Asian Business Aviation Conference

1

• Asian Business AviationConference Exhibition
• ABACE 2005
• Shanghai, China
• August 9 -11, 2005
• Security How Much Is Enough?

2
Asian Business Aviation Conference
ExhibitionABACE 2005

• Todays Panelists
• John L. Sullivan
• The Business Case For Corporate Aviation
  Security
  
• Richard Hancock
• Security Climate In Asia For Global Business and
  General Aviation
  
• Robert F. Valente
• Global Threats and Travel Planning

3
The World You Operate In

• Terrorism
• War and Other Military Activity
• Political Instability
• Civil Disturbance
• Anti-Western Sentiment
• Corruption
• Natural Disaster
• International Relations
• Infectious Disease

4

• What global threats/issues impact corporate
  flight operations?
  
• What do travel warnings really mean?
• Politics and threat

5
War On Terror

• Security situation in Iraq/Afghanistan/Saudi
  Arabia is non-permissive
  
• Anti-American sentiment particularly high in
  countries with large Muslim populations

6
War On Terror

• Predominantly Muslim Countries
• Gulf Littoral Nations
• North and East Africa (Egypt, Lybia, Algeria,
  Morocco, Tanzania, etc.)
  
• Indonesia
• West Asia (Turkey, Jordan, Lebanon, Syria)
• South Asia (Pakistan, Bangladesh, India)
• Central Asia (the stans)
• Parts of Russia, China, Philippines
• Fastest Growing Religion in USA

7
War On Terror

• Countries with large diasporas with anti-American
  sentiment may present a threat profile similar to
  predominantly Muslim countries

8
Infectious Disease

• SARS
• Monkey Pox
• Avian Flu
• Marburg Hemorrhagic Fever
• Tsunami aftermath

9
Security Implications of Infectious Disease

• Destabilizing economic effect
• Airspace closure
• Quarantine procedures
• Incidental contact at FBO/airport
• Create power vacuums (Tsunami) for nascent
  terrorist groups to operate in

10
Avian Flu SARS Lessons Learned?

• Crisis Management Decision Points need to be
  established NOW
  
• Designation of essential expat staff and travel
  or projects considered business-essential must
  occur NOW

11
Natural Disasters Asian Tsunami
12
Tsunami Lessons Learned

• Notification Cascade
• Travel Tracking
• Post-Incident Contact Trees
• Infectious Disease Exposure Issues
• Political Instability and Nascent Anti-Western
  Movements

13
What Do State Department Travel Warnings Mean?

• Worldwide threat
• Regional threat
• Country-specific threat
• Event-specific threat

14
Pan Am 103 And Double Standards

• Aftermath of Pan Am 103 Terrorist threat
  information must be provided to public at large
  if
  
• Timely
• Specific
• Corroborated
• NO DOUBLE STANDARDS

15
Travel Warnings

• What they mean to the USG
• (Escalation)
• Stand fast
• Voluntary departure
• Ordered departure
• Post closure

16
Case Study Politics and Threat

• Economic sanctions dropped against India/Pakistan
  as a result of cooperation in War of Terror
  
• June 2002 Travel warnings imposed with same
  effect as economic sanctions
  
• Many political observers felt that the security
  situation did not actually change but warnings
  replaced sanctions as a form of political
  currency

17

• Aviation Security Concerns in a Rapidly Expanding
  Region

18
Current Environment Threats Risks
Threats to General Aviation
19
Aviation Environment Threats Risks
Why Is General Aviation an Attractive Target?

• High profile/ commercial value/ prestigious
• Vulnerable due to high passenger traffic levels
• Incident may force a government reaction, e.g.
  change of government policy,
  
• Can be used as WMD maximum casualties

20
Aviation Environment Threats Risks

• Air travel has expanded to more destinations
  within China and elsewhere in the region
  
• More passengers are traveling (1.6 Billion)
• More airlines setting up, especially low cost
  airlines
  
• More airports are being built
• Bigger aircraft (A380) are coming on line
• More air cargo is being delivered

21
Aviation Environment Threats Risks

• Traditional Threats
• Hijacking of aircraft
• Sabotage of aircraft (on ground in-flight)
• Sabotage of airports and navigation aids
• Terrorist attack at airports (terminal concourse,
  check-in, passenger and baggage search areas)
  
• Attacks against off-airport locations (crew
  accommodation, ticket offices, cargo facilities)
  

