Introduction: why Behaviour Detection?

The concept of behaviour detection, or Behaviour Risk Assessment, as a method of detecting suspicious individuals continues to occupy the headlines. As a recognized layer of security screening that has been successfully deployed in Israel and other countries, it is part of considerable efforts worldwide focusing on reforming the existing legacy approach to security into a more risk-based system (read about Focus on Intent).

In recent years, two international bodies, IATA and ICAO, have been leading the way by advocating a transition from the current “one-size-fits-all model” of security to a model where passengers are screened based on established or perceived levels of risk. As part of a risk-based model, all passengers would be divided into Low, High, Unknown groups according to information available about them to security personnel in advance (e.g. Passenger Name Record) and identification of any suspicious indicators in real time. Various countries, such as the US, Canada, UK, France and Australia have been studying the subject very closely including in pilot projects and research studies to determine best practices and/or validate the approach.

Some groups of lower risk passengers, such as children, military personnel, seniors over 75 years of age and other ‘trusted travellers’ have been already introduced in the US and Europe. Passengers in these categories are assumed to present a lower risk and, as a result, are subject to less scrutiny at checkpoints. One of the unresolved security issues with low-risk groups is that despite possible prior clearance (say last month) there is no guarantee they can’t be involved in a terrorist plot today. In other words, despite a perceived lower risk they present to the system due to prior background checks, assumed innocence or loyalty, they could still be enlisted, tricked or forced to participate in carrying out a terrorist attack (and sometimes even without their knowledge). We must have a method to screen people in real time to reach a ‘Threat’ or ‘No Threat’ decision as they show up at a train station or airport terminal.

This is where behavior detection or alternative technology-based solutions that focus on Intent in real time come into the picture.

Trained officers vs. machines

The model for utilizing specially selected and trained officers to perform real-time behaviour observation and risk assessment has been developed and successfully deployed in Israel (including El-Al stations abroad) since the 1980s. After 9/11, the concept was adopted to varying degrees of depth and/or success worldwide, foremost in the US. In fact, to date worldwide, behaviour observation method remains the only screening method that has successfully intercepted would-be attackers in real time, including Ahmed Ressam (the Millennium Bomber), Richard Reid (the Shoebomber) and Umar Farouk Abdulmutallab (the Underwear Bomber).

Unfortunately, the program TSA has developed using generic Israeli security principles and Paul Ekman’s facial micro-expressions approach continues to attract criticism and negative coverage. Indeed, the program suffers from numerous shortcomings starting from how it selects and trains officers to what these officers are trained to focus on, limited performance oversight and lacking consistency in quality assurance testing. We covered some if these issues in the past.  

As a result of these and other shortcomings the US Government Accountability Office, the investigative arm of the US Congress responsible for auditing and evaluating government spending, recommended in its report on TSA’s Behavior Detection Program released in November 2013 that funding be withheld from the Behavior Detection program until TSA can prove its effectiveness.

At the same time, on page 20, the report stated that:

          “Recent research on behavior detection has identified more promising results when behavioral indicators are used in combination with certain interview techniques and automated technologies….Researchers began to develop automated technologies to detect deception, in part, because humans are limited in their ability to perceive, detect, and analyze all of the potentially useful information about an individual, some of which otherwise would not be noticed by the naked eye.”

Indeed, all behaviour detection methods in use today are heavily relying on a trained officer’s ability to detect suspicious indicators in behaviour, appearance, documents or context. While it is possible to select and train certain individuals to perform the role, it is a very specialized niche that requires considerable knowledge and skills, and of course time, on behalf of program managers. While humans can absorb and analyze information in ways modern computers still cannot, the success of such a program depends entirely on individual abilities to detect and process information that is ‘out of context’ – a subjective and risky proposition for most governments bound by public opinion.

The solution, as usual, is somewhere in the middle. There is no doubt in our minds that a robust security system must be founded on the skills and professional knowledge of specially selected and trained personnel conducting security operations and field intelligence (see Human Eye vs Technology: Who Wins?). If these activities can be reinforced by available technologies, they should be utilized where applicable to compensate for human deficiencies.

So, what kinds of technologies exist out there that could be utilized today to observe and detect suspects or various psycho-physiological indicators pointing to potential malicious intent?

In the next blog instalment, "Behaviour Detection in Real Time (Part 2): Technologies That Work and Not…Yet" we will look into such systems and discuss their effectiveness. 

Does the Private Security Industry need a Standard to improve their security service performance and demonstrate good management practices? If you, like us, think that the security industry should become more professional then who or what organization would develop such a Standard and how far would its tentacles reach?

