Planehook

Page 2
Risk as Dollars and Cents
From Yellow and Orange to Black and White
Safety and Security
Osama bin Ladin Is Dead
Prepare for Hurricane Season 2011
Table Top Exercises
Top Three...Pick 'em
Airport Signs
Walk the Fence
Getting Best Bang for the Buck
Perimeter Experts
Security Return on Investment
What You See During the Day....
If Fences Could Talk (A Pictorial)

Osama bin Laden is Dead!

After nearly 10 years of searching, United States military forces from the Joint Special Operations Command, led by special paramilitary forces of the Central Intelligence Agency, conducted a raid in Pakistan. During that raid Osama bin Laden was shot and killed. And so the mastermind behind the U.S. embassy bombings in Nairobi and Dar-es-Salaam, the attack on the U.S.S. Cole, and the 9/11 attacks... and many other attacks which were thwarted...is dead.

While there are many reasons for well-deserved celebration, please remain vigilant. Encourage employees, tenants and airport users to remain vigilant and continue to report unusual activities on your airports. U.S. military bases increased their threat conditions shortly after the President's announcement of bin Laden's death.

I recommend a similar course of action, at least for the short term.

Table Top Exercises

Having a consultant make a table top exercise for you can be expensive. But you don't have to pay to play. Here are some scenarios that you can use to improve your emergency response planning, all courtesy of the Federal Emergency Management Agency.

http://www.fema.gov/privatesector/exercises.shtm

The exercises you can find there include Earthquake

Critical Power Failure

Hurricane

Chemical Accident

Airport Signs

I recommend looking at how your security plan funnels people to the correct locations: the kid interested in learning to fly finds the flight school, not the taxiway; the new pilot flying into the airport for his aircraft's annual inspection finds the A&P's shop, not the tenant hangars; and so on. The reason good signs are important is that they can lower the security noise level at your airport. What do I mean by security noise?

Consider the person an airport tenant sees wandering around the aircraft parking ramp, just looking into the airplanes. Is this someone who is planning to steal someone's GPS nav/com radio? Or is this person genuinely interested in learning to fly, but they don't know where to go on the airport to ask about flight instruction? If you don't have signs telling them where to go, you don't know. That's security noise, just like static on the radio. But when there are signs which tell the legitimate visitors to the airport what they need to do, chances are that they will do what is written on that sign. That means the person you see wandering around on the ramp who doesn't appear to belong is more likely someone who shouldn't be there...because you've lowered the security noise with proper signs.

Signs are normally one-time costs. Signs that provide clear instructions and placed so that the probability is high that a law abiding citizen would be able to read and understand them can help funnel those who you want to have on and around your airport to the place where they should go. Signs also help make those who shouldn't be on the airside of your airport to standout. Signs generally have low acquisition costs and near-zero lifecycle costs. Signs can be a great form of low-cost, effective security.

Getting Best Bang for the Buck

In the last issue we covered prioritizing the top three security concerns at your airport. Now let's cover how to get the most security for your money. It's all based upon the understanding of your risk based upon a risk assessment. A risk assessment is made up of three parts. First, there's the consequential asset analysis. This analysis examines what key "things" in your operations would cause your airport the greatest harm if they were not available and fully functioning. If fuel surcharges and flowage fees are the greatest source of monthly cash flow, then a fuel truck or self-serve station at your Avgas or Jet A fuel tanks might be your asset(s) of greatest consequence. It could be that the airport sales tax earned by a particular A&P mechanic's operation is the greatest revenue stream. So activities or hardware that keep the airport solvent are a consequential asset. A threat is something or someone that has the potential to disrupt, deny or destroy some thing or activity of importance to you and the airport. The threat makes use of a particular tactic to expose an important--a critical--asset to harm. In the case of a human threat the tactic may be the use of a crowbar to pry open a door. For a weather related threat there is some undesired outcome: heavy rains can cause damage due to flooding. The threat which has the greatest likelihood of causing the most damage is called the Design Basis Threat--meaning the threat around which we seek to mitigate the most. Finally, for us to take the time to consider a consequential asset at risk to a threat (and its tactic), that particular threat and tactic must exploit a vulnerability, a weakness. Some threats--especially human threats--can use different tactics at different times to exploit multiple vulnerabilities in taking the path of least resistance to that asset you want to protect. For this reason it is important to break down risks to these fundamental elements. But why? Each dollar spent to improve security should do one or more of the following: 1. Reduce the consequence that the loss of an asset has. 2. Diminish the likelihood that the threat and the tactic will be effective. 3. Mitigate the vulnerability that an asset has when exposed to a threat and tactic. The point here is that each dollar you invest in security should be directly related to reducing asset consequences, diminishing the threat and the effectiveness of its tactics, and the vulnerabilities of an asset to a threat. You achieve the best bang for the buck when you invest in security that protects your most critical assets from the Design Basis Threat. And it all starts with having a clear picture of the risk to whatever is most important on your airport.