22
(No Transcript)
23
(No Transcript)
24
Aviation Environment Threats Risks

• Statistics 2004
• 16 Acts of Unlawful Interference in total
• 91 persons killed
• 8 injured
• 4 incidents of Sabotage
• 1 successful Hijacking
• 4 airport attacks

25
Aviation Environment Threats Risks

• Threat Groups
• Terrorists
• Criminals
• The mentally disturbed
• Employees (disaffected, and those with criminal
  motive)
  
• Refugees
• Other Governments

26

• Attacks Directed Against Airports
• Lod Airport, Tel Aviv, Israel (1972)
• Rome, Italy (1973)
• Paris, France (1978)
• Manila, Philippines (1983)
• Rome, Italy and Vienna, Austria (1985)
• Seoul, South Korea (1986)
• Algiers, Algeria (1992)
• Johannesburg, South Africa (1994)
• Heathrow Airport, England (1994)
• Reus, Spain (1996)
• Lahore, Pakistan (1996)
• Colombo, Sri Lanka (2001)

27

• Conventional Wisdom
• Very little airports/airlines/individuals can do
  to affect the threat, therefore -
  
• Personnel Technology concentrate on reducing
  the vulnerability
  
• Prioritizing counter measures (cost
  effectiveness)
  
• Distinguish Private and Public Space

28
Key Factors Air / Landside Segregation
Public Areas
Airline Check-In Areas
Airport Catering Services
Airport Administration and Management
Immigration
Immigration
Bag Screening
Boarding Gates
29

• Issues Affecting Aviation Security
• Human Factors
• Hardware Design, Implementation and Application

30
Airport Security in Asia The Human Factor

• Lack of Language Ability
• Majority of Airport Staff are not highly educated
  with a poor understanding of foreign languages
  
• High Turnover Rate
• Poor pay leads to high turn-over rate. Ground
  handling agent in Guangzhou Baiyun Airport
  receive on average RMB 1500 to 2000, the position
  in Fuzhou Airport is paid on average RMB800-1200
• Low wages increase likelihood of corruption and
  bribery. One local airline confirmed an annual
  turn-over rate of 40, recruiting between 150-200
  new staff per year
• Background screening of staff and due-diligence
  of vendors with access to restricted areas

31
Airport Security in Asia The Human Factor

• Poor Application of National or Regional
  Standard
  
• Aviation Industry is still growing in the
  region. Whilst national standards are set, it is
  not applied to the same standard across all
  airports due to budget and personnel limitations
• Lack Of Training
• Majority of airport staff receive only very basic
  training. The current evolving threat represented
  by ever more sophisticated terrorist and criminal
  organizations requires constant re-assessment and
  staff security awareness training

32
Airport Security in Asia The Human Factor

• Over-reliance On Technology
• Whilst new technologies are being imported into
  the region at an unprecedented rate they still
  require human interaction. Younger generation
  believe technology can replace the need for an
  inquisitive mind.
• Going By The Book
• Traditionally the education and government system
  has encourage a strong adherence to rules, and
  set in stone procedures. Initiative and
  questioning of authority is often discouraged

33
Airport Security in Asia The Human Factor

• A Nation of Guan Xi
• Relationships rather than professional
  competence considered to be more important. We
  have examples of high ranking officials using
  their influence to enter restricted areas without
  proper identification. Our own staff were allowed
  air-side by simply talking to airport security
  staff who knew the driver of the ground handling
  company we were using
• Government Response
• Experience and training of emergency units. Do
  all airports have dedicated fire-fighting, police
  and medical teams trained to respond to a major
  natural or man-made incident.

34
Airport Security in Asia Hardware Problem

• Airport Design
• Whilst the larger International Airports are
  designed by architectural and engineering
  companies with specialized expertise, older
  regional airports have not had the benefit of the
  latest technology and management practices. Often
  arriving and departing passengers are processed
  on the same level and not separated by physical
  barriers
• Misuse, Under-usage or Faulty Technology
• We have witnessed a huge leap in the availability
  and application of modern technology major
  international airports across the region.
  Unfortunately in some cases systems have been
  introduced that do not have a local support
  infrastructure. When systems breakdown or
  malfunction it can take weeks for qualified
  technicians or spare parts to arrive

35
Improvement Since 9-11

• More Rigorous Security Checks, but.
• No across-the-board standards
• Randomly applied
• Questionable depth
• Air Marshals
• Unconfirmed reporting that Air Marshals are
  armed now in the region. May migrate to business
  and general aviation
  
• Monitoring Equipment at Frontier Inspection
  Counters
  
• CCTV monitoring and recording equipment in nearly
  all airports.
  
