One of the most critical aspects of a security professional's career is to establish strong relationships with public sector agencies — specifically law enforcement agencies. This does not mean identifying key people in various agencies and adding their contact information to your Blackberry or Rolodex. It means getting to know members of various agencies, networking with them at trade association meetings, and offering assistance if needed. Developing these types of relationships are beneficial to both the private sector security professional, but also to the members of the various law enforcement agencies in your area. Each group has different experiences and resources available that, when shared, provide insight that might not be gained anywhere else.
As with anything worthwhile, developing these relationships will take time. Ultimately these relationships will provide for the sharing of sensitive information, which involves a significant level of trust. It takes time to gain the trust of both law enforcement professionals as well as seasoned security professionals.
The only sure way to develop these relationships is through face-to-face meetings. And one of the best places to do this is by attending various trade association meetings and conferences. Organizations such as ASIS International, Infragard and the High Technology Crime Investigation Association (HTCIA) foster public and private sector relationships. Even better than attending meetings and conferences is to actually participate on the board or a committee for one of the local chapters. This will allow you to work side-by-side with people from different agencies and organizations. I have served as chapter president for several organizations, and I believe that these experiences were some of the most enjoyable and beneficial of my career.
As a consultant, I periodically will have a client with an issue that involves criminal activity. And often the client will have called their local law enforcement agency, which has responded that they cannot be of assistance. In these situations, I can call one of my contacts in law enforcement and can determine which agency should be contacted to report the illegal activity. An example involves a client in southern California who had an eCommerce site hosted in Kentucky . The server hosting the site was compromised and all of my client's products were illegally downloaded. The question was which agency had jurisdiction. I contacted a local FBI agent who was able to direct me to the appropriate FBI field office and told me how to report the crime. The result? Arrests and successful prosecution of the hackers.
It is important to ensure that these relationships are not one-sided. I offer assistance whenever possible. I was contacted by a detective from a local metropolitan police department, who said he had been contacted by the father of a 14-year-old girl who suspected that she was intimately involved with a 27-year-old man. He asked me to provide options that would allow the father to monitor the girl's computer activity. I made several suggestions which were passed along to the father. The result? The “boyfriend” was arrested and convicted of a sex crime.
Another option that can help to develop a strong relationship with law enforcement is to offer free or deeply discounted training opportunities. One of the many issues facing public sector organizations includes budgetary constraints. Because of this, offering free programs to law enforcement agencies is greatly appreciated. As an example, I provided a free, one-day program for the Kansas Law Enforcement Training Center and suggested that the optimum class would be 30 attendees. When I arrived to teach the class, there were nearly 60 students in the room. One of the most rewarding parts of this class came several months later, when one of the students notified me that one of the concepts he learned in class helped to convict a pedophile.
It is important to recognize that private-sector entities may have the resources necessary to conduct in-depth research into particular issues. This often puts the private sector in a much better position to identify new tools, techniques and methodologies more efficiently than public-sector organizations; however, public-sector groups are often notified of government-funded research or statistics before private sector individuals. Since each group often has access to different information, knowledge sharing is absolutely critical. One of the best examples of knowledge sharing between private sector and private sector entities is the Midwest Consolidated Security Forum (www.mcsfonline.org) which is sponsored, planned and coordinated by at least nine different organizations — all with the goal of increasing collaboration between the public and private sectors.
The goal of establishing these relationships is to have contacts that will respond quickly and appropriately when presented with a problem or issue. Not having a contact within various agencies means that a lot of time can be spent during a crisis trying to track down the appropriate agency, identifying the appropriate individual and then trying to establish credibility in a short period of time. I have been called more than once by someone in a panic saying that their network had been compromised and they wanted to know who they should call.
Establishing relationships with private-sector individuals and groups provides law enforcement agencies with the ability to demonstrate to a section of the public how law enforcement agencies truly operate. Often, people's exposure to law enforcement is either negative or takes place in a very stressful environment. Building a rapport with private-sector security professionals makes it much easier for law enforcement agencies to do their jobs effectively.
