Protests and the politics of protection: In dealing with protesters, companies must uphold the civil rights of the activists while simultaneous protecting property and personnel. (Special Feature).
Armed with cell phones, the climbers began conducting interviews with reporters--some as far away as Australia. Some protesters pulled out sleeping bags and set up a sort of camp under the truck while others hung banners from the container. One protester operated a laptop computer powered by solar panels. The group took digital photos and uploaded them to the Internet, providing real-time coverage of the incident. The press, tipped off by the protesters, were on site with cameras ready.
The incident lasted for several hours. Company officials eventually had to call in the police. In the end, all of the protesters were arrested. But they had achieved their objective--disrupting company business and getting bountiful media attention. Thankfully, in this case, the groups had made their point without causing any significant damage to the company's property or personnel.
This company's experience is familiar to any organization that has faced direct-action protests. Such protests can range from peaceful demonstrations at a company's headquarters to looting to tree spiking--a dangerous sabotaging of logging operations that can result in injury or death to saw mill employees.
In all their guises, direct-action protests are launched by special interest groups such as environmental or animal rights activists. These groups feel that the best way to achieve their goals is to draw attention to the activity they oppose by protesting directly against companies that engage in that activity. Among the frequent targets are logging, oil extraction, medical research, and biotechnology operations. In recent years, protest groups have expanded their reach to include companies that fund such enterprises. For example, investment banking firms have been targeted for funding companies that experiment on animals.
In dealing with direct-action protests, companies must balance several issues. First, in most countries, protesters have a legal right to demonstrate peacefully. A company can take action only when protesters turn violent. Second, protesters are most interested in media attention. This means that whenever protesters congregate, the target company is under unusual scrutiny. Appearing too aggressive can hurt a company's public image and garner sympathy for the protesters.
Companies must protect themselves, however, from protests aimed at them and protests that might spill over from another site. To do this, security must devise a plan to protect property, respect the rights of protesters, and protect the company image. The best plan is for security to adapt crisis management techniques to address protests, train employees to deal with protesters, devise a media plan, and work with law enforcement. Other issues include cybersecurity and legal strategies.
Crisis planning. The first step in dealing with direct-action protests is to develop a crisis management plan designed for such situations. While these plans should include physical security precautions, they should be more heavily weighted toward other issues, such as public relations, due diligence, and employee training.
Physical security. Protecting against protesters can be a challenge because protesters often hit companies in remote areas where physical security is difficult, says David Ray, managing director for Kroll Worldwide. For example, logging operations, oil patches, and agricultural fields are often large and include difficult terrain. "Oil companies can't afford to put a guard on every well site," says Ray.
However, companies can implement physical security plans in other instances, to protect headquarters facilities, for example. According to Ray, most companies develop a three-phase program to deal with such events. Phase one is implemented when protests begin. In this phase, corporate security is put on alert and additional security officers are stationed around the property, but the company maintains relatively normal operations. If tensions increase among protesters and police or if the crowds become loud or unruly, phase two kicks in. In this phase, all exterior doors save one are locked. Also, contingency plans to increase protection of data and property are implemented, and employees are evacuated. Phase three calls for a lockdown of the building and is implemented when violence begins. In this phase, security locks all doors, covers windows with plywood to prevent looting, and works with local police to keep abreast of protester activity.
Many Canadian oil companies implemented such plans for the World Petroleum Congress held in Calgary in 2000. Companies were anxious to update security plans in response to the Seattle protests of the previous year, which resulted in widespread violence and millions of dollars in property damage. However, the Calgary event was peaceful partly because the congress drew crowds of several hundred protesters instead of the thousands anticipated. Police also kept protesters behind a six-foot wall, away from company buildings, for most of the conference.
