Fluent Essays

I am currently working on these assignments ... help is needed to finish them. CJ513 Unit 4 DQ Topic #1 The Effects of State-Sponsored Terrorism What are the primary effects of state-sponsored terrorism on the domestic and global communities? How does state-sponsored terrorism impact the political, economic, and social factors within these communities? Which of these factors would you argue is most significantly impacted by state-sponsored terrorism, and why? Be sure to include specific examples to support your post. Topic #1 Student Response #1 (Respond to Damon) Damon Bradshaw                           State-Sponsored Terrorism State-sponsored terrorism is a type of crime carried out by governments or non-profit organizations funded by the government, increasing the threat of global instability and creating a broader social and political divide. State-sponsored terrorism has become a growing threat to the world’s nations and can affect any country, regardless of its status (Wolf, 2017). The impact of state-sponsored terrorist activities is severe and systemic. Most countries have experienced significant changes within their public and private organizations. When a terrorist attack occurs, the international community response is altered (Wolf, 2017). According to Wolf (2017), this undermines the efforts of governments to address the basic needs of their citizens and straining their limited resources. While authoritarian governments are oppressive, they create a degree of stability (Mackintosh & Duplat, 2013). This fact makes it harder for state-sponsored terrorism to operate in nations that have adopted democracy. Mackintosh and Duplat (2013) note that stability is a critical component of the dialogue on terrorism. It helps prevent terrorist organizations from recruiting in underdeveloped regions where the government is weak. State-sponsored terrorism destabilizes economies by targeting businesses and affecting their profitability operating in the regions (Mackintosh & Duplat, 2013). The Inter-Service Intelligence (ISI) is Pakistan’s leading intelligence agency that operates through various divisions and agencies. According to Williams, Koch, and Smith (2013), ISI has been accused of participating in various state-sponsored terrorist activities such as the Mumbai train bombing and the Indian parliament attack. These attacks impact the victim countries politically the most as it trickles down, affecting society. Political arrangements that shape government formation make it more vulnerable to the effects of violent action than those decided by the people themselves (Williams, Koch, & Smith, 2013). Wolf, S. O. (2017). Pakistan and state-sponsored terrorism in South Asia. In Terrorism Revisited (pp. 109-155). Springer, Cham. Mackintosh, K., & Duplat, P. (2013). Study of the impact of donor counter-terrorism measures on principled humanitarian action. UN. Williams, L. K., Koch, M. T., & Smith, J. M. (2013). The political consequences of terrorism: Terror events, casualties, and government duration. International Studies Perspectives, 14(3), 343-361. Topic #1 Student Response #2 (Respond to David) David Carusotto Hello All, State-sponsored terrorism is the most severe type of terrorism since there is almost unlimited funding. States that sponsor terrorism often provide the terrorism groups with things such as money and or equipment (Berkowitz, 2018). In the domestic communities, they are forced to go along with the program because, most likely, their states are funding the organizations (Berkowitz, 2018). On the global scale, it falls onto other countries to step in and stop terrorism or funding. An example of this could be through military force and economic sanctions (Martin, 2018). State-sponsored terrorism impacted the political scene because a particular political party could be the one providing the funding in hopes that the terrorist group could insight fear into people voting a certain way (Berkowitz, 2018). State-sponsored terrorism could affect economics through economic sanctions. A possibility is that they could have sanctions placed on them due to funding terrorism, then the citizens of the country could feel the pain of this as prices sky rocket or goods are not allowed into the country. Having a state-sponsored terrorist group in your community could place fear on those who reside in the country (Berkowitz, 2018). It would be hard to believe in your government knowing that they are funding terrorist groups. Thank you, Dave Berkowitz, J. M. (2018, July/August). Delegating terror: Principle-agent based decision making in state sponsorship of terrorism. International Interactions, 44(4), 709-748. Martin, G. (2018). Essentials of Terrorism: Concepts and Controversies (5th ed.). Sage. Topic #1 Student Response #3 (Respond to Travis) Travis Reed Good Morning Y’all State-sponsored terrorism is the support of extremist non-governmental groups encouraging them to involve in terrorist acts. State sponsorship to terrorist groups can be achieved through several ways including direct funding, supply of weapons, provision of training, and hosting of terrorism groups with state borders. State-sponsored terrorism is an increasing threat around the world that has adverse effects on both the domestic and global communities (Carter & Pant, 2017). State-sponsored terrorism impacts the social, political, and economic factors of a country. State-sponsored terrorism results in remote military vengeance and increases border conflicts between countries that sponsor terrorism and those which are putting efforts to combat terrorism and promote peace (Carter & Pant, 2017). This causes tension among the domestic and global communities by interfering with national peace. State-sponsored terrorism creates political threats and tension in democratic countries that are committed to promoting peace (Carter & Pant, 2017). This political instability not only affects communities within but also affects communities abroad. In terms of social impacts, state-sponsored terrorism affects key social indicators including education, health, and poverty levels (Carter & Pant, 2017). The threats imposed by these attacks slow down social development because people are in constant fear and tension of attack. People are unable to socialize freely locally and also international visitors and tourists reduce their frequency. Destabilization of both political and social factors leads to slower economic growth and impacts macroeconomic variables. (Carter & Pant, 2017) For instance, tourism which has a great influence on most countries may heavily be affected by state-sponsored terrorism reducing revenue generation. For instance, various state-sponsored attacks on Kenya by Somalia Al-Shabaab groups have had a great negative influence on the flow of tourists into the country, reducing revenue generation from the tourism sector. The economic sector is greatly affected by state-sponsored terrorism because both social and political effects also influence economic growth.    