• Activities at the counters are monitored and
  video-taped.

36
The Business Case for Corporate AviationPerk or
Necessity???

• Corporate aircraft ownership is a
  business-critical solution for thousands of
  companies committed to increasing shareholder
  value.
• This value occurs in the areas of increased
  productivity, acceleration of business, better
  customer relationships, and in the reduction of
  and/or need to increase company infrastructure.
• Provides competitive advantage and timely
  execution of business strategy.

37
Making the Business Case for Security

• In the present threat environment, the private
  sector remains the first line of defense for its
  own facilities and assets
  
• Businesses have multiple incentives to invest in
  security (reputation, shareholders,
  competitiveness, etc.)
  
• Business is often in the best position to
  determine the immediacy of security concerns
  
• Better able to assess the magnitude of security
  concerns and to devise effective responses
  
• Corporate citizenship/responsibility

38
Cost Benefit and CostEffectiveness Analysis

• Limited resources necessitate maximizing the
  benefits of security while minimizing cost
  
• Risk assessment and cost-benefit analysis are
  dependant upon accurate data
  
• May be cost effective to have a professional
  security consultant conduct the risk assessment
  
• Security must show a Return on Investment (ROI)

39
Security Decision Making

• Understand Terrorism
• This new form of security risk required a better
  understanding of the Who, How and Whys of
  terrorism
  
• Selecting security through risk assessment and
  risk management
  
• Conducting accurate risk assessments and
  analyzing those assessment within a risk
  management framework will make for a best and
  efficient allocation of time and money
• Recognizing the limits of business
• Resources are finite. Security must not affect
  business operations. Business may assume some
  risk through insurance. May need to obtain
  services of a qualified security consultant to
  conduct Risk, Threat and Probability Assessments

40
Risk Management

• Prevention
• Focuses on preventive security including
  detection, information management and sharing of
  threat and vulnerabilities.
  
• Preventive security can range from installing
  alarms, fences, access control, background checks
  and overt/covert monitoring of facilities and
  assets.

41
Business Case for Security
Drivers Linked to Risk Management
Threat AssessVulnerability AssessProbability
Assess
Meet IndustrySecurity Standards
Comply WithGovernmentSecurity Mandates
Investment in Security
ReducedCost
EnhanceRevenue
PreserveMarketShare
ManageRisk
ProtectBrand
Drivers Linked to Business Success
42
A risk assessment is a tool for measuring the
compliance of an organization with applicable
security requirements.   The standardized
methodology is based on the interrelationships of
four key factors
What is a Risk Assessment?

• Assets - Any useful or valuable resource.
• Threat - An event, process or act which, when
  realized has an adverse effect on one or more 
  assets

43
Vulnerability - Weakness or susceptibility of an
asset or a collection of assets to losses of
various kinds.
What is a Risk Assessment?
Safeguard -  A countermeasure, control or action
taken to decrease the existing level of
vulnerability of an asset to one or more threats. 
Risk Threat Vulnerability
44
Risk Assessment Process

• Threat Assessment
• Tells who is trying to inflict harm and
  the how it will be done
  
• Need real time intelligence from
  government and private sources
  
• Vulnerability Assessment
• Focuses on unearthing weaknesses of the entity we
  are trying to protect.
  
• Examines those weaknesses and how they could be
  exploited by someone with hostile intent.
  
• Used to predict the effectiveness of additional
  security measures (security impact that a
  facility would get) to the investment in security

45
Risk Assessment Process

• Probability Assessment
• Analyzes the probability that a threat will
  actually occur
  
• The probability assessment is significant not
  so much as an independent calculation, but as
  applies to the threat and vulnerability
  assessment process.

