Here is a nice little article concerning a vulnerability for laptops operating with Microsoft operating systems (as if there are all that many laptops not using windows). However the news is not bleak, and for those of you that know me personally, I've been talking about the countermeasures for a long time anyway. But here's the problem...
I don't know why everyone with a wireless enabled laptop doesn't have a firewall or routinely disable the wireless antenna. These two simple countermeasures are useful for other important reasons. First, disabling the antenna will help conserve battery life. Oh, you say you're plugged in so battery life isn't an issue. So what! Why would you have the antenna turned on if you don't need to? It's sort of like leaving a door open to your house - why do it if you really don't need to. And the firewall is like a screen door on the house. It lets you know when people are trying to get in and lets the legitimate "air" through. It's not foolproof but it's a very nice tool. Firewalls now have gotten more user friendly and are pretty lightweight in terms of consuming system resources. Granted with the antenna turned off you really don't need an active firewall, but it's not that big a deal to leave it up.
The author of the article notes that his firewall had to be disabled for the vulnerability to be properly exploited. So keep the firewall up and pay attention to any notifications that the firewall might provide for attempts at accessing your system. So just turn off the antenna if you don't need it and use a firewall. There's one bundled with the Microsoft operating system and there are free applications available on the web. You may not need a "big honkin'" firewall, just one that restricts access effectively.
Rob
/
Tuesday, January 17, 2006
Wednesday, January 11, 2006
Managing vandalism - Part II (The Response)
Let's continue on and briefly discuss responding to vandalism and managing the successful attack. Once again, this has been spurred by this recent article about events near my home revisits just how hard it can be to prevent and manage vandalism.
Once a vandal, or vandals, have successfully attacked your facility what do you do? How long will it be before it is discovered and reported? What will the police want to do and how long will it take?
First make sure that you conduct some sort of liaison with your community police officer (by whatever name this position goes by in your local department) and learn how they will respond along with a "scientifically estimated wild guess" about how long their process will take to process the crime scene. Why? Because you want the greatest amount of time to reverse the efforts of the vandal before the general public gets a glimpse. Why? Because this has two effects: one it negates the effort of the bad guy and is a symbol of defiance, and two it helps to prevent any negative press that may come from the attack. What I mean by that is the willingness of the media - and this is not an attack on their activities - to begin digging and reporting on hate groups; and possibly giving them "face time" or printing their views. Why should your loss contribute to the publicity of those that work to destroy your organization.
With that said a quick step back to the previous post... You should create the opportunity to, if not prevent the attack, identify it as early as possible - so maybe patrols every two or three hours after nightfall. This might provide a large enough window to eliminate the value of the attack. This may further work as a deterrent to future efforts because they just didn't get anything out of their efforts - which may be referred to as a "benefit denial" strategy.
But let's assume that the attack has been discovered and the police notified. What should you do? First secure the scene. Keep everyone away from anything that may have value, like footprints, trash in trash cans, tire tracks, glass shards, and so on. It's perfectly acceptable, and in my opinion essential, to begin taking pictures now and keep taking them until the clean up it complete. This is useful for insurance purposes and for documenting the effort necessary to clean up the attack. Some of these may be useful when giving presentations to the local government and petition for better policing (manpower increases, enhanced patrols, etc.) or in developing anti-hate programs. You just can't go wrong with the pictures. I'd also encourage anyone to treat these like evidence and control the camera, any picture or film processing, and the pictures themselves. Also keep the rolls of film "clean" or don't mix pictures of none related activities with the attack.
Now that the police are gone you have to get rid of the mess. The purpose of this is to reduce the value that the attacker's efforts, not because of shame or other internal concerns. This is important to communicate to your members. You must not be ashamed - you did not commit the attack, you did not ask to have it committed. Cleaning up becomes an act of defiance. It is an act that is imminently more efficient if you have materials on-hand. Keep paint, sanders and sandpaper, boards for windows, tools, and the like availabe in moderate supply. More can be obtained on relatively short notice, but you should have enough to get started.
Determine in advance how you will respond to media inquiries for vandalism, then tailor your plan accordingly. Do you denounce the action, express forgiveness, seek punishment... Decide in advance when the emotions are not quite as strong. This first message after an attack may be crucial to how your congregation is portrayed in the media and in the community.
Just one last word... The goal is to prevent and not respond, but make sure that your response is planned in advance. Emotions can cause kneejerk reactions that are more detrimental than helpful, so plan your response and respond with your plan.
Rob
/
Once a vandal, or vandals, have successfully attacked your facility what do you do? How long will it be before it is discovered and reported? What will the police want to do and how long will it take?
First make sure that you conduct some sort of liaison with your community police officer (by whatever name this position goes by in your local department) and learn how they will respond along with a "scientifically estimated wild guess" about how long their process will take to process the crime scene. Why? Because you want the greatest amount of time to reverse the efforts of the vandal before the general public gets a glimpse. Why? Because this has two effects: one it negates the effort of the bad guy and is a symbol of defiance, and two it helps to prevent any negative press that may come from the attack. What I mean by that is the willingness of the media - and this is not an attack on their activities - to begin digging and reporting on hate groups; and possibly giving them "face time" or printing their views. Why should your loss contribute to the publicity of those that work to destroy your organization.
With that said a quick step back to the previous post... You should create the opportunity to, if not prevent the attack, identify it as early as possible - so maybe patrols every two or three hours after nightfall. This might provide a large enough window to eliminate the value of the attack. This may further work as a deterrent to future efforts because they just didn't get anything out of their efforts - which may be referred to as a "benefit denial" strategy.
But let's assume that the attack has been discovered and the police notified. What should you do? First secure the scene. Keep everyone away from anything that may have value, like footprints, trash in trash cans, tire tracks, glass shards, and so on. It's perfectly acceptable, and in my opinion essential, to begin taking pictures now and keep taking them until the clean up it complete. This is useful for insurance purposes and for documenting the effort necessary to clean up the attack. Some of these may be useful when giving presentations to the local government and petition for better policing (manpower increases, enhanced patrols, etc.) or in developing anti-hate programs. You just can't go wrong with the pictures. I'd also encourage anyone to treat these like evidence and control the camera, any picture or film processing, and the pictures themselves. Also keep the rolls of film "clean" or don't mix pictures of none related activities with the attack.