Perimeter Experts

In the last edition I wrote about the value of walking the fence. It's a simple act of security that lets you see firsthand the condition of the perimeter of your airfield and property line. This edition I want to expand on that act a bit further.

There are two perpetual truths that I've found in general aviation security. First, there is no substitute for experience. You gain both familiarity and experience with your airport perimeter by walking the fence regularly. You don't have to get out and walk the fence every day; however, it is a good idea to do it every so often. How often is that? I recommend walking the perimeter at least once a quarter, if not once a month. The rest of the time I suggest doing by vehicle. It DOES take time to walk the perimeter, even if you have a relatively small airplane patch.

The second perpetual truth is this: you are the expert. Unless you are a brand new airport manager or airport tenant, you probably have a pretty good idea of what happens...and what doesn't happen...at your airport. So you're the expert on your airport. You know what looks right. You probably have a very good idea of what doesn't look right. The trick is in knowing when to question or investigate further when something or someone doesn't look right or doesn't act right. Take action. A friend from Oregon asked me if blackberry bushes could be used as barriers around airport in lieu of a fence. She explained that there are plenty of blackberry bushes in Oregon, but not a lot of money for general aviation airport security. Having grown up near Seattle, I can attest to the fact that there are plenty of blackberry bushes that grow wild in the Pacific Northwest...and not always where you want them.

Risk as Dollars and Cents

I want to help you put a real dollars and cents value to the various risks at your airport. Why? It boils down to this: knowing the risk as a value with a dollar sign helps to prevent you from spending more on security than you have risk to mitigate. Would you spend ten thousand dollars on security when your financial risk is only a few thousand dollars? I didn't think so.

I want to introduce you to a risk analysis measurement method called Annual Loss Expectancy, or ALE. The way ALE works is that it looks at two specific values, tangible values. The first is threat probability. This threat probability is the frequency that a particular event or attack occurs. The second value is the amount of loss that occurred. In other words, how much did the event cost you, your airport, your tenants, and so on.

The ALE equation is exponential. But don't let that bother you; your computer most likely has a calculator program. Just put your calculator into the "Scientific" mode (found under VIEW in Microsoft Windows ®). Here's the equation:

ALE = 10(f+i-3) /3

The value "f" is the frequency that the event happens. Here's a table with the values of "f" and what those values mean.

“f” value Frequency of Occurrence

1 Once in 300 years

2 Once in 30 years

3 Once in 3 years

4 Once in 100 days

5 Once in 10 days

6 Once per day

7 10 times per day

Note: Why go from 3 years to 100 days? It's all based on days. It just so happens that 3 years is roughly 1,000 days (not exactly, but close enough for modeling purposes).

The values for "I" are a little easier to understand. These values for "I" are orders of magnitude of financial loss (in dollars or whatever monetary denomination you want).

“i”-value      Impact of Loss

1                 $10

2                 $100

3                 $1,000

4                 $10,000

So for example, let's say your airport is in Tornado Alley. On average your airport suffers a loss from a tornado once every 30 years. That means f=2. And the financial loss (impact) to the airport was $100,000. That makes i=5. So the ALE equation looks like

ALE = $ 10(2+5-3) /3 = $ 10(4) /3 or $3,333 per year.

So if you put aside $3,333 each year after the last occurrence, you should-on average-be able to pay for the damage when the next tornado strikes.

There are some limitations with this financial risk estimation model. First, the model doesn't take into account the future or time-based value of money and any impacts from inflation and perceived value. Second, this model requires historical data to provide valid results; however, it could be used as a model to play what-if scenarios. And third, this model doesn't predict new threats in the future, new or changing environments, and so on. However, as a means to estimating annual economic values for risk, it does a pretty good job.