In devising physical security for protests, companies must resist target hardening as a first step. Though a good plan for deterring thieves, such strong, proactive strategies can incite protesters to violence. One security director noted that his company attempts to let people protest so they don't become frustrated and turn violent. Ray agrees. "There is a push for security officers to refrain from wearing riot gear during protests," he says. Instead of relying on traditional security measures, companies should let public relations take the lead.
Public relations. Most companies know the standard PR preparations that must be part of any crisis plan (designating a key contact, having a place for the press to set up, and training senior management to face the media, for example). A less obvious--even counterintuitive--PR initiative is to welcome "the enemy" with open arms. In other words, rather than stonewalling, management should start a dialogue with protest groups before an incident occurs and should share information about activities the groups oppose.
For example, after the Canadian oil company had its first run-in with protesters, management decided that it would take a different approach when it needed to move its next oil container. Corporate security called the protesters in advance of the move, gave them the route, and invited them to come to a designated site along the route. The protesters were told that they would be given 30 minutes to discuss their concerns with company representatives. Security then called various media outlets and told them of the event. The protesters arrived on time and left quietly after they had aired their grievances.
According to David Colligan, an attorney with Watson, Bennett, Colligan, Johnson, and Schechter, L.L.P. in Buffalo, New York, corporate good will can even defuse a situation before it erupts. In one case, a large environmental activist group planned a protest against a company. Two days before the event, the company's public relations department released several reports documenting all of the actions the company had taken to protect the environment. The reports refuted the protesters' claims. Because of the public relations work, the protest did not materialize.
Due diligence. Another important step companies can take in preparing for and avoiding protests is due diligence, which means researching the profile and tactics of the groups that might target them. For example, one multinational company, which has used its crisis management plan many times in almost all of the 86 countries in which it operates, credits its success in preventing violent protests in part to its understanding of the activist groups that target the organization.
How can a company do its due diligence? Because protesters rely on public awareness to draw crowds, they typically put out a lot of information. Thus, security can easily access information about the group's cause. This helps security know what type of group it is dealing with. For example, the security director of the multinational company just mentioned noted that some groups, such as Greenpeace, are open to dialogue and welcome public debate. These groups are generally more peaceful. Other groups, such as the animal rights organization Stop Huntingdon Animal Cruelty, publicly advocate destruction of property and harassment of company employees as legitimate tactics. These groups are less interested in dialogue and more interested in media attention. The company uses this information to fashion a strategy for each situation. For example, if a group that has been peaceful in the past is planning a small, local demonstration, the site security director will work with local law enforcement to accommodate the protesters and get the company's message across. However, if a more notorious group has planned the same type of demonstration, corporate security would get involved and reinforcements would be dispatched in case of violence.
Corporate security at one oil company says that it surfs the Internet and protesters' Web sites to get more information about upcoming events. Through this type of research, the company found that a group was planning a protest at its Wyoming drill site. The group's Web site gave dates, meeting sites, activities, travel arrangements, and a schedule. This information was critical to the company's response. Security knew approximately how many people to expect, what they were planning to do on site, and how long they would be there.
The company was able to dispatch security officers to protect the equipment and patrol the site before the protesters arrived. The event ended peacefully without law enforcement intervention.
In researching activists, security should be cautious not to target individual groups or leaders. For example, some companies maintain databases on relevant groups and people with information such as home addresses and work information. This tactic is not recommended. According to one security manager, the intent should be to listen to what the group is saying and anticipate future protests, not to harass or intimidate any person or organization.
Employee training. In training employees to deal with protesters, security should remember that remote sites and company facilities are not the only venues protesters exploit. Activists that protest an event can also threaten companies by targeting employees who are traveling to that event. To help protect employees and the company, security should train employees on how to avoid being targeted by protesters and what to do if they are confronted.
For example, one company sent employees to the annual convention of the Biotechnology Industry Association held last June in San Diego. City police anticipated thousands of protesters, so the company identified the employees who were traveling to the event and provided special training. Security reviewed each employee's itinerary and advised them on what back routes they could take to avoid protesters.