Now that the police are gone you have to get rid of the mess. The purpose of this is to reduce the value that the attacker's efforts, not because of shame or other internal concerns. This is important to communicate to your members. You must not be ashamed - you did not commit the attack, you did not ask to have it committed. Cleaning up becomes an act of defiance. It is an act that is imminently more efficient if you have materials on-hand. Keep paint, sanders and sandpaper, boards for windows, tools, and the like availabe in moderate supply. More can be obtained on relatively short notice, but you should have enough to get started.
Determine in advance how you will respond to media inquiries for vandalism, then tailor your plan accordingly. Do you denounce the action, express forgiveness, seek punishment... Decide in advance when the emotions are not quite as strong. This first message after an attack may be crucial to how your congregation is portrayed in the media and in the community.
Just one last word... The goal is to prevent and not respond, but make sure that your response is planned in advance. Emotions can cause kneejerk reactions that are more detrimental than helpful, so plan your response and respond with your plan.
Rob
/
Managing vandalism - Part I
This recent article about events near my home revisits just how hard it can be to prevent and manage vandalism. Although the article gives no details of the attack, we really don't need to know those to discuss the difficulties with managing the potential, or continuing, threat of vandalism at any House of Worship. To better cover this topic we'll look at if from a couple of different perspectives including environmental knowledge, specific preventive and mitigative efforts, and finally the response.
We'll start a little out of order with preventing and mitigating these attacks...
Designing a plan to manage vandalism revolves around a couple of key points that rely on specific behavioral assumptions. First there must be some degree of privacy for the attackers to feel comfortable; that is comfortable that they will not be discovered, observed or caught. If they attackers do not fear discovery or capture then the entire dynamic of the management efforts must be altered. Second, there is an assumption that someone will see the fruit of the vandal's efforts. This is the psychological part of the attack. The physical damage to the facility may be annoying and expensive, but it is the specific nature of any messages left behind that causes the greatest impact.
With this in mind the greatest way to avoid much the impact is to prevent the successful completion of the attack. There may even be ways to thwart the manifestation of the threat, but we'll discuss that later in the environmental knowledge piece. Preventing a vandalism requires an effort to increase the likelihood, as well as the perception, that a vandal will be discovered and caught. This may be done a number of different ways given an ideal location with ideal conditions and we all know that each location has its own quirks and needs. As such, discovery and apprehension requires successful surveillance efforts that may be either natural or electronic. That means changing traffic patterns to ensure there is a steady flow of people that can observe activity in a specific place. I know this sounds a little silly when dealing with late night crime - even the most well illuminated locations could still be attacked simply because no one is there to see the attack. Furthermore there is an underlying assumption that those providing the natural surveillance will act on their observations - in other words that they'll care about what they are seeing. These shortcomings can be countered using electronic surveillance technologies, particularly at night or during low traffic times, and these have really come a long way in the last decade with some that are ideally suited for dealing with vandalism.
Let me preface this bit by saying that I generally discourage the purchase of equipment as a "point solution" because the cost can become onerous for any one issue, but in this case the solution has many applications besides crime loss management. Remote video monitoring. It used to be that you installed an alarm system and when it activated the police were dispatched by a central alarm monitoring station - time passed the the attack was completed - making this not much of a preventive tool. Now consider this current technology solution. The attacker approaches a "restricted" area, that may be defined as the area immediately surrounding the building, which causes a camera to become active a central monitoring station. The watch officer at the station seeing the attackers and activates a two-way intercom and reads a script that has been coordinated with the property owners. It may be something like:
"Attention! You are trespassing on private land. Your activity is being recorded and observed by live personnel. The police have been notified and are responding. Please depart immediately."
It has an amazing effect and has been used successfully at locations around the country in a variety of applications. The benefits are immense because an organization reduces the likelihood of a false alarm, which are getting expensive, and also receives the immediate interaction with the attacker. Not to mention that these systems may be tied into pretty much any alarm sensor like fire, flood, or medical assistance. Now I must admit I'm a little partial to this technology because I wrote a short paper on it while finishing my degree and it was still considered an "emerging" technology, but with that said it has real applications for this scenario. Imagine the vandal, or vandals since there is a degree of vanity and group think involved, being confronted as they prepare to committ mayhem. They just be stopped; at least stopped long enough to think about what they are about to do and the potential consequences. Besides the monetary benefit of preventing any damage, there is a real spiritual value to guiding someone away from wrongdoing rather than simply punishing them, right? Changing a thought rather than forgiving an act.
Ok, so we have natural surveillance and electronic surveillance and each can be reached differenct ways - far too numerous to cover here effectively. However, we neglected the value and method of increasing natural surveillance earlier. Natural surveillance often has the primary benefit lower cost. Let's face it, people moving around normally is, well, free. It does unfortunately breakdown when traffic is reduced. So how then can traffic be increased? Maybe by using the facility as much as possible for community events, although let me caution briefly that this creates other potential loss opportunities; or possibly security patrols can be added. This could be from a formal security service or by dedicated congregation members that will take time to check on the facility. It may also be possible to use the camera systems mentioned above on a private website with access available to congregation members. Possibly a "patrol" schedule could be created with specific members agreeing to keep an eye it. Like I said, once we get creative there just isn't enough room here for the options.
There is, at least, one other bit of technology to assit in preventing vandalism and that's vandalism resistant paint. This tool works to prevent other paints from bonding to the material permenantly. One word of caution is that the cost for materials could be as much 10x that of ordinary paint.
Here's a short article in Religious Product News on technology trends in security.
We'll start a little out of order with preventing and mitigating these attacks...
Designing a plan to manage vandalism revolves around a couple of key points that rely on specific behavioral assumptions. First there must be some degree of privacy for the attackers to feel comfortable; that is comfortable that they will not be discovered, observed or caught. If they attackers do not fear discovery or capture then the entire dynamic of the management efforts must be altered. Second, there is an assumption that someone will see the fruit of the vandal's efforts. This is the psychological part of the attack. The physical damage to the facility may be annoying and expensive, but it is the specific nature of any messages left behind that causes the greatest impact.