Prepare for Hurricane Season 2011

'Tis the season to be prepared. The 2011 hurricane season is almost upon us. While approximately two-thirds of major storms (storms that are large enough to be named) occur after the middle of August, we here in Texas were surprised last year by Hurricane Alex, a rare June hurricane. So I recommend reviewing and updating your emergency response plans this month.

The 2011 season promises to have more and larger storms than the average, according to the predictions made by Colorado State University. On average there are 11 named storms in a hurricane season; this year we're expecting 16. Typically, there are 6 storms that become hurricanes; but this year we should expect 9. Of these seasonal hurricanes only 2 storms become large enough to called major storms; this year we should expect 5 major hurricanes. The reason for the increase in storm activity this year is based upon two major factors: water temperature and Jet Stream location. The water temperature for the mid-Atlantic and Caribbean is above average by a degree-or-two. And while that may not sound like much, the amount of thermal energy it represents is significant. Also, La Niña effects will conspire to keep the Jet Stream in the higher latitudes. It's the shearing wind forces of the Jet Stream that reduce ease with which convective flows can help to make a storm into a major storm. So we have warmer waters and less Jet Stream effects that are two major factors influencing the prognosis for this year's hurricane season.

Now is a good time to make sure that the names, telephone numbers, email addresses, radio frequencies and other key information is up-to-date in your emergency response plans.

Top 3...Pick 'em

The problem with budgets is that they force us to make decisions between what we want and what we can afford. Unless you and your airport are blessed with deep pockets and people who will back any decision you make on how to spend your airport's money, you probably operate on a budget. And for those with deep pockets, you most likely have them because you effectively used budgets anyway.

When it comes to making money decisions for security, I like to advise clients to identify the top three things they want to protect on their airport. Then I ask them to prioritize those items from most to least important. For a private airport belonging to a single owner that list might be 1) My house, 2) My airplane, and 3) My barn/hangar. For a small public GA airport that list might be 1) The fuel farm & trucks, 2) The terminal building, and 3) The tenant hangars. The point here is that each airport will have assets or services that are most important to the financial well being of that airport.

Often we run out of money before we run out of things on which to spend it. For a security budget figure out how to split time, money and resources between those top three items. Maybe you'll split it 80-15-5. Maybe you'd go 60-30-10. Maybe the difference of value between each of those three assets is so small that you'd split it into equal thirds. The point here is to pre-determine how much you're willing to spend between your top three airport assets. Next time I'll write about getting the most security bang for your buck. 'Til then, keep 'em flying.

Walk the Fence

The summer months are typically the busiest for general aviation airport use. The weather is good. Pilots take vacations, sometimes using their aircraft for travel. So we make sure the field is mowed, looks good and that the tanks in the fuel farm are topped off so we're ready. That's just good business planning.

Before the summer gets too hot, I recommend walking the airport perimeter. For those whose airports are fortunate to have a perimeter road, I recommend leaving the vehicle parked and burning some shoe leather. Why? There is no substitute for the slow, methodical inspection that you get when walking your airport perimeter--whether there's a fence or not.

Take the time to examine all of the gates, entrances and exits to the airport property. Me personally, I've found a gate where locks were removed and replaced with nuts and bolts so a contractor could get in and out of the airside without needing to issue them a key. The problem was that long after the construction work was completed, the bolt and nut didn't get changed back to the lock. We're all human and forget about changing things back to the way they were. It took only a few minutes to correct the situation after that walk was completed. Another time I found a problem with the lock at a gate which was for use by the local fire department only. The gate had a bright red, keyed padlock. Unfortunately, the keyhole for the lock had rusted closed. The lock mechanism itself had been contaminated by rust to the point that the key wouldn't work. I wouldn't have seen that sitting behind the wheel of a slow moving car. The point to this article is that for the price of a few hours out of the office and a stroll on a nice day, you can find out all sorts of things about your airport that you may have forgotten about or never knew. And one more thing...wear some boots or other type of heavy footwear. I prefer to wear snake boots and carry a long forked stick because here in Texas there may be some critters that might be surprised that you're visiting their quiet part of the perimeter.

