A Thoughtful, Analytical Approach to NGO Security

NGO Security

Attackers target UN staff in Kabul guest house

Yesterday Taliban militants wearing police uniforms carried out a complex suicide attack on a privately owned guest house in Kabul. A two hour fire fight resulted in the deaths of six UN staff members.

This video from STRATFOR has a quick summary and analysis of the attack. Its well worth watching if you have the bandwidth.

In the aftermath of this attack we are already seeing the inevitable calls for a complete review of security procedures for UN and NGO staff in Kabul. There will be a flurry of activity as outside security consultants are called in and security assessment teams from regional NGO offices descend on Kabul. Numerous reports will be written, fingers will be pointed, and a couple of people may even lose their jobs. Unfortunately many will come to the conclusion that this incident was an unanticipated and unforeseen escalation of the threat.

The problem is that it is just not true. The writing has been on the wall for the past two years. There have been numerous incidents of surveillance on UN and NGO buildings and staff. The Taliban and their allies have also repeatedly made it clear, both in word and deed, that they do not view the UN and most NGOs as neutral.

Selected Attacks, Afghanistan and Pakistan, 2009

1 Feb 2009 - Charbagh, Pakistan - Two MSF medical staff were killed when their clearly marked ambulances were fired upon in Charbagh.

2 Feb 2009 - Quetta, Pakistan - A driver with the U.N. High Commissioner for Refugees (UNHCR) was killed and John Solecki, the head of the local UNHCR office, was kidnapped.

9 Jun 2009 - Peshawar, Pakistan - 5 U.N. workers are among those killed in a complex suicide attack on the Pearl Continental hotel in Peshawar.

18 Aug 2009 - Kabul, Afghanistan - Two Afghans working for the U.N. were killed during a suicide vehicle bomb attack on a NATO convoy.

5 Oct 2009 - Islamabad, Pakistan - Five World Food Program (WFP) staff were killed and four others injured after a suicide bomber disguised as a Frontier Corps soldier was allowed to walk into the WFP office under the simple pretext of being allowed to use the toilet. The Pakistani Taliban claimed responsibility with the following words: "We proudly claim the responsibility for the suicide attack at the U.N. office in Islamabad. We will send more bombers for such attacks. The U.N. and other foreign (aid groups) are not working for the interest of Muslims. We are watching their activities. They are infidels."


1. Dig out previous security risk assessments and physical security audits and make sure you've actually implemented the recommendations contained within.
2. If your existing security risk assessments and physical security audits are older than six and twelve months respectively update them now.
3. Ensure your Crisis Response Plan is current and practice it quarterly.
4. Implement a counter-surveillance plan.
5. Make sure you have a plan to respond if hostile surveillance is detected. Knowing your organization is being surveilled has little value if you are unable to respond to the fact.
6. Train as many staff as possible in personal counter-surveillance and surveillance detection.
7. Allow flexible work hours and 'work from home' policies.
8. Review access control procedures and ensure that guards are actually following them.
9. Limit visitors and insist on advance appointments.
10. Identify proper medical support.
11. Pull out all the stops on your active acceptance plan. You are unlikely to influence the Taliban and their supporters but you are going to need all the support and goodwill you can get from neighbours, beneficiaries, and local police.

The Future

As governmental and UN organizations continue to improve their security measures to deal with the militant threat in Afghanistan and Pakistan more and more of the risk burden will fall on softer targets, including NGOs. I assess their is a 70 to 80% chance that there will be VBIED or complex attack on an NGO facility in Afghanistan or Pakistan within the next twelve months. Are you ready?

Six scams that target aid workers and humanitarian organizations


1. Fake humanitarian conferences, events, and training opportunities

The script: You receive an e-mail announcing a conference, event or training opportunity related to some field of humanitarian endeavour in which your organization works. The email makes it clear that the sponsors will cover event cost, visa processing and handling, and travel arrangements. Your NGO only has to nominate two staff meeting certain criteria and the event organizers will arrange the rest.

Eventually your will be informed that, for example, hotel costs in Nairobi are not covered and you need to forward funds in advance before the participation of your staff can be confirmed.

This is a variation of the time tested advance fee fraud. Once you send funds the scammers disappear and you discover the event does not exist.

For example event scam emails see The Conference Con website.

Why it works: Conferences, and training opportunities, especially those that involve foreign travel are often seen by humanitarian organizations as a way to reward and develop hard working staff, especially junior or national staff who might otherwise not get such a chance. The promise that the vast majority of the event costs are going to be covered by the event organizers has great appeal to cash strapped NGOs.

How to avoid the con: Scammers have misused TakingItGlobal's name and reputation to carry out event scams so they have released this guide to spotting fake humanitarian event invitations.

text from a hitman scam email
2. The 'Taliban Hitman' scam

The script: The potential victim receives an email or series of text messages informing them of the following:

I was hired to kill you by the Taliban/AQ/a secret government organization. I have all the information on your daily activities that I need to kill you at any time. However, I recently became aware of your humanitarian activities and know that you are a good person at heart. If you send me 10,000 USD I will spare your life.

I have all the information needed to implicate my employer in the plot to assassinate you recorded on tape. If you me 1500.00 USD I will send you the tape. If you find the information on the tape useful you can send me the remaining 8,500.00. You can use the information on the tape to retaliate against my employer or you can go to the police with it.

Please be aware that my boys are watching you all the time. If you do not respond quickly I will be forced to carry out the contract despite my reservations.

Ahmad Killer

Why it works: Groups like the Taliban, Al-Shabaab, and Al-Qaeda have made it clear that they do not approve of many NGO activities. Often the victims have already received real threats warning them not to work for international NGOs. To a national staff member of an NGO in Afghanistan, Somalia, or Iraq it seems entirely plausible that one of these groups has hired someone to kill them.

How to avoid the con: Once you are aware of the existence of this scam the real nature of the messages become pretty obvious. The Taliban and their ilk don't need to hire a hitman to kill an aid worker. They have plenty of people willing and able to do the job for free and they are unlikely to have a change of heart.

Don't let fear overwhelm you. Don't respond to the threats and don't make counter threats. Keep the originals of all the threats and give them to your security officer so that the issue can be dealt with appropriately.

If you still suspect you are being targeted by a hitman take a look at the FBI’s 2007 post on the hitman scam.

3. The 'Intelligence Service' scam

The script: The victim is approached by a person or small group of people claiming to be undercover police officers or members of an intelligence service. The scammer tells the victim that he (the victim) is under suspicion but that for a small fee he is willing to look the other way.

Why it works: Fear... pure, simple, fear. Aid workers who belong to persecuted ethnic, religious or social groups are especially vulnerable.

How to avoid the con: Unfortunately this is a very difficult situation to deal with. Much depends on the local context. In some countries (*cough* Sri Lanka) where this scam is being run the perpetrators may actually be real police/inteligence agents. Is it better to throw them a few bucks and make your getaway? Or should you hold firm and refuse? I'll leave the choice to you. Hopefully, forewarned of this scam, you'll be able to make an intelligent choice.

Whatever choice you make you should report all such incidents to your security officer.

5. Emergency funds transfer scams

The script: The bank that holds an aid organization's funds receives a phone call and/or fax purporting to be from a program manager in the same aid organization. Usually this happens just before the bank closes for the weekend. The caller apologizes for not completely following the previously procedure for funds transfer but he explains that this is an emergency situation. Its seems that there are 250 families who have been stranded by the current emergency. They've been overlooked until now and they are in a desperate need . Unless the funds can somehow be transferred to a specified local NGO/CBO before the close of business the families will be forced to endure another weekend without food, water and shelter.

The local NGO is of course bogus and no one will know that anything is amiss until the following Monday at the earliest.

Why it works: Despite rumours to the contrary bankers are human. They don't relish the thought of their disaster stricken countrymen going without the essentials of life for another long miserable weekend. Usually the scammers have done enough research to help allay the bankers concerns. It is easy find basic information, such as the name and the contact details of the country director and finance officer on the internet. Account numbers can be found by going through the aid organizations garbage or conning a staff member to provide it.

How to avoid the con: Don't throw financial information in the garbage. Shred it. Even staff lists and contact information is useful to potential scammers. Make sure staff know and understand the risks of giving out information over the phone (see social engineering). Finally, make sure your bank understands exactly who can and cannot override previously agreed transfer and payment procedures.

6. The 'Build and Burn' scam

A badly damaged school in Afghanistan

The script: This scam is becoming more common in conflict plagued areas of Afghanistan and Pakistan. Essentially the scam works like this: a local contractor bids for a NGO funded contract to build a school or similar public building. Local militants allow the contractor to complete the contract but they take a cut of the contractors profits or divert building materials. Once the contract is complete the militants burn or blow up the school. Often an NGO, maybe even the same one, returns to rebuild the school and the scam starts over again.

Sometimes the contractor is an active participant in the scam at others times he is simply extorted.