With this in mind the greatest way to avoid much the impact is to prevent the successful completion of the attack. There may even be ways to thwart the manifestation of the threat, but we'll discuss that later in the environmental knowledge piece. Preventing a vandalism requires an effort to increase the likelihood, as well as the perception, that a vandal will be discovered and caught. This may be done a number of different ways given an ideal location with ideal conditions and we all know that each location has its own quirks and needs. As such, discovery and apprehension requires successful surveillance efforts that may be either natural or electronic. That means changing traffic patterns to ensure there is a steady flow of people that can observe activity in a specific place. I know this sounds a little silly when dealing with late night crime - even the most well illuminated locations could still be attacked simply because no one is there to see the attack. Furthermore there is an underlying assumption that those providing the natural surveillance will act on their observations - in other words that they'll care about what they are seeing. These shortcomings can be countered using electronic surveillance technologies, particularly at night or during low traffic times, and these have really come a long way in the last decade with some that are ideally suited for dealing with vandalism.
Let me preface this bit by saying that I generally discourage the purchase of equipment as a "point solution" because the cost can become onerous for any one issue, but in this case the solution has many applications besides crime loss management. Remote video monitoring. It used to be that you installed an alarm system and when it activated the police were dispatched by a central alarm monitoring station - time passed the the attack was completed - making this not much of a preventive tool. Now consider this current technology solution. The attacker approaches a "restricted" area, that may be defined as the area immediately surrounding the building, which causes a camera to become active a central monitoring station. The watch officer at the station seeing the attackers and activates a two-way intercom and reads a script that has been coordinated with the property owners. It may be something like:
"Attention! You are trespassing on private land. Your activity is being recorded and observed by live personnel. The police have been notified and are responding. Please depart immediately."
It has an amazing effect and has been used successfully at locations around the country in a variety of applications. The benefits are immense because an organization reduces the likelihood of a false alarm, which are getting expensive, and also receives the immediate interaction with the attacker. Not to mention that these systems may be tied into pretty much any alarm sensor like fire, flood, or medical assistance. Now I must admit I'm a little partial to this technology because I wrote a short paper on it while finishing my degree and it was still considered an "emerging" technology, but with that said it has real applications for this scenario. Imagine the vandal, or vandals since there is a degree of vanity and group think involved, being confronted as they prepare to committ mayhem. They just be stopped; at least stopped long enough to think about what they are about to do and the potential consequences. Besides the monetary benefit of preventing any damage, there is a real spiritual value to guiding someone away from wrongdoing rather than simply punishing them, right? Changing a thought rather than forgiving an act.
Ok, so we have natural surveillance and electronic surveillance and each can be reached differenct ways - far too numerous to cover here effectively. However, we neglected the value and method of increasing natural surveillance earlier. Natural surveillance often has the primary benefit lower cost. Let's face it, people moving around normally is, well, free. It does unfortunately breakdown when traffic is reduced. So how then can traffic be increased? Maybe by using the facility as much as possible for community events, although let me caution briefly that this creates other potential loss opportunities; or possibly security patrols can be added. This could be from a formal security service or by dedicated congregation members that will take time to check on the facility. It may also be possible to use the camera systems mentioned above on a private website with access available to congregation members. Possibly a "patrol" schedule could be created with specific members agreeing to keep an eye it. Like I said, once we get creative there just isn't enough room here for the options.
There is, at least, one other bit of technology to assit in preventing vandalism and that's vandalism resistant paint. This tool works to prevent other paints from bonding to the material permenantly. One word of caution is that the cost for materials could be as much 10x that of ordinary paint.
Here's a short article in Religious Product News on technology trends in security.
Monday, January 9, 2006
ELF exists!!!
There have been a series of articles, like this one, along the lines that the ELF (Earth Liberation Front) either does not exist or does not have members. This is an interesting argument that is being propagated for reasons I do not know, but the recent focus on ELF and ALF is the result of two events: the recent arrests of those accused of several arsons in the name of ELF and the FOIA document releases indicating that the FBI monitored such groups as PeTA.
First let's get the minutia out of the way...
The FBI was monitoring groups like PeTA for any number of reasons, but the best one that I can think of are the contributions PeTA made to Rod Coronado's criminal defense of roughly $70,000 so he could fight charges of arson that he eventualy plead guilty to and PeTA's contribution to the Earth Liberation Front which was stated to be for publicity. These funds were likely used just for that but it still creates enough suspicion for a little monitoring. Both of these groups, the ELF and the ALF, are considered to be terrorist organizations because they espouse the destruction of property in furtherance of their cause... And there are many arguments that they make about this being non-violence because humans are not targeted, but that is neither here nor there right now.
The problem here is the concern as to whether a person can be charged, implicated or considered a member of an organization that admittedly does not have "true" members. Anyone can claim to act on the organization's behalf as long as they abide by their rules - which can be easily found of the web. But let's attack this from another direction... There are "prisoner" support networks for both the ALF and the ELF. The North American Animal Liberation Front Support Group provides information about arrested activists and directions for making donations or sending care packages. Now if there is no organization with no members then who are these people that need support?
This point was make clear when one of the recent defendents requested that his information be removed from the support group website. This is presumably to make it harder to convince a jury that he a member of a terrorist organization rather than a lone arsonist with an ax to grind. Fine lines that could mean years difference in a sentence.
In other words, as long as an organization exists, in name or form, that encourages actions that target another they are a threat and should be treated appropriately.
With that said, keep in mind this is not some vast organization of shadowy activist but much more likely very very small handfuls of individuals getting a little worked up. Security programs should stay informed and stay focused rather than taking "knee-jerk" actions that cost unnecessary funds and damage the credibilty of the security team. Work with the local law enforcement, collect your own intel and make some sound judgements - or find someone more capable to assist you.
Rob
/
First let's get the minutia out of the way...
The FBI was monitoring groups like PeTA for any number of reasons, but the best one that I can think of are the contributions PeTA made to Rod Coronado's criminal defense of roughly $70,000 so he could fight charges of arson that he eventualy plead guilty to and PeTA's contribution to the Earth Liberation Front which was stated to be for publicity. These funds were likely used just for that but it still creates enough suspicion for a little monitoring. Both of these groups, the ELF and the ALF, are considered to be terrorist organizations because they espouse the destruction of property in furtherance of their cause... And there are many arguments that they make about this being non-violence because humans are not targeted, but that is neither here nor there right now.
The problem here is the concern as to whether a person can be charged, implicated or considered a member of an organization that admittedly does not have "true" members. Anyone can claim to act on the organization's behalf as long as they abide by their rules - which can be easily found of the web. But let's attack this from another direction... There are "prisoner" support networks for both the ALF and the ELF. The North American Animal Liberation Front Support Group provides information about arrested activists and directions for making donations or sending care packages. Now if there is no organization with no members then who are these people that need support?
