Dennis Treece and Massport: Safe Harbor

In that crystalline late summer day in 2001, when the modern meaning of “homeland defense” was being invented in four hijacked airplanes, Massachusetts Port Authority, or Massport, the public agency that runs Boston’s Logan International Airport and other port facilities, was widely regarded as a patronage-riddled dumping ground for political burnouts. That this fact was once deemed harmless is a relic of more innocent times.

In the wake of 9/11, a commission impaneled by then-acting Massachusetts Gov. Jane Swift recommended a thorough overhaul of Massport. Included in the list of action items was the creation of an executive security positionsomeone who would oversee all security strategy and decision making across the numerous functional units with operational authority for the various aviation, maritime and port infrastructures that fall under Massport’s control.

The aftermath of 9/11 was not pretty. You could make a case (and many did) that Logan was really no worse than any other big, busy airport when it came to security. But whether things that should have been foreseen were missed, whether procedures that should have been followed were disregarded, Boston still wore the stain of what happened. If you lived in the region, you watched the unseemly finger-pointing play out in the papers and on the local news. And even though Dennis Treece, now Massport’s director of corporate security, was then working in Atlanta for Internet Security Systems (ISS), he believes that the stain is part of a working reality that brings an ultra level of seriousness to the security mission.

“There isn’t a Massport employee who doesn’t remember what it was like to be here on 9/11,” says Treece. “That was an emotional lesson that will never be forgotten.”

With some fanfare, Treece was recruited in a national search. (And proving that nothing lies beyond the scope of symbolic gestures, the search firm Russell Reynolds Associates, in cooperation with Massport, donated the $66,000 placement fee for Treece’s position to the Massachusetts 9/11 Fund.) Treece moved from Atlanta late last September. So daunted is helike many transplants to Bostonby the harebrained local traffic flows, he averts the risks of driving to work by instead taking public transportation. “It’s underground most of the way,” he says. “So, unfortunately, I don’t get to memorize any landmarks.”Fanfare for the Uncommon ManWhat Massport gets in Treece is 32 years of security experience, much of it spent in military intelligence in such places as Bosnia, Germany, Kosovo and the Persian Gulf (where he regularly briefed Gen. Norman Schwarzkopf on terrorist activities during Operation Desert Storm). In the mid-1990s, he went to work for the CIA, applying his experience in military theaters to help the agency improve its support of combat operations. Most recently, he spent two years at ISS designing the global threat operations center that monitors and defends against attacks on customers’ information networks.

Despite a vivid imagination given to thoughts about, say, designing fences for maximum blast dispersion, Treece seems cheerful, relaxed and reasonably confident. In his office he has Aaron Copland playing (not, as it happens, “Fanfare for the Common Man”).

Not surprisingly, Treece’s intelligence background shows up strongly in his security priorities and practices at Massport. Intelligence is about gathering the best available information to support decision making. Treece’s idea of good security is thus rich in information flows. While he readily agrees that success in security is “a year in which nothing happens,” there still has to be enough data to bear out the cause-and-effect relationship between nothing happening and what you did.

“Successful programs collect the relevant metrics for you to measure your progress,” Treece says. “What were you busy doing? Were you busy doing the right things or the wrong things? I’m in the process of implementing a set of metrics. We have to be able to brief others as to how we are spending the security dollar here at Massport.” (Although Massport is a public agency, its operations are funded solely through private sources such as fees, bridge tolls, rents and parking revenue. In other words, no tax dollars are harmed during the making of security at Massport.)

While he concedes that he has the last word in setting strategy and direction, his is a consultative approach that draws on lots of other inputs. For example, to offer an outside perspective, Treece has assembled a security council of local business, political and academic leaders. (Included in the group is Sheila Widnall, former secretary of the Air Force and now a professor at MIT.) “Everyone has a voice. The [local] communities have a voice; the employees have a voice; the security professionals have a voice; the operational leaders have a voice; the board of directors has a voice. And this security advisory committee has a voice,” Treece says. “Everybody has a voice. It’s just that I have the loudest voice.”More Than a Cost CenterUnlike most CSOs, Treece is in the enviable position of serving an enterprise whose main product is security. So for him, the agonies of getting security issues on the radar of top executives isn’t a problem. He reports directly to Massport CEO Craig Coy, who like Treece has an armed services background (Coast Guard) to go along with his Harvard Business School degree. Treece describes his relationship with Coy as “excellent. There’s no one between myself and himalmost physically.” Coy’s office is two doors down the hall. “I have 24-hour access to the CEO, total support,” says Treece. “That was the promise that went with the job.”

