Assessing Vulnerability; The First Step in Protective Operations

By: Rick Colliver

Before we initiate any protective operation, we must begin with baseline threat and vulnerability analyses to understand how susceptible our Protectee is to danger and what security precautions and processes are already in place to mitigate these threats. Unfortunately, an obstacle to this process of analysis is that we live in a “what-have-you-done-to-me-lately?” society.

To be sure, as soon as someone steals from us or attacks us, we rise to the occasion and begin to re-evaluate our security, suddenly finding budget dollars that were previously unavailable.

However, if we have no specific threat information relative to our Protectee or their organization, it is often impossible to obtain funding for security upgrade projects that cannot be tied to the organization’s profit line. The resultant dichotomy is that if “all is quiet”, they don’t think they need you.

However, if they’re taking incoming fire every day, then they think that you’re not doing your job. For this reason we rely on the lessons learned from previous failures of security, to illustrate to non-security management why certain proactive measures need to be undertaken.

Luckily, there have been a substantial number of security failures throughout history, from which we can draw a wealth of experience.  In this era of satellite news broadcasts, we hear about assassination attempts somewhere in the world almost every day. The question for us as practitioners of protection is “what are we learning from this?”.

Attacks on prominent persons in furtherance of social, ideological or political objectives are nothing new.  Probably the earliest recorded assassination is revealed in the story of Ehud the Benjamite who killed Eglon, King of the Moab, in his tent following the delivery of tribute in 1200 B.C.

Ehud is reported to have dismissed his escorts, turned to the King and said, “I have a message from God for you”.  He then ran him through with his sword.  The attack was successful because the King was vulnerable.

Protection specialists at the time were relatively untrained, underpaid and usually underfed.  However, there is much that we could learn from this incident.  Had the United States Secret Service Exceptional Case Study Project  been published we probably would have developed protective intelligence about how the Benjamites felt about delivering tribute.

Moreover, we might have done a quick background check on all personnel who would be in our camp in the vicinity of our Protectee, Eglon. But owing to the lack of technology at the time, our best defense might have been to bolster security of the camp in general, and Eglon’s tent in particular.

Without blaming Eglon’s security team (after all, there hadn’t been any media coverage of prior assassinations, so we hadn’t learned any lessons yet) we can see where an application of the concentric rings approach could have been a valuable tool in preventing the assassination.

The camp could have been constructed in such a fashion as to enable sentries to see approaching traffic well off in the distance. A system of checkpoints could have funneled arriving troops and visitors into appropriate areas, with visitors to the king receiving the most scrutiny. The king’s personal quarters would be located well within the safety of the encampment, surrounded by his closest confidants and security teams.

Only those with a legitimate need for access would be granted permission to reach this part of the camp. Those having this permission would be given special breast plates, handshakes or passwords to establish their credentials. Outsiders wouldn’t even know which tent was Eglon’s.

The profession of protection has been evolutionary, but we had apparently still not learned a lesson by 1120 BC when Jael killed Canaanite General Sisera. As the story goes, General Barak of the Israelites suffered a defeat in battle against the Canaanites.

He subsequently put out a contract on his opposite number, General Sisera.  Sisera fled to the home of his ally, Heber, only to find him gone.  Heber’s wife, Jael invited him in, offered him milk and then agreed to guard him while he slept.

After he fell asleep, she drove a tent peg through his temple and into the ground, forever illustrating that they probably hadn’t identified the critical control points of his security, through an assessment of his vulnerabilities. We also learned that there is no ‘profile’ of an assassin.

Every protectee is exposed to a different level and type of risk depending on their role in life and their security profile.  Because adversaries choose the mode, time and the place for their attack, we are forced to address a variety of general security weaknesses and protect around “worst case scenarios” in order to maintain a safe work environment.

If the date, time and nature of attack were known, we could simply plan for that event without wasting organizational dollars and effort securing ourselves from an attack we knew would or wouldn’t come. More prudently, we just wouldn’t be where the attack was going to take place. After all, the first rule of surviving a gunfight is “Don’t go.”

As protection specialists and managers, we need to constantly learn from the world around us and use these experiences to educate those we protect. Education therefore becomes an indispensable component of protective operations and is vital to ensure that:
1)    Your protectee understands the risks to themselves and their families
2)    Your protectee’s organization is cooperative in funding security processes
3)    You are adequately prepared to meet security challenges.

But, before we can educate others about these security challenges we first have to know what they are through effective assessments of threat and vulnerability.

Rick Colliver has served as the global security director for two multi-national corporations with operations in 24 time zones, and has managed protection details in Europe, Africa, Asia and the Americas. He is the course developer and lead instructor in the Principal Protection program at the Ohio Peace Officer Training Academy and is an adjunct instructor in protective operations through several police, military and academic organizations. His book, “Principal Protection; Lessons Learned” is due out in summer 2010.