent CFATS program. EPW used a hearing as a platform to play politics.

You tell me who got it right.

Should We Seek Cyber Attribution?

Monday, July 26th, 2010

Several news items of late have addressed the thorny issue of cyber attribution; that is, the ability to identify the sources of Web and network attacks. For cyber companies and some government agencies, attribution is the Holy Grail.  Without attribution, there can be no real retribution for cyber attacks. If you don’t know (with certainty) who did it, you cannot respond. If you cannot respond, even if you have the means to do so, you become an impotent giant and therefore have no deterrence.

The counter augment, made last week by several experts before Congress, is that if we develop a means of attribution (technology that attributes cyber attacks to the criminals who conducted them), soon bad governments will get it too. They will surely use it against dissident elements inside their own countries to suppress free speech and abridge other civil rights of all sorts. Some folks in the United States worry that our own government will use technology of this sort for similarly nefarious purposes.

So, should we consciously forgo the possibility of deterring bad guys from cyber crime, cyber terror and cyber war because the technology could be used badly? I think the answer is clearly “no.”

Even if the United States and our democratic allies chose not to pursue the sort of technology needed to attribute cyber attacks, repressive countries will still eventually develop their own and use it against their people. We should be as vigorous as possible in discouraging the repression of civil rights, but we cannot give up the possibility of adding to our own protection.

This is one of those situations where national interests trump our idealist desires. If we could keep the attribution technology away forever, you might have an argument, but that is a pipe dream. We should develop it as soon as possible, keep it as closely held as we can for as long as we can, and then use diplomacy to mitigate its improper use.  In some cases, that is the best we can do.

Secrets in the News: Classified Crossings that Go Too Far

Monday, July 26th, 2010

For the second straight week, Washington, DC and the nation are reeling from headlines and news coverage of events on the national security stage. Last week, it was the Washington Post’s series on Top Secret America, which details the explosive growth of the intelligence apparatus since 9/11. This week, it is the release of nearly 92,000 pages of classified details on the ongoing conflict in Afghanistan.

While the Post series had the cooperation of the public affairs operations with the various intelligence agencies, combined with the exhaustive research work of the series authors and support staff, the stories this week come courtesy of the WikiLeaks website. Described by CNN and other media outlets as a “whistleblower site,” WikiLeaks has effectively pulled back the curtain with U.S. military and intelligence documents that give no-holds-barred descriptions of the state of U.S. combat operations. Based upon what has been reported, the picture these documents paint is not very promising. While certainly making for an interesting and fascinating read, the release of these documents and the recent Post series begs the question: “Is there anything the media will not share?”

Despite the valid questions raised, I still have tremendous misgivings about what the Post printed last week, as I believe that in identifying the physical locations of critical public and private sector operations, the Post put every person at those places at a risk of greater harm from those who wish to do us harm.

As for the WikiLeaks postings, I find it equally deeply troubling that the President, his senior National Security Team and our military leadership can not obtain unvarnished reports without having the risk of someone, somewhere posting them for all to see. What has been shared is a tremendous violation of trust amongst military/intelligence personnel that goes beyond the traditional Washington leak to a reporter.

The actions taken by this leaker are also illegal. As anyone who has ever held a security clearance knows, when entrusted with such information, your mouth is to remain shut; you share nothing with anyone who is not properly cleared. If you have a problem with what you read and want to raise an objection, there are ways to do so without violating the code of trust you swore to uphold.  If you break these tenets, you’ve committed a crime. Period.

I’m sure if the leaker of these documents is caught, he/she will claim all of the First Amendment, Freedom of the Press rights he/she can muster, but in the job they are supposed to be in, they are not acting as a journalist. They are acting as a criminal. Every military leader, including our Commander in Chief, should be afforded the ability to get unvarnished reporting of what is or is not happening on the battlefields where our military personnel serve and not have to see it spread over a newspaper or on the Internet for the world to also see.

The leaker in this case has a unique agenda to pursue and that should not be overlooked or forgotten. Regardless of whether the information is classified or unclassified, every leak to a reporter is about imposing an agenda for further distribution. It is obvious that the person behind this leak has grave reservations about a fight our President has declared “worth fighting.”

That is an argument that good people on both sides of that issue can debate, but doing so at the expense of releasing classified information is a bridge too far.

I am not naive enough to believe that everything in Afghanistan is going swimmingly. Nor do I believe that every word from our political and military establishment is absolute truth. But I am disturbed that in era where our media is in an ever present game of “gotcha,” media outlets feel the need to take one more step to share details that are classified for very good reasons.

For as interested as we may all be in what is really happening in the intelligence community and in Afghanistan, there is also a responsibility to not reveal everything. That is a line I think individuals and organizations like the WikiLeaks source, the Washington Post and others seem to cherish crossing. That’s an agenda in which I find little comfort.

Data Mining Tools for Law Enforcement?

Thursday, July 22nd, 2010

Recently, there’s been a trend toward some agencies purchasing new data mining tools for their needs at fusion centers.  It is great to see this investment in technology, but watch out – many of these solutions don’t have any inherent method for capturing Suspicious Activity Reports (SARs) and Request for Service (RFS) data, which fusion centers use to track case management activities.

