Chapter 22

Specific Security Threats

Goal: To identify major security threats- Economic Crime, Burglary, Robbery, Bombs, Espionage and Piracy, and discuss various ways to combat them.

Objectives:

• Discuss Economic Crime in terms of white collar criminals and the impact it has on the economy in particular businesses.

• Discuss Burglary as a problem, identifying various targets and techniques used to reduce exposure to burglary.

• Discuss Robbery as a problem, identifying various targets and techniques used to reduce exposure to Robbery.

• Discuss the threats of espionage and piracy and the techniques used to reduce exposure to those threats.

• Understand the security concerns related to labor disputes.

Lecture:

This chapter treats some of the more common security threats. First, we see Economic or White Collar crime, a term coined by Edwin Sutherland in 1939, and referring to occupation-related crime. Two other prominent crimes, often confused, are treated. Burglary is defined as "any unlawful entry into a building to commit a crime." It is a property crime. Robbery is " the stealing or taking anything of value by force, violence or fear (threat)."

Espionage, particularly industrial espionage, is defined as "theft of trade secrets or confidential information." This has particular meaning to high tech industries, whose procedures are often sought by other countries. Of course, military espionage - gathering information about one's military adversaries is still going on, despite the end of the Cold War. The Russians, the French, the Israelis, and others are still spying on us. And, we are still spying on them. Aldrich Ames, formerly of the CIA, and Robert Hansen, formerly of the FBI, are proof that spying is still going on.

Piracy is "illegal copying of copyrighted materials by unauthorized means." It is common in the recording industry-cassettes and CDs, but is also common in counterfeiting and television, radio and live performances, in addition to things like clothing (in the news a year ago - Nov 16th, 2002, there is a story about the GenX clothing stores being shut down because they are selling allegedly "pirated or counterfeited clothing"-, automobile repair parts, and even things like nuts and bolts used on commercial and military aircraft. How would you like to fly on a commercial airliner with jet engine repair parts that were counterfeited in some third world country?!

Let's talk a little more on the subjects above.

White Collar crime: with all the stuff in the news about Enron, WorldCom, Arthur Andersen Company, Martha Stewart (who just got five months in jail), and others, I think it is abundantly clear that white collar crime is still going on. Now it's reached the highest levels of industry. You and I, as security professionals, are not normally involved in this - it's usually discovered and investigated by people with strong accounting skills. If you are serious about a security career, you might want to consider taking at least a basic accounting course. White collar crime also includes deceptive practices by professionals such as doctors who file fake Medicare claims and lawyers who embezzle funds out of trusts they are overseeing.

I would lump into white collar crime certain non-violent confidence games such as the "pigeon drop" or the "bank examiner swindle." I did my master's thesis on con games back in the early 70's. In the bank examiner swindle, the con man calls you up and says he's with the "Federal Bank Examiner's Office." He says he's checking on embezzlement at local banks and asks what bank you use. (At this point you should hang up and report this to the police!) If you answer him, "I bank at First Bank," he asks you to get your latest statement. You do and you tell him you have $3,000 in your account. He tells you his associate will be right over. In a while, a well-dressed young woman shows up, flashes a badge, and asks to see your statement. She informs you that this is one of the accounts they are looking into and asks you to accompany her to the bank. Outside the bank, you are met by her male partner, who is the one who called you in the first place. Often one will be black and the other white - this helps play on racial perceptions and usually lets the victim, regardless of race, feel that these two can't be in cahoots. They tell you to go into the bank and withdraw your money and bring it out to them. When you do so, they go through an elaborate receipting process. They may examine the money and put it into an envelope. Then they distract you, hand you a similar envelope and tell you to go back in and redeposit the money. When you get to the window, you find that the envelope contains only newspaper. When you go back outside, they are gone.

Currently there is an elaborate con game that is hitting many businesses. It's the so-called Nigerian Scam. Here's a link:

Nigeria - The 419 Coalition Website

Our employees get letters and e-mails from Nigeria fairly frequently. We tell them to simply trash them. The Secret Service has a site you can report them to, but there are so many of these letters and e-mails there is no way to keep up. Believe it or not, there have been people who have fallen for the Nigerian Scam and lost money; I understand at least one American has been killed.

