Establishing Employee Security Awareness – Taking “See Something, Say Something” to the Next Level

November 18, 2020

Introduction:

The purpose of this article is to present some basic concepts of how to build situational and security awareness with employees to reduce the risk of security incidents and criminal activity.  This will be done by illustrating a simple three-step process:

1. Present a system of awareness levels which was developed to illustrate different levels at which people may be engaged in what is going on around them. Employees need to understand this system of awareness levels to develop a sense of self-awareness.
2. Next, employees are trained to establish baselines in their environments
3. Lastly, employees are trained to detect irregularities/anomalies in the environment and take “real time” action such as removing oneself from a situation or making a report about something suspicious.

In essence, coverage of the achievements above helps to bring to life the common phrase “See Something, Say Something”.  “See Something, Say Something” is a catch phrase used by the US Department of Homeland Security since the 9-11 attacks.  From the “See Something” perspective, employees must be taught, “What exactly am I looking for? How do I know if I’m paying attention to the right things?”  “See Something, Say Something” was generally initiated to help identify terrorists in the preplanning stages of an attack, but when you break it down, it can effectively be applied to a variety of day-to-day situations to help reduce criminal attacks, workplace violence or active shooter events.  Employees who can demonstrate situational awareness using the concepts above will also be more likely to:

• Avoid complacency.
• Observe with all senses.
• Be aware of unusual changes in surroundings.
• Notice unusual or suspicious behavior.
• Know whom to call if something is not right.
• Get assistance and not try to “handle it” themselves
• Prevent serious security incidents

Step One Teaching Self-Awareness:

What does “taking it to the next level” mean?  Let us turn our attention to the concept of situational awareness and hear what some of the experts have to say.  This military and policing concept can be applied in the private sector to your employees.  For the average employee, there are a few key points to emphasize that will gain incremental improvements in security awareness while recognizing that people typically operate on five distinct levels of awareness.  The late Jeff Cooper’s “Color Code” has been embraced and taught by competent instructors for many years. Some of you may be familiar with the concepts, but a review of these awareness levels is worthwhile in the context of situational awareness. Cooper broke down alertness levels into five degrees of preparation and awareness as depicted in the graphic below.

Unfortunately, far too many people operate in the white dimension, “unprepared and unready to take action”.  What are some of the common behaviors we exhibit that undermine our ability to observe what is happening around us?

1. Smart phones. If we are completely preoccupied with what is happening on our phones, we are not paying attention to what is happening around us.  This is far too common.
2. Listening to music in headphones while walking in public places.
3. Not following your gut instinct. So many people ignore the clues that are right in front of them, maybe because they want to believe in the greater good of mankind. Of course, just like there are weather conditions that predict a pending hurricane, there are often clues which tell you a violent incident is about to occur. This is also referred to as “Normalcy Bias,” which is the act of ignoring prospective threats because it seems unlikely that a dangerous situation might occur.

Therefore, the first objective in any security and situational awareness training program is to teach people the difference between white and yellow dimensions, then to encourage them to develop a sense of self-awareness to stay out of that dangerous “unprepared and unready to take action” mode.

To help employees develop basic alertness skills, they can be challenged to practice a few drills that are often referenced in the situational awareness discussion which include:

• Identify all the exits when you enter a space
• Count the number of people in a restaurant, subway or train car
• Look at the people around you and attempt to figure out their stories. Imagine what they do for a living, their mood, what they are focused on, what they are preparing to do based merely on observations.
• In a parking lot, look for and count the number of cars with people sitting in them either upon entering or exiting a destination.

Educating employees to actively engage their environment will train them to be aware of factors in their surroundings almost subconsciously when they learn to regularly operate in the “yellow” state of awareness.

Once that self-awareness is established and people are actively engaged with their surroundings, then you can focus on teaching more advanced situational awareness skills that can be applied to a variety of circumstances applicable in a wide array of work environments (e.g., healthcare, corporate, K-12, critical infrastructure).

Step Two Teaching Observation:

To borrow from another military training concept and apply it in civilian life, the OADA Loop is a learning system and decision-making process that was first presented with a slight variation by John Boyd, an Air Force fighter pilot and military strategist. The four steps of the OADA Loop are Observe/Observation, Analyze, Decide, Act.  For this article, we are only going to focus on the first two steps in the process.