References Carter, D. B., & Pant, S. (2017). Terrorism and State Sponsorship in World Politics. In The          Oxford Handbook of Terrorism. Topic #2 The Effects of Non-State-Sponsored Terrorism Consider the political, social, and economic effects of terrorist attacks committed by non-state actors. How do these effects differ, if at all, from the effects of state-sponsored terrorism? Would you argue that the political origin of terrorist attacks (state-sponsored vs. non-state-sponsored) alters the effects on the domestic and global communities, and why? Be sure to include specific examples to support your post. Topic #2 Student Response #1 (Respond to Travis) Travis Reed Good Morning Y’all Terrorism from non-state actors imposes various effects on the societies that it targets. While some effects can be limited to the specific period of attack and shortly after, the current extremist groups of terrorism such as ISIS and Al-Qaeda inflicts heavy and long-lasting negative effect which may not change over time. Sometimes it gets worse due to the effect on the social, political, or economic sector of the community affected.  Non-state-sponsored terrorism affects the political stability of a nation by creating terror, fear, and a feeling of insecurity, and the ideology that the leaders do not have enough capacity to protect the people (Berti, 2018). In terms of social impacts, this kind of terrorism affects the unity of different societies (Berti, 2018). For instance, most extremist groups have an Islam origin, and therefore, their attacks target people from other religions especially Christians and Jews. This has created a social tension between these religions and Islam religion creating a sense of hatred and division. In addition, it affects the culture of a country in that people are not free to run their daily activities as usual, due to fear of attacks. Economic-wise, non-state-sponsored terrorism causes high investments in implementing counterterrorism policies (Berti, 2018). In addition, this kind of terrorism causes tension in a country hence reducing the flow of tourists.  This effect is evident in Kenya, which has for the longest time experienced a threat of attack by the Al Shabaab group of Somalia.  These effects do not vary much from the effects of state-sponsored terrorism. Most effects are similar such as political instability and economic slowdown. However, the political effect of state-sponsored terrorism is greater than for non-state-sponsored terrorism because of the direct enmity created between the countries involved. Therefore, the origin of terrorist attacks has a slight effect on effects towards domestic and global communities.    References Berti, B. (2018). Violent and criminal non-state actors. The Oxford handbook of governance and limited statehood, 272-290. Topic #2 Student Response #2 (Respond to Shuree) Shuree Spencer Johnson Non-State Terrorism is what we hear most as it can be from other countries or even unknown units and usually cause the most fear across the nation and its something that is harder to control and protect the citizens from. State terrorism is when a state commits terrorist acts against another state or even their own people. The difference is with state there is either a specific target or group for political reasons and can even use fear among their own people as backlash or acts or forced protection. When it comes to non-state it could be directed at anyone and everyone and have religious, terror, or just wanting to cause destructive reasons. State terrorism will try to be swept under the rug to maintain the image of order and safety across the United States or in that specific country among one another, but will usually blow up non-state terrorism for fear reasons and for border security reasons.  Terrorism by the state is still terrorism. University of Birmingham. (n.d.).  https://www.birmingham.ac.uk/research/perspective/terrorism-by-the-state-is-still-terrorism.aspx. Martin, G. (2018). Essentials of Terrorism: Concepts and Controversies (5th ed.). Sage. Topic #2 Student Response #3 (Respond to Dave) David Carusotto Hello All, Non-state-sponsored terrorist groups differ from state-sponsored groups because these terrorists are funding themselves. This means that they do not have to answer anyone because they are supplying themselves with their materials. Non-state-sponsored terrorists have the ability to be the most dangerous because they are of their free will (Said, 2021). The political effects of this are that politicians may answer terrorist groups out of fear that the terrorist group can directly impact them (Said, 2021). As for social effects, self-funded terrorist groups are the most dangerous and cause substantial fear within society (Martin, 2018). As for the economic effects, these terrorist groups can cause economic turmoil out of fear of people not leaving their homes and putting money into the society or requesting ransom money from governments in return for peace. I would argue that the political origin of the terrorist alters the effect on domestic and global communities. I feel that there is more out crying support for governments to help combat non-state-funded terrorist groups. When a terrorist group is state-funded, many countries turn a blind eye to what is being done. Thank you, Dave Martin, G. (2018). Essentials of Terrorism: Concepts and Controversies (5th ed.). Sage. Said, W. E. (2021, April). The destabilizing effect of terrorism in the international human rights regime. UCLA Law Review, 67(6), 1800-1819. CJ513 Unit 4 Assignment Effects of Terrorism on the Domestic and Global Communities In a 4- to 6-page paper, discuss the effects of terrorism on the domestic and global communities. Select three specific terrorist attacks that have occurred against the United States, either at home or abroad, and discuss the impacts of each of these attacks on the domestic and global communities with regard to political, economic, and social factors. Based upon your discussion, what conclusions can be drawn about the overall effects of terrorism regarding each of these factors? Use at least two credible sources beyond the assigned reading and discuss how you evaluated the credibility of each source. You may consult the Library, the internet, the textbook, other course material, and any other outside resources in supporting your task, using proper citations and references in APA style. Download the Unit 4 Assignment Checklist. Directions for Submitting Your Assignment Compose your essay in Word and save it with a name you will remember. Be