Why it works: A poor security situation, remote management, and a certain amount of wilful blindness on the part of NGOs contribute to the success of this scam.

How to avoid the con: The only way I know of to avoid this scam is not to fund construction in contested areas. You'll need to balance the potential good of a new school (assuming it stays up) versus the bad of funding armed groups.

Al-Shabaab's NGO liaison office announces closure of UN offices in Somalia

It seems that Al-Ahabaab has an NGO liaison office. No... really! I’m not kidding. The official communication below announces the formation of the “Office for Supervising the Affairs of Foreign Agencies”. It also announces the closure of UNDP, UNDSS, and UNOPS offices in al-Shabaab controlled areas of Somalia.

In the Name of Allah, Most Gracious, Most Merciful

al-Shabaab logo

Harakat Al-Shabaab Al-Mujahideen
Department of Political Affairs and Regional Administrations

Date 27/07/1430H- 20/07/2009.

Press release on behalf of the Department of Political Affairs and Regional Administrations regarding the status of the various NGOs and foreign agencies operating in Somalia.

1. This is the official announcement of the establishment of The Office for Supervising the Affairs of Foreign Agencies. This office has been set up to coordinate all dealings with NGOs and foreign agencies and to fully monitor them.

It is mandatory upon all NGOs and foreign agencies operating in Somalia to immediately contact The Office for Supervising the Affairs of Foreign Agencies in their area. They must contact the Administration of the area that they are currently operating in and they will give out the address for the new office. The NGOs and foreign agencies will be informed of the conditions and restrictions on their work and on how their work may continue. Any NGO or foreign agency found to be working with an agenda against the Somali Muslim population and/or against the establishment of an Islamic State will be immediately closed and dealt with according to the evidence found.

2. As of (20/7/2009), a number of NGOs and foreign agencies currently operating in Somalia will be completely closed down and considered enemies of Islam and Muslims. The current list is as follows:


This decision was finally concluded after thorough research and due to an ongoing investigation into the actions and motives of many of the NGOs and foreign agencies currently in operation. The above foreign agencies have been found to be working against the benefits of the Somali Muslim population and against the establishment of an Islamic State in Somalia. Some of the findings include evidence of training and support for the apostate goverment and the training of its troops. The research also found material support being given to the apostate militias in the border regions in hopes of destabilizing the regions and disrupting the safety and security that the Islamic administrations of those regions have accomplished by the permission of Allah. On top of that, it has not been hidden that over $250 million dollars have been gathered in Brussels on April 23, 2009 from various infidel countries and donors for the crusader Amisom troops to continue their mission of oppression and massacre of the Somali Muslim people.

Previously, CARE and IMC, two American agencies, were closed down as evidence was found of participation in activities against Islam. Proof was uncovered of spying for and aiding the intelligence agencies of the enemies of Islam. In addition, as it is well known, those agencies assisted in the assassination of Sheikh Maalim Adam ‘Aayro.

Allah is our Protector and our Sustainer.
Department of Political Affairs and Regional Administrations

A HELP! button for aid workers

If you are an aid worker and you have an iPhone you need the Safety Button Assault Alarm iPhone application. Although it is Billed by its makers, Sillens AB, as an assault alarm for women its good for a myriad of situations in which aid workers can suddenly find themselves. Whether it’s a simple traffic accident on a remote road or the sudden realization that your new ‘friend’ intends to kidnap you, the safety button can help.


The Safety Button application is extremely easy to use. First, install it on your iPhone and fill in the email, phone, and SMS details of a reliable colleague or your organization’s radio room. Safety Button can then be set to do any combination of the following:

  • text your position
  • email your position
  • make an emergency call
  • sound an alarm


When you find yourself in a situation of impending danger simply start Safety Button. Your location data will be sent to the Sillens AB servers in Sweden and updated every 20 seconds. As long as you keep the application running your position will be tracked.

At this point, if your fears turn out to be unfounded, you can simply turn off the application. No emergency messages will have been sent and you won’t have bothered anyone. However, if your instincts were right, simply press the big red button and Sillens’s servers will notify your contact.

You can buy Safety Button from the iTunes store for $2.99. The price includes three alerts. You can buy additional messages from the Sillens website.

Personal Safety and Security Course - UK

Armadillo at Large is running a three day personal safety and security course from 27 July to 31 July at Farnham, UK. The course will be followed by two days of either field first aid or communications training.

The course syllabus:

The Security Management Framework
Risk, Threat, and Vulnerability
Situational Awareness
Standard Operating Procedures and Contingency Planning
Incident Reporting
Explosive Remnants of War Training
Hostage Survival Strategies
Guns and Bombs and things that go Bang
Personal Preparation
Safety Management
Travel Risks
Practical Simulations

If you are an aid worker heading off to a conflict zone, or you would like to be, I strongly recommend this course. The Armadillo at Large team has top notch instructors who have extensive first hand field experience garnered from some of the world’s most dangerous hot spots.

If you need more details download the course outline or contact Steve directly at steve@armadilloatlarge.com .

Course outline

More on acceptance

Even active acceptance strategies have their limits as NGO security tools. As a wise friend pointed out acceptance doesn’t work very well with itinerant armed groups. Criminals, and others who make their living by preying on the weak, just don’t care that much about the good work your organization may be doing or how much the local population might like you. You’ll need something aside from an acceptance strategy to reduce the risk from these groups.

Acceptance strategies also have obvious limitations when it comes to dealing with groups and individuals who are fundamentally opposed to the values they perceive your group represents. Whether they object to your organization’s religious values, work with women, or status as ‘foreign meddlers’ it is going to be very difficult to change their perceptions even with two or three years of a consistently applied active acceptance plan.

Other factors that inhibit acceptance:

• rapid staff turnover (or rapid expansion after a disaster as in the Tsunami response or the Pakistan earthquake)

• recipient only programs that do not engage the wider community

• friction between national and international staff

• divisions between national staff along conflict lines or ethnicity

• failure to deliver on promises or perceived promises to communities

Factors that promote acceptance:

• a long term presence in the project area (but only if you have been pursuing acceptance during that period)

• knowledge of local customs and language

• A close relationship/understanding between national and international staff

Active acceptance

Last week we looked at the acceptance fallacies that sometimes prevent NGO’s from properly implementing an acceptance strategy as part of an overall NGO security plan. Today we’ll look at a more robust approach to pursuing acceptance for humanitarian actors and activity.

Real acceptance is ‘active acceptance’. It needs to be continuously pursued and won. In order for an NGO to develop an active acceptance strategy an acceptance plan needs to be written, resources allocated to it, and deliberate action taken. Active acceptance involves regularly communicating with governmental groups, non-state actors, armed factions, and other key parties. The communication can be direct or through intermediaries when discretion is required. The communication needs to be two way.

All NGO staff need to be involved in the acceptance effort. Whether they are program managers, humanitarian field staff, or drivers, they need to be able to clearly communicate the humanitarian mandate of their organization. They also need to act in a manner compatible with the mandate. One misbehaving staff member can quickly destroy an organizations acceptance.

Other considerations:

• Active acceptance is costly in terms of time and resources but is cheap compared to the consequences of poor acceptance.

• Acceptance can be difficult to achieve in fluid conflict environments. New factions require new negotiations and agreements need constant reinforcement.

• Negotiations, especially with armed factions can be particularly stressful for staff.

• A rapid expansion in the number of NGOs in a country during a humanitarian emergency can make it difficult for any organization to maintain an independent identity. The actions of NGO’s with no pre-crisis experience in the affected area can have a negative effect on the acceptance of more experienced organizations.

• Your organization doesn’t exist in a vacuum. The actions of other aid organizations effect the perceptions of yours. Joint acceptance strategies should be considered.

Acceptance and acceptance fallacies

burnt out humanitarian vehicles in Afghanistan
Vehicles burned by an angry mob — at least partially due to the ‘good program’ fallacy.

In the traditional version of the acceptance approach to security an aid organization seeks to cultivate an atmosphere of trust and familiarity with beneficiaries and the host community. The idea is that beneficiaries and host community members will not target their ‘friends’ and will provide warning of impending attack by criminals or outsiders.

It’s a good approach that fits well with humanitarian ideals. Unfortunately many aid agencies fall victim to one or more of three acceptance ‘fallacies’ that prevent proper implementation of a real acceptance strategy. The first two have been outlined in “Providing Aid in Insecure Environments: Trends in Policy and Operations”, by Abby Stoddard, Adele Harmer and Katherine Haver.

Passive or assumed acceptance fallacy: To put is bluntly this fallacy is the end result of faulty logic. The assumption is made that if the organization does not have protective and deterrent measures it must therefore have an acceptance based strategy.

The exceptionalist fallacy: The assumption that an organization can simply reiterate humanitarian principles and proclaim its neutrality and independence from all belligerent parties. The problem with this approach is that beneficiaries don’t read organizational policy documents and they often have learned to be suspicious of the moral proclamations of outsiders and those in positions of authority.