This point was make clear when one of the recent defendents requested that his information be removed from the support group website. This is presumably to make it harder to convince a jury that he a member of a terrorist organization rather than a lone arsonist with an ax to grind. Fine lines that could mean years difference in a sentence.
In other words, as long as an organization exists, in name or form, that encourages actions that target another they are a threat and should be treated appropriately.
With that said, keep in mind this is not some vast organization of shadowy activist but much more likely very very small handfuls of individuals getting a little worked up. Security programs should stay informed and stay focused rather than taking "knee-jerk" actions that cost unnecessary funds and damage the credibilty of the security team. Work with the local law enforcement, collect your own intel and make some sound judgements - or find someone more capable to assist you.
Rob
/
Monday, December 5, 2005
So you want to be an investigator
Seen some old reruns of Magnum PI or VIP and suddenly being an investigator seems like a great career. Well it can be, but not for any reason that may be found in these TV shows. Investigations - private or public - tend to be a lot of legwork, thinking, talking, and most of all listening.
There are all kinds of investigations and investigators. On the public side are those in law enforcement, inspector generals, background investigators, and the like. Out in the world of private employment there are many different types of investigators; however each of these various jobs require nearly identical skills. So how does one become an investigator and how do they become an exceptional investigator?
For the most part, it really doesn't matter whether you are investigating a theft, an arson, or someone's background because the foundation skills are pretty much the same.
Think of it this way: An investigator is responsible for telling a story, as factually as possible. According to Sennewald there are two kinds of investigations. One attempts to reconstruct an event and explain it factually and the other attempts to uncover illegal activity. Clearly the first one is purely reactive; a homocide is committed and it is investigated. The second may be somewhat reactive but it may also be proactive; much like the efforts of Anti-crime police units or integrity shops in retail environments. So that's the big picture, but what kinds of skills does it take?
A good memory, notetaking skills, strong observation skills, and reasoning abilities (deductive and inductive). Inductive reasoning? Well it's the opposite of deductive reasoning. Deductive reasoning is often explained as the moving from the general to the specific. Inductive would be from the specific to the general. For a few examples to better describe this go here, here, here, and here.
How do you get these skills? There are many ways. Clearly the best known way is probably to work for the government and attend an academy - local or state police, FLETC, or the FBI Academy. However it is also possible to get there other ways, especially if you have no interest in being a police officer. Some companies offer training - formal or on-the-job - and some states require specific training before allowing licensing as a private investigator. But if you just want to drive yourself to being better - that is always striving to keep the edge sharp - there are training programs available.
Quite possibly the most important skill of an investigator is the interview, either the informational or the admission-seeking interview. The Reid technique is taught by Reid Associates and Wicklander-Zewlawski, and Wicklander is quite likely the standard for retail interviews. I am, however, biased since that's where I learned to interview (special thanks to Shane Sturman whose advice and guidance over those two days were invaluable). There are other methods and there are a large number of books available on the topic. Investing time in these books - and lots of practice - will pay off.
There are other helpful programs. You know I'll mention those by the IFPO. They offer the Certified Protection Officer, Security Supervision and Management, and a new program - Crime and Loss Investigations. There are other programs out there and it never hurts to do a little, dare I say, investigation to help you get what you need. There are also many books on the general topic of investigations such as Chuck Sennewald's The Process of Investigation and Dempsey's Introduction to Investigations.
You can also begin to build your skills by seeking employment (part-time can be as helpful as full-time) with private investigators, retail security departments, forensic accounting firms, or even investigative reporters.
The key to investigations is knowing what the "standards of evidence" are for whatever you are looking into at that time. The government has rules for what information is needed to "prove" a crime, and companies have rules as to what is acceptable for disciplinary actions. Know what information you need. Just keep these three questions in mind: What do we know? What don't we know? What do we need to know?
More later..
There are all kinds of investigations and investigators. On the public side are those in law enforcement, inspector generals, background investigators, and the like. Out in the world of private employment there are many different types of investigators; however each of these various jobs require nearly identical skills. So how does one become an investigator and how do they become an exceptional investigator?
For the most part, it really doesn't matter whether you are investigating a theft, an arson, or someone's background because the foundation skills are pretty much the same.
Think of it this way: An investigator is responsible for telling a story, as factually as possible. According to Sennewald there are two kinds of investigations. One attempts to reconstruct an event and explain it factually and the other attempts to uncover illegal activity. Clearly the first one is purely reactive; a homocide is committed and it is investigated. The second may be somewhat reactive but it may also be proactive; much like the efforts of Anti-crime police units or integrity shops in retail environments. So that's the big picture, but what kinds of skills does it take?
A good memory, notetaking skills, strong observation skills, and reasoning abilities (deductive and inductive). Inductive reasoning? Well it's the opposite of deductive reasoning. Deductive reasoning is often explained as the moving from the general to the specific. Inductive would be from the specific to the general. For a few examples to better describe this go here, here, here, and here.
How do you get these skills? There are many ways. Clearly the best known way is probably to work for the government and attend an academy - local or state police, FLETC, or the FBI Academy. However it is also possible to get there other ways, especially if you have no interest in being a police officer. Some companies offer training - formal or on-the-job - and some states require specific training before allowing licensing as a private investigator. But if you just want to drive yourself to being better - that is always striving to keep the edge sharp - there are training programs available.
Quite possibly the most important skill of an investigator is the interview, either the informational or the admission-seeking interview. The Reid technique is taught by Reid Associates and Wicklander-Zewlawski, and Wicklander is quite likely the standard for retail interviews. I am, however, biased since that's where I learned to interview (special thanks to Shane Sturman whose advice and guidance over those two days were invaluable). There are other methods and there are a large number of books available on the topic. Investing time in these books - and lots of practice - will pay off.
There are other helpful programs. You know I'll mention those by the IFPO. They offer the Certified Protection Officer, Security Supervision and Management, and a new program - Crime and Loss Investigations. There are other programs out there and it never hurts to do a little, dare I say, investigation to help you get what you need. There are also many books on the general topic of investigations such as Chuck Sennewald's The Process of Investigation and Dempsey's Introduction to Investigations.
You can also begin to build your skills by seeking employment (part-time can be as helpful as full-time) with private investigators, retail security departments, forensic accounting firms, or even investigative reporters.