sure to include your name, class, and unit number in your essay. Submit your Assignment by selecting the Unit 4: Assignment Dropbox by the end of Unit 4 HM502 Unit 4 DQ Topic 1: Emergency Management Strategies The three hazard mitigation plans examined in this unit each approach the challenge of eliminating or reducing risk somewhat differently. Some of the differences are based on geography and some are based on the assets threatened. A closer look at each plan should also reveal some similarities. The discussion below will enable those divergent and analogous characteristics to emerge. · Discuss how each plan conducts a threat assessment. · Describe how vulnerability and consequence assessments were conducted. · Describe how the risk assessment strategies and methodologies used in one plan could be applied to a different risk scenario. Topic #1 Student Response #1 (Respond to Skyler) Skyler Fry Each plan followed very similar pathways to determining the threat to the area of responsibility in respect to their specific plan. Each plan utilized past data sets such as previous occurrences / historical trends, likelihood of future occurrences, severity, and geographically specific threats. The Charleston plan provided a major advantage that the other plans seemed to miss which was the ability to pool their information and resources from regional participants rather than being restricted to the state or city level (Charleston County, 2019). The Charleston and Anaheim plans both also used surveys to rank what the public viewed as the biggest threat to the area. However, the effectiveness of surveys leaves much to be desired as the City of Anaheim only had 311 respondents (City of Anaheim Hazard Mitigation Task Force, 2017). Each plan utilized a task force or committee to further identify, assess, and rank threats to the geographical area. The vulnerability and consequence assessments varied on how the information was displayed depending on the plan but all included a break down by type of hazard, critical infrastructure, buildings, populations, planned projects, economy, ect.. However, federal level resources were utilized such as HAZUS and GIS floodplain mapping (State of New Jersey, Office of Emergency Management, 2007-2020). The risk assessment strategy and methodology utilized in the plans was directly derived from the Federal Criteria for Risk Assessment (City of Anaheim Hazard Mitigation Task Force, 2017). Therefore, the broad overview that is offered at the federal level can be applied to any risk scenario.  Charleston County. (2019).  Charleston regional hazard mitigation plan (2019). . Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf City of Anaheim Hazard Mitigation Task Force. (2017).  City of Anaheim hazard mitigation plan.  Retrieved from  http://local.anaheim.net/docs_agend/questys_pub/13502/13532/13533/13578/13581/2.%20Hazard%20Mitigation%20Plan13581.pdf State of New Jersey, Office of Emergency Management. (2007-2020).  2019 New Jersey State Hazard Mitigation Plan . Retrieved from  http://ready.nj.gov/mitigation/2019-mitigation-plan.shtml Topic #1 Student Response #2 (Respond to) Jeffery Bailey Hello classmates/Prof  When it comes to risk management, there is no cookie cutter risk assessment that fits every city or state the same. What may work for California with its wild- fire high risk potential, may not work for Alabama with its flood potential. In this discussion we talk of three different cities and their approaches to risk assessment.  Charleston County Regional Hazard Mitigation Plan. The county of Charleston based their principal risk program on the Federal Emergency Management Agency. Their aim is to teach communities how to become more hazard resistant. They accomplish by involving the public, private and non-profit sectors in forming partnerships. These partnerships were formed with the goal of reducing the amount of loss associated with in hazard they use a four-phase initiative to achieve this which are build community partnership, assess risk, prioritize needs, build support and communicate on addressing hazard preparedness and response. ANAHEIM HAZARD MITIGATION PLAN Anaheim uses a disaster mitigation act of 2000 known as public law act 2000 known as public 106-390 this act dictates how states and local government are to respond to planning, identifying hazard and potential losses DMA 2000 requires each state and local government to prepare and have a mitigation plan to be eligible for mitigation funds. Their basic plan revolves around promoting public policy designed to protect citizens b promoting public awareness. NEW JERSEY USES THE HAZARD MITIGATION PLAN (HMP) which is the corner stone to reducing New Jersey’s vulnerability to disasters. The HMP captures historic disaster experiences and presents to New Jersey potential hazards based on current science and research and through this research helps the city and state mitigate potential future hazard. NEW JERSEY USES a hazard mitigation process that can be used by any of the other two states. Their process of researching previous data and using science to predict future hazards is a basic process that can benefit all three states. The vulnerability of these planes occurs when you take into account the natural hazard proclivity for certain disasters such as New Jersey has an 18% of its land area I located in flood hazard area New Jersey has a high risk of wildfires also.     Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf     Retrieved from  https://www.fema.gov/sites/default/files/2020-06/fema-local-mitigation-plan-review-guide_09_30_2011.pdf   Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf   Topic 2: Emergency Management Strategies: Similarities and Differences The three risk assessment strategies that have been examined are similar in some respects and different in others. The choice of methodologies and processes used to assess risk are driven by a variety of factors to include geographical issues and asset realities. The similarities and differences found in each strategy reveal much about how planners approached risk assessment in their area of responsibility. · What are some of the key similarities between the plans? · Describe why some of the plans use similar processes and procedures. · What are some of the major differences between the plans? · Describe why some of the plans utilize different processes and procedures. Topic #2 Student Response #1 (Respond to Jeffery) Jeffery Bailey Hello classmates/Prof In risk management there are many different ways to go about achieving this goal. Researching the three different risk management styles I noticed that some similarities between them are community involvement, all three states realize that getting the community involved in risk mitigation proves to be very productive. Another similarity that the three states share in their programs is that they take a geographical assessment approach to their risk assessment plans. All three conduct vast studies and research on areas of their cities that are geographically vulnerable and use this information to assess risk probability.  