My professional life tends to be governed by calls from people who are facing unwanted and often unpleasant situations. The CEO’s residence has been vandalized by someone who appears to have a political axe to grind; a stranger has found his way through security and is claiming forcefully to have a meeting that does not exist; an irate customer is blaming the president of the bank for his financial losses and threatening to turn up at her house to “work something out.” In each of these instances the first call, correctly, had been to law enforcement; and, in each case, law enforcement did not have the resources to address the problem fully.
Having been a Special Agent of the FBI for 22 years, I know that these kinds of events are serious, and that long-term, lasting solutions frequently require the assistance of a private investigation and security consultant. Private security firms, such as Nardello & Co., where I oversee the Physical Security and Reputational Threat Mitigation practice, fill this gap. We work with our clients to formulate solutions to protect their people and their property, at work and at home.
A new kind of threat
All enterprises – companies, family offices, asset managers, government bodies – are operating in a new threat environment. Perhaps the most notable and alarming trend is that senior individuals are coming to represent their organizations in the minds of those who wish the organization harm. Leaders and managers come to be targeted by those who feel aggrieved by actions taken by the organization: investments the corporation has made, clients the firm has represented, stances the politician has taken. Some 58% of senior executives at companies with more than 5,000 employees said their CEO had received physical threats after taking a position on a racial or political issue, according to a 2022 study (2022 Ontic State of Protective Intelligence Report). And in the US, more than 14,000 direct threats or “concerning statements” were directed at members of Congress, judges, and federal prosecutors during the same period (CNN Report 12/7/2023 “A deluge of violent messages: How a surge in threats to public officials could disrupt American Democracy”).
This is happening at a time when personal data are easy to obtain, and individuals consequently all too easy to threaten. During the recent UK riots, the names of law firms that specialize in immigration law were posted online, apparently to encourage rioters to target their offices or employees. Unfortunately, this is not an uncommon tactic. The posting of home addresses and other personal identifying information, commonly known as “doxing,” is an insidious practice that makes the job of threat actors – those who seek to physically harm public figures or vandalize their property very much simpler – by drawing a straight line to the target’s location. Over the last year, protests have been held outside MP’s houses in the UK, and at the residence of a Manchester United executive. The internet has intensified the threat environment, providing information threat actors can capitalize on, and venues for them to amplify their message and recruit participants for intimidation campaigns.
Having had direct responsibility for investigating personal threats during my time as Special Agent in Charge of the FBI’s Washington Field Office, I can speak firsthand to the number of individuals who feel entitled to threaten with bodily harm – or worse – those with whom they simply do not agree. To safeguard clients in this alarming new world, private security companies need to offer a comprehensive, considered approach that identifies vulnerabilities, assesses threats and draws on investigative and security resources to ensure safety is maintained. Solid liaison with law enforcement is also a critical element. Increasingly, private security services offer attention and resources that law enforcement, working with stretched budgets, simply cannot provide; but some situations and some threats absolutely require law enforcement engagement, and for the client’s sake the first should seamlessly support the second.
Building a defense
During my early years in the FBI, I focused on internet-facilitated fraud schemes. Now I focus on internet-facilitated violence. In both scenarios, the correct security strategy starts with understanding where you are vulnerable – which in the current age means knowing what can be discovered online about you and those close to you. Intentionally and otherwise, we routinely reveal a great deal about ourselves to the world: executives build online profiles, revealing their professional associations, places of work, and travel plans; families place innocent-seeming information on social media without realizing the value it may have to someone less innocent. The first step in any engagement is to look at this body of information with the eyes of a threat actor, and to work with the client to remove anything that might create opportunity for such a person.
The next step is to determine who might constitute a threat. I frequently tell my clients that I will work to secure their people and their property as soon as we establish what they are seeking protection from. This is an imaginative exercise that requires a different kind of understanding of the client: what have they said or done that might prompt a reaction, and from which quarters? How are they perceived, as themselves and in relation to their businesses or origins or political beliefs? Is their wealth visible in a way that might invite unwelcome attention? Who, in short, is likely to take notice and for what reasons? Clients usually have a good sense of where threats lie, but it pays to be thorough in scanning for all threats.
Armed with this understanding, we produce a strategy, which in addition to the two elements outlined above – know the groups or individuals who may seek to do you harm; know and actively manage your online exposure of information – is encapsulated in a written plan to be executed should the threat level rise. Law enforcement can assist at this point, but private security will typically lead the way.
In the opening paragraph, I touched on three situations typical of those our clients face. All were real, and help to illustrate how a shrewd and well-resourced response can minimize or neutralize a threat.
In the first case, a CEO’s residence had been vandalized: epithets had been graffitied on her house and vehicles criticizing a stance the company had taken on a contentious matter. Characterizing it as ‘only minor property damage,’ the local police had declined to pursue the case – a not uncommon decision for this kind of crime, which can be perceived as minor. In contrast, we were able to investigate and document findings. By comparing the damage with other incidents, examining CCTV footage, and identifying related online activity, we were able to identify a suspect. And having done so, we handed the evidence to the police in a ‘ready-to-go’ format, giving them a head start on filing charges.
The second example was quite unusual. An unfamiliar person who bypassed security appeared on the employee floor of a prominent law firm’s offices and declared in a threatening manner that he had a meeting with the managing partner. No one knew who he was, and he refused to give his name. In this instance, we received the call as the episode was playing out, and were able to advise the client in real time as we made our way to their offices: be pleasant, give him a cup of coffee, keep him talking and see if you can find out who he is or what he wants. By the time we arrived, he had revealed his connection to a case that the firm had worked on some time ago and, by investigating the case, we produced a list of possible suspects, eventually identifying the mystery visitor amongst a set of class action plaintiffs that our client had unsuccessfully represented some years before. This allowed us to seek and obtain a restraining order; and to work with our client to improve their security, from entrance protocols to threat monitoring.
The third example also presented an imminent threat, leading us to engage law enforcement in the vicinity of the bank president’s residence to provide support while the firm’s investigators identified and mobilized executive protection resources to deter physical violence by the threat actor. An investigation into the customer’s transactions and behavior provided intelligence critical to establishing a rapport with him; a dialogue in which the consequences the irate customer faced were set out clearly for him. In addition, the team’s research identified a business partner who, upon being contacted, assisted in dissuading this individual from taking a path to violence. Due to the multi-faceted response by our threat team, this matter was successfully resolved without violence.
As I say, all these examples are drawn from experience. And while it’s regrettable that such things happen, with care, imagination, and expertise even these new and emerging threats, which can seem overwhelming, can be minimized and effectively neutralized.