Sharing Knowledge and Experience
It is important to never abuse any established relationship with anyone in law enforcement. Calling with frivolous questions or requests can quickly destroy a relationship that took a long time to develop. I will frequently contact various members of law enforcement while researching material for articles for this publication. I will tell them up front that I'm conducting research for an article and to let me know if there is anything that is not for “public consumption.” In the years I have been writing for Security Technology & Design , I have never written anything that was told to me in confidence.
One of the most critical aspects of private sector and public sector collaboration is the ability to share knowledge and experiences. In Kansas City , there is a group of security professionals and law enforcement officers called the Association of Security and Police (ASAP) that was founded in 1995 and meets monthly. In each meeting, individuals share current security threats or trends that they are seeing within their organizations or agencies. Law enforcement officers will describe crime patterns in particular neighborhoods or that are targeted at particular businesses. Private security professionals will report incidents they have witnessed on their premises or targeted at their employees. This sharing of information enables the members to better identify current threats or issues in their area — often much more relevant than looking at national trends or statistics.
The most important ingredient of these meetings is that the information is provided in a secure, confidential manner. Without a level of trust, this knowledge-sharing would never take place. Other parts of the country have similar groups that have been created to foster collaboration. The article “ Law Enforcement and Private Security Liaison: Partnerships for Cooperation” (www.ifpo.org/articlebank/lawprivateliaison.html) discusses several of these organizations and the issues surrounding successfully forming and maintaining these organizations.
An area where knowledge sharing should be encouraged involves the area of digital video and CCTV systems. One of the biggest complaints I hear from my contacts in law enforcement is that they have been provided video of a particular incident or crime, but its poor quality makes it completely useless for investigative or evidentiary purposes. This poor-quality video means limited to non-existent protection for the systems' owners, as well as preventing the apprehension of criminals. It would be a good idea to discuss what type of video quality is needed by law enforcement prior to an incident. This can ensure that a quick and effective response can be initiated.
Another area where law enforcement and private security professionals can work together is to follow and address legislation that impacts both groups. Items such as concealed carry, private investigator licensing issues, computer crime statutes, privacy concerns, etc., are just some of the current items that impact both public- and private-sector groups. Private-sector organizations may have the financial resources to mount an effective lobbying campaign, while public-sector officials may have government contacts that would be willing to discuss pending legislation.
While developing relationships with the private sector can prove mutually beneficial to the parties involved, there can be more significant benefits from public sector and private sector collaboration. This is eloquently and simply explained in the document, “Engaging the Private Sector to Promote Homeland Security: Law Enforcement-Private Security Partnerships” (www.ncjrs.gov/pdffiles1/bja/210678.pdf).
According to the article, “Since the attacks of Sept. 11, law enforcement/private security partnerships have been viewed as critical to preventing terrorism and terror-related acts. Because the private sector owns and protects 85 percent of the nation's infrastructure, while local law enforcement often possesses threat information regarding infrastructure, law enforcement/private security partnerships can put vital information into the hands of the people who need it. Thus to effectively protect the nation's infrastructure, law enforcement and private security must work collaboratively because neither possesses the necessary resources to do so alone.”
Extra Eyes and Ears
Private-sector individuals can often go places that are difficult for public sector employees to enter. This can be identified by the fact that business professionals that travel oversees are often contacted by government agencies to provide detailed information as to what they witnessed during their travels. I had a brief discussion with someone who spent time meeting with the president of a small South American country. Upon his return to the United States , he was debriefed by a member of a federal agency. He was questioned as to what he saw, specifically whether or not he witnessed, overheard or discussed evidence of terrorist activities during his visit. This ability to go places discreetly can provide extra eyes and ears for often understaffed, under funded agencies. Law enforcement will often reach out to private security professionals to notify them of significant threats or issues, specifically the abduction of children. An alert sent to a private security professional can then easily be forwarded to his or her network of contacts.
As outlined in the document “Engaging the Private Sector to Promote Homeland Security,” when establishing relationships between private sector and public sector entities, it is important to keep the 4 C's in mind: communication, cooperation, coordination and collaboration .
John Mallery is a managing consultant for BKD, LLP, one of the ten largest accounting firms in the United States . He works in the Forensics and Dispute Consulting unit and specializes in computer forensics. He is also a co-author of Hardening Network Security , which was recently published by McGraw-Hill. He can be reached at firstname.lastname@example.org.