They are also similar in that they all look to their local government for leadership and direction. It seems that the old adage of don’t reinvent the wheel, applies because these three states realize that there is a basic formula that works, and they all sample it. Another thing they share is vulnerabilities, these states all have areas that are particularly hazard vulnerable.   One major difference between them is Charleston focuses on their susceptibility to floods and they focus their mitigation on flood risk assessment. Anaheim in their mitigation plan focuses on their vulnerability of earthquakes, earthquakes is a continuous issue in California. Here is a different approach, the state of New Jersey uses land acquisitions as a form of mitigation. This involves a 75% FEMA funded plan that buys property from flood risk citizens to take them out of harm’s way. What a novel approach! All of these states use different approaches to their hazard risk assessment and mitigation. Each process is devised to address their particular problem area. They all use assets that are available from their local governments, they all incorporate the civilian population to get involvement and feedback as to what works and what doesn’t.   Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf     Retrieved from  https://www.fema.gov/sites/default/files/2020-06/fema-local-mitigation-plan-review-guide_09_30_2011.pdf   Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf Topic #2 Student Response #2 (Respond to Skyler) Skyler Fry While taken at face value each plan consists of a multi-hazard approach, however, community input and the way that the input is implemented varies greatly. The Charleston plan utilizes community survey to rand and determine what type of projects should take priority while also adding in additional goals provided by a hazard mitigation and public information committee (Charleston County, 2019).  The Anaheim plan relies on their risk and vulnerability assessment to determine the rankings of threats and strategies for mitigation efforts (City of Anaheim Hazard Mitigation Task Force, 2017). The New Jersey plan follows FEMA guidelines pretty closely while allowing the counties and municipalities to format their plans to fit the needs of their geographical area (State of New Jersey, Office of Emergency Management, 2007-2020). The biggest similarity between all of the plans is their reliance on historical trends to determine likelihood of future occurrence. The biggest difference between the plans seems to be the level of which the plan is meant for with the bigger the boundaries the more broad the plan and the more latitude provided towards actionable mitigation efforts.   Charleston County. (2019).  Charleston regional hazard mitigation plan (2019). . Retrieved from,  https://www.charlestoncounty.org/departments/building-inspection-services/files/Hazard-Mitigation-Plan.pdf City of Anaheim Hazard Mitigation Task Force. (2017).  City of Anaheim hazard mitigation plan.  Retrieved from  http://local.anaheim.net/docs_agend/questys_pub/13502/13532/13533/13578/13581/2.%20Hazard%20Mitigation%20Plan13581.pdf State of New Jersey, Office of Emergency Management. (2007-2020).  2019 New Jersey State Hazard Mitigation Plan . Retrieved from  http://ready.nj.gov/mitigation/2019-mitigation-plan.shtml HM502 Unit 4 Assignment Risk Assessment Strategies Write a 3–5-page paper that contrasts and compares the risk assessment strategies of the three local emergency management plans introduced in this unit. In your paper, include the following main points: · Plan threat assessments · Plan vulnerability assessments · Plan consequence assessments Each of the three main points should be contrasted and compared using geographic and asset-based criteria to distinguish each plan as well as identify similarities and differences. Also in your paper, discuss at least three of the prime factors that influence these differences and similarities. Note: This assignment will require outside research. Use at least two credible sources in addition to the assigned textbook/reading material and discuss how you evaluated the credibility of the resources used. You may consult the Library, the internet, the textbook, other course material, and any other outside resources You may consult the Library, the Internet, the textbook, other course material, and any other outside resources in supporting your task, using proper citations in APA style. Directions for Submitting Your Assignment Compose your paper in Microsoft Word and save it with a name you will remember. Be sure to include your name, class, and section number. Submit your assignment by selecting the Unit 4: Assignment Dropbox by the end of Unit 4 . Download  Unit 4 Assignment Checklist 3 Risk Risk assessment analysis is a rational and orderly approach as well as a comprehensive solution to problem identification and probability determination. . . . While it is not an exact science, it is, nevertheless…the art of defining probability in a fairly precise manner. —James F. Broder, CFE, CPP, FACFE What Is Risk? Risk is associated with virtually every activity one can imagine, but for the purpose of this text, we limit the meaning of the word risk to the uncertainty of financial loss, the varia- tions between actual and expected results, or the probability that a loss has occurred or will occur. In the insurance industry, risk is also used to mean “the thing insured”—for example, the XYZ Company is the risk. Additionally, risk can mean the possible occurrence of an undesirable event. Risk should not be confused with perils, which are the causes of risk—such things as fire, flood, and earthquake. Nor should risk be confused with a hazard, which is a contrib- uting factor to a peril. Almost anything can be a hazard—a loaded gun, a bottle of caustic acid, a bunch of oily rags, or a warehouse used for storing highly flammable products, as an example. The end result of risk is loss or a decrease in value. Risks are generally classified as “speculative” (the difference between loss and gain— for example, the risk in gambling) and “pure risk,” a loss/no-loss situation, to which insurance generally applies. For the purposes of this text, the divisions of risk are limited to three common categories: l Personal (people assets) l Property (material assets) l Liability (legal issues) that could affect both of the above. Here we include such problems as errors and omissions, wrongful discharge, workplace violence, sexual harassment, and last but not least, two issues which have become serious challenges to the business community: third-party and product liability. The first of these issues has given rise to a new profession: that of the “security expert witness.” The subject is so important to the security professional that we have devoted a chapter in this text to it titled, “Crime Prediction” (see Chapter 10). 