For the last several years ASIS International and ANSI (American National Standard Institute) have been debating this issue with subject matter experts from all over the world based on numerous difficulties and complaints in the private security industry related to costs, poor management, and human rights and freedom violations.

The result – ANSI / ASIS PSC.1-2012  “Management System for Quality of Private Security Operations – Requirements with Guidance” was developed and approved by the American National Standard. Our Senior Associate, Peter Stewart, has combed through the draft standard documents for your benefit.

When we start considering the issue, few nagging questions pop to mind right away: What value can a Standard provide to a Private Security Company (PSC)? Do we not have our own business model that got us to where we are today? And would it not cost too much money to follow some framework conjured up by some nongovernment organization (NGO) with limited field experience?

The standard, which may become ISO's standard in the 4th quarter of 2013, is the final product developed by a pool of 200 technical experts directly representing numerous security companies from 24 countries. This group of international security experts concluded that a Security Management System for PSCs providers was needed to provide Quality Assurance in all security related activities and functions while being accountable to the law and human rights.

This group concluded a standard such as this would (a) assure the Quality of Services, (b) ensure human rights and freedoms, (c) and provide a basis for small and medium size PSCs to bench mark and improve their security service performance and demonstrate good management practices.

In our analysis, the challenge for most serious-minded North American PSCs is to determine how to cost effectively manage risk while meeting the organization’s strategic and operational objectives within a framework that protects the safety, security and human rights of the client. For companies that recognize the need for higher standards in service delivery, a good look at this standard may provide the roadmap they have been looking for in achieving these goals.

For any and all PSCs that decide to adopt the standard they will:

1. Be able to establish and implement a Security Management System;
   
2. Be able to demonstrate the company’s ability to meet client needs to international laws, local laws, and human rights requirements;
   
3. Establish auditable processes for:

• Objectives;
  
• Culture;
  
• Structure;
  
• Resources;
  
• Processes; 
  
• Products and services;
  
• Performance;
  
• Corrective and preventive actions;
  

The values to any and all PSCs that choose to adopt this standard are numerous:

1. The ability to demonstrate the existence of a solid Quality Management system to clients;
   
2. The ability to demonstrate compliance to legal and regulatory requirements;
   
3. The ability to demonstrate commitment and compliance to the International Code of Conduct (ICoC);
   
4. Improve business performance, thus saving time and money;
   
5. Effective management commitments and reviews;
   
6. Manage all levels of risk to assure the Quality of security product and service, as well as attention to Privacy & Human Rights.
   

As with all new initiatives there is a cost of doing business. The costs involved in adopting this standard are minimal and are related to;

• Planning;
  
• Implementation;
  
• Employee training and;
  
• Reviews and audits; 
  

In a highly competitive environment of security and protection services, the adherence to this standard may just be the vantage point that positions a PSC ahead of its game. If your vision is one of quality, measurements-based improvement and desire to do things right, contact CHI Security to discuss  your options.

A feature article in the September 2013 issue of "Passenger Terminal World" is dedicated to the coverage of Behaviour Detection as one of the risk-based screening methods applied in modern mass transit (e.g. airports) settings.

CHI Security's Michael Berk was interviewed by this leading industry magazine to provide insights into this highly specialized trade. Read the feature article here on-line or in the digital format here 
(see page 18).

Note: the authors have incorrectly associated the Passenger Behaviour Observation pilot program with Transport Canada, as oppose to the Canadian Air Transport Security Authority. We asked them to update this (as well as the full name of our company) but the issue went to print already... 

In the past, we already discussed why the existing security paradigm based on legacy systems and addition of more layers of technology is incapable of addressing the new realities (see here). Understanding these limitations brings many strategic thinkers in the security realm to the realization that a complete revision of the way security measures are developed is required. The analysis of "lessons learned" from the thwarted and executed attacks in the last decade reinforces the view that a more effective way of dealing with emerging threats can be achieved by shifting the focus of security operations towards identifying individuals with the motivation, intent and capabilities for carrying out unlawful acts.

The Focus on Intent approach has both strategic and tactical sides to it. 
At the strategic, higher, level the approach includes a stronger degree of cooperation and communication between the security-minded stakeholders, including national intelligence and law enforcement agencies. The development of legal, regulatory, technical and privacy rules outlining the information sharing protocols, collection and storing of private information, data taxonomy, and various roles & responsibilities is required to ensure only the relevant information/intelligence is collected and shared. Due to the shifting focus of the system from 'objects' (ie. IEDs, knives) to 'intent' (higher-risk individuals) a revision of all existing procedures and process will be required as well. Given the stakes involved, this will take a considerable time and cooperation of jurisdictions at various levels. 

