Connecticut Conference of Independent Colleges

1. Connecticut Conference of Independent Colleges Security Risk Management Presentation June 14, 2006

2. Changing Security Environment War on terrorism • Asymmetric Warfare More traditional criminal activity in developing countries • Organized Crime • Opportunity Driven Crime Rise of non-traditional security threats • Cyber Crime • Piracy Political instability in developing countries • Rapid deterioration in security environment

3. Kidnap/Abduction : Growing Problem • One of the fastest growing crimes in the developing world • Involves life and death decisions • Requires specialized expertise • Requires significant resources and time • Can have major impact on reputation • Can involve prolonged legal action

4. Kidnap/Abduction : Growing Problem Political • Force the government or the enemy to succumb to some demands • Create a political embarrassment / highlight issue • Harm trade / tourism or strike enemy Economic • Obtaining ransoms • Organized Crime • Worldwide problem

5. Express Kidnap • Latin America • Short Term • Focused on ATM withdraw and immediate possessions • Brutal and traumatic • Transition into kidnap for ransom

6. Kidnap Environment Growing problem in developing world • Income Disparity • Access to arms and expertise Countries of Concern • Mexico • Philippines • Venezuela Rapidly changing conditions • Peru • Haiti

7. Other Threats • Civil Commotion / Civil War / Coup • Piracy • Detention by foreign government • Extortion • Threats of Violence against people and property • Abduction / Sexual Assault • Cyber Extortion

8. International Resources Local Law Enforcement • Training / Pay • Corruption • Motivation US Embassy • Limited role • Local context Private Firm • Primary interest is protecting victim / client • Professionally trained • More experience • Local contacts • Integrated into crisis management planning

9. Study Abroad Program Destinations U.S. students going to less traditional destinations • The growth of interest in studying outside Western Europe • Broadening of the overseas curricula • the increasing number of programs requiring less than a full academic year • Instruction in English has made broader range of sites available • Awareness of the need for global education has become more widespread • Countries with large increases included: South Africa (1,456, up 32%), (1,064, up 40%), Thailand (836, up 69%), Peru (522, up 47%), Singapore (231, up 97%), Senegal (211, up 51%), and El Salvador (145, up 86%).

10. Case Study In March 1999, Elizabeth Garland, an anthropology student at the University of Chicago, nearly died when Hutu rebels kidnapped and killed eight of her party in the jungles of Uganda. The Peace Corps had pulled its volunteers out of Uganda in 1991 and kept them out, saying it could not ensure the safety of its workers there.

11. Security Related Duty of Care • Physical Security • Proprietary / Confidential Information

12. Responsibilities • Assess and analyse their risks • Take reasonable steps to prevent incidents • Manage and/or transfer financial risk • Ensure an effective response

13. Evaluation • Review territorial exposures • Evaluate individual profile • What is the operational environment • Political risk information

14. Prevention • Clear and concise travel policies • Dissemination of information • Provide employee and student training • Clear lines of communication

15. Ensure an effective response • Access to qualified incident responders • Develop and maintain crisis management plan • Test procedures (Table top exercises)

16. Manage and/or transfer financial risk “Kidnap and Ransom” insurance a basis for security risk management program?

17. K&R: Market Perception • Unimportant in the context of an overall insurance program by risk management and brokers • Infrequent claims activity • Loss severity insignificant

18. K&R: Perception vs. Reality • Unimportant vs. critical security role • Infrequent claims vs. unclaimed incidents • Loss severity insignificant vs. broad implications

19. K&R Coverage: Outcome • Risk Management purchases coverage as an after thought • Placed by generalist broker (executive risks broker at best) • Coverage discussed only briefly

20. K&R = Security Risk Management Program Potential applications of comprehensive program: • Workplace Violence • Animal Rights Activism • Cyber Extortion • Proprietary Information threats • Abduction • Child Abduction • Wrongful Detention • Bomb Threats • Security threats due to coup, civil commotion, civil commotion etc • Piracy

21. K&R = Security Risk Management Program Dealing with wide range of threats: • Extortion • Hijacking • Evacuation • Incarceration by foreign government • Threats to kill or injure • Threats to damage property • Threats to reveal confidential information • Disappearance of faculty or staff • Abduction • Individuals or organization declared persona non grata

22. K&R = Security Risk Management Program Providing wide range of financial benefits • Fees and expenses of response consultants with priority access • Organizational liability • Legal fees • Loss of Revenue / Tuition reimbursement • Evacuation and Repatriation Expenses • Costs of personal protection • Additional site security • Public Relations • Medical / Psychiatric costs • Parental Expenses • Death or Injury Benefit

23. K&R = Security Risk Management Program World class security expertise • Access to security professionals without the cost of a retainer • Immediate advice • On the ground deployment within 24 hours worldwide • Access to subject matter experts

24. Are they qualified? Proliferation of security offerings post 9/11 • US Government outsourcing • Kidnap response expertise Carrier / Response relationship • ACE/Neil Young Associates • AIG/Thomas A. Clayton Consultants • Chubb/Ackerman Group • Great American (Hiscox)/Control Risks Group • PIA (Liberty Insurance)/Corporate Risks International • St. Paul/Kroll Associates

25. Response Evaluation Cases handled • Actual deployment and guidance Regional specific expertise and language Logistical capability Responder employment relationship • Salaried/Retained/Subcontracted Training and qualifications Operating philosophy and procedures

26. K&R = Security Risk Management Program Most markets will absorb costs of full or partial consulting services Organizational planning • Crisis Management Planning • Simulation exercises • Communication Operational security • Pre-deployment training development • Evacuation planning Travel Security • Country briefings • Journey management • Cultural advice • Dealing with confrontation • Safety protocols in host country (street awareness)

27. Questions for Educational Institutions to Consider • Does your institution have Crisis Management Procedures to address threats faced domestically and of study abroad programs? • Are you solely or heavily depending on State Department Warnings to monitor changing international environments? • Are you solely or heavily depending on the US embassies in country to assist in the event of a political evacuation? • Are you depending on “Waivers” to protect your organization’s legal liability? • Can your organization feel comfortable in front of a jury detailing the proactive approach your institution undertakes to protect students and faculty abroad in the event of an incident and ensuing litigation? • When was the last time your organization reviewed and tested your Crisis Management Plan? • How have your Plans changed with the changing global security environment and increase in threats to computer systems? • What does your “pre-deployment” advice/training consist of for students and faculty going abroad?

28. K&R = Integral Component of Security Risk Management Strategy Mitigating threat through: • Prevention planning • Risk transfer • Professional Incident Response

29. Contact Information Paul Mills + 44 207 208 5229 millsp@scr-ltd.co.uk Derek Rogers +212 804 0538 derek.rogers@scr-ltd.co.uk Lisa Zanotelli +212 804 0539 lisa.zanotelli@scr-ltd.co.uk