Since the convention center used for the convention was attached to several hotels, security advised the employees to stay at other, outlying locations where they would attract less attention. Employees were also advised to note the location of entrances and exits in the convention facility and hotels in case of an evacuation.
Because the company had an office in San Diego, security was able to get timely information from local police and the FBI. This information, which included the protesters' plans, concerns, and past actions, was passed on to employees.
Though the company usually urged employees to wear clothing with the company logo, such actions were discouraged for those attending the event. Similarly, employees were warned not to carry computer bags, luggage, or any other item that sported a company logo.
Employees were also taught how to respond if confronted by protesters. Security told employees not to talk to the groups because that could provide a photo opportunity for the activists or the local media.
Instead, employees were advised to be polite and, if possible, defer questions to a designated person at corporate headquarters. Staff were also given a short statement to memorize and were trained to recite it only if absolutely necessary.
For the most part, the employees did not need to put their training into action. The roughly 750 activists who attended the meeting protested peacefully. However, security's briefings and information on alternate routes helped employees avoid trouble spots and delays due to police activity around the convention center.
Legal issues. Some companies take legal action against protesters. This strategy can work in some cases, but it can also backfire by giving protesters media attention. Some of the legal remedies available in the United States and Canada are arrests and restraining orders. Companies should also be aware of local laws in case they face lawsuits from protesters. Laws in countries other than the United States and Canada, such as the United Kingdom, are similar but public sentiment can make legal remedies difficult.
Arrests. In the United States and Canada, companies can have protesters arrested if they chain themselves to equipment, otherwise prevent the company from doing business, or trespass on company property. Though companies have traditionally requested that only the chained protesters or their leaders be arrested, some businesses are starting to take a harder line. For example, according to Ray, a Canadian oil company faced with a group of protesters had the entire group arrested. The members of the group were from various countries. Since the foreign activists now had an arrest record in Canada, they were deported and barred from returning.
However, law enforcement methods do not work in every situation. In some cases, arrests can provide negative press for the company. Colligan, who specializes in forestry law, warns his clients not to arrest protesters except in egregious cases. He adds that strong perimeter control is a better tool than arrest warrants. "Once protesters are on a property, their main goal is a high-profile removal," says Colligan. "An arrest provides them with that media attention."
With this in mind, Colligan says that companies should consider forgiving minor trespass offenses as a show of corporate good will. Forestry companies, for example, should consider arrest only in cases of physical danger to company employees, such as in tree spiking, or to protesters, such as tree sitting-- where protesters camp out in treetops during logging or clearing operations.
Sound policies. According to Colligan, sound environmental policies should be part of a company's legal strategy. Companies involved in forestry, for example, should develop an ecologically sensitive forest management plan and put it in writing. This policy can be used as a trump card both legally and with the media. In some cases, protest groups have filed for information releases in an attempt to prove that the company has damaged the environment. Instead of fighting this request in court, which only creates had publicity, the companies can simply hand over their plan complete with sound ecological programs, environmental protection, and concern for endangered species. Of course, the company must be following the plan, not just using it as a PR ploy.
Restraining orders. When issuing restraining orders against protesters, some companies work with police to try to deter activists. For example, according to Ray, one oil company was plagued by protesters who chained themselves to drilling equipment and disrupted operations. The protesters were arrested and served with a restraining order. The company worked with police to ensure that the order prohibited the protesters from coming within 500 feet of company property. One of the protesters was arrested at the World Petroleum Conference when he came too close to the company's building.
Local laws. To legally protect against protesters, companies should work with counsel in considering all of the relevant laws of that jurisdiction. For example, according to Colligan, perimeter security laws relating to posting, fencing, road barriers, and security checkpoints vary from state to state within the United States.
Statutes can also help protect a company from lawsuits filed by protesters. For example, in New York, protesters caught on company property often claim that they were hiking. In response, legislators have enacted a law that forgives the company if a protester is injured while "hiking" on company property. According to Colligan, this means that barring aggressive action meant to harm a protester, such as spring guns or bear traps, companies are protected from liability suits in these cases.