The key to investigations is knowing what the "standards of evidence" are for whatever you are looking into at that time. The government has rules for what information is needed to "prove" a crime, and companies have rules as to what is acceptable for disciplinary actions. Know what information you need. Just keep these three questions in mind: What do we know? What don't we know? What do we need to know?
More later..
Tuesday, November 22, 2005
Security Technology - tools and trends
Religious Product News technology issue is out and with it a short article I put together..
I know the entire basis of my security philosophy is the "Security is what you do and not what you have," and it is. However, that is not to say that technology is some sort of evil that should be shunned. What can it do for you?
Technology cannot create exceptional security. It can make exceptional security easier, apparently seamless, and less noticeable. After all, we all want better security but we don't want to tilt the "Security v. Convenience" scale too far, right?
No one wants to be inconvenienced; least of all me. I'm a bear at the airport. Why? Because that security is an illusion. I've been inconvenienced at many facilities and, as annoying as it might have been, it was effective. I remember one jewelry manufacturer out West. No one told me it was a no-metal facility so I had to conduct my survey without a belt or any other bits of personal possessions. Losing the belt was particularly difficult since I had just lost a little weight and the pants were a from before that time. Effective security makes some things bearable, but illusionary stuff is just annoying.
So once you start with a well designed security program that's built around processes and engineering the environment the technology becomes a creature comfort. It makes the other stuff easier. Now you no longer need a guard at a door to identify you (or maybe you still do). Now you no longer need to patrol your property with a quality alarm and response system (and maybe you still do).
All this article is meant to do is provide a snapshot into where technology is right now and how some of that can be of help to you and your congregation. Creating a Safe Sanctuary should make "God's House" more secure and not turn it into "God's Fortress."
I know the entire basis of my security philosophy is the "Security is what you do and not what you have," and it is. However, that is not to say that technology is some sort of evil that should be shunned. What can it do for you?
Technology cannot create exceptional security. It can make exceptional security easier, apparently seamless, and less noticeable. After all, we all want better security but we don't want to tilt the "Security v. Convenience" scale too far, right?
No one wants to be inconvenienced; least of all me. I'm a bear at the airport. Why? Because that security is an illusion. I've been inconvenienced at many facilities and, as annoying as it might have been, it was effective. I remember one jewelry manufacturer out West. No one told me it was a no-metal facility so I had to conduct my survey without a belt or any other bits of personal possessions. Losing the belt was particularly difficult since I had just lost a little weight and the pants were a from before that time. Effective security makes some things bearable, but illusionary stuff is just annoying.
So once you start with a well designed security program that's built around processes and engineering the environment the technology becomes a creature comfort. It makes the other stuff easier. Now you no longer need a guard at a door to identify you (or maybe you still do). Now you no longer need to patrol your property with a quality alarm and response system (and maybe you still do).
All this article is meant to do is provide a snapshot into where technology is right now and how some of that can be of help to you and your congregation. Creating a Safe Sanctuary should make "God's House" more secure and not turn it into "God's Fortress."
'tis the season... For evil holiday ELF's
This Washington Post article reminds of the radical environmentalists. Now that may not be a bad thing if you're a supporter of the movement, but the those who thought their house would be completed soon it's definitely a disappointment.
So there may be an active Earth Liberation Front (ELF) cell in the western Maryland area or maybe one that has migrated here. We'll just have to wait and see how the investigation progresses...
If you want a better idea why this sort of thing happens read this document, or at least the philosophy section at the beginning.
The Earth Liberation Front is the newest re-radicalization of the environmental movement. There's a nice little history piece here, and another piece here. I tend to lead folks back to my own paper on the topic because it's just not healthy to try and understand today's environmental movement separately from the animal liberation movement.
Back to this issue, though. The largest issue in dealing with the ELF, or Earth First! for that matter, is the anti-organization design of leaderless resistance. For those that don't know about it it works like this. Someone, or someones, write a set of guidelines, manifesto, rules, mission statement, or similar ideological document that spells out what is acceptable conduct. Sounds like any other organization right? Now it gets sticky. Then these someones say that anyone that does stuff (legal or otherwise) that forward the goals, while abiding their conditions on conduct, can claim to be members. That's it. No leader - just an ideology. Now there's quite a bit of discussion as to where this all started and some put the beginning with the white supremacists after the American Civil War. I don't know when it started but I know it is extremely popular now. Wanna know why? Consider this. The easier it is to track people and activities to establish criminal wrongdoing then the more likely a leader will be arrested, killed, or otherwise destroyed from a credibility standpoint. Once you take away the leader you eliminate two things. One, the "Cult of Personality" that tends to exist around this sort of movement. Once that personality is removed the movement crumbles - so no leader = no target - but an idea can live on and on and on. Especially, it seems, the bad ones. The second thing that is removed is a clear definition and understanding of the adversary. How big is it? Who is in it? Etcetera, etcetera... Poof! We now have the makings of an underground guerilla army, or at least a core cadre of high-energy folks that are able to present the image of a larger force.
You see this organizational model works well against a democracy (or a republic in our case) that prizes its freedom of speech, but despises criminal acts of property destruction. It works well because it allows the "aboveground activist" to talk the talk and make veiled threats while not committing any clear criminal act. The "underground activist" then carries out acts of destruction to follow-up on those threats. What makes this pretty neat is the real lack of direct communication between to the two elements. The abovegrounders tell us how morally reprehensible we are and the undergrounders attack us. Sound familiar? Anyone British here? Sounds far too much like the old Sein Fein - IRA (Irish Republican Army) model. Maybe it's time we called it what it is, the way it is.
Maybe we are all too afraid of sounding callous and insensitive. Are we? If so, we as a society will ultimately lose. We must be prepared to say that regardless of how much we might like to see the environment left the hell along, it is wrong to commit acts of property destruction. Period. End of story. If we were all so environmentally concerned then we would donate tons of money to groups to buy the land that we won't protected. Maybe PeTA would have been better off not spending nearly $50,000 dollars on the criminal defense of Rod Coronado (Earth First! and ALF operator) rather than on showing people better ways to care for animals. There I said it. I'm a security guy by trade and by belief. If you don't think homes should be built somewhere then get out there and generate support and take legal action. If an eighteen year-old can be elected Mayor by write-in vote then many well intentioned activists can stop a construction project.
I'll step off the soapbox now. It's important to understand how these groups work as well as what they really want from you. Americans like the rebel, but this is the wrong rebel to cheer.
So there may be an active Earth Liberation Front (ELF) cell in the western Maryland area or maybe one that has migrated here. We'll just have to wait and see how the investigation progresses...