Burglary and Robbery - keep in mind that these are not the same! Burglary involves illegal breaking-in and entry. Burglars sometime take things, sometimes commit other crimes such as rape. Sometimes they do perverted things such as simply stand there and watch people sleeping (usually this causes them sexual arousal and satisfaction). Robbery involves violence or the threat of violence and the demand for money or something else of value. Sometimes, burglars and robbers (especially robbers) enjoy high status in prisons.

Espionage, as we noted above, is still a security concern. In the beginning of the course, we talked about the National Industrial Security Program (NISP) and the National Industrial Security Program Operating Manual (NISPOM). This program and the related NISPOM apply to defense contractors who have classified contracts with the Department of Defense. Under these contracts, the contractors have access to and possess classified classified documents and, perhaps, hardware. The materials are classified Confidential, Secret, and Top Secret. (Confidential is the lowest level and Top Secret is the highest.) There are also Special Access Programs ("SAPs") that are ultra-sensitive. Officially, they don't exist. At any rate, all these classified programs, documents, and hardware have security measures spelled out. The companies that have these programs must also have a person designated as the Facility Security Officer or FSO. In my organization, the FSO reports to me. He or she manages the NISP, obtains security clearances for those employees who need security clearances (provided by the U.S. Department of Defense of other government agency), makes sure all materials are properly safeguarded, and conducts training of personnel who are involved in the NISP. The Defense Security Service (DSS) conducts regular compliance inspections.

Companies also have information, processes, business plans, etc., that are not classified but that are proprietary. These must be marked and properly protected. Imagine the damage that can be done by a competitor who finds your company's pricing information on a program on which both of you are bidding. You may have read recently about a case in which Boeing hired away some guys from Lockheed Martin and obtained Lockheed Martin proprietary information. Boeing is in trouble for this. There are laws that punish economic espionage as well the the traditional national espionage.

As we noted above, espionage can be carried out by another nation or by a domestic competitor.

The security manager's response to the espionage threat is to have a strong program that complies with the NISP (if the company has work that falls under that program) and a strong program to safeguard proprietary information. This means policies have to be in place, employees need to be trained, materials need to be marked, and security measures (entry control, locks, etc.) need to be in place and enforced.

Before we leave the subject of espionage, I need to stress something: this is "need-to-know." This term means that anyone having access to sensitive information needs to have a reason for that access. Let's say that I have a Top Secret security clearance for a government program. In the HR department, there are employee files that are not classified but that are proprietary. The are marked "Sensitive - Human Resources only." I am not in the HR department but I go there and say, "I need to see the files on some guy who are in the same grade as I am. I need to see if they are getting paid more than I." The HR person says, "You can't see that information." I say, "Hey, I have a Top Secret clearance!" The HR person says, "Yes, you do, but you don't have the need -to-know for access to this information. Go away." The HR person is correct.

Piracy or counterfeiting is yet another concern. It applies to everything from t-shirts (such as the pirated Harley-Davidson t-shirt I had from Russia that fell apart the first time I washed it ) to counterfeit spark plugs. In between are pirated music and movie discs, high end leather goods, running shoes. I remember when I was in Viet Nam the thing to have was a Seiko watch. These are popular now but were just coming out back in the late 60s. I could buy one through the PX system for about $20. I could also go down to the village and buy one for $10. If I looked closely at the one in the village, I would note that instead of "Seiko" on the dial, it said "Senko." It would run until the next time it rained, which was probably an hour after I bought it. Even today, you can buy fake Rolex watches that are very good looking fakes, for much less than the real article. Who suffers? Well, many suffer. The customer suffers because most often the fake is nowhere near the quality of the real article. In fact, the customer may be many people who could suffer. Take the case of counterfeit bolts on a plane, the entire plane could crash, killing many innocent people. The manufacturer of the real article suffers because it loses the income from the sales it could have made but lost to the lower-priced, lower quality item made by the counterfeiter. And the national economy suffers due to lost growth of GNP (gross national product).

As far as piracy is concerned, the security manager's role is primarily in the function of protecting proprietary information, assisting in investigated allegations of piracy, and usually working with the company and agencies such as the FBI in prosecuting suspected counterfeiters of product.

Read the info on labor disputes in the text, pages 436-438. Union activities, including organizing campaigns, as well as strikes, can be real security threats to a company. During these activities there are concerns about theft, workplace violence, trespass, sabotage, even espionage. Real messy!!

No assignment!