At the tactical, operational, level the approach will be based on two major components: real-time Behaviour Assessment by especially selected and trained security staff and the use of CCTV / biometric equipment establishing the identity of individuals and assessing their psycho-emotional states. The security personnel on the ground should be supported by tech solutions and responsible for real-time assessment, security interviews, and differentiation of passengers/customers according to the established risk indicators. In case a suspect has been identified by security or support personnel, or SOC operator, a qualified interviewer will be dispatched to conduct an assessment and decide on the appropriate course of action. If supported by relevant intelligence / information from stakeholders and properly supervised, such security personnel will become the cornerstone of a new security system at any air/port, transit or mass gathering location. Naturally, to be able to perform their job to the highest standards of customer service and effectiveness such a unit must be selected and trained in a regimen of strict and continuous performance measurements and quality assurance oversight.  

Achieving a higher degree of security requires the development of a system that can be scalable, responsive, and sensitive to the context in which it operates. As many examples from the past terrorist attacks or recent counter-insurgency operations show, nothing beats the presence of 'boots on the ground' both as a deterrent and real-time respondent in a rapidly shifting context. As we begin to move towards the Focus on Intent, consider if your security system and personnel are ready to address the emerging challenges (or cease opportunities) in an increasingly unstable environment.

The challenges Via Rail (a large public, service-delivering operation) is facing are many, and so are its vulnerabilities. As usual, the decision as to what security measures to adopt will be based on a threat & risk assessments, prioritization of vulnerabilities, and then oscillate between available budgets, security value of each measure and public perception. In order to be truly proactive, we hope VIA Rail chooses to concentrate on the preventative measures that increase deterrence and detection capabilities, as oppose to adding surveillance technologies (security vs law enforcement mentality). In terms of the overall approach, the new security system must be flexible and scalable above all (see for other attributes here). Based on a risk matrix, such system would ensure security operations can be expanded or reduced when the situation requires it. 

Since it is likely that the attention would concentrate on the high-impact areas, i.e. passenger terminals along the Eastern corridor, what could some of the sensible options introduced at this point be?

1. Passenger ID: we believe a mandatory check is required, especially when connected with luggage reconciliation. Could be a machine-readable and quick process.
   
2. Luggage screening: may be required, but only as part of a risk matrix assessment and/or subject to a decision by the especially trained officers focusing on suspicious behaviours. Shouldn't be mandatory for all passengers at all times.
   
3. Biometric technology: some options exist allowing security operators at SOC to quickly identify suspicious objects, behaviours, inconsistencies that can be reported to and dealt with by the ground security personnel.
   
4. Professional Security officers: trained in behaviour observation and how to conduct security interviews would both increase deterrence and VIA Rail's customer facilitation levels. However, these officers must be part of a stringent performance measurement & quality assurance framework (we wrote about this here).
   

With that, the most important part is this -- if VIA Rail wants to create a proactive, risk-based model based on common sense and true security (preventative) it should be based on Quality and performance measurements for its staff and processes. Good security is based on regular assessments (i.e. accountability) and the professionalism of deployed security officers and managers who can motivate them. Various tech gadgets come later.

The challenge ahead is to decide which measures should be implemented to increase safety & security of passengers on board and in terminals, as well as physical security of rail lines and relevant installations. As possible threat scenarios are numerous and budgets are limited, the revised security system must contain the following general attributes:

• be applicable to all facilities, scalable (risk matrix) and multi-layered
  
• fit with existing frameworks (Human Rights, Privacy, legal, regulatory)
  
• have abilities to integrate stakeholders efforts and utilize available information
• contain built-in quality assurance and performance measurement parameters
• ensure customer facilitation and service

In this regard, we would like to briefly focus on the 'body language' training reportedly provided to VIA Rail employees. As the only proven method allowing especially selected and trained security personnel to focus their attention on higher risk passengers, Behaviour Risk Assessment can be a very valuable tool. In addition to identifying individuals with malicious intent (e.g. Richard Reid the 'Shoe bomber' or Ahmed Ressam, the 'Millennium Bomber'), behaviour observation officers contribute a lot to deterrence and also customer service. In order to succeed, however, possible candidates must be selected and trained (extensive in class and OJT) to the highest standards of professionalism and be part of a robust program with elements of continuous improvement, performance measurement and quality assurance oversight. 

In the absence of such an approach the lack of professionalism may lead to potential abuses, profiling or worst. Unfortunately, some of the problems experienced by TSA's Behaviour Detection Program in the last 7 years stem from insufficiently trained and supervised personnel.

So, while we welcome VIA Rail's attention to the 'body language' training we also hope their approach goes beyond a 1-2 days awareness course and includes the development of the necessary procedures to support this operation.