The good program fallacy: I sometimes refer to this as the ‘good houses’ fallacy. It is easy to assume that merely building ‘good houses’, or implementing good programming is all that is required to gain acceptance.

So how do we gain real acceptance? Stick around. We’ll discuss that in a future post.

The NGO security triangle

I’ve noticed that many readers of this blog are new to NGO security. Some are military or police personnel looking to move over to NGO security. Others are aid workers looking to expand their security knowledge. Either way I think that it might be time to review some NGO security basics. I would ask that more experienced readers be patient. Don’t worry, we’ll work our way up to some new ideas shortly.

Let’s start with the classic NGO ‘Security Triangle’. Most NGO’s use this model of risk reduction methodology. Essentially the model proposes that there are three primary means of reducing risk faced by NGO’s and their staff; acceptance, protection and deterrence. This diagram from a Tear Fund security manual sums it up nicely.

security triangle diagram - acceptance, protection, deterrence
Image from Tear Fund’s “Safety in Travel Guide”, April 2006.

Most NGO’s emphasize acceptance, and to some extent protection, over deterrence.

We’ll look at what these terms mean over the next few days. They are not as simple as they might seem at first glance and many people overlook their deeper ramifications.

Teaser: Personally I think it should be the NGO ‘Security Square’.

Maps - Aid worker fatalities in 2008

View Larger Map
Map - Humanitarian Aid Worker Fatalities - 2008

Aid Worker Fatalities in 2008 - Heat Map
Heat Map - Violence Related Fatal Incidents - 2008

Aid Worker Deaths Due to Violence

Aid Worker Deaths or Injuries Due to Violence

IFRC Aid Workers Leave Chad After Threat

Aid workers from the International Federation of the Red Cross and Red Crescent Societies have been temporarily pulled out of Chad after an unstated but specific security threat. IFRC staff have been supporting the Chadian Red Cross.

Red Cross aid workers leave Chad after threat

Justice for Muttur Video

ACF is calling for an international investigation into the Muttur Massacre, the killing of seventeen aid workers in Sri Lanka in 2006. You can help by visiting the Justice for Muttur site.

Don’t let the murder of 17 aid workers go unpunished!

On 4 August 2006, 17 aid workers were murdered in the town of Muttur in Sri Lanka. No one has been held to account for this outrageous slaughter of humanitarians dedicated to feeding the world’s hungry.

ACF is calling for an international investigation in order to shed light on the circumstances surrounding the Muttur massacre and to find those responsible. You can find a link to their petition below. If you can find it in your heart to help please sign it. If you are a blogger please write about it and link to the Justice for Muttur site.

Gunmen kill senior aid worker, driver in Mogadishu

Mohamed Abdulle Mahdi, the head of the Woman and Child Care aid agency (WOCCA), was killed by unidentified gunmen in Somalia on Wednesday 11 June 2008.

The gunmen opened fire on Mahdi’s car as he was travelling through the Suqbad neighborhood of Mogadishu. Mahdi’s driver was also killed in the incident.

Gunmen kill humanitarian chief, driver in Mogadishu: aid worker
Top Somali aid worker shot dead

30% of aid money is spent on security for aid agencies?

If you read this blog you’ve probably already seen the article above. I almost didn’t read it because it looked like yet another “aid is inefficient and ineffective article”. It was the reference to NGO security costs that caught my eye. According to Integrity Watch Afghanistan, “Between 15 to 30 percent of aid money is spent on security for aid agencies, the IWA report said...”

What? Really? Where did those numbers come from? Given the difficulty I’ve had in finding money for things as simple as burglar resistant doors and decent fencing I really have my doubts.

If you download the full report you’ll see this:

For instance, the contracted security of the Kabul-Kandahar road during its reconstruction* prevented the disarmament of the equivalent of a whole private militia. Serious estimates put the number of armed guards who were used by the aid agencies at tens of thousands. An estimated 15 to 30 percent of aid money has been spent on security.

Maybe that’s where things got confused. To be clear the meaning of the statement “15 to 30 percent of aid money has been spent on security” is nowhere near the same as, “Between 15 to 30 percent of aid money is spent on security for aid agencies...” While considerable donor money might go to ‘security’ in Afghanistan it includes things like security sector reform, demining, counter-narcotics, police training, etc. This is not the same thing as “security for aid agencies.”

I’m pretty confident that aid agencies are not spending 15 to 30 percent of their budgets on their own security. I know mine isn’t. Most NGOs do not use armed guards and security budgets are generally small even if you include what are traditional safety costs.

* To the best of my knowledge the vast majority of the work done on the Kabul-Kandahar road was done by private contractors, not aid workers.

Safer Access gets it!

I can’t believe I never blogged about Safer Access before. Its not that I didn’t know they were there. Its just that somehow I didn’t give them the attention they deserve. That is until I noticed this paragraph on their website.

Safer Access supports the open-source philosophy, and seeks to apply it to humanitarian access issues involving safety and security. Safer Access training documents and best practice are not regarded as proprietary material, and are intended to be shared widely and discussed within the humanitarian community as an open source resource. This philosophy, when applied to vital information and training, reflects our desire to ensure that our support reaches all of those that are in need.

Imagine that. No exclusive copyrights. No caveats. No weasel words. No “if you use our security manual we’ll sic our lawyers on you”. Just open source safety and security information provided for the benefit of the humanitarian community.

Be sure to check out their open source security documents and assessments. There are documents covering topics from personal trauma kits to laptop security as well as security assessments for a number of countries.

Old Choices Come Back to Haunt NGOs in Afghanistan.

The Ghosts of Alexander have a great post on the The Politicization and Militarization of Aid to Afghanistan. As the ghosts quite rightly point out the process did not begin in 2001. It began much earlier and NGOs are still feeling the impact today.

To quote the ghosts again, “All it takes is for either the US, the Taliban, the locals or the central government to see it as political and becomes so...” Unfortunately that means your organization’s carefully crafted, acceptance based, security strategy disappears along with your perceived neutrality.

Read the whole post to see how your NGO’s choice of friends in the 80’s might be affecting your security today.

More Cartoons and More Threats

A Norwegian newspaper recently published a drawing of a man with Turban, having his clothes open and displaying a t-shirt with the text: "I am Mohammed, no one dares to print me”. The artist says that the half naked caricature represents the naked face of terrorism. However, it is fairly obvious that others may interpret the cartoon differently.
The drawing seems to be circulating quickly on Arabic websites. 

In an apparently unrelated, but likely synergistic threat, AQ seems to include Norway as well as other EU countries on its target list as the story below highlights.

NGOs would be wise to monitor the situation closely. Any indicator of negative reactions to the new cartoon should be taken seriously and any necessary risk reduction and mitigation measures implemented.

Islamabad Bomb Damages Local NGO

The building of a local NGO, Devolution Trust for Community Empowerment, was damaged in an apparent VBIED attack on the Danish Embassy in Islamabad. Dozens of its staff were reported to have been injured by flying glass. A spokesperson for the NGO said that the organization had been concerned about their location across the street from the embassy.

Canadian Aid Worker Kidnapped in Haiti Released

Medecins du Monde Aid Worker Kidnapped in Haiti

A Canadian aid worker with Medecins du Monde was kidnapped on 21 May from the Tomasin neighborhood of Port-au-Prince.

Haiti has a well established kidnapping industry. At least 139 people have been kidnapped this year. Most kidnappings occur in the capital.

How Many Kidnapped Aid Workers?

Sometimes the mainstream media really makes my blood boil. You may recall that on 21 May three aid workers were kidnapped by gunmen in Somalia. The headlines that came in on my news feeds were maddening.

First off the mark was DawnNews via Twitter with the headline "Two Italians among three aid workers kidnapped in Somalia." OK, so we have two Italians and somebody else. Maybe they just don't know his nationality yet.

"Two Italians kidnapped in Somalia" - PRESS TV Hmmm... what about the other guy?
"Italian aid workers kidnapped in Somalia" - Independent Online
"Somali gunmen kidnap two Italian aid workers" - Reuters South Africa OK... so maybe its just two Italians?
"Officials say gunmen kidnapped aid workers" - Reuters Or maybe the other person wasn't an aid worker?
"Somali gunmen kidnap two Italian aid workers: officials" - Reuters
"Somali gunmen kidnap two Italian aid workers: officials" - Washington Post
"Witness: Somali gunmen seize 2 Italian aid workers" - The Associated Press Just two Italians I guess.
"Somali gunmen kidnap two Italian aid workers-officials" - AlertNet Newsdesk
"Witness, diplomat: Somali gunmen seize 2 Italians" - The Associated Press
"Somalia: Two Italian aid workers kidnapped" - آكي adnkronos
"Somali official: Gunmen seize 3 aid workers" - The Associated Press Five hours after the DawnNews report the AP editor realizes that it was three aid workers.
"Somali official: Abduction of 3 aid workers, including 2 Italians ..." - PR-Inside.com (Pressemitteilung)
"Somali official: Gunmen seize 3 aid workers" - The Associated Press
"Somali official: Gunmen seize 3 aid workers" - Adal Voice of Eritreans
"Somali official: Abduction of 3 aid workers, including 2 Italians" - Adal Voice of Eritreans
"Gunmen Seize 2 Italians, One Somali Aid Worker In Somalia" AHN via Hiiraan Online. And finally Hiiraan Online points out that there is such a thing as a Somali aid worker.