So, despite the ostensible fear factor in the challenges that face him at Massport, does Treece also see himself as being fortunate?

“I do. It’s one of the reasons I took this job,” he says. “It was the [right] time to come here. There’s a window of opportunity, post-9/11, where security in the transportation sector is on the top of the pile. So this is a great time to come into a CSO position. Of course, it’s incumbent on me to make good use of that [opportunity] and not overuse the position that security now has within the organization.”

At Massport, security “is the avowed top priority,” Treece says. “Given 9/11, and given the fact that if you don’t have the faith of the traveling public, you don’t have a traveling publicsecurity is job one.”

It has to be. Little things are always happening. On the day CSO spoke with Treece, a Transportation Security Administration (TSA) employee was caught, incomprehensibly, bringing a loaded handgun to work at Logan. The gun was detected in the employee’s coat during a routine screening to which all workers are subjected when they show up for each shift. The spin on the incident was, naturally, that the system works. Less than a week later, a United Airlines flight from Boston to San Francisco was delayed when a passenger found a box cutter in a seat pocket in the first-class compartment. The passenger reported it to a flight attendant and the plane was immediately emptied and searched, and the passengers rescreened, before the aircraft was reboarded and allowed to depart. No explanation for the presence of the box cutter was found before the plane finally pushed back, but later it was learned that an airline maintenance worker in Denver was the source (raising questions about a possible gap in airport security involving ground personnel).

Treece believes that the traveling public is prepared to endure a reasonable level of inconvenience in exchange for greater confidence in the travel experience. But how much will travelers be willing to put up with before convenience and service degrade unacceptably? In other words, as in every other security context, how much is enough versus too much? Andalso as in every other security contextmitigation of the impact of security measures on productivity (or, in this case, the customer experience) is paramount.

He offers the example of Logan’s new $146 million, federally mandated baggage-screening system (see “Carrying a Lot of Baggage,” Page 31). “Because of the way Logan is laid out, we had no lobby space in which to put these [new X-ray] machines. And we did not want the traveling public to have an impact from 100 percent baggage screening. So everything is in the basement; everything’s inline,” he says. “It still takes four to five minutes for your bag to get from check-in to the plane. And this includes going through the [X-ray] machine. There’s a little bit of extra time if the machine can’t clear a bag and the TSA has to physically get into it. But we’re not experiencing any late push-backs, and no bags are missing their flights because of this added security. There’s plenty of time within the traditional window of arriving an hour before your flight in order to make that happen.”

But customer convenience is no longer the only, or even the prime, directive. At Logan and elsewhere in townthe Tobin Memorial Bridge, the Conley Container Terminal in South Boston, Hanscom Field in nearby Lexington and Worcester Regional Airportsecurity is Massport’s main deliverable.

“Remember that the nation is at yellow alert. [Editor’s note: At the time of the interview, Homeland Security’s advisory system was at the yellow level, indicating “significant risk” of terrorist attack.] And yellow alert means that there’s a significant chance of terrorism from those who have declared war against our civilization,” says Treece. “So we have in place today what we call ‘yellow plus.’ We’ve done more [at Logan] than we think is absolutely necessary. And the reason for that is that we do not expect to get actionable intelligence telling us that the threat will increase.”Getting Ahead of the CurveIn fact, one of Treece’s laments about the homeland defense effort to date is that there have been no effective mechanisms developed to get meaningful intelligence out to people who could put it to good use. “We’ve got to figure out how to get U.S. intelligence into the hands of first responders, including guys like me who have to develop plans and procedures based on the magnitude of the threat,” he says. “If you can’t tell me what the magnitude of the threat is, don’t expect me to be on top of it; expect me to be reactive. And I hate being reactive. I want to be proactive. I want to get ahead of the curve.”