If you want a better idea why this sort of thing happens read this document, or at least the philosophy section at the beginning.
The Earth Liberation Front is the newest re-radicalization of the environmental movement. There's a nice little history piece here, and another piece here. I tend to lead folks back to my own paper on the topic because it's just not healthy to try and understand today's environmental movement separately from the animal liberation movement.
Back to this issue, though. The largest issue in dealing with the ELF, or Earth First! for that matter, is the anti-organization design of leaderless resistance. For those that don't know about it it works like this. Someone, or someones, write a set of guidelines, manifesto, rules, mission statement, or similar ideological document that spells out what is acceptable conduct. Sounds like any other organization right? Now it gets sticky. Then these someones say that anyone that does stuff (legal or otherwise) that forward the goals, while abiding their conditions on conduct, can claim to be members. That's it. No leader - just an ideology. Now there's quite a bit of discussion as to where this all started and some put the beginning with the white supremacists after the American Civil War. I don't know when it started but I know it is extremely popular now. Wanna know why? Consider this. The easier it is to track people and activities to establish criminal wrongdoing then the more likely a leader will be arrested, killed, or otherwise destroyed from a credibility standpoint. Once you take away the leader you eliminate two things. One, the "Cult of Personality" that tends to exist around this sort of movement. Once that personality is removed the movement crumbles - so no leader = no target - but an idea can live on and on and on. Especially, it seems, the bad ones. The second thing that is removed is a clear definition and understanding of the adversary. How big is it? Who is in it? Etcetera, etcetera... Poof! We now have the makings of an underground guerilla army, or at least a core cadre of high-energy folks that are able to present the image of a larger force.
You see this organizational model works well against a democracy (or a republic in our case) that prizes its freedom of speech, but despises criminal acts of property destruction. It works well because it allows the "aboveground activist" to talk the talk and make veiled threats while not committing any clear criminal act. The "underground activist" then carries out acts of destruction to follow-up on those threats. What makes this pretty neat is the real lack of direct communication between to the two elements. The abovegrounders tell us how morally reprehensible we are and the undergrounders attack us. Sound familiar? Anyone British here? Sounds far too much like the old Sein Fein - IRA (Irish Republican Army) model. Maybe it's time we called it what it is, the way it is.
Maybe we are all too afraid of sounding callous and insensitive. Are we? If so, we as a society will ultimately lose. We must be prepared to say that regardless of how much we might like to see the environment left the hell along, it is wrong to commit acts of property destruction. Period. End of story. If we were all so environmentally concerned then we would donate tons of money to groups to buy the land that we won't protected. Maybe PeTA would have been better off not spending nearly $50,000 dollars on the criminal defense of Rod Coronado (Earth First! and ALF operator) rather than on showing people better ways to care for animals. There I said it. I'm a security guy by trade and by belief. If you don't think homes should be built somewhere then get out there and generate support and take legal action. If an eighteen year-old can be elected Mayor by write-in vote then many well intentioned activists can stop a construction project.
I'll step off the soapbox now. It's important to understand how these groups work as well as what they really want from you. Americans like the rebel, but this is the wrong rebel to cheer.
Monday, November 14, 2005
Bad (domestic) Intelligence
Let me begin by saying that from this article we just can't know the whole story, but it certainly sounds bad for the FBI. For those of you that haven't been around this blog before I've posted on both Eco-terrorism (here, here, and here) and Intelligence operations (here). I have also presented a background piece on Eco-terrorism in the U.S. that discusses the philosophy of the environmental and animal liberation movements and traces their development and tactics over the years. If you're more interested in Intelligence then I have a paper for you as well that discusses intelligence operations in the private sector.
Since these topics are near and dear to me let's discuss this a little. The FBI arrested the wrong person, released him, and will be paying for their mistake. There must be more to the argument, because it's generally rare that damages are paid when the wrong person is arrested. Why it sounds as though they may not have had probable cause. So how then did they decide that this was the right person to apprehend? I generally do not criticize law enforcement if I wasn't right there (I dislike those that tend to second-guess my efforts without realizing they weren't there); however this doesn't seem to be a decision that had to be made in the heat of the moment - so why the mistake?
It looks like the error was with bad intelligence or at least a poor interpretation of the available intelligence. Concerns from civil liberties groups over the Patriot Act and domestic intelligence gathering have been on-going for many years. These concerns predate the Patriot Act with the COINTEL (Counter-Intelligence) activities of the FBI from years past. We in the U.S. do not take too kindly to being spied on by our own government; however it is necessary whether we like it or not. Another recent episode in this matter deals with the Denver PD intelligence files which were found to have a couple of serious flaws. First they were never purged - that's right files were maintained for indefinite periods of time, and second they information on activities that are protected under the first amendment - things like legal protests.
One may have thought that an important lesson was learned from the COINTEL days... Maintaining extensive dossiers is inefficient and often counter-productive. I know from a very limited experiment. These files are cumbersome, time-consuming, and just don't provide much predictive information. Sure you feel like you 'know' your target, but you really don't know them. Anyway, it appears that a decision may have been made based on a similar "belief of knowledge."
So the FBI screwed up. Is there a threat posed by the Eco and animal liberators? Absolutely. Read my paper on the movement. The important thing to remember is that each new generation builds their beliefs where the last generation left off. What this means is that the Sierra Club wanted to preserve park land, but today's Earth First! and Earth Liberation Front want to restore the world to how it looked before the industrial revolution. While I find it intriguing to consider a time when we lived in greater harmony with the environment, I recognize that without excess agricultural capacity and the ability to store and preserve this excess we would be living one year to the next - just like the real old days. Regardless of my own beliefs on environmental impact, I find the use of violence, or the threat of violence, to reach one's goals to be reprehensible, and worthy of our efforts to defeat it. Will mistakes be made? No doubt. Should remuneration be made? When it is appropriate. Why?
To answer that we need to consider the writings of Carlos Marighella's Mini-Manual of the Urban Guerilla." While avoiding a discussion on why his techniques ultimately fail, it is important to understand one very important concept. The insurgents act against the government only. The government, being unable to discern between guerilla and general population, cracks down on the general population. This in turn drives support to the insurgent movement. Rinse and repeat! Eventually the government's oppressive actions destroy their legitimacy with the population. So will mistakes be made? Yes. Should the government try to make those wrongfully caught up in the process whole again? Yes. We as a population must not forget that the target is, and must always be, those that use violence or the threat of violence to attempt to achieve their goals.