Of the seventeen headlines that crossed my virtual desk more than half would have had me believe that only two aid workers were kidnapped. Seven of seventeen acknowledged that in fact three aid workers were kidnapped. Only one clearly identified the nationality of the Somali aid worker.

With headlines like these it is no wonder that so many national staff in INGOs feel like the second class citizens of the aid world.

Three Aid Workers Kidnapped in Somalia

Three aid workers from Cooperazione Italiana Nord Sud were kidnapped by gunmen on 21 May in the Lower Shabelle region of Somalia. Two Italians, one male and one female, and a male Somali colleague were kidnapped early in the morning in the village of Awdhegle.

Two Italians among three aid workers kidnapped in Somalia: officials
Somali gunmen kidnap two Italian aid workers-officials
Witness: Somali gunmen seize 2 Italian aid workers

Red Cross Website Hacked to Steal Quake Relief Donations

A section of the Chinese Red Cross website has reportedly been hacked. Apparently the hacker gained access to the website and created four fraudulent bank accounts to steal earthquake relief funding. If you can read Chinese you can read the report here. Otherwise check out the link attached to the graphic below. Read the full report from The Dark Visitor.

Crossing Borders with your Laptop

Recent media coverage of the Ninth U.S. Circuit Court of Appeals' decision to allow border agents to search travellers laptops without cause has inspired a lot of coverage in tech media circles. However, as an aid worker it is important to remember that the US border is not the only place where your laptop can be searched. Aid workers have reported having their laptops searched by authorities in Sudan, and Pakistan. Sri Lankan security forces frequently demand access to aid worker's laptops when they are entering LTTE controlled areas or travelling by to or from Jaffna. In one case they even seized the computer of the Executive Director of an NGO.

So how do you keep prying eyes from accessing your sensitive files while travelling? The EFF has some good advice for protecting your laptop from arbitrary searches. Bruce Schneier has his take as well. Finally you shouldn't overlook Front Line's "Digital Security and Privacy for Human Rights Defenders".

Kidnapped Aid Workers Released in Pakistan

On 17 May, Taliban fighters operating in Mohmand Agency, Pakistan, released four employees of two NGOs. The four were kidnapped by the Taliban on 23 April.

The aid workers were reportedly released after a local Peace Jirga facilitated talks between the Pakistani government and the Taliban.

Darfur 'No Fly Zone'?

According to sources the Government of Sudan is creating a 'no fly zone' for UN and humanitarian operations in Darfur. There are contradictory reports of airport closures and the grounding of flights. Nyala and El Fasher airstrips were closed on 13 May.

NGO security advisors are advised to reassess their medical evacuation plans for Darfur. The lack of reliable aeromedical evacuation capability increases the threat to life and limb of even relatively minor medical events.

WFP Head of Sub-office Killed by Gunmen in Northwestern Kenya

On Wednesday, 7 May 2008, gunmen shot dead 37-year-old Zimbabwean Silence Chirara outside a UN compound in Lokichoggio, north of Nairobi, near the border with southern Sudan. He was ambushed while driving a clearly marked UN vehicle.

See also:
UN food agency shocked by killing of staffer in Kenya
Zimbabwean Aid worker killed in Kenya

Sending GPS Coordinates from your Thuraya to Twitter

Aid Worker Daily has instructions for sending GPS co-ordinates from your Thuraya satellite phone to Twitter via an SMS message. This might come in handy if you get into trouble and need help like James Karl Buck.

Save the Children Aid Worker Killed in Chad

Save the Children aid worker, Pascal Marlinge, was shot and killed by armed men in Chad on 1 May 2008. The link below has more detail from Save the Children.

UNDP Worker Arrested with Pistol - Snarky Comments Follow

This article about a UNDP worker being arrested while carrying a pistol is interesting but its the comments that stand out. Some are funny... some just sad. What does it say about acceptance as a security strategy in Sri Lanka? Have we been doing a good job communicating what it is we do and who we are?

IFRC Releases Two New Security Manuals

IFRC has released "Stay Safe", its new security manual. I've only taken a quick look at it but so far it looks good. There is also a security manager's version.

NGO Security Scenario - Valuables Snatched

In homage to NGO Security's Security Scenario videos I offer the following. Unfortunately (perhaps fortunately) I can't find any video for this scenario so you'll have to read the article below. I swear it is real!

A staff member has refused to report to working claiming to have been victimized by one of the snatchers. The remaining staff of your organization have requested that you brief them on the risks. Identify the two threats in this scenario. What are the probabilities associated with each. How do explain the risks to the staff. How do you deal with the absent staff member.

Afghanistan Non-Government Organization Safety Office Quarterly Data Report

ANSO has released it's quarterly data report titled "Afghanistan Non-Government Organization Safety Office Quarterly Data Report (January 1st 2008 - March 31st 2008)".


NGOs have been directly targeted for attack on 29 occasions in the first quarter of this year with 16 of those attacks associated to Armed Opposition Groups (AOG) and 13 to criminals. Although comparable to last years figures in volume (30), the attacks of this year have resulted in many more fatalities indicating an escalation in the seriousness of attacks on NGO. This assessment is demonstrated in the fact that NGO incidents attributed to AOG have doubled from in first quarter of 2007 to 16 in the same period this year. The NGO incidents include, amongst others, seven AOG armed attacks which between them resulted in nine fatalities, nine injuries and near total destruction of two NGO compounds; seven armed abductions accounting for 12 persons kidnapped and an additional two fatalities including a female US citizen; and ten serious armed robberies accounting for one additional NGO staff injury and a long list of losses and damages to property. These figures are all higher than last year by a significant margin.

You can download the full .pdf report here.

Security Incidents Map - Nepal - March 08

OCHA Nepal has released a security incidents map for Nepal covering March 2008.


Talks with a UN Security Guard

I didn't know whether to laugh or cry when I read this. On the plus side I guess it means there is still lots of work available for NGO and UN security officers.

More on Espionage Against Pro-Tibet NGOs

You might recall that a couple of weeks ago NGO Security and humanitarian.info covered cyber attacks on NGO's in Tibet. Now Wired magazine has a more mainstream follow up article on the issue. Most alarming perhaps is that some of the malware used in the attacks was designed to steal PGP encryption keys. PGP is used by many human rights groups to secure their email from prying eyes.

If you'd like to know more about how to protect your organization's information from prying eyes be sure and check out "Digital Security and Privacy for Human Rights Defenders".

Are aid groups doing too much newsgathering?

The frontline club introduces "The News Carers: aid groups doing too much newsgathering?", with the following:

Are the media relying too much on aid groups and NGOs to provide pictures and video of the world's forgotten crises? Or does it make no difference where we source our material? Does the public even know the difference?

These are interesting questions but I'd rather switch it around a little. Do NGO's rely too much on mainstream media to get the word out about forgotten crises? How do governments, non-state armed actors, and others view our relationship with the media? How do these perceptions affect NGO security? How do they affect our ability to access those in need?

Appropriate Response to NGO Kidnappings and Abduction

Image of a man in a blindfold

In the past most NGO kidnappings were conducted by criminal groups seeking economic gain. However in at least the past five years we have seen a marked increase in the number of NGOs who have been kidnapped for political reasons. Confusing the issue are indications that some recent kidnappings may have been 'speculative' in nature. That is to say they were carried out by groups that were primarily criminal in nature but with the intent to sell the victim to the highest bidder.

"Experienced Advice Crucial in Response to Kidnappings" outlines the nature of the kidnapping threat and the steps NGOs should take to prepare themselves. Kidnap insurance, crisis management plans, family support, and media liaison plans are all covered in an accessible manner. If you are an NGO security officer the article might be useful for opening a discussion with senior staff. If you are a programme person you should read it and raise any questions you might have with your security officer.

The article was authored by Bob Macpherson, former director of the CARE International Safety and Security Unit, Christine Persaud, and Norman Sheehan. Between them they have a wealth of experience dealing with NGO security issues.

"...we keep them alive, until they are massacred."

The Carnegie Council has an interesting presentation by Jan Egeland, former UN Under-Secretary-General for Humanitarian Affairs, in which he introduces his book, "A Billion Lives: An Eyewitness Report From the Frontlines of Humanity". Its all good but a couple of quotes really caught my attention.