To that end, he stays in touch with former colleagues in the intelligence communitythough there are strict limits to what they can share with him because he lacks an intelligence clearance. (That may soon be remedied. Treece has applied for a clearance, through the TSA as his sponsor, which he expects will be granted.)

Still, even given his background (or maybe because of it), Treece thinks that intelligence can be overrated. “I’m not convinced that the United States has all the information that we need,” he says. “These are the most difficult types of intelligence operations you can [attempt]. Penetrating al-Qaida’s got to be next to impossible.”

Lacking reliable intelligence, you use your imagination. “These [terrorists] do not give you any warning. These people strike. And we’re doing everything we can to anticipate the next type of attack,” says Treece. “The more difficult we make it to steal an airplane and use it as a missile, the less likely that becomes. So what’s next? I spend an awful lot of my time thinking about that and then developing security around those [potential] things.”

Along those lines, Treece thinks about the airport of the future. Notwithstanding an ambitious and expensive upgrade that Logan is in fact still undergoing, the whiteboard in Treece’s office has a sketch of some big ideas for a safer, more efficient air travel environment.

The sketch shows graduated transitions from purely public (and less secure) spaces and structures leading inward to those that are stringently controlled and sequestered. High dirt embankments rise between roadways and would deflect the force of a car bomb. Drop-off and pickup is envisioned occurring at the ends of long tunnels leading into and out of the terminals. The terminals themselves would be fortified by embankments and buried under green space on the other side of which “you wouldn’t even hear” a bomb blast. Treece is enthusiastic about the need to bring architecture and security together.

“Man, I could take you over to terminal E and show you a beautiful building. I mean, it’s breathtaking. But there’s just one thing wrong with itit’s made out of glass,” he says as he shakes his head. “Glass!” Like political patronage, the vestige of a more innocent age.Life on the EdgeThere is a beach at the edge of Logan Airport. On some level, the very existence of that totally open and unprotected beach just galls Treece. It makes him envision bad guys in wet suits coming out of the waterthe kinds of people against whom, as he puts it, you would just want to “open up a can of whuppass.”

That has led Massport to make a self-interested alliance with the clam diggers who eagerly work the fertile flats adjacent to Logan’s runways. For 14 months the clammers were banned. “When 9/11 happened,” says Treece, “everybody shut all the ‘gates.’ And one of those gates was the beach.”

The problem was that Massport didn’t know much about the clammers because, before, it had never seemed important to know. But post-9/11, says Treece, “all things that were unknown were questionable, and all things that were questionable were stopped.” That greatly displeased the clam diggers, whose livelihood was disrupted, and who waited out a solution that, in essence, turned them into vendors like any others who service the airport. “The vendors all have to have fingerprint-based criminal history background checks. And they have to be badged and be a known quantity,” he says.

So the clammers have now gone through that process. In addition to being licensed by the state’s fishery department, they are official known entities at Logan. They have badges, wear special vests and are regularly checked on by security guards. In addition, they are extra eyes and ears at the edge of the airport property.

“And we appreciate that,” says Treece of the clammers (who now, after their 14-month hiatus, are digging up a record harvest from the long-neglected flats). “The [nearby] Winthrop Yacht Club is in the same position to help us, and we’re working to make sure that they know what number to call if they see something out of the ordinary. Because these are the people who know everything that is ordinary [on the waterfront scene], whereas we don’t. So we’re happy to be associated with good Americans out there protecting our flank.”

The beach forms one part of Treece’s perimeter. Massport’s computer networks form another. “My perimeter is my perimeter,” he says. “My background has been in all of the security fields that exist. It’s all pretty much important to me. And there’s nothing more important to me than our information technology network because it touches everything. It hits every one of my strategic focus areasand in a big way.” Treece works happily with Massport’s Director of IT Francis Anglin, whom Treece credits with being very savvy about security. The network at Massport is old but ironclad.

“We hired a firm to try to hack into our network. They were unsuccessful. We have a private network that’s not addressable from the Internet. You have to come through a special servera network address table, a NAT serverto get to our network,” he says. “Those [servers] are tightly controlled, and they are the only things that touch the network (those and the public Web servers we use). So we conduct our business just fine, and maybe we’re not hackerproof, but the company we hired spent 25 hours trying to hack into our systems and couldn’t do it.”