Thanks for persevering to the end.
Since these topics are near and dear to me let's discuss this a little. The FBI arrested the wrong person, released him, and will be paying for their mistake. There must be more to the argument, because it's generally rare that damages are paid when the wrong person is arrested. Why it sounds as though they may not have had probable cause. So how then did they decide that this was the right person to apprehend? I generally do not criticize law enforcement if I wasn't right there (I dislike those that tend to second-guess my efforts without realizing they weren't there); however this doesn't seem to be a decision that had to be made in the heat of the moment - so why the mistake?
It looks like the error was with bad intelligence or at least a poor interpretation of the available intelligence. Concerns from civil liberties groups over the Patriot Act and domestic intelligence gathering have been on-going for many years. These concerns predate the Patriot Act with the COINTEL (Counter-Intelligence) activities of the FBI from years past. We in the U.S. do not take too kindly to being spied on by our own government; however it is necessary whether we like it or not. Another recent episode in this matter deals with the Denver PD intelligence files which were found to have a couple of serious flaws. First they were never purged - that's right files were maintained for indefinite periods of time, and second they information on activities that are protected under the first amendment - things like legal protests.
One may have thought that an important lesson was learned from the COINTEL days... Maintaining extensive dossiers is inefficient and often counter-productive. I know from a very limited experiment. These files are cumbersome, time-consuming, and just don't provide much predictive information. Sure you feel like you 'know' your target, but you really don't know them. Anyway, it appears that a decision may have been made based on a similar "belief of knowledge."
So the FBI screwed up. Is there a threat posed by the Eco and animal liberators? Absolutely. Read my paper on the movement. The important thing to remember is that each new generation builds their beliefs where the last generation left off. What this means is that the Sierra Club wanted to preserve park land, but today's Earth First! and Earth Liberation Front want to restore the world to how it looked before the industrial revolution. While I find it intriguing to consider a time when we lived in greater harmony with the environment, I recognize that without excess agricultural capacity and the ability to store and preserve this excess we would be living one year to the next - just like the real old days. Regardless of my own beliefs on environmental impact, I find the use of violence, or the threat of violence, to reach one's goals to be reprehensible, and worthy of our efforts to defeat it. Will mistakes be made? No doubt. Should remuneration be made? When it is appropriate. Why?
To answer that we need to consider the writings of Carlos Marighella's Mini-Manual of the Urban Guerilla." While avoiding a discussion on why his techniques ultimately fail, it is important to understand one very important concept. The insurgents act against the government only. The government, being unable to discern between guerilla and general population, cracks down on the general population. This in turn drives support to the insurgent movement. Rinse and repeat! Eventually the government's oppressive actions destroy their legitimacy with the population. So will mistakes be made? Yes. Should the government try to make those wrongfully caught up in the process whole again? Yes. We as a population must not forget that the target is, and must always be, those that use violence or the threat of violence to attempt to achieve their goals.
Thanks for persevering to the end.
Weak Assumptions + Overconfidence = Poor Security
Here's an article that I found recently that illustrates an interesting point.
Security is a process; not a product. Our security is determined by what we do and how we do it much more so than what we have.
September 11th is another example - and a very painful one at that - the airport screeners were not required to identify and remove small knives. We all know what this resulted in. We failed to manage the threat, and recognize that a hijacker, or hijackers, might seek alternate methods beyond a firearm or bomb.
We must manage our threats and not simply operate equipment if we are seeking real security.
Incidentally, if anyone is offended by the article topic, I apologize, it's merely an example to illustrate a point.
The last statement is important. We failed to build appropriate countermeasures for the threat on 9/11 and the results were disasterous. When we accept that our security today is adequate for the threat tomorrow then we create opportunities for our adversaries. We must continually question our own methods, countermeasure effectiveness, and what our threats actually are, if we wish to create real security.
Enough said for now...
Security is a process; not a product. Our security is determined by what we do and how we do it much more so than what we have.
September 11th is another example - and a very painful one at that - the airport screeners were not required to identify and remove small knives. We all know what this resulted in. We failed to manage the threat, and recognize that a hijacker, or hijackers, might seek alternate methods beyond a firearm or bomb.
We must manage our threats and not simply operate equipment if we are seeking real security.
Incidentally, if anyone is offended by the article topic, I apologize, it's merely an example to illustrate a point.
Tuesday, August 30, 2005
Harry Potter and the half-assed security
In the latest Harry Potter book, we see Hogwarts implementing security precautions in order to safeguard its students and faculty.
One step that was taken was that all the students were searched – wanded, in fact – to detect any harmful magic. In addition, all mail coming in or out was checked for harmful magic.
In spite of these precautions, two students are nearly killed by cursed items.
One of the items was a poisoned bottle of mead, which made it onto school grounds and into a professor's office.
Of course, since everyone knew everything was checked on its way into the school, no one felt the need to take any special precautions.
The moral of the story is, inadequate security can be worse than no security at all.
The last statement is important. We failed to build appropriate countermeasures for the threat on 9/11 and the results were disasterous. When we accept that our security today is adequate for the threat tomorrow then we create opportunities for our adversaries. We must continually question our own methods, countermeasure effectiveness, and what our threats actually are, if we wish to create real security.
Enough said for now...
Friday, November 11, 2005
Veteran's Day 2005
Please take a moment and consider the sacrafices over the years that have secured our blessings of liberty.
Here are a few interesting links in no particular order:
From the Department of Veteran's Affairs
From Wikipedia
Voice of America
Information from the Census Bureau
From the U.S. Army
From About.com
Here are a few interesting links in no particular order:
From the Department of Veteran's Affairs
From Wikipedia
Voice of America
Information from the Census Bureau
From the U.S. Army
From About.com
Veteran's Day 2005
Please take a moment and consider the sacrafices over the years that have secured our blessings of liberty.
Here are a few interesting links in no particular order:
From the Department of Veteran's Affairs
From Wikipedia
Voice of America
Information from the Census Bureau
From the U.S. Army
From About.com
Here are a few interesting links in no particular order:
From the Department of Veteran's Affairs
From Wikipedia
Voice of America
Information from the Census Bureau
From the U.S. Army
From About.com
Tuesday, November 8, 2005
Hurricanes, earthquakes, mudslides, flooding - Natural Disasters - and contingency planning
Mother Nature has a nasty, nasty temper as was clearly demonstrated by the last few months around the world. So what does all this mean for security? Business Continuity Planning? General preparedness? LOTS!!!
