Page 2
Risk as Dollars and Cents
From Yellow and Orange to Black and White
Safety and Security
Osama bin Ladin Is Dead
Prepare for Hurricane Season 2011
Table Top Exercises
Top Three...Pick 'em
Airport Signs
Walk the Fence
Getting Best Bang for the Buck
Perimeter Experts
Security Return on Investment
What You See During the Day....
If Fences Could Talk (A Pictorial)

Osama bin Laden is Dead!

After nearly 10 years of searching, United States military forces from the Joint Special Operations Command, led by special paramilitary forces of the Central Intelligence Agency, conducted a raid in Pakistan. During that raid Osama bin Laden was shot and killed. And so the mastermind behind the U.S. embassy bombings in Nairobi and Dar-es-Salaam, the attack on the U.S.S. Cole, and the 9/11 attacks... and many other attacks which were thwarted...is dead.

While there are many reasons for well-deserved celebration, please remain vigilant. Encourage employees, tenants and airport users to remain vigilant and continue to report unusual activities on your airports. U.S. military bases increased their threat conditions shortly after the President's announcement of bin Laden's death.

I recommend a similar course of action, at least for the short term.

Table Top Exercises

Having a consultant make a table top exercise for you can be expensive. But you don't have to pay to play. Here are some scenarios that you can use to improve your emergency response planning, all courtesy of the Federal Emergency Management Agency.

http://www.fema.gov/privatesector/exercises.shtm

The exercises you can find there include Earthquake

Critical Power Failure

Hurricane

Chemical Accident

Airport Signs

I recommend looking at how your security plan funnels people to the correct locations: the kid interested in learning to fly finds the flight school, not the taxiway; the new pilot flying into the airport for his aircraft's annual inspection finds the A&P's shop, not the tenant hangars; and so on. The reason good signs are important is that they can lower the security noise level at your airport. What do I mean by security noise?

Consider the person an airport tenant sees wandering around the aircraft parking ramp, just looking into the airplanes. Is this someone who is planning to steal someone's GPS nav/com radio? Or is this person genuinely interested in learning to fly, but they don't know where to go on the airport to ask about flight instruction? If you don't have signs telling them where to go, you don't know. That's security noise, just like static on the radio. But when there are signs which tell the legitimate visitors to the airport what they need to do, chances are that they will do what is written on that sign. That means the person you see wandering around on the ramp who doesn't appear to belong is more likely someone who shouldn't be there...because you've lowered the security noise with proper signs.

Signs are normally one-time costs. Signs that provide clear instructions and placed so that the probability is high that a law abiding citizen would be able to read and understand them can help funnel those who you want to have on and around your airport to the place where they should go. Signs also help make those who shouldn't be on the airside of your airport to standout. Signs generally have low acquisition costs and near-zero lifecycle costs. Signs can be a great form of low-cost, effective security.

Getting Best Bang for the Buck

In the last issue we covered prioritizing the top three security concerns at your airport. Now let's cover how to get the most security for your money. It's all based upon the understanding of your risk based upon a risk assessment. A risk assessment is made up of three parts. First, there's the consequential asset analysis. This analysis examines what key "things" in your operations would cause your airport the greatest harm if they were not available and fully functioning. If fuel surcharges and flowage fees are the greatest source of monthly cash flow, then a fuel truck or self-serve station at your Avgas or Jet A fuel tanks might be your asset(s) of greatest consequence. It could be that the airport sales tax earned by a particular A&P mechanic's operation is the greatest revenue stream. So activities or hardware that keep the airport solvent are a consequential asset. A threat is something or someone that has the potential to disrupt, deny or destroy some thing or activity of importance to you and the airport. The threat makes use of a particular tactic to expose an important--a critical--asset to harm. In the case of a human threat the tactic may be the use of a crowbar to pry open a door. For a weather related threat there is some undesired outcome: heavy rains can cause damage due to flooding. The threat which has the greatest likelihood of causing the most damage is called the Design Basis Threat--meaning the threat around which we seek to mitigate the most. Finally, for us to take the time to consider a consequential asset at risk to a threat (and its tactic), that particular threat and tactic must exploit a vulnerability, a weakness. Some threats--especially human threats--can use different tactics at different times to exploit multiple vulnerabilities in taking the path of least resistance to that asset you want to protect. For this reason it is important to break down risks to these fundamental elements. But why? Each dollar spent to improve security should do one or more of the following: 1. Reduce the consequence that the loss of an asset has. 2. Diminish the likelihood that the threat and the tactic will be effective. 3. Mitigate the vulnerability that an asset has when exposed to a threat and tactic. The point here is that each dollar you invest in security should be directly related to reducing asset consequences, diminishing the threat and the effectiveness of its tactics, and the vulnerabilities of an asset to a threat. You achieve the best bang for the buck when you invest in security that protects your most critical assets from the Design Basis Threat. And it all starts with having a clear picture of the risk to whatever is most important on your airport.