Security Return on Investment

Would you make an investment of your retirement funds if it didn't pay some sort of return? If someone else is getting the benefit of using your money, wouldn't you expect a piece of the action?

Before getting involved with tacking up cameras and installing smart card access readers on your gates, I recommend contacting your insurance company first and talking with your agent about security equipment. Perhaps the money you choose to spend on security is your own; perhaps that money comes from the city or county coffers. But in general the money used for security in the general aviation community is discretionary. You have a certain amount of latitude on how and where that money gets spent. But because of that latitude, you probably have a fair amount of oversight and justification with which to contend. So being able to make a case using the sound investment principles for return-on-investment, or ROI, provides more solid ground than simply saying, "Well, the camera salesman made it sound good at the time."

Contact your insurance salesperson or underwriter and ask them directly, "What types of investments in security equipment will reduce my premiums, reduce my deductibles, or increase my coverage?" It's a fair question. IF YOU DON'T ASK and go ahead and invest that money in security, there's no reason for the insurance company to give you a more favorable policy. You've reduced their exposure to the risk of loss. That's a windfall for their investors. Wouldn't it be reasonable to at least SHARE that benefit?

General Aviation Security

Premier Edition

Fall 2011

In This Issue

So Many Sensors, So Little Time

Invisibility and Passive Infrared Detectors

Got Security?

Assessing the Threat

Simple Entry...for the Bad Guys

Homeland Security...The Texas Way

Wing Dings

Can You Eat a Whole Cow?

(more on Page 2)

So Many Sensors, So Little Time

 There are lots and lots of different sensors that are commercially available.  There are also lots and lots of 

security system vendors out there who will be happy to tell you why their systems are best.  So how do you know if

you are getting the right system with the right sensors?

 Ask yourself these two questions:

1) What am I protecting?

2) Who or what am I protecting it from?

 Sound simple?  I wish it were simple.  Imagine standing in front of the airport board, city council or county court of 

commissioners and being asked one or both of those questions.  Maybe yours is a private airport.  Maybe you have 

to answer those questions to board members or shareholders.

 Sometimes the asset you want to protect is the cash flow at the airport.  That could range from keeping hangar

renters happy and hangars rented to making sure that the popular airport cafe can continue to serve its $100

hamburger.  It could also mean that the biggest client on the airport continues to keep their bizjet at your airport,

 paying fuel flowage fees, and contributing to the airport by having its aircraft maintained on the airport by the A&P

who includes the airport tax on their bill.  It could be a lot of things.  What exactly are you wanting to protect?

 It could be that the most worrisome threat is the weather. Perhaps it's tornados in the Red River area or floods

along the Gulf Coast.  You know, Mother Nature.

 But it could also be a human or man-made threat.  Whatever it is, the biggest, baddest threat that can exploit in

the vulnerabilities of what you want to protect is your Design Basis Threat--the threat that your security system

should be designed to mitigate.

 Don’t spend a dime until you can answer these two questions.

Invisibility and Passive Infrared Detectors

 One of the most common, low-cost sensors used for security is the passive infrared motion sensor, or PIR.  The 

human body radiates the equivalent energy of a 100 watt light bulb.  The PIR senses the difference of the back-

ground temperature with any changes of temperature that pass in front of its lens (or lenses for multi-beam PIRs).  

When there is a detectable temperature difference that passes in front of the PIR within a specific period of time, the

PIR send a signal that it has detected something.  Perhaps that signal triggers a security light to turn on, an audio 

alarm to sound, or the record feature of a digital video recorder for a particular CCTV camera to turn on.

 Some people make use of PIRs with lighting so that they or their clients and employees can see their way in dimly

lit or dark areas.  Some people use the same system with the intent to discourage criminal activity.  One use is for 

safety; one is for security. When used for safety the need for redundancy and overlapping coverage isn't as  great as 

with security.  If the area is lit for safety, one need only proceed more carefully or even go to get a flashlight.  But 

when illuminated for security, the criminal prefers to have the area dark so as to reduce the chance of detection.  

That's why I recommend PIR lighting systems used for security be used in pairs with the sensors positioned to provide

overlapping coverage, just in case the criminal tries to damage or deactivate one or both sensors.