1 4 RISK ANALYSIS AND THE SECURITY SURVEY What Is Risk Analysis? Risk analysis is a management tool, the standards for which are determined by whatever management decides it is willing to accept in terms of actual loss. To proceed in a logical manner to perform a risk analysis, it is first necessary to accomplish some fundamental tasks: l Identify the asset(s) in need of protection (people, money, manufactured products, and industrial processes, to name a few). l Identify the kinds of risks (or threats) that may affect the assets identified (kidnapping, extortion, internal theft, external theft, fire, and earthquake, for example). l Determine the probability of the identified risk(s) occurring. Here one must keep in mind that the task of making such a determination is not an exact science but an art— the art of projecting probabilities. Remember this rule: “Nothing or no one can ever be made 100 percent secure; there is no such thing as a perfect security program.” l Determine the impact or effect on the organization in dollar values when possible, if a given loss does occur. These subjects are given an in-depth treatment in the chapters that follow. Risk Assessment Risk assessment analysis is a rational and orderly approach, as well as a comprehensive solution, to problem identification and probability determination. It is also a method for estimating the expected loss from the occurrence of an adverse event. The key word here is “estimating” because risk analysis will never be precise methodology; remember, we are discussing probabilities. Nevertheless, the answer to most, if not all, questions regard- ing one’s security exposures can be determined by a detailed risk assessment analysis. What Can Risk Analysis Do for Management? Risk analysis can provide management with vital information on which to base sound decisions. A thorough risk analysis can provide answers to many questions, such as: Is it always best to prevent the occurrence of a situation? Is it always possible? Should policy also consider how to contain the effect a hazardous situation may have? (This is what nuclear power plants prepare for.) Is it sufficient simply to recognize that an adverse potential exists and to do nothing for now but be aware of the hazard? (The principle here is called being self-insured.) The eventual goal of risk analysis is to strike an eco- nomic balance between the impact of the risk on the enterprise and the cost of imple- menting prevention and protective countermeasures. A properly performed risk analysis can provide many benefits to management, a few of which are as follows: l A properly performed analysis will show the current security posture (profile) of the organization—what it really is, not what management perceives it to be! Chapter 1 l Risk 5 l It will highlight areas in which greater (or lesser) security is needed. l It will help to assemble some of the facts needed for the development and justification of cost-effective countermeasures (safeguards). l It will increase security awareness by assessing and then reporting the strengths and weaknesses of the security profile to all organizational levels from operations to top management. Risk analysis is not a task to be accomplished once and for all; it must be performed periodically if one is to stay abreast of changes in the environment and society as a whole. For example, in some industries “bomb threats” are seen to be on the increase. This is generally true for society as a whole. Bomb threats do not, however, fall into statistically predictable patterns. So it would behoove those of us who have any potential exposure to this problem to ensure our security plan is designed to deal with such anomalies. Also, because security measures designed at the inception of a program for building or expansion generally prove to be more effective than those superimposed later, risk analysis should have a place in the design or building phase of every new facility. This is being done increasingly as architects have begun to realize the importance of planning for security. The major resource required for performing a risk analysis is trained manpower. For this reason, the first analysis is the most expensive. Subsequent analyses can be based in part on previous work history, and the time required to do a subsequent survey should decrease to some extent as experience and empirical knowledge are gained. The time allocated to accomplish the risk analysis should be compatible with its objectives. Large facilities with complex, multi-shift operations and many files of histori- cal data require more time to gather and review the necessary data than does a single- shift, limited-production location. If meaningful results are to be achieved, management must be willing to commit the resources necessary to accomplish the mission. It is best to delay or even abandon a security survey unless and until the necessary resources are made available to complete the tasks properly. In this regard, the security professional should be ever mindful of the legal risk associated with being “on notice” that seri- ous threats exists which are not being addressed. After a situation is identified as being a “security risk” and is brought to management’s attention, corrective action must be taken. Not doing so could expose the company to legal liability should an otherwise pre- ventable event occur. Role of Management in Risk Analysis The success of any risk analysis undertaking is contingent on the role top management plays in the project. Management must support the project and express this support to all levels of the organization. Management must define the purpose and the scope of the risk assessment. It must select a qualified team and formally delegate the authority nec- essary to accomplish the mission. Finally, management must review the team’s findings, decide which recommendations need to be implemented, and then decide on and estab- lish the order of priorities for implementing the recommendations made in the survey report. Most of the professional security consultants the author has worked with list their 6 RISK ANALYSIS AND THE SECURITY SURVEY recommendations in the order of priority. This takes the guesswork out of the equation for management. Personnel who are not directly involved in the survey and the analysis process must be prepared to provide information and assistance to those who