Also, some state laws provide for protesters who trespass to be assessed a special fine if they damage company property. For example, the fine for trespassing in New York is $25, but if a protester trespasses and spikes trees, the company can seek damages of three times the value of the trees.
Companies should not, however, try to deter protesters through excessive legal actions. Such litigation can be considered Strategic Lawsuits Against Public Participation (SLAPP). Enacted in many states and in similar form by some foreign countries, SLAPP protection can be invoked in countersuits against companies. For example, protesters in California who were arrested and charged with criminal trespass have sued the company, claiming that the trespass suits were designed to silence the criticisms of the activists.
Companies that operate internationally must also be aware of laws in host countries. For example, in the United Kingdom, where direct-action protests are frequent, companies have both civil and criminal recourse. However, public sentiment may affect the outcome of any court case.
According to Andrew Copley, an attorney with Mayer, Brown, Rowe and Maw in London, companies can file criminal charges against individual protesters who destroy property. However, Copley notes that such action does not stop other people from carrying out the same actions, nor does it provide any monetary relief for the company. Civil actions can also be pursued. Injunctions, which are similar to restraining orders, can prevent certain individuals or groups from coming onto company property.
An issue in the United Kingdom, however, in both criminal and civil cases is that courts have been reluctant to sentence protesters for their criminal activities. For example, four people who had violated an injunction against the destruction of crops were found in contempt of the injunction in 1999, but all were given suspended sentences. Most recently, in 2001, more than 10 people were exonerated by U.K. courts on various trespass and criminal damage charges.
The U.K. government is currently considering measures to make direct-action protests more difficult, according to Copley. One such measure would keep names of individual company officers from being listed in government registries if the officers can show that protesters have demonstrated that they pose a risk to the person or the company.
Working with law enforcement. At major events, such as international conferences, government will take the lead and work with various private companies to coordinate security. In such cases, police often establish a special squad to liaison with private security.
During the World Petroleum Congress, for example, police worked with private companies to coordinate protection efforts. The partnership was successful and produced some surprising results. In one instance, a company trained a Web cam on one of the major routes leading to the conference. It then gave other companies on the street access to the camera feed through a Web site. All of the businesses, as well as the police, could watch in real time as protesters came down the street.
When protests are targeting a particular company rather than a major event, government is less likely to get involved, but the company can still reach out to local law enforcement officials to coordinate security. Some companies share information about protesters with the police to keep them abreast of anticipated events and to apprise them of concerns, if security suspects that the company is becoming more of a target for a particular group, local law enforcement officials should be notified. One company interviewed said that it usually doesn't invite law enforcement to attend protests that it knows about in advance, but it does inform police. The company also works with law enforcement on a regular basis to reinforce the company's preference--that police enforce the law but otherwise keep a low profile.
Cybersecurity. With information-savvy members in their ranks, direct-action groups have taken their protests into cyberspace. Hacking incidents are rare, but protesters have launched distributed denial of service (DDoS) attacks and parody sites of target companies.
DDoS. According to Scott Blake, vice president of information security for Bind View of Houston, DDoS attacks are the electronic equivalent of picketing. Such requests tie up server space and prevent legitimate traffic from flowing to a Web site. These attacks are often staged in conjunction with live protests. For example, during the World Trade Organization (WTO) conference in Seattle in 1999, one group of protesters also launched a simultaneous DDoS attack on the WTO's Web site.
Some protest Web sites offer software that users can download to launch a DDoS attack. The user downloads the software, and at the appointed date and time of the protest, all users simultaneously launch the software against the target site.