Among the things Treece wants from technology is more data on the variability of threat levels across those focus areas. He’s in the midst of developing a system that aims to synthesize various data points into a real-time, rolling assessment of risksomething that could express threat as a numerical variable. Once again, he turns to the detested beach.

“The beach is a vulnerability,” says Treece. “I have a list of the types of threats that can exploit the beach. There’s a numerical value for each of these based on, say, the destructive power of a sniper coming out of the water, as opposed to, you know, a streaker.” Risk equals the destructive power of an event multiplied by the likelihood of its occurrence, he says. “So at the end of the day, the residual risk of that open beach will have a defined value based on the best judgment I can give it along with my team.”

And would he be able to take certain actions guided by fluctuations in those defined values? Sure, he says, “it could cause us to raise the color level from yellow to orange, based on our new calculations, without the state telling us to do that. We might even want to tell the state that we think we ought to go to orange, and here are the reasons.”High-Touch StrategiesBut numerical variables, no matter how precise, take you only so far. Security ultimately comes down to human strategies. Take, for example, the work of Israeli security consultant Rafi Ron, who recently trained members of the Massachusetts State Police in techniques pioneered by the Israeli national airline, El Al. No technologies are requiredno sensors or X-rays or metal detectorsonly the power of observation applied to human behavior. It’s behavioral pattern recognition joined with a purposeful, but deceptively casual, interview technique.

The method, says Treece, “is based on the premise that anybody who’s about to [commit a crime] is not acting like everybody else.” A state trooper who observes someone acting unlike everybody else approaches the subject and initiates a conversation. “It might start off, ‘Cold day, isn’t it?’ Very casual, just to see the response,” he says. “What’s the body language? Is the person starting to stammer and stutter and sweat? What about the eyes? Are they dilated? All these little manifestations of nervous behavior.”

Treece notes that some people are simply nervous flying or are nervous whenever they talk to a cop. But Ron says that the technique’s goal is to begin with an assumption that there’s a reasonable explanation for the observed behavior and to find out what it is. “During the course of the interview,” says Treece, “the focus is on ‘Why are you here?’ Even though it’s a public place, [an airport is] a potentially dangerous public place…. In the course of the interview process, very quickly, the [trooper] can determine if there’s something unusual going on. As the interview progresses, it becomes more and more of a law enforcement matter. And sometimes it has resulted in an arrestif not by the state police, then by the Immigration and Naturalization Service, for instance.

“It’s a great system. We just have to be very careful…that we monitor [its use] so that it doesn’t become viewed as another racial profiling deal,” Treece says.

Treece says that Massport is compiling statistics for review by the American Civil Liberties Union once the system’s been in place for a year. For its part, the ACLU says it has an open mind about the potential value and fairness of the program.

While it’s the primary job of the state police at Logan Airport to look for suspicious behavior, the airport’s 13,000 employees are also focused on security as an integral part of whatever their jobs might be. “The employees are our first line of defense,” says Treece. “They are literally our eyes and ears.”

On the theory that it’s always better to catch people doing something right than something wrong, he has inaugurated an awards program to recognize employees who show an exceptional level of security-mindedness. He gets up and plucks a certificate, enclosed in a dark blue folder, from the credenza in his office. First Line of Defense Award, the certificate reads. There’s a scrollwork border, the Massport logo, an embossed gold-foil medallion sticker and a line for the recipient’s name.

“When an employee steps outside their own role and does some security function, we recognize them,” says Treece. “There’s an 8:30 security meeting every morning at Logan. Seven days a week. Packed house. Has been ever since 9/11. We pick a day convenient to the schedule of the person who is being recognized, and we award it publicly. And a letter goes up through the chain of command so their boss knows that, hey, one of your guys did a really great thing.”

And this awardlike the back-scanner X-ray unit at the container cargo port, or the TSA passenger checkpoints or the inline baggage-screening system in Logan’s basementis also part of the security process. It helps give shape to the small bits of effort and creates the sense that they all fit together in an orderly way that eventually equals confidenceconfidence that there’s a chance of overcoming the persistent threat of wickedness and erasing the lingering stain of 9/11.