are. In addition, all employees must accept any inconvenience and the possible temporary interference of any activity that may result from actions of the survey team. Management should make it clear to all employees that it intends to rely on the final product and base its secu- rity decisions on the findings of the risk analysis team’s report. The scope of the project should be well defined, and the statement of scope should spell out the parameters and depth of the analysis. It is often equally important to state specifically and in writing what the survey is not designed to accomplish or cover; this serves to eliminate any misunder- standings at the start of the project. An example might be the exclusion from a security survey of safety and evacuation procedures in the event of an emergency or disaster. At this point, it may be helpful to define and explain two other terms that are sometimes used interchangeably with risk: threat—anything that could adversely affect the enterprise or the assets; and vulnerability—a weakness or flaw, such as holes in a fence, or virtually anything that may conceivably be exploited by a threat. Threats are most easily identified and organized by placing each in one of three classifications or categories: natural hazards (floods), accidents (chemical spills), or intentional acts (domestic or international terror- ism). Vulnerabilities are most easily identified by interviewing long-term employees, super- visors, and managers in the facility; by field observation and inspection; and by reviewing incident reports. In the case of security hardware and electronics, tests can be designed and conducted to highlight vulnerabilities and expose weaknesses or flaws in the operation (see Chapter 18). Examples would be an out-of-date access control system or inadequate proce- dures to ensure operational procedures in the high-value cage of a storage warehouse. Threat occurrence rates and probabilities are best developed from reports of occur- rences or incident reports, whenever these historical data exist. If reports containing this information do not exist, it may be necessary to develop the information from other sources. This can be accomplished by conducting interviews with knowledgeable people or projecting data based on an educated guess, supported by studies in like industries at different locations. Risk Exposure Assessment Before any corrective action can be considered, it is necessary to make a thorough assessment of one’s identifiable risk exposures. To accomplish this, it is essential that three factors be identified and evaluated in quantitative terms. The first is to determine (identify) the types of loss or risk that can affect the assets involved. Here, examples would be fire, flood, burglary, robbery, and kidnapping. If one of these were to occur (for now we will consider only single, not multiple, occurrences), what effect would the resulting disruption of operations have on the company? For example, if computers were destroyed by fire or flood, what would the effect be on the ability of the company to Chapter 1 l Risk 7 continue operating? There is a saying common to protection professionals: “One may well survive a burglary, but a major fire can put you out of business forever.” If the chief executive officer, on an overseas trip, were to be killed in a terrorist bombing (or even suf- fer a serious heart attack), who would make the day-to-day operating decisions in his or her absence? What about unauthorized disclosure of trade secrets or other proprietary data? After all the risk exposures are identified (or as many as possible), one must pro- ceed to evaluate those identified threats that, should they occur, would produce losses in quantitative terms—fire, power failure, flood, earthquake, and unethical or dishonest employees, to name a few of the more common risks necessary of consideration. To do this, we proceed to the second factor: estimate the probability of occurrence. What are the chances that the identified risks may become actual events? For some risks, estimating probabilities can be fairly easy. This is especially true when we have docu- mented historical data on identifiable problems. For example, how many internal and external theft cases have been investigated during the past year? Other risks are more dif- ficult to predict. Workplace violence, embezzlement, industrial espionage, kidnapping, and civil disorder may have never occurred or may have occurred only once. The third factor is quantifying (prioritizing) loss potential. This is measuring the impact or severity of the risk, if in fact a loss does occur or the risk becomes an actual event. This exercise is not complete until one develops dollar values for the assets pre- viously identified. This part of the survey is necessary to set the stage for classification, evaluation, analysis, and for the comparisons necessary for the establishment of coun- termeasure (safeguards) priorities. Some events or kinds of risk with which business and industry are most commonly concerned are as follows: l Natural catastrophe (tornado, hurricane, seismic activity) l Industrial disaster (explosion, chemical spill, structural collapse, fire) l Civil disturbance (sabotage, labor violence, bomb threats) l International and domestic terrorism (the infamous 9/11 attack) l Criminality (robbery, burglary, pilferage, embezzlement, fraud, industrial espionage, internal theft, hijacking) l Conflict of interest (kickbacks, trading on inside information, commercial bribery, other unethical business practices) l Nuclear accident (for example, Three Mile Island, Detroit Edison’s Enrico Fermi #1, the 2011 major disaster in Japan). Some of these events (risks) have a low, or zero, probability of occurrence; also, some are less critical to an enterprise or community than others even if they do occur (fire versus burglary, for instance). Nevertheless, all of the identified possible events could occur and are thus deserving of consideration. Examples include the nuclear accident at Chernobyl in the Soviet Union in 1987 and the chemical gas disaster (“breach of containment”) at the Union Carbide plant in Bhopal, India, in 1984. Also, there are today in the United States chemical and nerve gas weapons stored in bunkers at military depots near populated areas. Do contingency plans exist to deal with these risks in the event of accidental fire, leak, or explosion? Are 8 RISK ANALYSIS AND THE SECURITY SURVEY disaster drills and exercises conducted periodically to test the effectiveness of the con- tingency plans, if they exist? There are contingency plans for breach of containment and other industrial accidents in nuclear power generating plants in the United States, and these are strictly monitored by the Nuclear Regulatory Commission (NRC), which requires periodic drills to rehearse emergency plans. In the following chapters, we continue to discuss vulnerabilities and threat identifi- cation, as well as risk measurement and quantification. The material presented above should give the reader some idea of what this textbook is all about. Risk analysis is a very powerful tool for management’s use if properly applied to the problems unique to any given enterprise. To identify these unique problems, however, requires that an in-depth survey first be conducted. 