Jan Egeland on the need for more than just humanitarian aid:

"...in the old days, they said, "Send the Marines." Now it's, "Send the humanitarians. They will keep them alive, and we can maybe forget about it." Well, we keep them alive, until they are massacred."

Jan on humanitarian security in a post UN Bahgdad bombing world:

"...it is a watershed when we go from just preparing ourselves to survive in crossfire with militias, with child soldiers, with drunken soldiers, with mines, and so on—we have lots of procedures to survive in such circumstances, but we do not know how to survive when a well-financed, ruthless organization plans for one month to kill you."

You can watch a video excerpt of the presentation below.

If you have good bandwidth you can watch the full video presentation...
or you can listen to the audio archive...
or if your connection is very slow take a look at the transcript.

Private Security Companies and Local Populations: An Exploratory Study of Afghanistan and Angola

The Swiss Peace Foundation has released a new working paper titled "Private Security Companies and Local Populations: An Exploratory Study of Afghanistan and Angola". Issues surrounding Private Security Companies (PSC's) and NGO security are a hot topic these days. This paper may give you insight as to what your beneficiaries may think about PSC's. The attitudes of your beneficiaries have a direct impact on your organization's acceptance.

NGO Security is Compiling a Security Training Directory

NGO Security is compiling a humanitarian security training directory. If you or your organization want to be included in the directory drop them a line. If you know someone who might want to be included please pass the word.

Breaking NGO IT with Low Tech - Suggested Readings

Discussion (here and here) regarding Bruce Schneier’s recent post on security mindset combined with recent interesting posts from friends regarding NGO IT security issues (here, here and here) has me thinking. It seems to me that social engineering, rather than a purely technological attack, is still the easiest route into most NGO’s networks. There is no need for anything too complicated. Most aid workers are somewhat trusting and helpful by nature making them easy targets for even relatively inexperienced social engineers.

Kevin Mitnick’s book, “The Art of Deception - Controlling the Human Element of Security” is a great introduction to social engineering. Kevin Mitnick was one of the world’s greatest hackers. He gained great notoriety for his ability to penetrate telephone and computer networks seemingly at will. What surprised many is that it wasn’t sophisticated technology that allowed him to do it. It was his ability to con or ‘pretext’ people into giving him the information he needed to access their systems. As he explains in the book the human factor was security’s weakest link.

Hint: If you search for “Kevin Mitnick The Art of Deception.pdf” Google you just might be able to find a free copy of Kevin’s book floating around the net.

To further develop your security mindset check out "No-Tech Hacking" by Johnny Long. Its a sample chapter from "Techno Security's Guide to Managing Risks for IT Managers, Auditors and Investigators". Johnny has since turned the chapter into a book in its own right. In the freely available sample chapter he covers tailgating, faking ID cards, lock bumping, shoulder surfing, dumpster diving and other low tech means of gaining forbidden access.

Happy reading and don't blame me if it keeps you up at night.

Kidnapped Aid Workers Reportedly Killed in Afghanistan

Aid workers Cyd Mizell and Muhammad Hadi have apparently been killed in Afghanistan according to this statement by Asian Rural Life Development Foundation. The pair had been kidnapped by armed men in Kandahar while they travelled to work in the morning.

Our prayers are with the families and friends of Hadi and Cyd.

Trunk Monkey Security System

Thanks to Sources and Methods for pointing out the Trunk Monkey Vehicle Security System. Hopefully they'll develop a ruggedized version for NGO use. Just imagine how useful it could be at militia checkpoints or when the police want to search your vehicle for the fifth time that day.

For more about Trunk Monkey go to trunkmonkey.com.

Mexico's kidnapping business

According to AlJazeera kidnappings are big business in Mexico with an average of 900 kidnappings per day last year.

Watching the video reminded me of a kidnapping conference I attended a couple of years ago. Among the participants was Rachel Briggs, the author of "The Kidnapping Business". Her publication is well worth reading even without the extensive references to the NGO community.

To paraphrase her report a kidnapping business hotspot country can be identified by the following characteristics:

1. The presence of networked groups that can support the crime. Tribal groups, fringe political groups, religious groups, and pure criminal groups are the major classifications and they are by no means mutually exclusive.

2. Political or economic transition that results in ineffective policing, corrupt judiciary, or weak laws but avoids outright conflict which would likely limit the number potential victims.

3. A local middle class, significant numbers of expatriate businessmen, or I would argue the presence of large numbers of aid worker.

4. Areas where potential victims are poorly protected and do not manage risk well.

Does the country you work in have some or all of these characteristics? Does your organization have a kidnap and ransom policy? Do you know what it is? Do you know what personal security measures to take to reduce your risk? Do you actually use them?

Family Statement Regarding Cyd Mizell, Aid Worker Held in Afghanistan

Cyd Mizell's father asks for his daughters safe return in this video statement.

If your connection is too slow for the video you can read the text of the statement below.

SEATTLE, Feb. 3 /CNW/ -- The family of Cyd Mizell, an American aid worker currently being held in Afghanistan, today released the following statementfrom her father, George Mizell: "I am Cydney's father. My family and I want to thank all those who have shown their deep concern for the safety and well being of my daughter, Cydney Mizell, and Muhammad Hadi. I am indebted to the Afghan people for their support of Cydney and Muhammad. "My family and I love Cyd very much. I'm confused why my daughter would be taken because she's a gentle, caring and respectful person. "When we talk to Cyd, she tells us about the friends she's made and the kindness that's been shown to her and her desire to help them. "To those people who are holding our daughter, please let Cyd come home. Each day that passes without knowing about Cyd is difficult for our family andfriends. "We ask that you work with us so Cyd can come home. Cyd knows how to contact us and her co-workers. All of us are waiting to hear from you."

For further information: Bill Curry, spokesman for the Mizell family, +1-206-697-3684 Web Site: http://www.onlinefilefolder.com

Imminent Threat: Potential for Violent Backlash over Anti-Qur'an Film

Although Geert Wilders, the leader of the Dutch Freedom Party, has agreed to delay the release of his controversial anti-Qur'an short film the potential for a violent backlash remains. The pending release of the film has led to fears of a repeat of the worldwide Prophet Mohammad cartoon riots in 2006.

Wilders says his short will show that the Qur'an is "a source of inspiration for intolerance, murder and terror." Little else is known about the contents of the yet to be viewed video leading some to speculate that it may contain deliberately provocative acts.

NGO’s working in Islamic countries or in countries with significant Muslim communities should review their exposure to the risk of a violent backlash. Organizations that might be labelled as “Western”, “Christian”, “Dutch” or “Israeli” are especially vulnerable. Security plans should include responses for civil disobedience, demonstrations, and riots. With luck cooler heads will prevail and the plans won’t be needed but, as always, it is better to be prepared.

Free Media and NGO Security

Yesterday the Free Media Movement (FMM), Sri Lanka, sent me an e-mail announcing their new website. A quick review of the new site reminded me of how valuable FMM and similar sites can be to NGO security officers. The risks faced by independent journalists are similar to those faced by NGOs working in the same area. Official and factional attitudes towards free media often reflect attitudes towards NGOs, especially human rights organizations. Therefore actions against journalists can be indicative of impending risks for NGOs.

There is another reason as well. Sooner or later you and your organization are going to face a crisis. When you do there is a very good chance you are going to have to talk to the media. Independent media sites can help you find credible, non-partisan journalists who will be willing to listen objectively to your side of the story.

The FMM site also has a link to “On Assignment: A Guide to Reporting in Dangerous Situations”, a security guide for journalists working in conflict zones. Although it is intended for journalists much of the information is of value to NGOs as well. It is worth the download just for the resource links.

Finding NGO Security Officer Jobs

How do I get a job as an NGO security officer? I've been asked that question several times over the last few weeks. I can't claim to be an expert in this regard as there was a fair bit of serendipity involved in getting my first security job with the UN. However, I have asked around a bit and I think the following advice should help anyone looking for a security job in the NGO world.

If you already have a safety or security background breaking into NGO security isn’t usually too difficult. You’ll need to concentrate on adapting your existing skills so that they more closely match the needs of humanitarian organizations. RedR’s Security Management course familiarized me with the humanitarian vocabulary and helped me recognize adjustments I would need to make in my working style. It helps to focus on the ‘softer’ side of security: acceptance vs. deterrence.

If you already have a humanitarian background you’ll obviously need to take the opposite tact. Concentrate on improving your security skills. Many NGOs offer free in-house security courses. You might also want to volunteer to be a security focal point in exchange for security training.

If you don’t fall into either of the above categories you are likely to find it more difficult to break into the NGO security field but all is not lost. Identify appropriate skills that you already possess and then concentrate on acquiring additional skills and experience. The tips below should help as well.

