Introduction
On the afternoon of August 19, 2003, a terrorist's bomb exploded at the Canal Hotel in Baghdad, killing 22 people and wounding more than 100. One of the deceased was Sergio de Mello, the UN High Commissioner for Human Rights. Five days earlier, the hotel had been converted to the Headquarters for the United Nations Assistance Mission in Iraq. Abu Musab Zarqawi, the leader of al-Qaeda in Iraq, claimed responsibility for the blast. Zarqawi asserted that the deliberate victim of the attack was de Mello, who was targeted because he had assisted East Timor in becoming an independent state in 2002.1 The terrorist organization stated that de Mello had participated in the illegal secession of the area from an Islamic state, and as such, he was a criminal. This event had a deliberate and significant influence on the security practices of the United Nations and international humanitarian and development organizations.2
A series of reports were produced in relation to this fatal bombing. Key areas of the “Accountability Panel” report were: (1) possible blurring of chain of command and accountability on security issues; (2) the decision to return to Baghdad; (3) the warning signs of an attack; (4) the perimeter and UN Headquarters security; and (5) security clearances, staff ceilings, and staff lists.3 In summary, the UN Secretariat found that the Designated Official (a senior official designated by the UN Secretary General to undertake overall and special responsibility for the protection of the organization's staff members), the Security Management Team, the Senior Representative to the Secretary General, and the UN Security Coordinator failed to grasp the magnitude of the deteriorating security situation in Baghdad. The report read, “They ignored the warning signs which were becoming more obvious each day. They failed to respond effectively to the recommendations and advice which were coming from their own security advisors to enhance the protective measures of the Canal Hotel Compound.”3
As a result of this attack and the dramatic lack of attention to basic safety and security standards by the United Nations, the UN convened several reviews, which resulted in the establishment of basic Minimum Operating Security Standards (MOSS) as a fundamental policy for all UN field operations.4 In 2006, a similar set of standards were adopted by the US humanitarian and development community through InterAction, which serves as the representative association for many of the US-based international nongovernmental organizations (NGOs). However, the InterAction MOSS standards are specifically identified as “suggested guidance only” rather than a requirement.4InterAction, which is the largest NGO association in the world, represents approximately 200 of the most active and influential international organizations with hundreds of thousands of staff working in extremely complex and insecure environments, and still considers the definitive and binding attention to the safety and security of their staff as a voluntary commitment.4
Today, the NGO community is populated by both organizations that have implemented security standards that rival those of international governments and by others that pay little or no attention to the security of their staff. At times, many of these organizations work alongside each other in insecure and unstable international locations. This inattention to fundamental standards for staff well-being has led to a number of well-publicized lawsuits across North America and Europe. Increasing litigation was the catalyst for a recent policy paper “Can you get sued? Legal liability of international humanitarian aid organizations towards their staff.”Reference Kemp and Merkelbach5 It is an extensive review of organizational responsibility to staff under the legal principle “Duty of Care.”Reference Kemp and Merkelbach5 In this legal perspective, organizational inattention to providing necessary preparation, guidance, resources and training for staff exposes the organization to liability when someone is kidnapped, killed, or injured while traveling or operating under or within their purview.
Therefore, the NGO community is confronted with considering two documents. One details what organizations should do in order to meet the MOSS associated with staff security. The second discusses standards to achieve in order to limit liability in the event it is sued. Both provide good information, but define security architectures in broad terms. Consequently, for any organization, whether nonprofit or for-profit, a roadmap to address what is really needed to build an adequate security oversight mechanism remains abstract.
The purpose of this report is to offer a set of specific recommendations to address both the moral and ethical responsibilities of organizations toward staff security, and to satisfy the basic elements associated with the legal definition of “Duty of Care.”Reference Kemp and Merkelbach5
Creating a Security Framework
An organization's security architecture should consist of essential integral components that come together in an interdependent fashion throughout the entire organization. Staff safety and security cannot stand alone as an “add-on” to the existing framework hierarchy, to be used only when required. Essential to this structure is the institution's staff, procedures, and resources working together as an integrated unit. To successfully balance these parts, the mechanism for the oversight of staff safety and security must be planned and proactive. The challenge is that security is a fluid and dynamic process. The world stage on which it operates is constantly changing, making security dependent on the environment, threat levels, and the training of staff. In this context, the most significant advantage an organization can achieve to mitigate the emotion and confusion which will always occur in the first hours of a serious or catastrophic event is a well-defined process that is in place and understood by senior management.