46
Risk Assessment Example

• Threat Credible intelligence that a terrorist
  group would steal a large twin engine corporate
  aircraft
  
• Vulnerability Hanger has state of the art
  security and meets or exceeds NBAA Best Practices
  for Business Aviation Security but FBOs visited
  have only limited security in place

47
(No Transcript)
48
Risk Assessment Example

• Threat Credible intelligence that a terrorist
  group would steal a large twin engine corporate
  aircraft
  
• Vulnerability Hanger has state of the art
  security and meets or exceeds NBAA Best Practices
  for Business Aviation Security but FBOs visited
  have only limited security in place
• Probability - Some what subjective assessment of
  Risk based on vulnerability and threat assessment

49
Continuum of Threats and Probabilities
High
Nuclear device
Dirty bombin container
Plane flowninto building
Attack onnuclear plant
InfectiousAgent
Railbombing
Difficulty of Execution
Hacking intoComputer system
Oil tankerattack
Computervirus
Foodcontamination
Employeesabotage
Truck/carbomb
Bombing ofmajor bridge
Kidnapping
Low
Severity Impact
High
50
Continuum of Threats and Probabilities
High
Aircraft at home
Nuclear device
Dirty bombin container
Plane flowninto building
Attack onnuclear plant
Railbombing
Oil tankerattack
Difficulty of Execution
Aircraft awayfrom home
InfectiousAgent
Hacking intoComputer system
Computervirus
Foodcontamination
Employeesabotage
Truck/carbomb
Bombing ofmajor bridge
Kidnapping
Low
Severity Impact
High
51
Continuum of Threats and Probabilities
High
Nuclear device
Aircraft at home
Dirty bombin container
Attack onnuclear plant
Plane flowninto building
Aircraft awayfrom home
Oil tankerattack
Railbombing
Difficulty of Execution
InfectiousAgent
Computervirus
Hacking intoComputer system
Foodcontamination
Employeesabotage
Truck/carbomb
Bombing ofmajor bridge
Kidnapping
Low
Severity Impact
High
52
NBAA Best Practices for Business Aviation Security

• People
• Establish a Security Champion role (much like the
  Safety Champion's role)
  
• Establish and maintain a communications link with
  the company security department or the equivalent
  
  
• Flight department personnel to complete annual
  security training
  
• Remain diligent to changes in emotional
  well-being and health of all crewmembers, ground
  personnel and passengers
  

53

• Facilities
• Ensure home facility perimeter security with
  effective fencing, lighting, security patrols (as
  appropriate), gates and limited access areas
  
• Ensure street-side gates and doors are closed and
  locked at all times
  
• Require positive access control for all external
  gates and doors
  
• Close and lock hangar doors when that area is
  unattended
  
• Secure all key storage areas (food and liquor,
  parts and tools, etc.)
  
• Have an access control management system for keys
  and passes

54

• Facilities
• Confirm the identity and authority of each
  passenger, vendor and visitor prior to allowing
  access to facilities and aircraft
  
• Escort all visitors on the ramp and in the hangar
  area
  
• Use a government issued photo ID to verify
  identity of any visitor or vendor
  
• Post emergency numbers prominently around
  facility
  
• Ensure easy access to phones or "panic buttons"
  in various facility locations (break room, hangar
  bay, etc.)
  
• Confirm security of destination facilities
• Be aware of your surroundings and do not be
  complacentchallenge strangers

55

• Aircraft
• A flight crewmember must be present at all times
  when the aircraft is being serviced (fueling,
  catering, etc.)
  
• Check lavatories, baggage compartments and all
  cavities for unauthorized people or objects prior
  to every departure
  
• Use the aircraft's security system (locks and
  alarms) whenever it is unattended to prevent
  unauthorized entry
  

56

• Procedures
• Require that aviation department members
  participate in security training
  
• Maintain a security information program
• Require an accurate and accessible passenger
  manifest for all trip legs
  
• Only company personnel and authorized guests,
  identified in advance, are allowed to board a
  company aircraft
  
• Passengers or flight department members must
  maintain positive control of luggage

57

• Procedures
• Crewmembers must display photo IDs
• Have a security plan specific to your location
  and operation
  
• Develop, maintain and exercise an Emergency
  Response Plan and its associated resources
  
• Positively identify all luggage and match luggage
  to specific passengers (color-coded bag tags can
  be helpful)
  

58
IF FOUND Call(800) 926-xxxx Or return to 123 F
irst St Anywhere, USA RETURN SHIPPING GUARANTEE
D
J Sample
IF FOUND Call(800) 926-xxxx Or return to 123 F
irst St Anywhere, USA RETURN SHIPPING GUARANTEE
D
J Sample
59
Q A
60
(No Transcript)
61
Security Response

• Manage risk by designing formal procedures to
  reduce damage in the shortest period of time
  after a security incident.
  
• Rescue victims, secure facilities and conduct
  investigation immediately following a security
  incident.

62
Recognizing the Limits of Business

• Resources are finite
• Security investment should not exceed the value
  of the business
  
• Security should not affect company profits or
  cause disruption to business operations