General Tips

Take courses – RedR offers some good security management courses. Take courses that involve face-to-face interaction. This will provide networking opportunities. Don’t limit yourself to purely security courses. Communications training, hostile environment driving, mine awareness, fire safety, and advanced first aid are courses you should consider. The trainer versions of these courses are especially valuable for security professionals.

Volunteer – Consider volunteering for a while. This will provide you with additional experience and prove to potential employers that you are motivated by more than just money.

Network – Many NGO security positions are filled by word of mouth. Try to establish good relationships with established security practitioners. Take part in online discussions. Consider writing security related articles.

Polish your resume – Make sure your resume reflects the type of position you are seeking. A resume tailored for a local position may not be suitable when applying for an international position.

Security Jobs Online

These sites should be your starting points for any online job search. Most list more than just security jobs but you can filter the listings pretty quickly to find what you are looking for.

ReliefWeb: Many humanitarian organizations post their vacancies listings here. You'll also find UN, governmental, media and academic positions available.
AlertNet: AlertNet is another good source of security job listings from multiple organizations.
jobs.un.org: If you are looking for UNDSS or DPKO security jobs this is a good place to start.
unjobs.org: This link is not actually a UN site but it does have UN and NGO job listings.
RedR: Many organizations use RedR to help them find suitable candidates for positions they have available. Registration is required.

Don't ignore the websites of the larger humanitarian organizations either. Most have job listings that include security positions from time to time.

Sri Lanka 2008

2008 is going to be a very difficult year for humanitarian organizations working in Sri Lanka according to this post in groundviews. I wish I could disagree with the author as the predictions are grim indeed.

"Senior leadership of pro-democracy NGOs will face ever increasing hate speech by those in power and their local and international apparatchiks. Field workers of local and international human rights and humanitarian organizations in particular will suffer the brunt of physical attacks, including outright murder and torture with total impunity. Further, organizations working on media freedom and the freedom of expression will find themselves painted as agents of foreign government’s with no real legitimacy in Sri Lanka. The Administration will become more rabid and parochial in its definition of what is local, authentic, Sinhala and Sri Lankan and essentially kosher in civil society initiatives. Anything and anyone that falls outside these self-styled definitions will be dealt with extreme prejudice."

Unfortunately I think that Sanjana has it right. You might want to make sure your contingency plans are in place and up to date.

Twitter Tracking for NGO Security

Two months ago Twitter added the ability to track keywords. Essentially this capability means that whenever someone sends a public update containing the word or phrase you’ve told Twitter to track you’ll receive a copy of the SMS.

Since its introduction I’ve been examining this feature’s potential utility for NGO security officers. I’ve tracked the names of several towns in trouble areas, the term Tsunami, and a variety of other keywords. The effort produced some positive results.

While most of the results were tweets sent by news services there were some other useful messages. On two occasions the messages containing tracked terms tipped me off hours before the issue made the media. On another occasion the issue never even made it to the mainstream media. In each case we were able to take pre-emptive action to reduce our potential risk.

There are caveats however. You get ALL public updates containing the search term, even ones in languages you don’t speak. It’s also surprising how terms are used sometimes. ‘Information Tsunami’ seems to be making its way into the modern lexicon. Apparently Tsunami is also the name of a very popular Sushi restaurant. It must be on the other side of the world from me because people’s lunchtime “enjoying Sushi at Tsunami” messages would arrive in the middle of the night. Needless to say I’m not tracking Tsunami any more.

Risk Homeostasis: Is NGO Security a Sham?

Risk homeostasis theory, developed by Gerald J.S. Wilde, has some serious potentially serious implications for NGO security.

At its core risk homeostasis theory has two basic premises. The first is that every individual has an inbuilt, personal, acceptable risk level that does not readily change. The second premise is that when the level of acceptable risk in one aspect of an individual's life changes there will be a inverse change of acceptable risk elsewhere. In other words everyone has their own risk ‘set point” at which they are comfortable and which they will endeavour to remain at.

In an NGO context it suggests that increased security precautions encourage greater risk taking amongst staff in other areas of their lives. Better vehicles and improved communications would therefore result in staff to pushing the envelope in their field activities. In effect, according to risk homeostasis theory, security measures merely serve to "move risk-taking behaviour around".

Wilde’s book, Target Risk, is full of citations from studies showing that vehicle safety improvements increase risky driving and fail to decrease the accident rate. He also cites examples of industrial safety programs that don’t decrease overall work related injuries and anti-smoking campaigns that come to nothing.

All of this begs the question of whether or not current security programs are, or even can be, effective. Do security officers, security training programs, and improvements in equipment merely shift the risk? Do aid workers compensate for decreased risk by pushing harder and farther than they would otherwise? Should we be concentrating on mitigation rather than risk reduction?

Note: The out of print first edition of “Target Risk, Dealing with the Danger of Death, Disease and Damage in Everyday Decisions” is available for free online. The expanded “Target Risk 2: A New Psychology of Safety and Health” is available from online bookstores.

Front Line: Accessible Security for Human Rights Defenders

I like Front Line more and more as time goes on. They get it. They put a lot of effort into making their security related materials accessible and understandable. Their newly updated website is clean, easy to navigate, and full of valuable resources. They have a good primer on security for human rights workers, and a great manual titled "Digital Security and Privacy for Human Rights Defenders".

Even their site licence is a breath of fresh air. They have a nice simple Creative Commons licence. Front Line understands that its job is protecting people not content. Try comparing their licence to the pages of unfriendly legalese found on the websites of some large NGOs.

Front Line is also making good use of internet video as these two examples released on YouTube demonstrate.

Video: Front Line - Protection of Human Rights Defenders

Video: NGO in a Box - Security Edition

Evacuation and Relocation Training

Several months ago I did evacuation, relocation and hibernation training with one of our offices. We were all very busy at the time and my planned eight-hour training day turned into three hours. I insisted we go ahead with the training despite my concern that everyone was too tired to learn anything of value.

It turns out I needn’t have worried. Last week we were forced to temporarily relocate a sub-office due to security issues. The relocation went very smoothly and staff were keen to point out that it ‘was just like the training’.

The method we used for the training is outlined below.

The team with thier creations


1. Index cards or construction paper

2. Flipchart paper – or any other type of paper you can use to cover several desks

3. Pens and markers

4. Note paper


1. Create cardboard representations of all your vehicles. They can be as simple as an index card with the vehicle details or as complex as the three-dimensional models shown in the photo below. The models in the photo are accurate down to the vehicle plate number and communication equipment on board.

2. Draw a large map that covers your operational area and potential relocation sites. The map will probably need to be large enough to cover several desk tops.

3. Prepare an equipment list outlining items needed at the relocation site and items staying behind.

4. Write each major piece of equipment on a separate small square of cardboard. Minor items can be grouped together i.e. “staff luggage - one load”.

5. Prepare a staff list that indicates who will relocate and who will stay behind. It is a good idea to brief staff on agency and individual responsibilities during evacuation/relocation a day or two before the exercise. They should also be encouraged to discuss the issue with their families.

6. Write the name of each staff member being relocated on a cardboard square.

cardboard vehicles and map

Exercise process:

1. You’ll start the exercise at your desired end state. Place the cardboard squares representing equipment and people and the vehicle models on the map at the relocation site. Divide everything into two piles: ‘essential’ and ‘nice to have’.

2. Working backward, load the equipment and staff pieces onto the vehicles. Record what equipment and which people go on which vehicle. Be realistic about how much your vehicles can carry. You’ll also need to record how long the unloading process will take.

3. Continue to work backward recording travel times, rendezvous points, rest stops etc for several alternative routes.

4. Repeat the process until all equipment and staff are back in their place of origin.

5. Using this reverse process will allow you to come up with realistic planning times, load lists, and staff lists for relocation based on your own unique situation.

Some questions to ask:

1. Have you allowed enough time for delays? Nothing ever goes perfectly to plan. Also, convoy travel is generally slower than that for an individual vehicle.

2. Will you need to make more than one trip to move all your equipment and staff? Is this going to be possible?

3. Have you allowed time for acquiring travel permission from the relevant authorities? Drafting Performa requests in advance will save time.

4. Will you be able to travel after dark? Will it be safe to do so?

Although training is important it is how it is applied in the field that matters. I'm happy to say that the team passed their real life test with flying colours.

Complacency Management

"Complacency Management" is a great term that I just ran across at World Changing. It is a term that accurately describes what many NGO security advisors end up spending much of their time doing.

Security Tip: Increasing Your Visibility

After a recent series of lethal ambushes and Claymore mine attacks against civilian vehicles we were warned by local subject matter experts to increase our visibility. They pointed out something that is blindingly obvious in retrospect. People conducting an ambush or Claymore attack will generally be laying down so they'll likely see something like this:

NGO Vehicle front - low visibility
NGO Vehicle - Low Visibility

Believe it or not there is a large flag mounted on this vehicle. Now imagine the vehicle is travelling down a dusty road just before dusk. What would you be able to see if you were laying near the road? Would you be able to distinguish this vehicle from a police vehicle, a 4x4 full of combatants, or one of the infamous "white vans" that plaque parts of Sri Lanka?