 When employing a PIR sensor it is important to consider the environment at which it stares.  Here in Texas the tarmac

can get pretty warm, even when the outside air temperature isn't all that warm.  Again, the sensor is looking for a 

change in temperature across multiple lenses over a period of time.  But what if the temperature of the background is 

generally the same temperature as the person you are trying to detect?  They become invisible to the sensor.  For this 

reason the detection background and surrounding environment are important.  There are times when the background 

temperature is warm enough so that a person becomes virtually invisible to a PIR.  The background will warm up and 

cool down in a generally predictable manner.  The PIR has a minimum resolvable temperature (MRT) for differentiating 

between the background and the person moving through its field of view.  

 The MRT is the range of vulnerability when the background and target are close to the same temperature.  Typically,

the more expensive the PIR, the smaller the MRT (but not always, so caveat emptor).  So if it takes 30 minutes for 

the background to heat or cool through the MRT range of the temperature of the person you're trying to detect, that's 

a 30 minute window when the asset you're trying to protect with that PIR is vulnerable.

 So is it time to get rid of your PIR systems?  Absolutely not!  But it is important to understand that detection 

systems have their strengths and weaknesses and to consider your risks and develop your security plans accordingly.

 PIRs are machines.  Machines require maintenance.  When was the last time you inspected, tested and cleaned your

PIR sensors?  I recommend reviewing the manufacturer's guidance on keeping your PIR sensors in good working 

condition.  But if you can't find those instructions, I recommend treating the PIR lenses like you would your computer

monitor. Using the same bottle of compressed air you use to blow away dust, crumbs and debris from your computer, 

use it to blow dust from the PIR lens.  Is the PIR mounted outside, and does it have more than just dust contaminating 

the lens?  You can make use of a pre-moistened wipe that you would use for your computer monitor and gently wipe 

any dirt or grime from the lens.

     Again, in the absence of a manufacturer's recommended cleaning and maintenance plan, I recommend monthly testing and quarterly cleaning of PIR sensors.  These simple preventive maintenance steps should help ensure that your PIR systems function properly when they must.

Got Security?

 How long does it take for local law enforcement to reach your airport?  Security 

equipment doesn't detain anybody or make an arrest.  Your local law enforcement 

agency does.  By local law enforcement I mean the agency with the primary arrest

authority for your airport.

 Time is typically an airport's biggest enemy.  Airports tend to be located in rural

areas away from population centers; the centers typically patrolled by local law 

enforcement.

 Security systems provide notification that a sensor has been triggered or a time

delay for the criminal to reach the asset you are trying to protect.  Sometimes

they do both.  But a determined criminal is eventually going to overcome the delay

device.  Is the response time for law enforcement to arrive at a location on the 

airport to thwart that criminal less than the sum of all of the delay devices 

employed?  That's the really big question.

 If you do not have a published and distributed or trained plan for airport 

employees and users to notify local law enforcement in the event of an alarm or 

sighting of unusual activity, do you really have security? 

 The clock is ticking. 

Assessing the Threat

Simple Entry...for the Bad Guys

 Locking a door...that seems like a simple way to protect most things.  The assumption is that

we have the only key--or more likely one of the few keys--to that lock. When you need to 

keep a high value asset safe like an airplane or  customers' account information, that's not a

good assumption to make.

 Here's an actual situation: A flight school had had so many problems with a particular 

flight instructor that the owner felt he had no choice but to fire the CFI.  Unfortunately, the 

owner forgot that the CFI had keys to his facility and did not have the CFI  return them.  A 

week later a number of expensive items went missing at the flight school.  The doors to the 

facility showed no evidence of tampering or damage.  While the owner strongly suspected 

that the former employee was the culprit, the police were unable to charge him with the

burglary for many different reasons--one of them being that the owner had no   records 

showing who had keys and who didn't.

 Here are five simple steps you can use to keep this situation from being repeated.

1.   Develop and maintain a record of keys and key holders to whom they were issued.

Every key must be accounted for.

2. If a critical key cannot be accounted for, then rekey that specific lock for the lost key 

or rekey the facility if a master key (opens more than one door) is lost.

3. Issue a key only after the key holder agrees not to make duplicates.  Have key 

holders sign this agreement.

4. Periodically have key holders produce their key(s) to ensure none are missing.

Check to make sure the key has not been duplicated.

5. Immediately confiscate issued keys from those who no longer have reason to have

access to your airport hangars and other buildings.  This should be in any HR checklist

for employee termination.

