Safety and Security: The Intersection

Security and safety often go hand in hand, but sometimes they conflict. Here are ways to cooperate to achieve both departments' goals.

In 1999, the Massachusetts state fire marshal issued a cautionary advisory about a new security product: a surveillance camera designed to look like a smoke detector. "This action has created a great concern for us in the fire service," Stephen Coan said. "If this [security cameras as smoke detectors] becomes widely known, we feel that the lives of people will be placed in jeopardy. Out of fear of being watched and the loss of privacy, it is possible that people will begin to cover over smoke detectors, endangering their lives...." Marshal Coan was not alone in his concern: In 2004, New York officials forced local outlets to stop selling the device for many of the same reasons.

Whatever else this incident might teach, it certainly illustrates the complex relation of safety to security. On one hand, the missions have much in common: Both are concerned with the integrity of systems and the protection of people. Yet there are also deep differences: Safety defends against outcomes that are unintended; security, against planned malevolence. Security is comfortable with the languages of incentives and probability; safety, less so. Safety is usually defined by area (Is this a safe neighborhood?); security, often by systems. Safety is a state of mind; security is a procedure. Safety concerns itself with people; security worries about assets, which include but are not confined to people. Security divides the population into good people and bad people; safety treats everyone alike.

At least potentially, these variations can spark conflicts. Security and safety are both interested in access, but security likes to see small numbers of well-identified people moving slowly, while safety wants the option of evacuating large numbers rapidly, without regard to identity. Safety might want to clean up scenes of incidents; security, to secure sites and preserve evidence. Safety systems like to be conspicuous, generally accessible and simple to operate; security might have second thoughts about all those virtues. (And then sometimes security likes to be conspicuous, while safety might have objections, as in a store or school.)

Chemicals security is advanced significantly by underground storage; the EPA, which is charged with ensuring the safety of underground water reserves and is therefore concerned with leaks, makes that difficult. "EPA regulations on chemical storage tanks do not specifically address security, nor do they seek to balance security versus environmental protection," observes Roxanne Smith, press officer at the EPA.

Exactly.

Managing this relationship can therefore be complex. Differences create cultural barriers, and barriers—silos in the organizational context—can slow the diffusion of good ideas. For instance, some feel that safety has been slow to embrace security cameras, even for such simple and straightforward applications as incident review and training, and for monitoring procedure compliance. Sloan Foster, VP of marketing for HBMG Inc., a company in Austin, Texas, that makes surveillance equipment, suspects that this reluctance does not reflect considered policy decisions as much as simple cultural inertia. "Safety people just haven't thought much about security cameras," she says. Of course there is a chicken-and-egg issue here—so long as the market is defined around security, which is what market development will focus on. As of July, not even Foster's own company promoted the safety applications of its products on its site.

So one obvious task of smart management is to poke holes—the right holes—in these walls between security and safety. David ("Mike") Hager, enterprise security officer at Unisys, had a university client come in after the Virginia Tech shootings with an interest in using cameras and remotely controlled locks to advance student safety. The idea was to give safety officers enough intelligence to unlock the doors that might be impeding student evacuations while locking or relocking those that would confine the source of the threat—all without traveling physically to the doors in question. "This was a case of safety driving security, which does not happen that often," Hager says. (While the first iterations of the project design proved financially impractical, conversations are continuing.)

Safety and Security's Common Groundkey operating responsibilities in the food sector are detecting food contamination, economic fraud (in which a contracted input is switched surreptitiously for a cheaper one) and threats to salability (bruising, spoilage). All these require high levels of surveillance, which means that almost everyone working on the floor of a food manufacturer or distributor is already so alert to unexplained and unexpected changes that security functions can be added cheaply. If you are already checking tank outlets to make sure they are capped (to avoid contamination from rain or dust), checking the locks on the caps is a small step.

Another useful exercise of management might be to find points of overlap between the two missions, identifying places where each can advance the mission of the other with small investments in training and equipment. For instance, the

However, as with cameras, gaining leverage across the cultural divide does not happen automatically. "Food defense" (this industry uses the term defense where other sectors use "security," since here the term security is used to refer to sustainability) hasn't been part of the traditional mind-set of food processing workers. "People just didn't think of calling the FBI," says Gary Ades, a food safety and defense consultant in Bentonville, Ark. John Spink, director of the Packaging for Food and Product Protection Initiative at Michigan State University, believes that managing the security-safety overlap in this sector requires defining and enforcing clear, simple, intuitive and routine communication procedures. If it is useful for protective purposes to know about unusual patterns in salability rejections, the right way to distribute that information is to gather and report it routinely, as opposed to leaving it to each worker to think through the merits of each specific case.