The Solution:

Taking the warning to heart one of the teams designed a short portable flag mount for attaching to the front bumper of NGO vehicles. They are also in the process of putting logos on the bumpers of their vehicles.

Flag Mount

Flag Mount Closeup
Flag Mount Close-up

Thanks to Cader and his team for passing this tip on.

"...becoming a better NGO security officer"

I was feeling a little depressed over the weekend. I’d reread Paul’s post on why he wasn’t liveblogging the Global Symposium +5 in Geneva. It bothered me. I could sense his frustration at what he sees as the slow progress in the world of humanitarian information exchange. Maybe I’m reading too much into it but I thought I could detect a similar sentiment at the NGO security blog in recent weeks as well. Of course there is a good chance it’s just me.

When I started this blog I had a vague idea that I could share some ideas and maybe pass on a little hard won wisdom. I suppose I also thought that I could, in a small way, influence the course of the NGO security world. Seeing people I respect have doubts made me question whether I could make a difference. In effect, “what the hell makes me think I can change anything when these guys, so much more articulate and educated than myself, are feeling stymied?”

Fortunately for me, and my mood, serendipity intervened. I received three packages. Two are ‘tech toys’ with a security bent (I’ll post about them over the next couple of days). I’m a geek at heart so shiny gadgets, software, and such always pick me up. It was the third package that really made the difference however.

OK, I confess that it wasn’t really a package per se but ‘three packages’ just sounds better. Actually it was a video I downloaded off the web and hadn’t watched until this morning. It’s a presentation by a guy named Stephen Downes at the National Research Council, Institute for Information Technology, in Canada. I won’t bore you with the details. You can watch it yourself below. Go ahead, don't let the lead frame fool you.

Stephen’s presentation made me realize that I had it wrong. This blog is not about me teaching. It’s about me learning. It’s about learning the way I always wanted to learn. It’s about me becoming a better NGO security officer... or maybe just better.

Through blogs, RSS feeds, email, YouTube, Skype and a myriad of other online tools I’m connected to, and learning from, people who aren’t afraid to push the boundaries and strive for something beyond the status quo. I have access to teachers who are also fellow students. I have access to fields of endeavour too niche for textbooks and lectures. When was the last time you saw a textbook about “Security Reporting, Accessible Maps and GeoRSS” or “YouTube for Security Training”?

All of this has been a round about way of getting to what I really want to say. To all my teacher-students out there, you are making a difference. Thank you.

Note: If you’re not sure if I mean you I probably do. You can also check out the sidebar on the resource page for some hints if you are still unsure.

Twitter Tracking for Security and an Answer

Twitter has added the ability to track keywords. Now whenever someone sends a public update containing your word or phrase of interest you’ll receive a copy of the update. How is this useful for NGO security officers? I’m currently tracking several towns in trouble areas, Tsunami, and a variety of other keywords. You’re only limited by your creativity. One word or warning though: you’ll get ALL public updates with the search term, even ones in languages you don’t speak.

I've also finally added the solution to our geographic distribution analysis problem.

Aid Worker Killed - Sri Lanka

I met the Rev Fr Nicholaspillai Packiyaranjith of the Jesuit Refugee Services while I was in Mannar district a few weeks ago. He struck me as a quiet, principled man, who was dedicated to his beliefs and service to others. Despite the difficult security situation in the area he continued to work hard to bring relief to the poorest and most vulnerable. In short he was the type of man I endeavour to be.

On the afternoon of 26 September 2007 while travelling towards Vellankulam in an LTTE controlled area of Mannar his vehicle was struck by a command detonated Claymore. Fr. Packiyaranjith was killed instantly. His driver was severely injured.

No one has accepted responsibility for this brutal and myopic act. Nor is anyone likely to. The government blames the LTTE. The LTTE blame the government.

Over the weekend the sheer senselessness of his death left me feeling frustrated and depressed. This morning however, I had a revelation. Fr. Packiyaranjith was the type who, if he had been given the choice, would have chosen to spend his last moments in his quest to help others.

Sri Lanka needs more like him.

Social Networking Tools Part 2 - Twitter and Tsunamis

On 12 and 13 September there were a series of earthquakes near Indonesia spawning fears of another Asian Tsunami. It proved to be a good test of our Twitter based NGO security tree.

I was in Mannar, Sri Lanka at the time and I didn’t have a useable Internet connection. My first warning of the situation came when a concerned staff member called wanting to know “when is the Tsunami going to hit!” As the fear of a Tsunami spread I started to receive more and more calls from staff. Soon the mobile system was completely overburdened in many parts of the country and creaking under the strain in others. The very slow, single line dial-up Internet connection continued to work but proved to be all but useless for gathering timely information.

Fortunately I quickly started to get SMS’s. Some came from feeds I was following on Twitter: BBC, Reuters, CNN, EQTW, etc. Others came directly or were forwarded from UNOCHA, the Sri Lankan Disaster Management Centre, the Met office, the police and assorted individuals. Twitter allowed me to quickly forward the useful ones to all my followers while limiting the strain on the overburdened mobile system.

There were some glitches however. I continued to receive forwarded text message warnings long after credible sources had given the all clear. In some instances it seems that text messages became trapped in the telephone companies’ SMS system and were released as the queue began to clear. In some cases staff, confused by contradictory information, continued to forward outdated information.

Unfortunately the biggest problem with the Twitter based NGO security tree was one of buy in. Only a fraction of the staff who were intended to be served by the tree had bothered to sign up. The manual SMS security tree, which had been left in place as a backup, failed for much the same reason.

Lesson Learned: While emergency communications tools continue to improve, and become easier to use, buy in remains the number one problem. NGO staff members, especially office staff, often prove reluctant to dedicate even minimal effort to their own personal security until it proves too late.

For some background, check out “Social Networking tools for NGO Security – Part 1”.

To see a live feed of the NGO Security stream check out the demo page here. There is a Jaiku based stream as well.

IT Security and NGOs - A Little Knowledge?

The other night I was having dinner with some NGO friends when the subject of government eavesdropping on NGOs came up. One of the people at the table said that in the past they had used an email trick to allow sharing sensitive information amongst team members. Essentially the premise was that one could sign up for a free web mail account and share the account password amongst team members. Members would draft emails as usual but rather than sending them they would simply leave them as drafts. Other team members would then read them by going to the account.

The idea was that as long as the email wasn’t sent it couldn’t be monitored. Unfortunately it is just not true as Nart Villeneuve points out here.

I recalled the conversation a few days later and wondered what the problem was. It is not that my friends weren’t aware of the potential risks, and they are certainly not unintelligent. I think the issue is that most aid workers already have more than enough work to do without trying to keep up with the latest developments in IT security. So the problem becomes one of learning about IT security in small, manageable, easily absorbed bits.

Fortunately there are resources that can help. Thanks to Bruce Schneier at Schneier on Security for pointing out securitycartoon.com. I don’t think it is meant to be funny but it does present IT security in a straightforward and comprehensible manner. Subscribe to the RSS feed to make it even easier.

Privaterra is a good resource that covers data privacy, secure communications, and information security for Human Rights NGOs.

Over course you shouldn’t miss Nart’s blog. It isn’t NGO specific but it covers Internet privacy, freedom of expression, censor-ware, security, surveillance and anonymity. Whether you are interested in "Cyber-Cafe Monitoring in India" or need to know how to avoid internet filtering Nart’s blog is a good place to start.

Odds and Ends

A couple of weeks ago I emailed Paul Currion and happened to mention that I wanted to plot RSS news feeds on an easily accessible map. Paul passed my question onwards and it mushroomed into an interesting conversation between some very clever people. Numerous hat tips and thanks to you all. I’m still experimenting with some of the ideas that were shared and I’ll update everyone at some time in the future.

So far I’ve run into some stumbling blocks:

  • In Google Maps Sri Lanka is a big empty space. The only thing missing is a ‘here be dragons’ label
    • RSS to GeoRSS utilities tend to encode the first place name encountered. This means that a story about Trincomalee will be plotted to Colombo if Colombo is in the by-line
    • Some utilities don’t work well on some platform/browser combinations
    • It seems the IT section’s web filters are causing some problems as well
    • Popfly seems to work pretty well but so far the Geonames database they use only covers the US

Common sense update

No sooner did I post my common sense rant then I came across this picture.

lightning strike

My common sense tells me that aircraft getting struck by lightning would be an extremely rare and very dangerous event. Apparently my common sense has let me down as this article and the reader comments explain.

The Common Sense Myth

I don’t know how many times I’ve heard some variation of this statement; “Security is just common sense.” I’ve seen NGOs use this belief to justify not dedicating resources to security. “We don’t need a security officer… we have experienced staff with good common sense.” Worse, I’ve seen people use it to justify breaking security procedures. “Its all just stupid rules… my common sense will keep me out of trouble.”