9 Vulnerability and Threat Identification Before the question of security can be addressed, it is first necessary to identify those harmful events which may befall any given enterprise. —Charles A. Sennewald, CPP, Security Consultant, Author, and Lecturer Risk Identification In a systematic approach to the identification of threats, such as the one recommended in this text, the primary purpose of vulnerability identification or threat (exposure) deter- mination is to make the task of risk analysis more manageable by establishing a base from which to proceed. When the risks associated with the various systems and subsys- tems within a given enterprise are known, the allocation of countermeasures (resources) can be more effectively planned. The need for such planning rests on the premise that security resources, like all resources, are limited and therefore must be allocated wisely. Risk control begins, logically, with the identification and classification of the specific risks that exist in a given environment. To accomplish this task, it is necessary to exam- ine by surveying all the activities and relationships of the enterprise in question and to develop answers to these basic considerations: l Assets—What does the company own, operate, lease, control, have custody of or responsibility for, buy, sell, service, design, produce, manufacture, test, analyze, or maintain? It would be advisable to review the company’s mission statement at this point in time. l Exposure—What are the company’s exposures? What could cause or contribute to damage, theft, or loss of property or other company assets, or what could cause or contribute to personal injury of company employees or others? l Losses—What empirical evidence is available to establish the frequency, magnitude, and range of past losses experienced by this and other companies located nearby, performing a like service, or manufacturing the same or similar products? Obviously, the answers to these questions and any additional questions that may be raised when conducting initial inquiries will be the basis for the identification of risks and eventually the quantification of all identifiable risks that may have a negative effect on the enterprise in question. Security professionals can employ many techniques to develop the data for risk iden- tification. They may review company policies, procedures (or take into account their 2 http://dx.doi.org/ 10 RISK ANALYSIS AND THE SECURITY SURVEY absence), the structure of the organization, and its activities to ascertain what risks have previously been identified (if any) and to what extent they are perceived as management responsibilities. They may review insurance and risk-related files, including claims and loss records. Interviews with the heads of departments that have experienced loss expo- sures can develop vital information on the organization and the adequacy of loss-control procedures, if in fact any exist. Performing observation tours and inspections and inter- viewing management and other personnel in enough locations and activities will help develop a comprehensive picture of the company’s risk exposures as a basis for later evaluation of existing loss control procedures and their effectiveness. The tools necessary to accomplish the above tasks are the ability to conduct thorough interviews; the ability to conduct site inspections and field observations of operations, procedures, manpower utilization, the hardware, and electronics used in existing secu- rity systems; and the ability to identify, obtain, and analyze all pertinent records that one finds. Another technique one may use is to develop asset data. To do this, one needs to com- pletely identify all company assets, tangible and intangible, in terms of quantity and quality. One then locates all company assets and identifies obvious exposures that may exist at these locations. Next, one must determine the value of these assets in terms of actual dollars. This should be broken down into the following three categories: l Owned assets $________________ l Leased assets $________________ l Facility losses $________________ Total tangible assets $________________ Total intangible assets $________________ Grand total $________________ The identification of all company assets, coupled with a history of loss exposure for the company and other companies similarly located and engaged in a like or similar activity, will normally be sufficient to identify most of the major risks involved. After this identification procedure is concluded, the security survey or inspection can be limited to those risks or exposures that specifically relate to the enterprise in question. These risks will usually include most, if not all, of the following: l Crime losses, such as burglary, theft (internal and external), fraud, embezzlement, vandalism, arson, computer abuse, bomb threat, theft of trade secrets and intellectual property, industrial espionage, forgery, product forgery and trademark infringement, robbery, extortion, and kidnapping—to name the most common crime risks encountered by business and industry. Some others are: l Cargo pilferage, theft, and damage l Emergency and disaster planning l Liability of officers and directors l Environmental controls as directed by occupational safety and health codes Chapter 2 l Vulnerability and Threat Identification 11 l Damage to property from fire, flood, earthquake, windstorm, explosion, building collapse, falling aircraft, and hazardous processes l Comprehensive general liability arising from damage caused by any activity for which the entity can be held legally liable l Business interruption and extra expense. An evaluation of this type of risk may require a detailed study of interdependencies connecting various segments of the entity and outside suppliers of goods and services. The study may indicate the need for extensive disaster recovery planning, for the reduction of risks not previously identified. l Errors and omissions liability l Professional liability l Product liability As can be seen from even a cursory review of these risks, the scope of risk identifica- tion alone, separate from risk evaluation and risk control, presupposes a degree of edu- cation and practical knowledge not often possessed by the average security