Defense By Design

The Little Boy Who Cried “ALARM!”

We all know the story about the boy who cries “WOLF!” People respond. He cries “WOLF!” again. People respond again. Eventually, after enough false alarms, something changes.

Not with the wolf -- with the PEOPLE! They've been conditioned to stop responding. THIS is what I found so interesting (and concerning) about this article (linked below in comments section) from Security Today

Now consider the alarms, alerts and notifications generated by the technologies intended to keep our people and places safer.
ALERT → investigate → nothing.
ALERT → investigate → nothing.
ALERT → investigate → nothing.
Eventually...
ALERT → probably nothing.

The technology may still be working exactly as designed. The professional may still be sitting exactly where they're supposed to be. But if repeated false or meaningless alerts have conditioned that professional to discount the very signals intended to get their attention...what good are either of them?

Sometimes the vulnerability isn't that an alarm failed to sound -- it's that we've been conditioned to stop listening.

I know someone who can help.

What does your security system already know that YOU don't? That question caught my attention this morning.

A recent Security Today article (linked in comments section below) makes an interesting point: Organizations already collect enormous amounts of information through access control, video surveillance, visitor management and monitoring systems.

The camera captured it, the access system logged it, the visitor system recorded it, the information may already EXIST -- but did anybody actually SEE it?

For years, I've encouraged organizations to begin their security conversations with two very simple questions:
1. WHAT do we have that others might want?
2. WHO do we have that others might seek to harm?

Now consider those questions from a slightly different perspective: what might the systems YOU ALREADY HAVE be telling you about the answers?

We're often tempted to address emerging risks by adding another camera, another sensor, another system or another layer of technology. Sometimes the greater opportunity may be learning to look differently at what we already have.

That's particularly interesting to me right now as I prepare to present "Hocus FOCUS!" to a conference on October 8 in San Antonio comprised of owners of companies and companies. Because there's a considerable difference between LOOKING at something...and actually SEEING it.

I know someone who can help.

*ONE WEEK AGO TODAY* -- I had the opportunity to spend the morning in Iowa with a room full of and leaders discussing "Emerging Risks — Emerging Responses."

And we covered a LOT of territory in three very specific areas: PHYSICAL risks, DATA risks, and REPUTATIONAL risks. Different risks? Yes, but throughout the conversation, one common denominator kept showing up -- *PEOPLE.*

We talked about situations that can threaten employees, patients and others within a healthcare environment. We also talked about , access to sensitive information, and the very human behaviors that can either support—or undermine—the controls intended to protect it. And finally, we talked about , negative publicity and how quickly the actions of one person can affect the perception of an entire organization.

Technology matters, policies matter, procedures matter, but PEOPLE interact with all three. And sometimes an emerging risk isn't something entirely new. It's something familiar being influenced by circumstances we haven't considered before.

Thanks again to everyone who joined me in Iowa for such an engaged conversation, and particularly the online and offline conversations and connections that followed.

I trust I was able to help.

ONE WEEK FROM TODAY — Houston Building Owners and Managers Association (Houston BOMA)

Where does responsibility for a property's security begin—and where does it end? At the front door? The loading dock? The parking garage? The property line? A tenant's leased space?

And how much of a property's reputation for safety is shaped by things management may not completely control, such as what is going on in the immediate area or neighborhood?

Next Wednesday I'll be joining Houston where we'll explore the shared role property management and tenants play in creating safer environments—and why what happens *around* a property can sometimes matter as much as what happens *on* it.

Because other people's perceptions can quickly become *your* reality.

I (and they) know someone who can help.

The technology may be new, but the LURE isn't by a longshot! A recent Dallas-area story describes an -assisted scam involving a supposed emergency with a family member.

The details are worth reading—but what caught my attention wasn't merely the technology -- it was the story. Details below in the comments section.

"Someone you care about is in trouble."
"You need to act NOW!"
"Don't stop. Don't verify. Just follow my instructions."

We've been using versions of that lure against one another LONG before anyone ever heard the words . I have "personally" been teaching this lure/approach to audiences for 40 years myself regarding and .

Yes, AI may make the voice more convincing. Yes, AI may make the story more believable. Yes, AI may make the artifact harder to question. But ultimately, the objective is still to influence a PERSON into making a decision.

Maybe the better question isn't simply, “Was that really their voice?” Maybe it's: “What are they asking me to DO—and where are they asking me to GO?” Those familiar with my work know these two KEY questions and the qualifiers that come with them.

Technology changes, but human influence? Not so much.

I know someone who can help.

The technology didn't make the arrest -- *PEOPLE* did.

A Tennessee woman is suing after she was arrested and spent months in custody in connection with bank thefts in North Dakota—crimes she maintained she did not commit. facial-recognition technology reportedly played a role in identifying her as a lead in the , but THAT may not be the most important part of this story.

Full story linked below in comments section.

The more interesting question to me is: "what did the technology actually tell investigators...and what did they ASSUME it told them?"

Because technology can provide us with information. it can identify similarities, it can flag anomalies, it can recognize patterns, and it can give us another place to LOOK. But PEOPLE still have to decide what that information MEANS.