There is only one problem. Common sense is NOT good for security! Common sense is based on a whole series of faulty assumptions, biases and quirks.

Assumption of Common Knowledge

The first assumption is sometimes referred to as “Assumption of Common Knowledge”. In other words you know something so well that you think everyone must know it too. It just seems so obvious to you that it must be common sense.

The faulty logic of Assumption of Common Knowledge is revealed when common sense is cited in instructions. Reliance upon the term common sense when giving instructions pre-supposes that the instructed already has a grasp on the subject, and therefore needs no specific detail.

Some examples from security advice I have read:

“When working in high-risk areas use your common sense.”
“When travelling in a foreign country use common sense to avoid offending people.”
“If you are involved in a motor vehicle accident and an unruly crowd begins to form use common sense.”
“Use common sense during first aid emergencies.”

Do these statements make sense to you? Consider that in most security manuals, immediately after the “use common sense” statement, you’ll find a checklist of things that you should and shouldn’t do when in such a situation. If it is truly common sense why is the checklist needed?

Not convinced? Try these:

“When deciding whether or not to bilaterally transect the artery use common sense.”
“When connecting new wiring to the building mains use common sense.”
“If you are alone when you go into labour use your common sense.”
“When conducting sensitive hostage negotiations use common sense.”

Do you feel a sudden need for more detailed instructions? If saying, "use common sense" worked security procedures wouldn’t be nearly so wordy.

Cultural Norms

Every culture and subculture has norms which members are immersed in and unable to distinguish from common sense. Anyone with experience working in other cultures has had the experience of running up against cultural practices that seemingly lack any semblance of common sense. Eventually of course you realise that members of other cultures may also view your own cultural norms as similarly nonsensical. The physical reality of the world remains the same wherever you travel but the ‘common sense’ rules people use to navigate it change.


“Saudi flag on football = good PR” vs “Saudi flag on football = insult to Allah”
"When negotiating “be open and honest” vs “allow participants to save face”
“Using weapons to protect NGO personnel and property decreases security by sanctioning violence” vs “Weapons are necessary for protection. Its just common sense!”

By the way, the last statement was expressed to me by national staff members of a large INGO. While they were willing to accept that the ‘soft’ international program staff might not see the necessity for self-defence weapons they really could not believe that a security officer couldn’t see the common sense in it.


In effect it sounds like it makes sense. Clichés often fall into this category. “Opposites attract” - common sense right? “Birds of a feather flock together” – common sense too!

Clever arguments, well stated, can be persuasive even if built on a foundation of bias lacking evidence. Take for example the politician who exclaims, “What we need is a common sense solution to the conflict” leaving the majority nodding their heads sagely while overlooking the fact that the opposition never actually supported a solution devoid of common sense.

“Mosquitoes can spread AIDS.” By now most of us should know that that just isn’t true. Surprisingly many people still believe it. To them it just sounds plausible. “AIDS is spread by body fluid to body fluid contact… mosquitoes transfer body fluid… mosquitoes spread AIDS.” It’s just common sense, right?

Cognitive Biases

There are a large number of cognitive biases that cloud our thinking and skew our common sense. Covering them all is beyond the scope of this article but consider these:

Optimism bias the tendency to be overly optimistic about the outcome of intended actions
Recency effect — the tendency to consider recent events as having more import than earlier events
Zero-risk bias — the preference for reducing a small risk to zero over a larger reduction in a greater risk

Pre-Pubertal Learning

Ideas learned before puberty are difficult to unseat and are generally believed by the holder to be common sense. Thought processes change during puberty allowing most of us to more readily consider inconsistencies, question assumptions, and assess the grey areas of life. However, what we have learned prior to puberty generally remains unchallenged.

Most children accept "morality of authority" in which truth is what a credible authority figure has stated is truth. In effect parents, primary school teachers, and religious instructors all shape our ‘common sense’. Later in life it is difficult for us to unlearn these truths. How many of us still believe that sound travels better through liquids than through air or that Ben Franklin's kite was struck by lightning? How much harder is it to change our perceptions of risk?

‘Lanka a top danger spot for aid workers’

According to this Reuters piece …

Sri Lanka is among the most dangerous places on earth for humanitarian workers, the UN’s aid chief says, calling on the government to probe civil war abuses and consider an international rights monitoring mission. Aid agencies say 34 humanitarian staff have been killed in Sri Lanka since January 2006, including 17 local staff of Action Contre La Faim shot dead in the restive northeast a year ago in a massacre Nordic truce monitors blamed on security forces. “There is a concern ... about the safety of humanitarian workers themselves and the record here is one of the worst in the world from that point of view,” John Holmes, UN Under Secretary General for Humanitarian Affairs, told Reuters in an interview late on Wednesday during a visit to Sri Lanka.

Read more…

This is not news to most of us who work here but it is a reminder just how bad the situation has become. Sri Lanka can be a very deceptive place. It is important that we not let the sunshine, beauty, and beaches blind us to the risk that NGO staff, especially national staff, face in what is in essence a civil war. I worry that we have begun to accept these deaths as the price of doing business here.

The Analysis Gap

There is a real gap in the availability of good analytical training and resources for NGO security officers. Most NGO security manuals introduce the topic by stressing the importance of good analysis and an understanding of the local context. They might then go on to briefly cover actor mapping, and if we are lucky incident plotting. Beyond that the reader is left to his or her own devices.

Admittedly there have been a number of recent analytical studies that examine the patterns of violence against NGOs. These studies come replete with multiple regression analysis and complex equations like this one; "Sec100k = -1.384 + 1.691*BorderPak + -0.00011*Poppy + 0.036*Homeradio". I’m sure these studies are useful for developing policy and keeping underemployed academics out of the soup lines. However, they are unlikely to provide much solace when the country director wants to know how he can safely keep program running despite the recent spate of IED attacks.

In order to try and address these shortcomings I am opening the conversation on security analysis for NGOs. We’ll start with simple, robust, and inexpensive tools and techniques that can be used anywhere under any conditions. We’ll also examine more advanced tools that take advantage of the latest in ICT.

Anyone who wants to share tips and techniques should feel free to do so. It doesn’t matter to me whether you do your analysis on the back of an empty cigarette package under a sputtering lantern or on the latest networked GIS platform in a brightly light office. The goal is to identify and share best practices and to encourage the development of new tools and techniques.

I'll post the first technique shortly.

NGO Security Blog

Nick seems to be posting again on the NGO Security blog. This is good news! Welcome back Nick.

The Economist on Tech, Response, and NGOs

The economist has an interesting article on how technology is changing the power dynamics between NGOs and their beneficiaries. There are even a couple of paragraphs covering concern about how mobile phones and similar technologies might impact on NGO security.

NGO in a Box - Security Edition

NGO in a Box has a Security Edition that includes Free and Open Source Software (FOSS) to aid NGOs in securing and protecting their data and online activities. The package seems ideally suited to human rights, anti-corruption, and womens groups, as well as independent media outlets. Any other group that wants to protect their data from abuse, misuse, and vandalism might want to check it out as well.

Social Networking tools for NGO Security – Part 1

I was experimenting with Twitter when it occurred to me that it was an ideal tool for NGO security officers. Rather than using the service to merely update friends on what I was having for breakfast I could be sending out security information alerts and updates. All my “followers” would then get current, low cost, security information.

This method has many advantages over the SMS security tree method commonly used by NGOs. Traditional security trees tend to fail when one or more members (the branches of the tree) do not receive or pass on the text messages they receive to those below them, typically because they are on leave or because the tree information is not up to date. Traditional trees can also be expensive. Each SMS sent by every member of the tree comes out of someone’s budget. This can add up quickly if you are sending out several messages a day to a two hundred-member security tree.

Social networking services like Twitter or Jaiku allow us to avoid these problems. Essentially Twitter and Jaiku allow the head of the security tree to send one SMS to the service’s server. The service then distributes the SMS to all the “followers” (subscribers) of the account more or less simultaneously. This means the tree still works even if members are missing. In addition you only pay for the SMS to the service’s server. SMS messages from the server to each of the followers are free*.

* Most mobile service providers only charge for text messages that are sent while those received are free.

Other Stuff

Subscribe to Patronus in a feedreader
Subscribe to Patronus Analytical RSS Feed by Email

Low on bandwidth? Try this low graphics version

Lijit Search

Bloggers' Rights at EFF Global Voices: The World is Talking, Are You Listening?

Support CC - 2007

Creative Commons License
This work by Kevin Toomer is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 Canada License.
Jun 2008
May 2008
Apr 2008
Mar 2008
Feb 2008
Jan 2008
Dec 2007
Nov 2007
Oct 2007
Sep 2007
Aug 2007
Jul 2007