DDoS attacks are extremely difficult to prevent, says Blake. But some companies have addressed the problem by increasing bandwidth to the point that a DDoS attack has no effect. For example, one company that operates a commercial Web site purchased multiple [OC.sub.3] lines--each of which can handle a gigabit per second of information--so that even a large DDoS attack does not disrupt the site. However, this is not a cheap solution. According to Blake, a single [OC.sub.3] line can cost a company more than $20,000 per month.
If a large e-commerce site brings in $1 million a day, this cost would be acceptable, notes Blake, because a shutdown of several hours could cost the company $100,000 in sales. And this figure doesn't measure the intangible cost of people who don't come back or who avoid e-commerce because of a bad experience. For some companies, however, the solution would cost more than the problem. For example, more bandwidth would not be suitable for sites that are purely informational.
According to Blake, other remedies, such as firewalls, are not as successful against protest DDoS attacks because such attacks are often launched by multiple users, meaning that the incoming messages could not be blocked. Also, while some software programs are available to help prevent DDoS attacks, these programs often succeed only in further challenging protesters to defeat the program rather than in stopping the attacks, says Blake.
In an attack similar to DDoS, some groups use company Web sites to find employee e-mail addresses. The protesters then spam the addresses with protest messages. To solve this problem, some companies have removed individual e-mail addresses from Web sites and replaced them with general information addresses. Blocking e-mail from certain sources is also a possible solution, but that option may not be effective if the company can't predict where the attack e-mails would come from.
Parody sites. Protest groups often parody the sites of target companies. For example, at the WTO parody site, the headers, logo, and organization of the site are similar to the real WTO site but the information is sarcastic and highlights the perceived damage done by the WTO in developing countries.
Other sites are openly critical of a specific company. For example, protesters set up a phantom Web site for an oil company, making the URL the company name with an additional "e" on the end. The site contained disparaging remarks about and accusations against the company. The company aggressively investigated the incident and intended to sue the owner for slander. However, the investigation proved to be costly, and in the end the company could not prove who authored the site. Eventually, the site was taken down.
Direct-action protests present security professionals with a unique challenge. Many tools that work against crime, such as target hardening, are ineffective against protesters. But security can take a politic approach by planning for protests, working with the media, protecting electronic information, and keeping abreast of relevant legal remedies.
Teresa Anderson is a senior editor at Security Management.
Keeping Problems at Bay in Qatar
When U.S. government officials began planning the World Trade Organization (WTO) conference to be held in November 2001, they were faced with several challenges. The terrorist attacks of the previous September were fresh in the minds of all concerned. The location, the small Persian Gulf country of Qatar, had difficulty with local terrorists even before the September attacks. And the two previous WTO conferences, held in Seattle and Genoa, Italy, had seen violent attacks by and against protesters.
Douglas Melvin, director of security and administrative services for the White House Office of the U.S. Trade Representative, had all of these issues in mind when he began security preparations for the WTO's Qatar conference. Melvin's challenge in organizing the conference was ensuring that the representatives from 124 countries were protected and relatively undisturbed during the five-day event. Melvin conducted a thorough pre-event visit, garnered the necessary resources, and gained the cooperation of private industry, which included more than 40 private U.S. companies.
Pre-event visit. During the visit, which occurred more than three months before the conference, Melvin established necessary law enforcement contacts, scouted hotels, reviewed transportation plans, and checked for real or perceived threats. This visit highlighted some problems and allowed Melvin to dismiss others.
For example, when just looking at a map of the country, Melvin was concerned about the country's long coastline. Because many hotels were located along this shore, Melvin felt that protecting it would be difficult and would require significant manpower. However, when he saw this littoral region, Melvin found that rugged rock outcroppings prevented access to the coast in all but four places. These four spots could easily be protected.
Geography posed a problem, however, for the communications system. Melvin had anticipated that a standard, wireless communications system would be sufficient. When he visited the country, Melvin found that the desert environment and natural formations adversely affected the communications equipment. To address this problem, more equipment was brought in to the area and was placed strategically to circumvent these formations.