In order to achieve this balance, the security framework must be built on a series of protocols, guidelines, and directives. The starting point is the creation of definitive organizational principles, which state what the organization “stands for” with regard to staff security, performance expectations, accountability, and how the system will be implemented. These guidelines may consist of a number of different statements, but seven safety and security principles capture the essential elements of an organization's responsibility toward staff safety and security. These serve as a guide to ensure minimum standards for staff well-being are addressed in operational planning and execution. In essence, these principles represent what the institution stands for, and as such are the guiding light for the entire program:Reference Macpherson and Pafford6
1. The organization affirms that the safety and security of every staff member is a primary concern.
2. Within the organization, safety and security is everyone's responsibility through due diligence and accountability.
3. Program and program support decisions will always be informed by safety and security considerations.
4. Clear lines of authority and procedures for decision making are maintained at all times.
5. All staff members will comply with the organization's MOSS.
6. All staff will be adequately trained and supported in the area of safety and security.
7. All staff members will hold themselves accountable for maintaining organizational security principles.
Security Framework Components
The framework must be strategic, and designed to support the organization's operational goals. At this point in time, the organization has announced its intent regarding staff safety and security. Unfortunately, this is where the authors find many organizations experience process “breakdown.” It is a significant step to formally publicize that an international or global corporation has created its own benchmark for staff well-being. In doing so, the organization has acknowledged a subtle and naïve failing; by not defining its position, it may not be accountable.Reference Gibbs7 This outdated notion will likely make the institution more vulnerable to litigation when something goes wrong. Thus, the question arises, “How do we translate the strategic principles into a working model at the headquarters level?” The elements that define the components of a strategic oversight for the framework development are listed in Table 1.8
Elements That Define the Components of Strategic Security Oversight8
Difficult and Uncomfortable Decisions
“There is no single, perfect, final solution to security problems. There is only patient, consistent vigilance and constant, hopefully creative, improvement. Those wishing to do harm to [an organization] are watching all the time and they too try to be creative.” 9
Finding a suitable balance between organizational risk and a realistic threat management program in support of operational initiatives is the fundamental challenge facing every corporate security management system. Very often, organizations build solid security plans, guidelines and procedures with detailed crisis management plans specifying how the organization will handle a critical event. Yet, when confronted by a significant crisis, they fail to respond at an adequate level. The dilemma (and the most difficult part in building an organizational security architecture) is how to inculcate the “notion or sense” of staff safety and security into the corporate culture.10 There are two reasons for this. First, there is the perception that robust security management will inhibit the effectiveness of the organization, ie, if there is too much emphasis on safety and security, programming will suffer. Second, a more subtle observation, based on human nature, is that there is a tendency to diminish uncomfortable insights by ignoring them or by creating false degrees of comfort through equivocation (eg, “our staff will not get kidnapped because of the quality or type of our programming, our links to the community, our tenure in the country).”10
It is at this point that an organization either moves to an effective program that truly focuses on risk and threat mitigation and provides a platform to minimize threats to reputation and/or from litigation, or it increases it exposure. To state the obvious, the essential characteristic of an inclusive approach to organizational risk mitigation is its proactive support throughout the corporation at each level. One of the tenets of “Duty of Care” is the “legal obligation imposed on an individual or organization requiring that they adhere to a standard of reasonable care while performing acts (or omissions) that present a reasonably foreseeable risk of harm to others.”Reference Kemp and Merkelbach5 Consequently, too many organizations increase their own liability by working very hard to identify “what they will do to ensure staff safety and security,” by creating, for example, a commendable set of documents, but failing to follow the most basic tenets of program development (ie, design, monitor and evaluate (DME)).Reference Kemp and Merkelbach5 In other words, the documentation is established, but the culture continues to ignore the requirements. Prior to the attack on the UN compound in Baghdad, the United Nations had an impressive collection of safety and security protocols. However, these were ignored, and virtually no one in line management bothered to monitor or administer the standards. An examination of the factors leading up to this tragedy highlights the failure of a system to adhere to its own standards. The dilemma is that under the precepts of “Duty of Care,” when an organization develops its standards for staff safety and security, it increases its exposure to litigation if it does not follow through with implementation. However, if an institution ignores the requirements related to staff well-being with the hope it will deflect attention by not having a program, this will only increase its risk of litigation.Reference Kemp and Merkelbach5 This is an outdated and dangerous approach. Consequently, it is incumbent on organizational management to ensure that staff are aware of the risks they are being asked to face, and to define precisely what the organization will do to assist with mitigating the dangers. This is a two-way process. Specifically, corporate staff have a responsibility to adhere to institutional safety and security protocols. There are three ways to ensure that reliable mechanisms are established: (1) relevant safety and security education and training; (2) effective situational awareness guidance pertaining to the specific geographic areas where the staff will reside and operate; and (3) the inclusion of a “check and balance” system to oversee the process.Reference Macpherson and Pafford6
