Traveler Safety & Security in the Modern World Bruce McIndoe February 2012

1. Traveler Safety & Security in the Modern World Bruce McIndoe February 2012

2. You will learn… • How Global Threats and Business Disruptions Impact Business • About Organizational Liability and Duty of Care • Travel Risk Management as a discipline • About the Traveler Safety Continuum • How to benchmark your TRM program and where to focus • Precautions around social media, smartphones, and laptops • The Top 10 Reasons Programs Fail

3. Major Incidents Every Year…

4. SOURCES: Georgia Institute of Technology. National Center for Atmospheric Research. The Rand Corporation. The World Health Organization. Escalating Global Threats

5. Who do Your Employees Turn to? • Pre-trip / assignment destination – safety and security? • For immunizations and medical advice? • Hotel or residence property selection? • When they need help? • When an incident occurs?

6. Who do You Turn to? • For country/city safety/security information? • Traveler or Expat safety/security training? • What to do in higher-risk environments? • Threat against an employee? • For a medical emergency? • Plane or vehicle crash? • Kidnapping?

7. Management Questions • Who can do it? • What is our liability if we don’t? • What is our competition doing? • What’s really happening now? • Who is impacted? • Where and how does this affect us? • Are the right people aware? • What should we do? When?

8. Legal Deposition – How would you answer? Death or serious injury to employee • It is well known that this area was risky, why wasn’t the employee notified? • What process do you have in place to understand the risks your employees may face? • What information is provided to the employee before he or she went there? • What did you do to mitigate these hazards? • Who was notified and when? What did they do?

9. Management Program Motivators • Organizational Liability • Risk Exposure • Previous litigation history • Duty of Care • What is expected? • Anxiety Management • Standard of Care • What are others doing?

10. What is Travel Risk Management?

11. Travel Risk Management … is a well defined process to identify risks, prepare travelers pre-trip, monitor threats, and respond to incidents as they arise. Benefits include: • More productive and prepared employees • Reduced number of costly “incidents” • Lower cost of response • Reduced corporate liability

12. OptimalResponse Optimal Response Time The longer it takes an organization to respond to an incident or opportunity, the greater the risks and costs.

13. Planning • Mitigation • Communication • Exercises/Drills PREPAREDNESS Preparedness Impacts Response Time

14. Multiple Functional Areas Support the Employee SECURITY Risk assessment Crisis & evacuation plans Emergency contact info Coordinates Response TRAVEL Advisor and knowledge base Books trips and handles travel issues Provides reporting MEDICAL Pre-trip health planning Immunizations Medical assistance & evacuations for international travelers • HR/LEGAL • Focus on expatriates • Responsible for all employees • Policy & procedures • Corporate insurance / benefitprograms EMPLOYEE

15. Traveler Safety Continuum • Pre-Trip/Assignment • Crisis management plans • Policy/compliance • Enterprise communication • Access to Intelligence • Travelers/Expatriates • Management (push) • Assess risks/set ratings • Pre-trip (pull) • During travel (Alerts) • Training • All employees • Management team • Personal protection • Country/region specific • Track Employees • Employee profiles • Automated and verified • Real-time alerting • Communication options • Hotline • 24 x 7 - One Number • Specific protocols • Travel, security, health • Security Service • Executive Protection • Ground Transport • Guards • Evacuation • Medical Service • In-country, Western-quality care • Evacuation

16. Key Elements of Execution Feedback Proactive 24x7 Monitoring Planning Training Incident Response Reactive

17. How it works – Every Trip! Pre-trip/assignment Preparedness Book Trip or Assignment Help Provided Automated Risk Assessment Report Trouble Automated Trip/Assignment Briefs & Alerts Report Issue Implement Protocol Alerts & Notification Travel Agency/Booking Tool Country & City Information Help Provided 24x7 Global EmployeeHotline Report Trouble Employee Implement Protocol Report Issue Travel/ Security/ HR Manager Response Worldcue® Risk System Alerts & Notification

18. TRM3 - 10 Key Process Areas Policy/Procedures Overarching KPAs Management KPAs Infrastructure KPAs Training Risk Disclosure Risk Assess-ment Risk Mitigation Risk Monitoring Response Notification Data Management Communication

