BLUF: There are many indicators of increasing crime, unrest, and security issues in the United States (and abroad) that must be monitored and managed for the rest of this year and into 2022. This is largely due to general weakening economic factors, increased political division, hotter weather, and certain citizens feeling underrepresented and marginalized. Impacts will be felt throughout several threat and exposure categories so adjust your security posture and budgets accordingly.
As an individual that appreciates and studies the arts of early warning risk intelligence I would be remiss not to weigh on the events of 2021 so far. The lack of conversation about the current state of affairs and the obvious impacts on business and society is being overshadowed, deservedly, by the situation in Afghanistan and now the drastic measures being used to force compliance with vaccinations. The rising crime rate across multiple types, the number of people choosing to stay home as opposed to working, and the increasingly hostile rhetoric from opposing viewpoints is not being discussed in terms of security and risk management and what we need to be prepared for. I will cover some of the main indicators of threats today, what they mean, and a few areas of your security program that must be tweaked in response.
The economy is related to threat dynamics. The economy of the United States has been churning along, powered by significant government investment in business loans but mainly in social relief programs. This relief has largely been targeted towards lower income families and has allowed many to stay home with families and thrive during the pandemic despite its extremely negative impact on employers. Many service industries, including security, have struggled to find reliable workers. Even when increasing wages, some fast food chains are now paying over $20/hour, the quality and reliance on hired help has suffered. When a lower income employee can earn just as much on unemployment, staying at home, there is not much to motivate them to work or stay at work. This has led to poorer margins for companies, poorer service, and in some cases, security vulnerabilities as companies become more desperate for help with many unmotivated employees. The number of people at home is often correlated with higher domestic/local crimes, higher medical costs, and other threats due to inactivity and increased local social proximity. However, the ability to pay bills though social programs is a strong motivator to remain a good citizen and to maintain access to funds.
Employment is related to threat dynamics. Recently, the amount of social economic support is being reduced. This should have a significant impact on the worker population and should correspond with lower unemployment and more capable individuals in the workforce. This will likely result in more competition for jobs and a reduction in salary unless minimum wage laws continue to dictate these terms. Due to prolonged shutdowns, poor margins, inflation, and reduced spending, businesses will not be in the same position to hire and may hire less. As more people struggle to earn a livable income, crime rates will probably increase even more. People will become more frustrated and after becoming accustomed to an easier path to income, there will be some resistance to being “forced” to work. Tempers and attitudes will spark and underlying beliefs about inequality will again become a domestic talking point. This will result in increased civil disobedience, crime, and division. Fickle and unreliable employees will also be the norm as people leave or transfer jobs for better paying ones.
The movement of commerce and capital to digital currencies and nontraditional investments will act as an early hedge against inflation and a solid vehicle for some to invest and make a profit. However, the large returns from crypto currency are likely behind us, and less sophisticated investors have capital stuck in crypto hoping for a rebound. This took millions of dollars out of circulation and reduced the spending power of crypto buyers. Some are even investing in collectibles, gambling, or high risk start up companies in an effort to gain more of a return than the volatile stock market or low interest earning vehicles provide. This high risk, high reward approach will inevitably leave many people broke and desperate, even if a few savvy investors get rich. This will contribute to unstable economic conditions when combined with rising cost of goods, lower salaries, and a reduction in social support. The capital must come from somewhere, and there is no such thing as a “money tree.” Now that the plug is finally being pulled on social programs be ready for the consequences.
Climate and Health Indicators
Climate and health, believe it or not, have an impact on the willingness and ability of people to stay outdoors, the ability for viruses to spread, and the temperament of people in general. When its hotter, people are less patient, prone to anger more easily, and suffer from dehydration conditions. In hotter climates, there seem to be more of these now, viruses can’t survive and spread as easily, providing some pandemic relief. Even though there are unprecedented energy costs, many people stay indoors when it’s very hot outside and this lowers the opportunities for entanglements, protests, social friction, etc. Winter snow may also work to keep people indoors, but fewer US cities are disrupted due to winter conditions. Fewer people want to commit crimes or protest when its uncomfortable. So, there are some offsetting conditions here, but the more temperate seasons will likely net more threats and triggers for threat events.
However, we are quickly approaching colder weather. Viral transmission will go up, people will go outdoors more, and the conditions for large gatherings and comfortable demonstration will be present. This could lead to more lock downs, police control, and civil unrest. The recent vaccine mandates will certainly not help with this matter and will also have economic and civil consequences. Companies will increasingly stay remote for economic and health reasons, and smaller physical store fronts will continue to dwindle until only staple services are available and big box stores remain. Shipping will be a growing industry and there will be consolidation of logistics and supply chains. This will result in less redundancy and options and more prone to shocks and damaging consequences during crises. As many more work from home, transportation sectors will take a hit with cyber and domestic threats increasing proportionately.
The FBI recently put out a very general and largely not useful warning about homegrown violent extremists (HVEs). These acronyms only incite more division and attempt to point fingers at certain political opposition groups over others. What is a “homegrown” extremist exactly? Does that mean someone born here who believes strongly enough in their cause that they will resort to violence? It is more useful to frame any extremist with the potential for violence as a violent extremist organization or individual (VEO or VEI). The focus on general domestic terrorism is not helpful and really read like a government trying to superficially cover their exposures through superficial pronouncements. If we are going to gain insight into the real threats and exposures to our assets, we need to dig deeper and stop merely pointing fingers at the “other team.”