Often, the leveraging of these overlaps works by circulating personnel across missions. Greg Halvacs, CSO of Cardinal Health, a medical products and services company in Dublin, Ohio, uses security audits to ask safety-related questions (Do you have a lockout, tag-out program in place? Let me see your loss-time accident log sheet.) and safety audits to ask security questions (Do you do background checks?).

He says the practice saves travel costs and reduces the time that field sites have to spend dealing with audit committees. Sometimes the security coordinator at a site becomes the full-time safety contact; at other sites, safety people are tasked with asset security, taking inventory of items and equipment on a site, and monitoring the presence (or absence) of subcontractors. While examples can be found of both flavors of integration—moving security's responsibilities to safety and safety's to security—the former seems more common, perhaps because in certain industries, safety is usually more heavily manned and is more familiar with the operating landscape.

Emergency response or disaster preparedness units are often textbook cases of integration. United Rentals of Greenwich, Conn., rents items such as generators and chain saws, which can be critical for advancing both safety and security after a disaster. As a result, UR places a priority on having outlets in disaster areas up and running very quickly after an event, regardless of the damage their branch might have experienced, or, indeed, whether there had been a preexisting UR branch in that area at all.

According to Steven Baird, VP of corporate security, UR keeps a small fleet of reaction trailers in the parts of the U.S. most likely to be affected by hurricanes or tornadoes. When there is a disaster, a trailer drives to the heart of the affected area. "If an unplanned disaster hits, we can usually get to a site in 12 hours or less," Baird says. "If we have any warning, as with a hurricane, we're ready to go as soon as the storm has blown through." These trailers carry everything necessary to support a UR presence until a new building is found or built, from staff facilities (a kitchen, a bathroom, sleeping quarters, satellite uplinks) to emergency gear (fencing, ladders, saws, traffic cones, rain gear). Trailer staff have been trained in emergency medical procedures and First Responder protocols. They do safety (checking for downed wires and leaking fuel), security (setting up a corral with illuminated fencing) and business resumption (organizing connections with supply trucks).

Finding BalanceC-TPAT (Customs-Trade Partnership Against Terrorism), the Customs and Border Protection initiative intended to secure the integrity of supply chains that pass in and out of the U.S.

However, it is easy to overshoot this business of integration. Departments have their logic, silos are not all bad and there are returns to specialization and autonomy. Curtis Shewchuk, CSO of Con-way Freight, points out that in recent years, safety has extended into wellness programs and sustainability or green issues, and security, into family and executive protection and participation in

At the same time, Shewchuk adds, even where responsibilities remain the same, expectations about the execution of both missions have changed. Increasingly, both security and safety are expected to think of threats proactively, before circumstances drop them in our laps. It takes real expertise to tell the difference between the potentialities that need to have resources thrown at them right now and those that are too unlikely to worry about. Second, supply chains are becoming more integrated, requiring companies to coordinate—and therefore be aware of—the safety and security protocols of clients and partners up and down the chain. Again, very demanding tasks. The professionals involved with them do not have time to wear two hats.

Pete Wilcox, large-account director of Travelers Construction (a unit of the big insurance company), sees safety professionals turning into full-fledged risk management experts. In the old days, he says, "safety meant enforcing the compliance of your own workers on your own site to OSHA regulations. In those days, the sole remedy for workplace injuries was workers' compensation. But liability exposure has expanded dramatically, and today we enforce a much broader standard of care. If we tear up a sidewalk, we have to know who had been walking on that sidewalk and where they were going and how they will be affected by our project. None of that is addressed anywhere in OSHA." Wilcox thinks that the financial implications of this broader standard are such that safety professionals are going to be involved from the very start in project design, including bid preparation. "We see ourselves as leading this change," he says, "but eventually it will affect everyone."

Clearly these issues are only going to grow more complex. Years ago I was having a casual conversation with Tim Overton, chief process safety engineer at Dow Chemical. I asked him to speculate as to the core mission of his profession over the next 10 years. He didn't hesitate: "Reconciling and integrating safety and security," he said. At the time, I didn't even know what he meant, but today, looking back, that turns out to be one of the better forecasts I've heard. ##

Copyright © 2008 IDG Communications, Inc.

The 10 most powerful cybersecurity companies