And that's where another kind of risk can enter the equation. An investigative lead isn't necessarily a conclusion. An indicator isn't necessarily evidence. And an artifact isn't necessarily a FACT.

Technology may help us see things we otherwise would have missed. But sometimes the greater risk isn't what the technology failed to see, it's what WE stopped looking for once we thought it had given us the answer.

I know someone who can help.
Texas Municipal League

Termination removes the person from the organization. It doesn't remove the person's history from the organization.

Full story linked below in comments section, but there is also police bodycam footage available on YouTube.

That's worth considering when misconduct involving someone in LEADERSHIP results in their departure. I recently came across the story of this former Chief Civil Deputy County Attorney for Cochise County, Arizona. He was arrested after a 12-year-old girl reported that he had followed and recorded her inside a retail store. He was subsequently terminated and ultimately pleaded guilty to tampering with evidence, receiving three years of probation after serving 79 days in jail.

But from a perspective, his termination raises a larger question: "What happens to everything that came BEFORE it?" He represented the county in legal matters. Does his subsequent conduct mean anything was improper about those previous cases or professional decisions? No. We have no basis to make that assertion, but could people now ask questions they weren't asking before? Absolutely!

Cases handled, advice given, decisions influenced, people supervised, positions advocated. What, if anything, now deserves a second look? And how much will it cost the county, his employer, FOR any such second looks?

And that's looking BACKWARD -- now look FORWARD.

His position must be filled, responsibilities reassigned, institutional knowledge replaced, employees managed. , and reputational consequences addressed. That's .

An incident may involve ONE person, but its consequences can travel throughout an organization—and sometimes in BOTH directions. Firing someone may end the employment relationship, but it doesn't necessarily end the risk.

I know someone who can help.

"Your safety isn't about where you LIVE -- it's about where you live your LIFE." I've used that line for years when discussing personal safety and risk.

Why? Because most of us don't spend our lives hiding behind locked doors or even live in our homes 24/7/365. We go to work, we meet friends for dinner, we go shopping, we go to concerts, we go to church, we go on vacations, we attend sporting events...

And we go to coffee shops.

Sometimes the risk we encounter in those places has absolutely nothing to do with us. This weekend I came across the story of a deadly shooting at a Starbucks in Allen, Texas. According to police, the violence wasn't the result of a robbery or some dispute involving the business itself, but rather an exchange between visitors/patrons outside.

It reportedly began with a child-custody exchange that turned violent. Think about that. A personal conflict became a PUBLIC SAFEY incident—and a business became the setting for somebody else's HOME-BASED drama/crisis.

That's worth considering from more than one perspective.
For individuals: Where do you live your LIFE?
For employers: How prepared are you for personal conflicts involving employees, customers or family members that may find their way into your workplace?
And for property owners and : What happens when a risk you didn't create suddenly becomes associated with your property, your tenants or your reputation?

Just look at the headline. It isn't simply a story about a custody dispute. It's a “deadly shooting...at an Allen Starbucks.” The underlying conflict belonged to the PEOPLE involved, but the headline belonged to the PLACE involved. And that's another principle I've discussed for years: OTHER PEOPLE'S perceptions can become YOUR reality.

Physical risk. Reputational risk. Sometimes they're not separate conversations at all. Neither risk nor reputation respect property lines, leased commercial spaces, or their associated parking lots and garages.

I know someone who can help. Houston Building Owners and Managers Association (Houston BOMA)

Some risks aren't created by bad habits. They're created when we get GOOD at them. 🤣

Think about it, the first time we bypass a procedure, ignore a warning sign, share something we probably shouldn't, prop open a door, reuse a password, or say “we've always done it this way”—we may recognize the risk. But do it often enough without a negative consequence, and something interesting happens -- risk starts feeling normal.

Not only is this nightmare fuel for , but it should be for and as well.

That's the problem with habits. Eventually we stop making a decision -- and simply start repeating one. So maybe the better question isn't, “Do we have any bad habits?” It's “Which bad habits have we gotten really GOOD at?” YIKES! 😮

I know someone who can help.

Three hospital employees were attending active-shooter training. At that very moment, an actual shooting was taking place inside their hospital.

Think about that for a moment...

In June, three IT interns at a Delaware reportedly had an argument. One asked to leave, then later returned to the hospital with a handgun. Two coworkers were shot; one died. Full story linked in comments section below.

At the time, visitors were screened for weapons -- but employees were not. The alleged shooter was still an *active employee* with *valid access.* Consider those two key factors.

Yes, absolutely, 100% active-shooter training matters. It prepares people for what to do once violence begins. In our world today, this approach is totally justified and relevant -- no issues here. But what are we doing *BEFORE* that moment, a point at which "prevention" may still be applied?

We aren't trying to predict whether a person WILL act. We're trying to understand and potentially then mitigate the conditions that could support THEIR WILL to act. This involves across all departments.

Reaction matters -- but so does recognition. What are we looking for *BEFORE* the bang?

I know someone who can help.