Also, these new data mining tools typically don’t communicate bi-directionally with Regional Information Sharing Systems (RISS), nor can they communicate with National Data Exchange system (NDEX), the FBI’s information-sharing platform.

In fact, many of these software vendors don’t understand these systems need to comply with 28CFR23, the federal guideline that governs intelligence sharing.

Let’s review the four types of data that law enforcement officers encounter in their work:

1. Open-Source Data – Anything from the Internet, newspapers, other public sources [No prohibitions to sharing]

2. SARs – Information reported by citizens or police; no identifiable crime being committed but something’s suspicious [Can be shared between agencies under National SAR Initiative]

3. Investigative related – Evidence or information collected from a crime that has been committed with a goal to prosecute or prevent crimes [data sharing polices vary widely]

4. Intelligence –  Important data in assessing threats to the community; proactive, strategic analysis conducted and patterns of activities are identified; resources focus on problem at hand, be it street gangs or organized crime [28CFR23 governs this type of data – If information rises to level of reasonable suspicion, then it can be entered into an intelligence system and shared with other agencies.]

All four types of data streams have separate and distinct laws governing what law enforcement can and cannot do with them.

Agencies want to ensure that they are holding data consistent with all the rules and regulations. But if the data mining technology companies have not considered any of the aforementioned issues, their tools are putting fusion centers at risk of violating statutes, laws and regulations.

One fusion center I use as an example vetted vendors with this criteria, and instead of settling for a one-size fits all intelligence analysis system, it selected one vendor for information/intelligence management and another for analyzing the information managed by the other system.

This is what should be happening more often – using the right tool for the right job.

Bottom line: Look for technology companies that know the compliance landscape.

Building a 21st-Century Strategy to Counter Piracy and al Shabaab

Thursday, July 22nd, 2010

The piracy question and how to deal with it is huge and is about to become a much larger question in the global supply-chain management continuum. I, like other folks, would like nothing more then to send in the Marines and clean out the nest of pirates. But alas, the days of gunboat diplomacy are of a bygone era.

We now engage our adversaries with not only guns and bullets, but also batteries to run our high-tech systems. Increasingly more important is the new adage, “bring lawyers, guns and money.” Nation building will take a great deal of finesse and understanding, as well as forceful measures.

One of these first opening salvos has been fired by the White House, though it seems to have been ignored by the business community with an interest in these matters. The Presidential Executive Order (EO), issued in April 2010, prevents U.S. citizens/entities from making payments to certain named individuals. It also has the potential to prevent any payments to individuals or groups involved in or supporting piracy in Somalia.

The regulatory guidelines for implementing this EO are yet to be promulgated, but given the recent Shabaab attack in Kampala, Uganda, in which at least one U.S. citizen was killed (a crime being investigated by the FBI), one can reasonably expect the enforcement issue of the EO to be forthcoming.

Shabaab is known to have sworn allegiance to bin Laden and Qaeda, and this Shabaab attack will clearly articulate the connections between piracy ransoms, Shabaab and the broader global war on terror. The probable outcome, in my opinion, will be the Lloyds, Joint Hull & Joint War Committees declaring that they will no longer underwrite insurance for kidnap and ransom in this arena. And now the lawyers and money come to the forefront.

In order to operate the critical sea lanes in the Gulf of Aden and the Somali environs, government resources from concerned nations will need to be deployed. The United States may not be the principal user of these lanes, but we are likely one of the principal end-users of the output from the associated supply chain. For this reason, it is important that we gain understanding and proactively look for how we engage the piracy issue. At least 85 percent of our critical infrastructure is privately held, and therein lays the bulk of the responsibility for defending those nodes. Building coalitions across industry and national borders, sharing information and supporting combined military action when needed will be a key effort to meeting the threat.

In one of his first acts of president, Thomas Jefferson met the challenge of pirates. Now, 200 years later, we face a similar situation, which will indeed need lawyers, guns and money. It will also take intelligence, technology and collaboration.

The New Face of Aviation Security?

Wednesday, July 21st, 2010

The hunt for someone to lead the Transportation Security Administration (TSA) began in 2009, but it wasn’t until June this year that the Senate confirmed John Pistole as administrator. Pistole was the third nominee for the job, after two earlier hopefuls pulled out (see Southers and Harding). Security Debrief followed the confirmation process every step of the way and found the latest development in this week’s Air Cargo Week.

If you visit TSA’s website, you’ll find Pistole’s photo, which looks like this:

John Pistole

In Air Cargo Week’s Arrivals & Departures section, there is a note on Pistole’s confirmation (first bullet, right column). But the photo referenced is clearly not John Pistole.

Arrivals&Departures, Air Cargo Week, 7/19

Who is this man? Nominee #4? A hero cargo pilot? The publisher’s cousin?

It’s Chris Battle, Security Debrief’s founder and editor.

That’s some good PR.

©2008 Adfero Group. All Rights Reserved.