In this vein, the medical community may offer a practical mechanism to create an organizational/individual means to monitor staff preparation for a trip or when establishing a longer-term presence in a complex environment. There is value to an informed consent agreement between the corporation and a staff member. The document will list a series of requirements that the organization has established to address its responsibilities based on “Duty of Care.”Reference Kemp and Merkelbach5 This may include pre-departure Hostile Environment Awareness Training (HEAT),9 briefings regarding the specific area of operations, an overview of relevant medical evacuation insurance, emergency contact numbers for 24-hour assistance, etc. The individual will certify that his or her record of emergency data is correct with updated phone numbers and contact information, a statement that his or her health is sufficient to make the trip, that he or she has completed a specific set of training [if required] and has received briefings as to the environment, etc. The informed consent document should also note that the staff member or student is traveling to a complex environment, is aware of the risks associated with that travel, and agrees to comply with organizational requirements/procedures.8
There is a tendency to look on documents of informed consent with cynicism. Too often we have heard the statement that it exists only “to protect the organization if something goes wrong.” That is part of it, but the absolute value of the text is the requirement for both the institution and the individual to document mutual accountability in preparing for a trip. The supervisor assumes the role of ensuring that standards set by the organization have been met, and accepts a commensurate degree of accountability. The most essential component of all security initiatives is accountability for both the individual and the organization. First and foremost, it requires that both elements accept responsibility for the outcomes expected of them. Informed consent is not a means to preclude litigation. Rather, it helps ensure that both the corporation and the staff understand the complexities of a situation, and agree they have each done all they can to mitigate the risk. In addition to documentation, accountability, and good leadership, there are two more initiatives that have an immediate effect on enhancing the organizational “culture of security.” One is the simple incorporation of a statement of safety and security responsibilities in the job description of the Chief of Party/Country Director and all those who support the programming and operational efforts of the organization. The second, inclusion of “attention to staff safety and security” as part of the individual's annual performance appraisal, is an effective means to draw attention to this critical requirement.8
Discussion
In 2011, the Aid Worker Security Database, a project of humanitarian outcomes, reported 151 violent incidents involving 308 aid workers. One hundred and twenty-seven victims were injured and 86 killed, more than Peacekeepers. An additional 95 were kidnapped. This annual audit calls attention to the ongoing reality of security issues facing the humanitarian community.10 This report has outlined a series of things to do and measures to implement to begin to mitigate these tragedies. However, the key to building a culture of security and the commitment the process takes is to ask oneself, “Do I really want to do this?” Also, this report offers a road map by explaining the standards associated with “Duty of Care” and the consequences for failing to pay attention to it. However, some may read this report and revert to an undocumented thought process that has plagued the humanitarian and development community for years. It is a notion that “we are good people doing good things and the [acceptance model of security, God, our tenure, etc.] will protect us.” There is also an unstated part of that sentence “and, it is cheaper.” Certainly, no organization will admit to this, but it is an unspoken consideration. That thought process will not work anymore.
Many organizations in the humanitarian and development community have created enviable security architectures, thereby heightening industry standards and leaving those lagging behind with little excuse for not keeping up. For example, the NGO Save the Children has a global risk mitigation design that would rival that of small nations. Within this community, many institutions, including colleges and universities, have set the standard for the industry.
An often unspoken concern is cost. There is a continued excuse that the cost for staff safety and security will come from “unrestricted funds” and this will hurt programming. Any senior executive in a university, organization or corporation who is confronted with this statement must recognize the gravity of such a decision and its consequences. Funding for organizational security by the donor communities has advanced significantly in the past six years. Is it a “free ride?” Of course not, but donor funds are available to support staff security. Donors frequently lament that the obstacle to supporting security is not the lack of funds or donor willingness, but that organizations do not program and budget adequately for security in their proposals.Reference Stoddard and Harmer11
Conclusion
There are no easy answers to attending to effective organizational safety and security management. However, it is possible to create a system that, at a minimum, allows staff to reasonably consider the security elements of a deployment, and the measures in place to mitigate risk given the expected tasks to be performed, and ultimately make an informed decision whether or not to proceed. The goal is effective “mitigation.” No one will ever be able to eliminate a threat. However, one can prepare for and have a mechanism in place to respond rather than react when such a critical event occurs…because it will. Too often, it remains that the problem is not in the process, but the culture of the organization.
Creating a culture of safety and security is a matter of organizational leadership. There is no equivocation. Without engaged leadership, security management remains an afterthought at best, and any international organization deploying staff to the field that has yet to develop effective security management lacks visionary leadership. Time and again we are reminded, after another terrible incident where colleagues are killed or seriously injured, the key factor is that the most senior leaders did not have control of the institution's most basic requirement: to mitigate the threat to the staff who represent them in an international forum. The most unsettling part of drafting a report such as this is that all of the systems, templates, documents, and mechanisms for funding exist. Tragically, we still find organizations and universities that devote tertiary attention to critical requirements until they are confronted with the death, injury, kidnap, rape or detention of a staff member, or representative.