19. Measuring your Program Maturity Level Optimized (5) Program integrated throughout organization Metrics collected and reviewed. Cross-organization support. Managed (4) Consistent execution of travel risk management processes. Proactive (3) Basic travel risk management policies defined and documented. Primary focus on incident response. Defined (2) Ad hoc. Few policies. Chaotic in the event of an emergency. Reactive (1)

20. Social Media Awareness • Do not disclose travel plans on Facebook or other social media sites. • Do not post while on travel – discloses where you are, and are not! • Caution on using Twitter or other IM software in high risk countries • Be cautious of who you “friend” – especially on travel • Consider having two personalities – “Open You” and “Closed You”

21. Be Aware! Your mobile telephone has four major vulnerabilities • Vulnerability to monitoringof your conversations while using the phone. • Vulnerability of your phone being turned into a microphoneto monitor conversations in the vicinity of your phone while your phone is inactive. • Vulnerability to trackingyour phone based on its emitter or GPS data. • Vulnerability to "cloning," or the use of your phone number by others to make calls that are charged to your account.

22. Smart Phones - Vulnerabilities • Smart phones are powerful computers… • Complete with an Operating System and Applications • Every PC vulnerability can be translated to the phone… and more! • Cross-Service Attacks (LAN, Bluetooth, WiFi, GSM, etc.) • Code vulnerabilities and exploits • Malware • Viruses

23. What to do? • Backup contacts, email, and calendars • Install latest OS and security updates • Enable PIN/Password – And remote “Wipe” • Record Make/Model/Serial Numbers • Maintain continuous control of your devices • Lock in safe if you leave in room • Do not use unprotected networks • Do not allow web browser to save login & password • Consider using a travel phone with limited data to higher risk locations

24. Guidelines for Laptops – Before Travel • Leave all but essential storage devices at home – use encrypted USBs • Enable “user authentication” -- requiring a password or PIN on your device to gain access. Use a strong (combination of number, digit, and special character) password • Load encryption software and encrypt either the whole device (full-disk encryption) or any sensitive files or folders • Ensure operating system, firewall/VPN and Anti-Virus are updated

25. Summary – Key Take-Away Thoughts • Protection of human assets is a multidisciplinary effort • Best approach is a risk management framework • Training is critical to overall success • Prevention and decision support through real-time intelligence & communication • Planning for response minimizes impact

26. Top 10 Reasons Things Fail…

27. #10 Company does not know what to do in an emergency Don’t be reactive. Get a basic plan in place and make sure you know where to get help.

28. #9 Out of date contact numbers Get contact numbers (cell, home, office, e-mail, IM, etc.) for the people that you need in an emergency. Periodically get them updated and verified.

29. #8 Primary AND Backup Person are not available This happens frequently. Try to have multiple backup contacts. Think about people that are normally available.

30. #7 Cell phones don’t always work We are becoming totally reliant on cell phones. Try to find a pay phone! Provide travelers with international cell phones or satellite phones.

31. #6 No response resource retained Who would you turn to for a kidnapping? What about a threat against an employee? Medical emergency? Car accident? Incident on Vacation? Make a list of incident types and answer who would I turn to?

32. #5 3rd Party response resource does not know what is going on Talk to your vendors. Include them in your planning. Run exercises and drills.

33. #4 Protocols are not maintained Managers and organizations need to periodically review their plans and protocols. At least annually. Train staff on procedures. Run drills and exercises.

34. #3 Protocol or procedure is too complex Many times the plans and procedures are way too complex. Look to streamline the process. In a time of emergency, you will only have time and bandwidth for the basics.

35. #2 Inconsistent skill level within the team Crisis and emergency management is not the core competency of most travel managers and staff. Get training for the core team that will be called to deal with an emergency.

36. #1 Cost sensitivity delays response Deal with where the funds will come from and who will pay BEFORE the event! Delay in response increases cost and can cost lives.

37. THANK YOU! Every organization needs to address duty of care for all employees Bruce McIndoe, President, iJET International Bruce@iJET.com Resources www.ijet.com/GBTA