 How can you make sure that keys are not duplicated?  One way is to have your keys 

numbered.  You record the key number with the name of the person to whom it is issued. 

Numbered keys can be expensive; so a low-cost way to mark a key is to score, dent or make

a small hole in the bow of the key (the part you twist when the blade of the key is inserted

into the lock).  If when you conduct your periodic key inspection you are presented with a 

key that doesn't have that mark or scoring, you know that the key was duplicated--but you 

don't know how many times.

 If you choose to make your own mark or scoring, I recommend contacting the locksmiths

that serve your local area and ask them to contact you if someone presents a key with your 

particular mark or scoring for duplication.  You can describe the mark or scoring.  I 

recommend providing them with an uncut key blank with your mark or scoring so they can 

see exactly what it looks like.

Homeland Security...The Texas Way

 I'm a firm believer that security, like charity, begins at home, not in 

Washington, D.C.  Our airports are critical infrastructure and worthy of support 

and protection at the local level. Actions taken to protect our homeland should 

fall in the following three priority actions.

1. Prevent. Prevent terrorist attacks in Texas and prevent criminal enterprises 

from operating successfully.

2. Protect. Reduce vulnerability to natural disasters, criminal and terrorist attacks

and catastrophic events.

3. Prepare to Respond and Recover. Prepare to minimize damage through rapid,

decisive response, and quickly recover from terrorist attacks and other disasters.

 If you have a continuity of operations or a disaster recovery plan, you've

probably already considered these three steps.  If you don't have a plan, we can 

help you make a plan that fits the unique needs of your airport.  But the bottom 

line on this is to have a plan that gets you through the first 72 to 96 hours after 

a disaster and on the path to recovery.

Wing Dings

 We all do our best to make sure that those who fly into our airports want to come back.

We get line boys/girls to wave customers in with a smile.  The pilot and passengers are

met with a golf cart for a ride into the terminal or cafe so they don't have to walk far in 

the cold winter or hot summer weather.  We go all out to make that experience enjoyable

so they want to come back...and buy fuel...and eat in the cafe...and buy stuff in the FBO. 

It's all about business...and winning repeat business.

 Now for the real focus of this article:  Who do you let drive around the aircraft?

Is it only your staff?  or you?  Do you allow airport business owners, hangar renters, or 

even the general public to drive on the airside of your airport?

 Here's a possible scenario: What if one of your drivers makes the innocent error of 

trying to put their Big Gulp â„¢  container back into a vehicle's cup holder without looking 

while they are driving on the ramp?  What if they miss the holder and spill the drink, 

taking their eyes off of where they were going because they have 32 ounces of ice cold 

beverage in their lap?  Now while their eyes are inside, not outside, they veer ever so 

slightly into a transient or based aircraft and "brush" the wing with the ramp vehicle?  

Now by stating "your drivers," I'm writing this from the point of view of that aircraft 

owner/operator whose aircraft now has a touch of ramp rash.  If people are allowed to 

drive a vehicle on the airside of your airport, you'd probably want to know that their auto 

insurance is sufficient to cover that unfortunate incident.

 Now I do apologize if this sounds like a parental lecture; I'm just trying to be

objective here.  My point is one of financial responsibility on the part of those

to whom you have given permission--directly or indirectly--to drive on the airside of your

airport.  Here is my advice for mitigating the risk of your airport's having to make up the 

difference for financial damage from a ground vehicle accident.

1. Only those whom you have specifically authorized should drive on the airside of your 

airport. It shouldn't be viewed as a right, but a privilege which must be given and can be 

revoked.

2. Prior to receiving authorization to drive on your ramp, a driver must allow you to review

and record their auto insurance for sufficient coverage in the event of a damage claim 

made while they are on the airside.

3. Provide a simple set of instructions which detail where they are allowed to enter/exit, 

to drive on the airside, and any other rules expected of a driver with airside privileges.

4 Document their knowledge with a simple written exam.  Periodically re-test

the driver (at least once a year). Maintain a copy of the
exam results as proof of training.

     Even the smallest wing ding can be costly. Mitigate the risk to your airport by ensuring only authorized, sufficiently insured, trained and tested drivers are granted the privilege of driving on the airside of your airport.

Can You Eat a Whole Cow?