manager. This implies that the person who is charged with this responsibility should have the education, training, and practical experience necessary to seek out, recognize, and thus identify not only the risks involved but also their impact upon the enterprise in question. The process of risk identification, evaluation, and control, in any dynamic organiza- tion, public or private, requires constant attention by professionals who possess the necessary knowledge and tools to accomplish these tasks. This knowledge is best acquired by study and practical experience. There is, however, no substitute for “hands- on” experience when it comes to the analysis of risks. Examples of the Problems of Identification We were given the assignment of conducting a security survey for a chain of fast-food restaurants. At the initial meeting with the management staff of this chain, reports from the company’s internal audit division were furnished for our review. These reports showed all of their crime-related losses that had occurred for a 12-month period. They contained statistics that showed a disturbingly high incident rate for “robbery.” One of the firm’s top management people stated that he had a growing concern that a part-time high school cashier working in one of their restaurants might get shot in the course of a robbery because of the absence of procedures instructing employees what to do in case of an armed robbery. Field inspections of a representative number of these restaurants produced evidence that the crime problem most often experienced was burglary (breaking and entering), followed closely by internal theft. “Armed robbery,” or just plain robbery, as perceived by management, although admittedly always a dangerous situation, was not as frequent or as serious a problem as management had been led to believe by the statistics reported in the audit reports. Further inquiry revealed that the terms robbery and burglary were being used indiscriminately and, in many cases, synonymously. It was only after 12 RISK ANALYSIS AND THE SECURITY SURVEY identifying the real problem that we could proceed to develop the proper procedures and allocate the necessary resources to address and then solve management’s concern. In another case, I met with the management of a national corporation that, among other things, printed negotiable instruments. The purpose of the meeting was to develop a mutual agreement regarding the scope for a security survey to be conducted at one of its West Coast plants. At the outset, one of the management representatives asked, “Have you ever conducted a security survey at a plant that prints negotiable instruments?” The simple fact at the time was that we had not. Nevertheless, the answer we gave was, “No, we haven’t, but that really doesn’t matter. It is immaterial to us if your plant manufactures widgets or prints negotiable instruments. You will either have a security program or you will not. If you do, it will either be functional, or it will not. In either event, it can be eval- uated, and we can determine if the state of the security in existence at that facility is ade- quate, given the unique requirements for protection that this type of product requires. If we feel the security is not adequate, we will make recommendations to upgrade the quality and the quantity of the security safeguards necessary to accomplish this goal. If you have no program for security, we will design one for your consideration to meet the above requirements.” When we arrived at the facility we found a total absence of even rudimentary security protection and had to design a basic program of safeguards and countermeasures for this operation. The managers at the site had been complain- ing to their superiors about the lack of protection for a number of years without success. The message here is “do not assume that management has any understanding of their security program or what they need to be protected.” In security, as with many other disciplines, we deal in acceptable practices and prin- ciples. These remain fairly constant, regardless of the problem involved or the environ- ment encountered. The end result is loss prevention. This means that one either has or does not have an adequate security program in place. One way to find out is to conduct a security survey and identify those harmful events that may interfere with the company’s objectives, as they are defined by the management of the enterprise in question. Security Checklist Until now we have been discussing some of the techniques and tools that the security professional needs to develop data for risk identification. Very often, security checklists are used to facilitate the gathering of pertinent information. These checklists take many forms. They can be simple lists of yes-or-no questions or open-ended questions requir- ing narrative responses. They may be brief and narrowly focused on the specific opera- tion or activity in question, or they may be broader in scope and cover security concerns common to all the company’s operations. No matter what its appearance, the purpose of a security checklist is to provide a logical recording of information and to ensure that no important question goes unasked. The checklist is usually the backbone of the security survey or audit. This subject is covered extensively in Chapters 7, 8, and 9. Chapter 2 l Vulnerability and Threat Identification 13 The following is a generic or introductory security survey checklist. It was designed for general use; therefore, it may include many items that are not appropriate in some situ- ations. Additional checklists can be found in the appendices of this text. We do suggest, however, that one develop his or her own checklist tailored to the unique requirements of the operation being audited. I. Policy and Program 1. Top management established a security policy? a. Policy published? b. Part of all managers’ responsibility? c. Designated individual to establish and manage security program? 2. Top manager accessible to security supervisor? 3. Any regulations published? (Attach copy) 4. Disciplinary procedures? a. In writing? b. Specify offenses and penalties? c. Incidents recorded? d. Review by management? e. Uniformly enforced? 5. Any policy on criminal prosecution? a. Number of prosecutions attempted during past 5 years? b. Number of convictions? II. Organization 1. Security supervisor full time? a. If part time, percentage of time spent on security? b. Describe chain of command from security supervisor to plant manager. 2. Number of full-time security personnel? 3. Number of personnel performing security duties each shift? a. Do they perform non security duties concurrently? b. Do security duties have first priority? 4. Have security personnel received security training? 5. Are written reports made …