We, that is our industry (and probably most every business planner), learned a lot about how mass evacuations - or the lack thereof - affect BCP and Disaster Recovery (DR) plans. Your plan might have been great, right until it ran into everyone else's plan (and the odd hundred thousand without a plan).
Fundamentally speaking, it's no longer good enough to have a plan, rehearse the plan, improve the plan, and keep it current. Now you have to coordinate your plan with the plans of the local and state governments. Will you still try to shelter in place? Or, will you shift operations to another regional center and just pack up and go as early as possible. It's all about cost, right? Well consider the cost of if you tried to stay in New Orleans. It took quite some time before fuel and food arrived... How much do you plan to store? How will you deal with any looters and vandals that might remain behind?
It may just be better to contract the services of a remote hotsite provider such as Recovery Point Services. There are many others and there other options similar to this as well. In some instances, funds permitting, it may just be best to "get out of Dodge." Other times it may not be possible to do so - or to continue operations remotely. Then it may just be best to be sure your Business Interruption insurance is up to date and that you have coverage for natural disasters; not to mention how much coverage that actually is.
Plan carefully and make sure your plan blends with those around you.
Don't neglect to also develop a return to normal operations plan. How will you go about getting back to your old location, or when will you start looking for a new one? What has to moved first and when is the best time to do that? Etc. ad nausium.
Good luck.
We, that is our industry (and probably most every business planner), learned a lot about how mass evacuations - or the lack thereof - affect BCP and Disaster Recovery (DR) plans. Your plan might have been great, right until it ran into everyone else's plan (and the odd hundred thousand without a plan).
Fundamentally speaking, it's no longer good enough to have a plan, rehearse the plan, improve the plan, and keep it current. Now you have to coordinate your plan with the plans of the local and state governments. Will you still try to shelter in place? Or, will you shift operations to another regional center and just pack up and go as early as possible. It's all about cost, right? Well consider the cost of if you tried to stay in New Orleans. It took quite some time before fuel and food arrived... How much do you plan to store? How will you deal with any looters and vandals that might remain behind?
It may just be better to contract the services of a remote hotsite provider such as Recovery Point Services. There are many others and there other options similar to this as well. In some instances, funds permitting, it may just be best to "get out of Dodge." Other times it may not be possible to do so - or to continue operations remotely. Then it may just be best to be sure your Business Interruption insurance is up to date and that you have coverage for natural disasters; not to mention how much coverage that actually is.
Plan carefully and make sure your plan blends with those around you.
Don't neglect to also develop a return to normal operations plan. How will you go about getting back to your old location, or when will you start looking for a new one? What has to moved first and when is the best time to do that? Etc. ad nausium.
Good luck.
Sunday, November 6, 2005
CRASH!!! - Auto accidents
Just a little deviation from the normal sorts of posts.
On Saturday night I, once again, witnesses a car accident. Not a bad one in terms of injuries, but an accident. My wife and I had just left a restaurant and were in the upper left section of a "T" intersection preparing to turn right - down the "T". The car in front of us turned right but the vertical section of the "T" had three lanes, two heading toward the intersection (up the T) and one heading away (down the T). The car in front of us turned into the middle lane, which is the left-hand turn lane, and hit a car coming toward the intersection head-on. I parked on the shoulder and got out to help. So here are a few thoughts on handling vehicle accidents...
First, it is important to follow your local laws and the direction of your insurance company's and/or attorney's direction and guidance. With that said remember that personal injury and health are the most important issue immediately after the accident. Make sure you are ok, and then worry about others. Keep yourself safe whenever you attempt to check-on or help others. It's the same way with professional rescuers - there's no point in getting yourself hurt and making yourself another casualty. So assess the situation quickly and determine if anyone is hurt and call for help. Try to get the contact information from not only the others involved parties but witnesses as well before they wander away - and no doubt they will.
Anyway, keep a few key things in your car like flares, a first aid kit, a disposable camera, pen/pencil and paper, insurance card, and any seasonal items that are appropriate - like a blanket in winter. As for the disposable camera, don't hold back; if you have 26 exposures then use 26 exposures. It's not like you want you vacation on that roll too.
If you're a witness - and you're civic-minded - make sure everyone is ok, get the tag numbers as quick as possible (and tag numbers of vehicles that have stopped briefly before leaving), call for help if no one else has, and then offer your assistance. Keep in mind that the involved parties probably have no idea what to do - take the lead. Offer to lay flares, get names and contact information, and take pictures.
Just a few thoughts on something off the beaten path.
Rob
/
On Saturday night I, once again, witnesses a car accident. Not a bad one in terms of injuries, but an accident. My wife and I had just left a restaurant and were in the upper left section of a "T" intersection preparing to turn right - down the "T". The car in front of us turned right but the vertical section of the "T" had three lanes, two heading toward the intersection (up the T) and one heading away (down the T). The car in front of us turned into the middle lane, which is the left-hand turn lane, and hit a car coming toward the intersection head-on. I parked on the shoulder and got out to help. So here are a few thoughts on handling vehicle accidents...
First, it is important to follow your local laws and the direction of your insurance company's and/or attorney's direction and guidance. With that said remember that personal injury and health are the most important issue immediately after the accident. Make sure you are ok, and then worry about others. Keep yourself safe whenever you attempt to check-on or help others. It's the same way with professional rescuers - there's no point in getting yourself hurt and making yourself another casualty. So assess the situation quickly and determine if anyone is hurt and call for help. Try to get the contact information from not only the others involved parties but witnesses as well before they wander away - and no doubt they will.
Anyway, keep a few key things in your car like flares, a first aid kit, a disposable camera, pen/pencil and paper, insurance card, and any seasonal items that are appropriate - like a blanket in winter. As for the disposable camera, don't hold back; if you have 26 exposures then use 26 exposures. It's not like you want you vacation on that roll too.
If you're a witness - and you're civic-minded - make sure everyone is ok, get the tag numbers as quick as possible (and tag numbers of vehicles that have stopped briefly before leaving), call for help if no one else has, and then offer your assistance. Keep in mind that the involved parties probably have no idea what to do - take the lead. Offer to lay flares, get names and contact information, and take pictures.
Just a few thoughts on something off the beaten path.
Rob
/
Subscribe to:
Posts (Atom)