Perimeter Experts

In the last edition I wrote about the value of walking the fence. It's a simple act of security that lets you see firsthand the condition of the perimeter of your airfield and property line. This edition I want to expand on that act a bit further.

There are two perpetual truths that I've found in general aviation security. First, there is no substitute for experience. You gain both familiarity and experience with your airport perimeter by walking the fence regularly. You don't have to get out and walk the fence every day; however, it is a good idea to do it every so often. How often is that? I recommend walking the perimeter at least once a quarter, if not once a month. The rest of the time I suggest doing by vehicle. It DOES take time to walk the perimeter, even if you have a relatively small airplane patch.

The second perpetual truth is this: you are the expert. Unless you are a brand new airport manager or airport tenant, you probably have a pretty good idea of what happens...and what doesn't happen...at your airport. So you're the expert on your airport. You know what looks right. You probably have a very good idea of what doesn't look right. The trick is in knowing when to question or investigate further when something or someone doesn't look right or doesn't act right. Take action. A friend from Oregon asked me if blackberry bushes could be used as barriers around airport in lieu of a fence. She explained that there are plenty of blackberry bushes in Oregon, but not a lot of money for general aviation airport security. Having grown up near Seattle, I can attest to the fact that there are plenty of blackberry bushes that grow wild in the Pacific Northwest...and not always where you want them.

Risk as Dollars and Cents

I want to help you put a real dollars and cents value to the various risks at your airport. Why? It boils down to this: knowing the risk as a value with a dollar sign helps to prevent you from spending more on security than you have risk to mitigate. Would you spend ten thousand dollars on security when your financial risk is only a few thousand dollars? I didn't think so.

I want to introduce you to a risk analysis measurement method called Annual Loss Expectancy, or ALE. The way ALE works is that it looks at two specific values, tangible values. The first is threat probability. This threat probability is the frequency that a particular event or attack occurs. The second value is the amount of loss that occurred. In other words, how much did the event cost you, your airport, your tenants, and so on.

The ALE equation is exponential. But don't let that bother you; your computer most likely has a calculator program. Just put your calculator into the "Scientific" mode (found under VIEW in Microsoft Windows ®). Here's the equation:

ALE = 10(f+i-3) /3

The value "f" is the frequency that the event happens. Here's a table with the values of "f" and what those values mean.

“f” value Frequency of Occurrence

1 Once in 300 years

2 Once in 30 years

3 Once in 3 years

4 Once in 100 days

5 Once in 10 days

6 Once per day

7 10 times per day

Note: Why go from 3 years to 100 days? It's all based on days. It just so happens that 3 years is roughly 1,000 days (not exactly, but close enough for modeling purposes).

The values for "I" are a little easier to understand. These values for "I" are orders of magnitude of financial loss (in dollars or whatever monetary denomination you want).

“i”-value      Impact of Loss

1                 $10

2                 $100

3                 $1,000

4                 $10,000

So for example, let's say your airport is in Tornado Alley. On average your airport suffers a loss from a tornado once every 30 years. That means f=2. And the financial loss (impact) to the airport was $100,000. That makes i=5. So the ALE equation looks like

ALE = $ 10(2+5-3) /3 = $ 10(4) /3 or $3,333 per year.

So if you put aside $3,333 each year after the last occurrence, you should-on average-be able to pay for the damage when the next tornado strikes.

There are some limitations with this financial risk estimation model. First, the model doesn't take into account the future or time-based value of money and any impacts from inflation and perceived value. Second, this model requires historical data to provide valid results; however, it could be used as a model to play what-if scenarios. And third, this model doesn't predict new threats in the future, new or changing environments, and so on. However, as a means to estimating annual economic values for risk, it does a pretty good job.

Prepare for Hurricane Season 2011

'Tis the season to be prepared. The 2011 hurricane season is almost upon us. While approximately two-thirds of major storms (storms that are large enough to be named) occur after the middle of August, we here in Texas were surprised last year by Hurricane Alex, a rare June hurricane. So I recommend reviewing and updating your emergency response plans this month.