Transportation issues also surfaced during the visit. Even before going on site, Melvin knew that using public transportation to shuttle delegates and representatives was out of the question for security reasons. Once at the location, he learned that hired vehicles would also be difficult to manage.
In Qatar, all vehicles are rented for 24-hour periods. However, each vehicle comes with only one driver. Consequently, if that car is needed in the middle of the night, it will not be available because the driver will be sleeping. During the conference, therefore, vehicles would need to be rented in shifts and, if a car was to be used at night, prior negotiations with the driver would be necessary.
The on-site visit also gave Melvin a chance to get critical information about local laws and practices. For instance, the movement and habits of women are limited. As a result, when staffing the security force, Melvin was careful not to put women in a position where they would have to rely on a man to get help. For example, he was careful not to put a woman in charge of screening baggage at a hotel where her only contact would be a local male manager. Instead, Melvin put women in more covert positions where they could work directly with other U.S. personnel.
Resources. After returning from the site visit, Melvin began allocating resources based on his information. "First, we made a laundry list of things that could go wrong-- protests, violence, terrorism. Then we compared the threats to resources that were available," says Melvin.
For the most part, this allocation process focused on logistics. For example, the communications system, staffing, and transportation plans were all solidified after the site visit.
Issues relating to the Qatar police were more difficult. In Qatar, the local police pride themselves on their abilities, but Melvin knew that the force was not large enough or experienced enough to handle the conference. To protect delegates and let local police stay in charge, Melvin arranged to put only local police out front, but to provide them with significant backup. In same cases, Qatar police were trained to do tasks that U.S. government forces would normally take on.
Some issues required Melvin to arrange for covert reinforcements, however. For example, the Qatar officials wanted to have their own bomb-sniffing dogs clear rooms before the WTO ministers entered. Melvin arranged for U.S. officers to walk discreetly behind the dogs and check the air with hand-held particle detectors. The local press concentrated on the dogs, and Melvin felt more confident in his ability to ensure that no explosives were present.
Cooperation. A critical part of the process was building a coalition with industry, government agencies, and other foreign nations. Part of this process was communicating the threat information. Because of recent events, Melvin decided to share classified information with everyone who needed it. This prompted several meetings with private industry to ensure that each company understood its particular roles and responsibilities.
In the briefings, Melvin discussed every potential contingency, from peaceful protesting to violent attacks. In return, private companies told the government about the medical conditions of the employees going to the conference, and arrangements were made so that those employees could receive reliable help in the event of a health emergency.
In the meetings, companies also offered information about the region. For example, one company that had worked in Qatar warned Melvin that supplies are difficult to obtain quickly even if they are available in the country. Based on this information, Melvin arranged to take backup supplies for everything, even if the items were available locally.
Another company had run into trouble with local drivers from vehicle firms. Even though they had been vetted by local police, some of the drivers had criminal histories. Melvin ordered U.S. officials to conduct additional checks on the drivers and found that some had to be let go because of past criminal acts.
Companies also voiced their concerns. For example, some companies had concerns about ships passing close to the hotel. With the terrorist threat high, some were worried about a situation similar to that of the U.S.S. Cole. This threat was compounded by the fact that Qatar has no national coast guard. Though Melvin had already arranged for security on the coast, he worked with local officials to have a patrol ship keep other vessels a safe distance from the hotel.
The conference was successful, but officials had to deal with several incidents. Peaceful protesters were in evidence, as were some more violent activists. Some protesters threw small items at the ministers. However, local police had set up a barricade that kept the protesters at a safe distance from attendees.
In a more dramatic incident, the plane carrying the American representatives was an hour outside of Qatar when officials responded to a report of terrorist activity at a U.S. facility near the airport. A shootout ensued, and the terrorist was killed by guards.
Melvin had to decide whether to let the plane land. "After reviewing the situation, we felt we were prepared and that our security plan would be able to meet any threat," says Melvin. The plane landed, and delegates were taken to their hotels without incident.