Many of the problems plaguing TSA today were 'built in' during its early days after 9/11 when the agency was established. Given authority not only to regulate security policies and develop procedures,  but also to implement them through hiring and managing of a mammoth workforce and oversee themselves in the process, the agency's job can only be described as Sisyphean labour. 

One of the biggest problems from day One was TSA's inability to develop and implement a quality-driven performance measurement framework with regard to selection, training and supervision of the workforce. Tasked with raising the force right after 9/11, the perceived level of threat (plus, political expediency) dictated an immediate response at the expense of quality. Over ten years later, with thousands hired and procedures and adopted mentality in place, the job of John Pistole is unenviable. I am surprised the statistics cited in GAO report are not higher.

(One thing about Pistole as TSA's chief -- his focus on risk-based security is commendable. See here for his recent interview during the Aspen Security Forum) 

In modern security operations (as oppose to law enforcement, where Profiling is actually used) with the emergence of 'home grown terrorism' phenomena, building profiles based on a typical stereotype is a taboo. If stereotypes get used by security personnel in their line of work it usually means these officers were not selected and/or trained adequately to perform this very sensitive work. 

In our work, we tend to steer away from using Behaviour Profiling or Behaviour Detection at all. Apart from confusing the security work performed with that of law enforcement agencies, these terms do not fully describe the breadth of what is actually done on the ground by focussing on behaviours alone (let alone bringing the ire of human rights activities many of whom do not understand the difference between 'security' and 'law enforcement'). As explained above, behaviour observation constitutes only a small part in the overall process of identifying suspicious individuals. That being said, using the word Profiling in the title of this post or in other places intentionally is another story -- it attracts media attention and results in better search returns! 

Behaviour Risk Assessment (as it will be known from now on) can be used effectively as part of a risk-based security to identify and focus the attention of security apparatus on higher-risk individuals. Since bombs do not explode by themselves or guns fire on their own, the attention of security officers is should be given to screening individuals and not items.

Especially selected and trained officers perform routine observations in crowded areas or spot checks in mass transit systems to identify suspicious indicators associated with humans, items or situations. If something or someone suspicious is noted, they follow the procedures and act to resolve the situation as quickly as possible. Due to the high levels of responsibility and sensitivity involved BRA will only work if officers deployed to perform these duties:

• get selected especially to fit the required cognitive and personality traits
  
• receive sufficient theory and OJT training (it might take up to 2-3 months to get someone qualified for the independent job)  
  
• provided with clear SOPs
  
• supervised and tested on a regular basis to ensure highest performance and quality standards
  

Due to numerous Human Factors involved in this operation, the BRA process must be designed according to the principles of continuous improvement. The role of supervisors and managers as a result should be focused on coaching, mentoring, motivation and setting high standards for achievement. 

The security values derived from an effective and efficient engagement of such a highly specialized unit are numerous:

• your security apparatus dedicates its resources and time to higher-risk individuals and associated threats
  
• smart deployment of Human Factors engineering in selecting, training and supervising your staff will result in higher motivation, better performance, improved customer service -- better retention rates, job satisfaction, happier customers etc
  
• the deterrence value goes up -- your site becomes a harder target and chances of being caught increase.
  
• improved image of real security for customers and media alike
  
• efficient resources allocation and possible capital savings

Understanding these benefits led the Canadian Air Transport Security Authority to developing its pilot Passenger Behaviour Observation program, the first such comprehensive program in Canada. In almost 3 years, we were able to develop all the required processes and procedures, as well as identify, select and train security officers to perform these duties effectively in line with human rights and privacy considerations.

Indeed, the principle of using a random selection process as one of many layers in aviation security whereby a certain percentage of passengers is diverted to more intensive screening is not new (in fact it has been used by CATSA in Canada for years). It adds a certain degree of unpredictability in the system and makes it more difficult for individuals with malicious intent to circumvent the screening process. As the levels at which randomizers make their choices can be adjusted to lower or higher rates (there is an algorithm to do just that), the enhanced screening lines can process fewer or more people depending on threat level.

The problem with this approach could be...in its randomness. If a national security operator deploys random selection beyond a very small percentage (say 0.02 of purely random selection) it could be a sign of a system that chooses optics instead of a true risk-based approach to security where solutions are deployed based on threat/risk assessments. If a qualified TSA officer makes an informed decision to send a passenger to an enhanced screening line, the system behind that officer must stand firm and maintain that it is done based on a real-time risk assessment. That is, of course, if the system actually believes in the officer's knowledge and skills to perform the job right and operates based on a risk-based model.

Otherwise, unfortunately, it appears to be a smart communications ploy only.