The 2011 season promises to have more and larger storms than the average, according to the predictions made by Colorado State University. On average there are 11 named storms in a hurricane season; this year we're expecting 16. Typically, there are 6 storms that become hurricanes; but this year we should expect 9. Of these seasonal hurricanes only 2 storms become large enough to called major storms; this year we should expect 5 major hurricanes. The reason for the increase in storm activity this year is based upon two major factors: water temperature and Jet Stream location. The water temperature for the mid-Atlantic and Caribbean is above average by a degree-or-two. And while that may not sound like much, the amount of thermal energy it represents is significant. Also, La Niña effects will conspire to keep the Jet Stream in the higher latitudes. It's the shearing wind forces of the Jet Stream that reduce ease with which convective flows can help to make a storm into a major storm. So we have warmer waters and less Jet Stream effects that are two major factors influencing the prognosis for this year's hurricane season.

Now is a good time to make sure that the names, telephone numbers, email addresses, radio frequencies and other key information is up-to-date in your emergency response plans.

Top 3...Pick 'em

The problem with budgets is that they force us to make decisions between what we want and what we can afford. Unless you and your airport are blessed with deep pockets and people who will back any decision you make on how to spend your airport's money, you probably operate on a budget. And for those with deep pockets, you most likely have them because you effectively used budgets anyway.

When it comes to making money decisions for security, I like to advise clients to identify the top three things they want to protect on their airport. Then I ask them to prioritize those items from most to least important. For a private airport belonging to a single owner that list might be 1) My house, 2) My airplane, and 3) My barn/hangar. For a small public GA airport that list might be 1) The fuel farm & trucks, 2) The terminal building, and 3) The tenant hangars. The point here is that each airport will have assets or services that are most important to the financial well being of that airport.

Often we run out of money before we run out of things on which to spend it. For a security budget figure out how to split time, money and resources between those top three items. Maybe you'll split it 80-15-5. Maybe you'd go 60-30-10. Maybe the difference of value between each of those three assets is so small that you'd split it into equal thirds. The point here is to pre-determine how much you're willing to spend between your top three airport assets. Next time I'll write about getting the most security bang for your buck. 'Til then, keep 'em flying.

Walk the Fence

The summer months are typically the busiest for general aviation airport use. The weather is good. Pilots take vacations, sometimes using their aircraft for travel. So we make sure the field is mowed, looks good and that the tanks in the fuel farm are topped off so we're ready. That's just good business planning.

Before the summer gets too hot, I recommend walking the airport perimeter. For those whose airports are fortunate to have a perimeter road, I recommend leaving the vehicle parked and burning some shoe leather. Why? There is no substitute for the slow, methodical inspection that you get when walking your airport perimeter--whether there's a fence or not.

Take the time to examine all of the gates, entrances and exits to the airport property. Me personally, I've found a gate where locks were removed and replaced with nuts and bolts so a contractor could get in and out of the airside without needing to issue them a key. The problem was that long after the construction work was completed, the bolt and nut didn't get changed back to the lock. We're all human and forget about changing things back to the way they were. It took only a few minutes to correct the situation after that walk was completed. Another time I found a problem with the lock at a gate which was for use by the local fire department only. The gate had a bright red, keyed padlock. Unfortunately, the keyhole for the lock had rusted closed. The lock mechanism itself had been contaminated by rust to the point that the key wouldn't work. I wouldn't have seen that sitting behind the wheel of a slow moving car. The point to this article is that for the price of a few hours out of the office and a stroll on a nice day, you can find out all sorts of things about your airport that you may have forgotten about or never knew. And one more thing...wear some boots or other type of heavy footwear. I prefer to wear snake boots and carry a long forked stick because here in Texas there may be some critters that might be surprised that you're visiting their quiet part of the perimeter.

Security Return on Investment

Would you make an investment of your retirement funds if it didn't pay some sort of return? If someone else is getting the benefit of using your money, wouldn't you expect a piece of the action?

Before getting involved with tacking up cameras and installing smart card access readers on your gates, I recommend contacting your insurance company first and talking with your agent about security equipment. Perhaps the money you choose to spend on security is your own; perhaps that money comes from the city or county coffers. But in general the money used for security in the general aviation community is discretionary. You have a certain amount of latitude on how and where that money gets spent. But because of that latitude, you probably have a fair amount of oversight and justification with which to contend. So being able to make a case using the sound investment principles for return-on-investment, or ROI, provides more solid ground than simply saying, "Well, the camera salesman made it sound good at the time."

Contact your insurance salesperson or underwriter and ask them directly, "What types of investments in security equipment will reduce my premiums, reduce my deductibles, or increase my coverage?" It's a fair question. IF YOU DON'T ASK and go ahead and invest that money in security, there's no reason for the insurance company to give you a more favorable policy. You've reduced their exposure to the risk of loss. That's a windfall for their investors. Wouldn't it be reasonable to at least SHARE that benefit?