The country is divided more rigidly and starkly than most will admit or accept. Identity politics left vs right, geopolitics, racial tensions, varying degrees of nationalism, libertarianism, and socialism are all forces successfully dividing the country along defined lines. The rhetoric on social media and in the mainstream media is constant, aggressive and many are planning to enforce their beliefs through action soon. This reality was taken lightly by security experts in 2020 and this mistake should not be made again. The underlying causes of domestic unrest are still present, if not stronger, and combined with aggressive public health policy, worsening economic conditions, and alienated citizens, there is the potential for serious disruption, destruction, and violence.
People are generally upset about many topics now. There are those that feel the country has changed for the worse this year, and those that feel it hasn’t changed enough. There are disillusioned military veterans that feel that their sacrifices to the country in decades of war were not warranted or valuable. There are extreme leftists and socialists that want more government power and social support, and those extreme conservatives that want to spend all of our money on a massive military and to eliminate all social programs. There are racial and other minorities that feel underrepresented and genuinely feel oppressed economically and socially. There are anarchists and extreme libertarians that want near zero government and nationalists that want to protect our borders and have intense national pride. The country is struggling to find common ground, and many of these subjects don’t have a middle ground. This creates friction and there are very few national/global events, outside of the pandemic, that could possibly galvanize cohesiveness. I wish I could say there was a way to change this fact. In short, there will be ideological conflict for some time, and this creates the conditions for many threats and extreme risks.
Given the above, it is constructive to distill these larger indicators (there are more) into possible action items for security programs. It is also important to convey these threats and the possible consequences to company leadership so there is common understanding and appreciation of these possible realities. The corresponding threats facing this country and the organizations within it are diverse and must be monitored carefully. The most resilient companies will be those with robust intelligence programs. The sooner the indicators are measured, aggregated, and understood, the better off the organization will be financially and operationally. It is up to the security and risk professional to create the correct ROI explanations to stakeholders to create buy-in and common understanding of how strategic security risk program budgets must be taken seriously.
The economic indicators discussed above will impact crime trends, physical threats, margins, talent retention, talent quality, cyber risk, and many other categories. The main risks will be human risks and external/environmental risks. Companies will need to prepare to maintain remote work forces, have more rigorous hiring screening practices, and be prepared to react to government mandates and governance frameworks. Protecting assets will become more important and should receive proper attention as rising physical threats converge with higher cyber threats. Screening employees for unconventional indicators, such as job flight, will be important as frequent employee turn-over creates security and productivity challenges. Although budgets will be tighter, proper attention should be paid to protecting the vital organs of the business: people, product, and processes. Having contingency plans, excellent training, and sound threat identification and management processes will pay dividends and keep the company afloat during troubling times.
The health and environmental risks (some are using more confusing acronyms like ESG to partially describe this), will come down to talent protection, cyber, and security governance frameworks for the organizations. Remote workers will need to be protected and their nodes of communication as well. Each node represents more attack surface. Each remote connection is subject to exploit. Each person not closely supervised is a security risk, and only creative monitoring and training can help to overcome this. It only takes one event to cripple a company legally, financially, reputation wise, or asset wise. For those companies that keep physical presence intact and have assets distributed, the physical protection decisions must be based on an accurate understanding of current and projected threats, costs, and the ROI based on changes in consequences/impact with and without security treatments. The author will be publishing a paper on measuring the ROI of security programs in the next 6-12 months. As a security professional, you must read the threat “tea” leaves and start to treat potential threats in a relational context.
The political and ideological threats under the surface will start to bubble up soon. We are already seeing sporadic violence against and between police, public institutions, and competing ideological groups. This will create intimate security and risk management challenges that will test the objectivity of organizations and practitioners. Human risk and major disruption risks will be front and center as increased social unrest and aggression will have damaging impacts on the economy and can target certain industries more than others. Logistics, talent, markets, resilience, training, and operations will be tested. Having adequate early warning, optimized physical deterrents and robust, connected security programs will help. Monitoring your own staff, business partners, and vendors will become more important. Policies for political discourse and participation might become more frequent to avoid risk. The choice of asset location and degree of protection will largely be a function of the threat environment as it changes. Effective, proactive intelligence will be necessary to survive and thrive in the environment of the next 12-18 months.
We are living during unpredictable and trying times. The coming decades will define our country, culture, and world more than we know. It doesn’t have to be scary, and there are ways to evolve with the threats and exposures that emerge. In the absence of a global economic meltdown, a worsening pandemic, a hot civil war, or a hot world war, the show and business must go on. The smarter leaders will invest in security and risk management technology. The organizations that want to evolve will invest in better intelligence capabilities. The resilient companies will attempt to predict the threats of tomorrow instead of just protecting against the threats of today. Shape your security and risk programs based on data driven insights and we will get through the hype and hysteria as well as the real probabilities of emerging threats. Security programs and decisions must be informed in a return on investment context but cannot take emerging threats for granted. Risk management budgets must be serious, adaptive, and liberal. Security leaders and influencers must be taken seriously. Intelligence should not be ignored, and we should remember that what we know today, may not be the environment of tomorrow. In the spirit of the US open, which thankfully had very few security incidents, I leave you with:
“Luck has nothing to do with it, because I have spent many, many hours, countless hours, on the court working for my one moment in time, not knowing when it would come.”