Observation, which requires conscious thought and practice, is a very deliberate action that employees need to be taught and reminded about.  This secondary skill should convey the importance of developing mental “baselines” for people and environments.  Having a baseline is an essential foundation to be able to detect anomalies which are important to trigger action or reporting of suspicious activity.  The “environmental baseline” is what employees have experienced in similar environments and situations. They should be trained to determine what is considered normal sounds, behaviors and sights so they have a frame of reference to better identify unusual behavior or anomalies

By establishing an understanding of the baseline through observation of daily routines, employees will quickly notice when something deviates from the pattern.  Everybody has some understanding of the baseline around them, which will differ by environment and situation.  Those skills can always be refined.  Another way to identify a baseline is to teach employees to ask themselves some basic questions¹:

• What’s going on here?
• What’s the general mood of the place?
• What are the legitimate actions 99% of people in the environment would be engaged?
• What are the typical belongings we would expect to see persons in the environment carrying?
• What is the typical behavior we would expect persons in the space to exhibit?
• What is the identity that we would expect to be associated with a legitimate user?
• What is the “story” or the knowledge that a legitimate person would be expected to have in the environment?
• What are the documents a legitimate user would possess?
• What is the appropriate attire that would be expected for the environment?

It would be a good exercise in a training session to have employees ask these questions and collectively contribute to the baseline in their assigned work environment.  This will help get a better grasp of the concept and prepare them for the next key skill–recognizing and responding to anomalies.

Teaching the Importance of and Response to Anomalies:

Obviously, the “observe” step is what most people associate with the concept of situational awareness, but the reality is we also need to incorporate the second step, “analyze,” to truly achieve situational awareness.  Analyzing what we observe puts those observations into a context against a baseline of what is normal so employees can recognize deviations/anomalies and make a game plan such as reporting suspicious activity or removing oneself from a situation to create the time and distance necessary for a safe outcome.

Anomalies are things that either do not happen that should, or that happen and should not. Employees must be trained to recognize and respond to anomalies.

Then to help analyze anomalies, “What would cause someone or something to stand out?”  For example, most people are going to look relatively comfortable in most situations. Think about a bus or a subway ride — passengers generally appear relaxed while they stare out the window or read a book. If someone looks uncomfortable, that is an anomaly that warrants extra attention but does not mean that a person is necessarily a threat, just something employees should be trained to monitor.

Patrick Van Horne, author and founder of The CP Journal, a behavioral analysis training company, says that a common display of uncomfortable behavior by individuals up to no good is when a person looks over their shoulder to see what’s behind them or checks their surroundings constantly.  This is also referred to as scanning – when a person is continually looking around in all directions and showing situational awareness.  People who are comfortable generally do not “scan” because they don’t feel any threat. So, if you see a guy looking over his shoulder a lot when he should be standing there, that’s an anomaly that warrants additional attention and potentially an upgrade from yellow (prepared and alert with good situational awareness) to orange (alert to probably danger, ready to take action or make a report of suspicious activity).

On the flipside, someone acting comfortable when everyone else is uncomfortable would be an anomaly. One of the ways law enforcement was able to identify the Boston Marathon bombers was that they noticed in surveillance footage that the men looked relatively calm while everyone else was running around in a panic. The reason they looked calm was because they knew the explosion was going to happen and thus were not surprised by it, while everyone else was caught off guard.

Here are some negative anomalies (something missing) which should lead to action:

• A person not accompanied by someone you recognize in the workplace.
• A person not wearing appropriate identification in the workplace.
• A person with an appearance that is inconsistent with the workplace dress code.
• A person who seems lost or is asking for directions to specific areas.

Here are some positive (something extra) anomalies that can be included in employee training:

• Person loitering too long (particularly around employee entrances or parking lots)
• Person moving too quickly or running through an area where this is not normal behavior.
• A person repeatedly looking over his/her shoulder
• A person leaving a bag, suitcase, or other object behind or suspicious object left unattended
• Inappropriate clothing for weather or setting (e.g., a heavy winter coat in the summer)
• Fumes, odors or liquids associated with a package or letter
• Unattended vehicles in an area where vehicles are not supposed to be parked.
• Sensitive information that is left in an unauthorized area

When anomalies are observed, employees must be trained to spring into action either by removing themselves from a potentially dangerous situation or to file an immediate report about something suspicious and out of the ordinary so that the appropriate security or police agencies can intervene.

Summary:

This article presented three steps to build situational and security awareness with employees to reduce the risk of security incidents and criminal activity.  The steps are:

1. Teaching employees to develop a sense of self-awareness.
2. Establish and train employees on people and facility “baselines” in any given environment
3. Train employees to detect anomalies in the environment and take “real time” action such as removing oneself from a situation or making a timely report about something suspicious.

In essence, without these extra steps, “See Something, Say Something” will be nothing more than a catchy phrase that under performs.

¹ Some of this information was presented by Michael Rozen at ASIS International in 2019 in an excellent session.